default revoke driver should be the non-deprecated driver

Have checked other config options that default is not the deprecated
option, others are OK.

Change-Id: Ie6e7351114d79eb25b392faaa0e6376c24c45fa0
Closes-Bug: #1384775
fix wrong indentation in contrib/federation/utils.py

Change-Id: Ib4c99b474aafaad4b34df125fd94b7c4c55aa863
Fixes links in Shibboleth configuration docs

Change-Id: I57902acdb3bd58014b4ddd21a19b560b2ff98dbf
Add test for update role without name

There was no test that showed what happens when a role update is done
without a name. The test shows that when using the LDAP assignment
backend a role update without a name raises an exception.

Change-Id: I9ca7d1af432cec2f0dcc5833e196f5e1e18a8013
Partial-Bug: #1241134
Fix update role without name using LDAP

When the keystone server was configured to use the LDAP assignment
backend and a role was updated and no name was included in the update
dict the operation would fail with a 500 Internal Server Error.

With this fix, an update without a name works.

Change-Id: I234a36301a54ad4796cd421c42e85b15e9415902
Closes-Bug: #1241134
Add tests for enabled attribute ignored

There were no tests that showed what happened when the enabled
attribute is ignored for the LDAP backend for various entities.

The tests show that if the client tries to disable the entity the
entity actually remains enabled.

Change-Id: I48608f772456ade05318170d3615920d664d7dd2
Partial-Bug: #1241134
Fix disabling entities when enabled is ignored

When LDAP is configured so that the `enabled` attribute was ignored
for an entity (user, group, role, project) and a client attempts to
disable the entity, it remains enabled, so a user might think that the
entity was disabled when it's not.

With this change, attempting to disable an entity where `enabled` is
ignored will return a 403 Forbidden error.

Since entities are always enabled when the `enabled` attribute is
ignored, there's no change to reject changes that attempt to enable
the entity.

Closes-Bug: #1241134

SecurityImpact
This is for security hardening.

Change-Id: I8cb3326952d6e379a457c19d7f8f5f9ee4b29eb0
Add a test for modifying a role to set the name the same

There was no test that showed what happened when a role is modified
to have the same name. The test shows that when using the LDAP
assignment this request fails with a conflict error.

Change-Id: I40bb62200e79c8ff519e02facad042a657c26cae
Partial-Bug: #1401721
Fix modifying a role with same name using LDAP

When the keystone server was configured to use the LDAP assignment
backend and a role was modified with the same name as the role the
operation would fail. This is because the server would check that a
role with the same name existed already and it would of course find
the entry that is currently being modified.

The server is changed to check if the entry currently being modified
is the one with the same name and the operation is allowed if this is
the case.

Change-Id: Ia86ef9fabfd438367a7ed09efb55711860e47d8b
Closes-Bug: #1401721
Remove XML support

XML support has been deprecated for the last two releases, staged to be
removed in Kilo.

implements bp removed-as-of-kilo
Closes-Bug: #1384382
Closes-Bug: #1384789

Change-Id: I95761267b6c0f3052bc52deda6d56fc4b713ea6b
Fix the way migration helpers check FK names.

The current check for FK names is unsfafe due to the order
of checks - this patch resolves this.

Since FKs are not supported as part of standard database used for
unit tests (sqlite), there is no unit test for this change. This
change has been tested (and required) with MySQL and Postgres in the
following on patch (https://review.openstack.org/#/c/130954/)

Change-Id: I77ab359b4018e49de0afbef1f6e137d9080bdc26
Closes-bug: 1398470
Rename `removeEvent` to be more pythonic

This is a non-functional change that renames a testing method to be more
consistent with OpenStack method naming conventions.

Change-Id: If9088379326acbb06b3b85731ad30edc10a9e7b6
Check and delete for policy_association_for_region_and_service

Calls proper function in the manager and driver

Unit tests now check pre- and post- conditions on CRUD

Change-Id: I26e4d4f15ff39dd76141aa5fb7aae1ebb6680bf7
Closes-bug: 1400362
Merge "default revoke driver should be the non-deprecated driver"
Merge "Fixes links in Shibboleth configuration docs"
Merge "fix wrong indentation in contrib/federation/utils.py"
Merge "Rename `removeEvent` to be more pythonic"
Merge "Add test for update role without name"
Merge "Check and delete for policy_association_for_region_and_service"
Merge "Fix update role without name using LDAP"