Remove fixture from openstack-common.conf

Keystone doesn't use anything in fixture, so remove it from
openstack-common.conf and re-sync with oslo-incubator 5fa2da to
remove unused parts.

Change-Id: Icec01fc7e3bcf3df03c1f8a589d13f8955c64380
Trust unit tests should target additional threat scenarios

This adds unit tests for two threat scenarios around the trust functionality
that are not currently tested.

The first scenario is related to deletion of a grant that has been previously
delegated via a trust. We need to ensure that executing a trust for a role that
the trustor no longer has is rejected.

The second scenario is related to an attempt to use a trust token with
impersonation to execute another trust as the impersonated user. We need to
ensure that a trust token can't be used to execute another trust.

SecurityImpact
Closes-Bug: #1347909
Change-Id: Ie1a0c286ff7e513cd964d4a93855230c78b98c6c
Class for V3 router packages

The V3 routes were being added by the append_v3_routers function in
each controller package, so the only way state could be stored is in
a global variable which makes unit testing difficult. With this
change, the append_v3_routers functions are put into a class in each
package. This will eventually be used to store JSON Home data.

bp json-home

Change-Id: I744a4c82dc84bb1a8d29d0314e3c51cc43c077a2
Add oslo.utils requirement

This will allow Keystone to use functions out of oslo.utils.

Change-Id: I0467ed68f894e7075bc25ff3e779351fab9ed4c3
Remove S3 middleware tests from tox.ini

The middleware was moved to the keystonemiddleware project and no longer
needs to be tested here.

Change-Id: Ic4ac0d2558ced56eeadd6241159188c49fcceb6e
Make token_provider_api contain token persistence

The token_provider_api now houses the token persistence manager
directly. A new token_api provider has been created that just
proxies to token_provider_api.persistence.

This is in support of deprecating use of token_api internal to
Keystone and migrating direct uses of token_api to gate through
the token_provider_api methods.

Uses of the token_api within the provider and provider drivers
has been lifted up to the token_provider_api manager and now
utilize the persistence manager directly.

Change-Id: I62cc1d5efbe0869fd0e501aaa9405ff0b0da0e5e
bp: non-persistent-tokens
Fix documentation link

Without the :py: prefix the mod part of the string ends up in the
documentation.

Change-Id: I652eb6c545deede33622b64fb4810c319d480f7a
Delete intersphinx mappings

The documenatation does not use intersphinx mappings so remove these so
as not to download them.

Related-Bug: #1353817
Change-Id: I0b0e48fa04d08b1023984b6d2169322060fcee9e
Refactor serializer import to XmlBodyMiddleware

Previously, the keystone/middleware/core.py module would import
keystone/common/serializer.py regardless of the XmlBodyMiddleware class
being used. This change modifies keystone/common/serializer.py to raise
an error if there is an issue with using lxml at runtime.

Change-Id: I977275d0df8666b49ddbfadd4f5606d7c2292b1f
Closes-Bug: 1351016
Update CADF auditing example to show non-payload information

Currently, the documentation only shows the payload of a CADF
authentication event. We should show the other non-payload info
so as to be consistent with the other notification examples.

Change-Id: I878a71c4b99bb8e9e080be852cb139909030dfd9
Refactor names in catalog backends

Change-Id: Ic447056d8572d8d444e5199e7bd63e2f7f7ce97b
Merge "Trust unit tests should target additional threat scenarios"
Merge "Update CADF auditing example to show non-payload information"
Check for empty string value in REMOTE_USER

The external auth method shouldn't be used if REMOTE_USER is set
to the empty string value. This happens in some setups of Apache
and Shibboleth SP, leading to authentication failures with the
saml2 auth method unless the external auth method is disabled.

Closes-Bug: #1354315
Change-Id: I3cb46ddffa76be3d4526a175257014ca7f1ab94a
Co-Authored-By: Florent Flament <florent.flament-ext@cloudwatt.com>
swap import order of lxml

lxml is a third party library, so attempt to import it with six rather
than first, which makes it look like a package from stdlib.

Change-Id: I43028d326f17ea8cd0aaf7a3b80bf291d2bf0982
Merge "Refactor serializer import to XmlBodyMiddleware"
Update control_exchange value in keystone.conf

The control_exchange comes from oslo and is set to 'openstack' by
default. This should be overridden by the projects that use
oslo.messaging, since projects should be placing notifications
on project specific exchanges.

Nova performs the override in the same manner:
https://github.com/openstack/nova/blob/master/nova/config.py#L33
https://github.com/openstack/nova/blob/master/nova/rpc.py#L77

Change-Id: Ifcc43dcccaa9d56e03922ce8cf0bf7fb8e93bdcc
Merge "Check for empty string value in REMOTE_USER"
Ensure roles created by unit tests have correct attributes.

Change-Id: I04817c992fe66d4937960a3e5dedb954606a4334
Closes-bug: 1354417
Merge "Delete intersphinx mappings"