Adds support for username to match the v2 spec

The v2.0 API spec uses username for the user's name, whereas the v3 API
just uses name. The v2.0 implementaion incorrectly used name instead of
username, but did allow a username to be specified and stored in the
extras.

This patch makes the implementation more closely conform to the API
without breaking backward compatibility. Anyone using name in the v2.0
API can continue to do so. They can even specify a username that will
still get stored in the extras. Users can now use the documented
username instead of name and the API will work for them as well.

Both name and username will always be returned for the v2 API calls.

DocImpact
Change-Id: Ia95aa5d442a8311925399fa59e5022d31f68d374
Closes-Bug: #1214686
Sync several modules from oslo-incubator

This change syncronizes excutils,lockutils,log, and
db.sqlalchemy.session modules from oslo-incubator
commit 19e0a51204df247dc38de880d08e6d66e89e6572 .

 $ python update.py --nodeps --base keystone --dest-dir ../keystone \
     --modules  excutils,lockutils,log,db.sqlalchemy.session

This includes fixes for 2 problems:

"keystone=INFO" was in the default_log_levels. This made it
more difficult than necessary to debug the Keystone server,
since you can set debug=True but then the keystone logging
level is overridden and you get no debug output for keystone.

"keystone=INFO" may have been in the default_log_levels because
of the auth_token middleware, but this has been moved to
python-keystoneclient now and the logging config for the
python APIs is done differently.

Closes-Bug: 1245629

Also, fixes some warnings and errors when docs are generated.

Change-Id: I53868bef975f73b4aee35695b6387b718c4179f9
Clean up docstrings in contrib.oauth1.core

The docstrings were using the wrong parameter name.

Change-Id: I237b2b137fa8c8f6138a4a7eacf6140843517225
Merge db.sqlalchemy from oslo-incubator af5f710

The db.sqlalchemy module was not recent with oslo-incubator.

 $ git checkout af5f71096c7bb83fe2f956588a9ec643b0d9a2f6
 $ python update.py --nodeps --base keystone \
   --dest-dir ../keystone --modules db.sqlalchemy

The af5f710 oslo-incubator db.sqlalchemy contains a fix for the
following problem, which caused a regression in Keystone:

The database connection string was not marked as secret, so it
would be printed out in cleartext in the logs when config settings
were logged.

The database connection string typically contains the password
that's used to connect to the database, so it should be marked as
secret so that it doesn't get logged.

Change-Id: Ibdc63480a836646c5571a368f3c3a1d0c82d6aba
Closes-Bug: #1266590
Subclasses of TestCase don't need to reset conf

Subclasses of TestCase were unnecessarily resetting the config on
cleanup. This is unnecessary because TestCase resets the config
already.

This takes care of some TODOs in the code.

Change-Id: I4350efb03a40616e6a9e7fb6ee7cc507f4709f00
Cleanup test_no_admin_token_auth cleanup code

The addCleanup call for the temporary paste config file was separated
from where it was needed because the function that required it
was outside the TestNoAdminTokenAuth class. This moves the
function to be a member and moves the addCleanup call in the
member function right where it's needed.

It's better to put the addCleanup code close to where it's needed
because then it will be called even if an exception occurs.

Change-Id: I50c97a3229958f4d15c7cd68ffa2a9d45914d1db
Remove unused variables

Remove unused variables in keystone/tests/test_v3_identity.py

Change-Id: Ia70242aa6ceaebfe8380f3de879b5b7885ca80d5
Closes-Bug: #1268094
Fix sample config external default doc

The sample config file documented the incorrect default for the
[auth].external value as defined in keystone.common.config.

Change-Id: I6f9454f35eaade5fa35738a9ba3f74a388bf5099
derive custom exceptions directly from Exception

Although StandardError derives from Exception, the python docs for
Exception read:

    All user-defined exceptions should also be derived from this class.

http://docs.python.org/2/library/exceptions.html#exceptions.Exception

Change-Id: If0f009cd0ad5a30329f0f97d869137aeef66af23
Enable lazy translation

This change makes it so that if the user makes a request with an
Accept-Language header and the response is an error where the
message is translatable, then the message will be translated to
the requested language (or the most appropriate language
available).

completes bp user-locale-api

Change-Id: I5b0b02e0459a6a444baa12f8722adb829b7e152b
Document running with pdb

There was no documentation in "Developing with Keystone" that
makes it obvious that you can use "tox -e debug" to run with pdb
breakpoints.

Change-Id: I82cc827d076a4d95ab6a2f903ceb0cde34005bc3
Sync with global requirements

Change-Id: Ibdd73aa142be103d285ce0f15701dc96c1ec34ae
Enhance tests for non-default default_domain_id

There were no tests that show what happens when the
default_domain_id is changed from the default. The new tests show
that in some cases the behavior is incorrect, and in other cases
it is correct.

Change-Id: Ia167e153f488617f94afce7fddfc52e1e2c8e79c
Related-Bug: #1265108
Remove unused member from KVS assignment

The KVS assignment backend's _get_user_by_name method was not used.
This change removes it.

Change-Id: I357adf745095b2ac868c3c6eb78e4ab6db2ca0fc
KVS support domain as namespace for users

The KVS identity backend didn't support having users with the
same name in different domains.

Change-Id: I4f6a9010ed085aef9cba5f368e292dd28339a0fa
Related-bug: #1265108
Enhance auth tests for non-default default_domain_id

There wasn't an authentication test that showed what happens when
the default_domain_id option is changed from the default. The new
tests show that the behavior is incorrect.

This test is split out because it uses a new feature of the KVS
backend to allow adding users with the same name in different
domains, because I don't think we'll backport that change.

Change-Id: I890a1c798d7f4a8a345404cd7754708ab0d36651
Related-Bug: #1265108
Fix using non-default default_domain_id

Changing the default_domain_id to something other than the
default would cause several operations to not work correctly.
This is because the value of default_domain_id was read and
cached in several parts on import, which is before the call to
CONF() so the cached value is the original default ('default')
rather than the value that the operator has in the config file.

This change removes the cached default_domain_id and instead
reads the value when it's needed at runtime so that the
user-configured value is used instead of the original default.

Change-Id: I9543e2108866ed66000d75f868bbd2b1ed978b97
Closes-Bug: #1265108
Refactor context trust_id check to wsgi.Application base class

Move the ec2 controller check for a trust_id in the token
specified in the request context, renaming it to match the
existing convention in the controller base classes.

This function can be used by both v2 and v3 controllers
hence putting it into the common Application base class.

Test coverage for this is provided via existing tests in
test_keystoneclient_sql.py

Change-Id: I6028a2cfa0e9e2e16acc99b5a0a027cd6cc42ada
Partial-Bug: #1259584
Store trust_id for v3/credentials ec2 keypairs

To fix bug #1259584 without re-opening the vulnerablility fixed in
bug #1242597, we need to store the trust_id in the data blob when
storing an ec2 keypair via the v3/credentials API.  This is already
done when keypairs are created/stored via the ec2tokens interface,
so this aligns the behavior when the credentials are created via
v3/credentials.

Change-Id: I8443d30dffed4201b46d10cef6a0bb43ccdcddc1
Partial-Bug: #1259584
remove unused LOG

Change-Id: I5dec1b23667c7226697f064fe793c556c71e3abe