Configurable token hash algorithm

Tokens were always hashed with MD5. This change allows tokens to
be hashed with SHA256 (or any other algorithm supported by the
keystoneclient token hash function). This is for security
hardening.

There's a new configuration option 'hash_algorithm' in the [token]
section. This is the algorithm to use for hashing PKI tokens, so is
used

a) when storing the token in the db
b) as the hash in the revocation list

hash_algorithm defaults to 'md5' for backwards compatibility.

SecurityImpact
DocImpact
Closes-Bug: #1174499

Change-Id: Iafe3c975d59818c8f362647f7ea5149a03deee47
Fix typo of ANS1 to ASN1

Replace is_ans1_token with is_asn1_token in test of v3 auth. This is dependent
upon the review of python-keystoneclient. https://review.openstack.org/87069

Change-Id: I5ab0205f9c58a769cd1f2a5ffe51ca37d981fe67
Closes-bug: 1306874
Include extra attributes in list results

The extra attributes defined in the *_additional_attribute_mapping config
options weren't included in the list results. These attributes should be
included in the list results.

Change-Id: Ia80174063a5eacdef690ca378b7cb71300a5f5f8
Closes-Bug: #1293698
Fix catalog Driver signatures

The 'hints' parameter was missing from the base catalog Driver.
The 'hints' parameter is required for all the subclasses and the
manager requires it, so it should be specified in the base class.

Change-Id: I3e7d84b671468c064d6bb3b2828ce4a03fdd620b
Code which gets elements of tree in ldap moved to a common method

Code which uses 'search_s' in ldap backends moved
to a new method to remove duplication of code.

Change-Id: I5b9b89d452d6031b54ccb15cdbd9129939d29f7f
Make the LDAP debug option a configurable setting

The LDAP OPT_DEBUG_LEVEL is very useful for debugging LDAP
problems with Keystone. This change makes it easier to set
and find. The default will be to have it disabled.

DocImpact

Change-Id: I342fe2eea752bd8632074600386f0173e7328132
Fixes for in-code documentation

Fixes a couple of issues that slid by on review
https://review.openstack.org/85651

Change-Id: I2dd19c6d0af9c7c3148811aeb8299656d1afc788
More notification unit tests

This is to support future refactoring. The current implementation has
sections of code that were completely not tested and has tests that are
very tightly coupled to the implementation.

Change-Id: I3d8d744005ba9006cefbc0feb740cc2662f57146
Remove LDAP password hashing code

Keystone should not be hashing passwords for LDAP users
itself.  Password hashing should be performed by the LDAP
server, as password policies may not allow pre-hashed
passwords to be set (they may enforce a scheme that is
stronger that salted SHA-1).

This removes the LDAP password hashing code.  When using
fakeldap for running unit tests, passwords will not be
hashed.  For this reason, the hashing tests are skipped
for LDAP backends.

Closes-bug: 1308793
Change-Id: Ia0998b7fd8fb5d01b86a947d18b7e79fcffd1228
Refactor test_password_hashed to the backend testers

The test_password_hashed method was defined in
test_backend.IdentityTests. This is a bad place for it because not
all backends do password hashing (for example, the LDAP backend
doesn't), and it was also implemented in a way where it called a
private method of the backend, which the SQL backend implemented
differently (it requires an SQLAlchemy session).

The test_password_hashed method is moved into the KVS backend
test class, since the current implementation is specific to the KVS
backend.

Change-Id: I0a2390412de6304b7436e6723cb2d411dd53421d
Stronger assertion for test_user_extra_attribute_mapping

The assertion was checking if the value was in the list, but it's
actually the only element in the list.

Change-Id: I8666736ec0eec5a859e646a3e0328a8e6baccde7
Merge "Remove LDAP password hashing code"
add dependencies of keystone dev-enviroment

add sqlite-devel and openldap-devel to dependencies

Change-Id: Ia8d0d996795f71ea2885c37d3b05bc1643e85202
Closes-Bug: #1290254
Discourage use of pki_setup

After a mailing list discussion it is clear that users need more
information to make a decision on how to setup their PKI tokens.

This recommends an external CA over using keystone pki_setup as it does
offer a bit more protection against an intruder being able to setup a
rogue token generator.

Change-Id: I798a562dd8c222e04660482b434ed3bbe6b63d62
Fix sql_upgrade tests run by themselves

The tests in test_sql_upgrade would fail to run individually, with
a None dereferencing error:

 Traceback (most recent call last):
   File "keystone/tests/test_sql_upgrade.py", line 135, in setUp
     conn_str.startswith('sqlite') and
 AttributeError: 'NoneType' object has no attribute 'startswith'

Change-Id: Id05ec05a344abab8d588a4761c207e2db715e750
Merge "Fixes for in-code documentation"
Fix typo on cache backend module

The correct module is 'dogpile.cache.memcached' and not
'dogpile.cache.memcache'.

Change-Id: Ie452c95dab4fcd04f65f6378c735490ee8cf4c70
Merge "Discourage use of pki_setup"
Merge "Code which gets elements of tree in ldap moved to a common method"
Merge "Configurable token hash algorithm"