Opening stable/icehouse

Bump version to next stable release on icehouse branch, and set
defaultbranch in .gitreview for convenience.

Change-Id: I64f11ddbb5fb28ec6cbeb55f672f7eae0c56d38d
Treat LDAP attribute names as case-insensitive

LDAP attribute names are case-insensitive, and different LDAP
server implementations behave differently when returning search
results.  Keystone attempts to use the attribute names as defined
in the mapping configuration when checking for values in the dict
that represents the search results.  If the case doesn't match,
we won't find the values which can lead to errors.

This patch converts the dictionary keys to lowercase to allow us
to perform a case-insensitive lookup when processing LDAP search
results.  When we create the model object, we still use the
attribute name case as defined in the mapping to allow predictable
lookups when we process the model object later.

Change-Id: Ib9a03b912bc7652dc6a61b1c97a950e263a9c6fa
Closes-bug: 1281216
(cherry picked from commit 7c104e13fce919dd2563f06ce31c059f145beb77)
Allow any attributes in mapping and include in results

When using attribute mapping (e.g., user_additional_attribute_mapping), any
attributes that Keystone didn't know about were ignored and a warning was
issued, like

 WARNING keystone.common.ldap.core [-] Invalid additional attribute mapping:
 "description:description". Value "description" must use one of password,
 enabled, default_project_id, name, email.

This check is removed. Additional attribute mappings for "unexpected"
attributes (such as description) should be allowed. For one thing, all the
known attributes already have a way of setting the mapping, via the
user_*_attribute config option. This will allow setting a "description" or
any other attribute mapping for users.

The extra attributes defined in the *_additional_attribute_mapping config
options weren't included in the list results. These attributes should be
included in the list results.

This is a combination of 3 commits from master:
(cherry picked from commit 17db03164200f0d7fff564058fc7df8e97705523)
(cherry picked from commit 10051adace7cd728d46cd4c999e3019fdbf2d961)
(cherry picked from commit ebfdab034f2b35074f1645b70c1f07d0c4dfd337)

Change-Id: Ia80174063a5eacdef690ca378b7cb71300a5f5f8
Closes-Bug: #1293698
Removed duplication with list_user_ids_for_project

Keystone list_user_ids_for_project has the possibility of returning
duplicate users if the user has more than one role in the project.
list_user_ids_for_project queries the assignment table which has
one entry for every role the user has but will now remove
duplicate combinations of target_id and actor_id. This impacts
V2 calls for tenants.list_users(<tenant_id>) and
users.list(tenant_id=<tenant_id>).

Change-Id: I9a1e5b944c2c627138851976e81d405f54fae1c9
Closes-Bug: #1308218
(cherry picked from commit d6cb7043cb47f5e73b61635af596736314441275)
Updated from global requirements

Change-Id: Ieea9cc5b41ac787fe9b1378f0df2f5c43ad4e6a9
SQL and LDAP fixes for get_roles_for_user_and_project user=group ID

When there was a role assigned to a group with the same ID as a user,
the SQL and LDAP assignment backends would incorrectly return the
assignment to the group when requesting roles for the user via the
get_roles_for_user_and_project method.

With this change, assignments to a group with the same ID are not
returned for the user when calling get_roles_for_user_and_project.

Functions were added to compare DNs more accurately based on the
LDAP RFCs.

The fakeldap code was changed to normalize the values when
comparing values for checking if the values match the filter.

Co-Authored By: Nathan Kinder <nkinder@redhat.com>
Co-Authored By: Adam Young <ayoung@redhat.com>

Change-Id: Id3d6f66c995e65e37d909359420d71ecdde86b69
Closes-Bug: #1309228
sql migration: ensure using innodb utf8 for assignment table

During migration from 37 to 38, migration fails to create assignment
table if we don't explictly specify InnoDB and UTF8 charset.

Closes-bug #1320855
Signed-off-by: Emilien Macchi <emilien.macchi@enovance.com>

Change-Id: Icd88202d2f020aea02514e49c2d07e349c74949f
(cherry picked from commit 18289b9e26ba900302874e72fcbf4529580a973a)
Merge "Allow any attributes in mapping and include in results" into stable/icehouse
Merge "SQL and LDAP fixes for get_roles_for_user_and_project user=group ID" into stable/icehouse
Merge "Removed duplication with list_user_ids_for_project" into stable/icehouse
Merge "sql migration: ensure using innodb utf8 for assignment table" into stable/icehouse
remove runtime dep on python-pbr
sync parameter values with keystone-dist.conf

and adjust descriptions to take dist.conf defaults into account (rhbz#923912)

Change-Id: If36c384f86843a6506a494d79beca65639fb3480
Refactor service readiness notification

import and apply Oslo systemd module
drop old keystone.common.systemd
drop onready configuration parameter
 - systemd notification is no-op when not running inside systemd

Oslo commit 53e1214c092f09e3851b1a1b55289a93a72b09ec

Conflicts:
        bin/keystone-all
        etc/keystone.conf.sample
        keystone/common/config.py

Change-Id: I80f325c9be9c171c2dc8d5526570bf64f0f87c78
(cherry picked from commit c045ea108d7246ccddcc8c540b6057b2105bfd07)