Enforce scope mutual exclusion for trusts

We already warn if you try to scope a domain and project together. This
should be extended to trust scoping rather than clobbering the existing
scope.

Change-Id: I9d8fe001b65588b1c21e58f38a47456fdad85ee1
Related-Bug: #1288223
Split sample PKI token generation

Splits the file that generates the sample data into two.
One part is the set of individual functions.  The second
is a script that calls each of the functions in turn.  By
splitting them, it becomes easier to regenerate just a subset
of the sample data.  The use-case that prompted this change
was the need to regenerate the signed tokens based on a different
algorithm.  Without this change, all of thecertificates would
need to be regenerated, and that has nothing to do with the
actual change required.

Change-Id: I53b6cfde98a52f0a59b06ad8abbe0d2f1251f796
Add 'methods' to all v3 test tokens

methods is a required field of v3 tokens but none of the sample tokens
have them. This field is required for determining the difference between
a v2 and a v3 AccessInfo object.

Change-Id: I4d45e90f24eeb2f35451549771ad999628619c20
Use AccessInfo in auth_token middleware

auth_token middleware parses the token and extracts the data manually.
We have this parsing ability in AccessInfo now so we should use that
instead.

Change-Id: I23c6e33d327c3d3669fb977d9623b788324c4785
Discover should support other services

Most services don't provide a 'values' element for their version
definitions, however are otherwise similar. Discovery should allow that
case and continue on otherwise.

Change-Id: I878377a779da5c96c47603842c024059920423fd
Reference docstring for auth_token fields

The documented variables that the auth_token middleware sets for
the request was out of date with the code. Rather than maintain
the documentation for the fields in 2 places we'll now link to the
auth_token module docs.

Change-Id: Id4ca1843f749c1ed0b515c8860764add3ec4a3da
Don't use a connection pool unless provided

To prevent left over TCP connections from keystoneclient not correctly
cleaning up we shouldn't use a connection pool. This is not ideal but it
was a relatively new addition so shouldn't affect performance.

When we are able to find a long term solution to keystoneclient's other
problems we can move back to using a connection pool.

Change-Id: I45678ef89b88eea90ea04de1e3170f584b51fd8f
Closes-Bug: #1282089
use v3 api to get certificates

Let Token signing and ca certificates can be accessible at
/v3/OS-SIMPLE-CERT/{ca,certificates}.

Change-Id: I6c82d1f78ba1ff2ab110474623982542610b4d2d
Closes-Bug: #1206345
add pooling for cache references

Change-Id: Iffb1d1bff5dc4437544a5aefef3bca0e5b17cc81
Closes-Bug: 1289074
Merge "add pooling for cache references"
Merge "Don't use a connection pool unless provided"
Add a positional decorator

This decorator allow us to define that certain parameters are strictly
keyword arguments only, without sacrificing the convenience of having
those arguments listed in the function definition.

This will mean that we are no longer trapped maintaining backwards
compatibility for the order of keyword arguments.

The enforcement levels should allow us to start putting warnings on
existing functions and strict enforcement on new functions.

Partial-Bug: #1295881
Change-Id: Ic0a196874930e7be8362df50594471ab8037c5b2
Sync config fixture object from oslo.incubator

Specify the config file directly otherwise we end up with a lot of new
dependencies.

Change-Id: Id39f5c039d5d0d68ab6e4008a1212868396eda3e
add functional test for cache pool

Change-Id: Id12c6175dc5bf72d6c453b8ab2d66652eed13656
Related-Bug: 1289074
Merge "Enforce scope mutual exclusion for trusts"
Fix passing get_token kwargs to get_access

get_token takes kwargs so that a different plugin implementation might
make use of them. It is not expected that token arguments would be
passed to the code that is doing the token fetching.

Change-Id: I28aa2b8070feec76f225601069c92c535334f4d4
Start using positional decorator

Apply the positional decorator to functions. It has been added as I
think best practice would dictate, though in some places it has been
added in a way that doesn't break existing tests.

Closes-Bug: #1295881
Change-Id: I4f7ddbede4cba4ab79d144ad1f9dc83ea76f204a
Merge "Add a positional decorator"
sanity check memcached availability before running tests against it

Change-Id: I40fff70cbf395e7fe42530155074f75dd116034c
Closes-Bug: 1296794
Add a method for changing a user's password in v3

The new Identity API v3 resource for changing a user's password in
keystone can be utilized with:

  c.users.update_password(old_password, new_password)

Change-Id: Ia887d853140a18ba75d6eb1bfde4ce2d64b7af60
Closes-Bug: 1239757
Co-Authored-By: Dolph Mathews <dolph.mathews@gmail.com>
DocImpact