Adds support for username to match the v2 spec

The v2.0 API spec uses username for the user's name, whereas the v3 API
just uses name. The v2.0 implementaion incorrectly used name instead of
username, but did allow a username to be specified and stored in the
extras.

This patch makes the implementation more closely conform to the API
without breaking backward compatibility. Anyone using name in the v2.0
API can continue to do so. They can even specify a username that will
still get stored in the extras. Users can now use the documented
username instead of name and the API will work for them as well.

Both name and username will always be returned for the v2 API calls.

DocImpact
Change-Id: Ia95aa5d442a8311925399fa59e5022d31f68d374
Closes-Bug: #1214686
Sync several modules from oslo-incubator

This change syncronizes excutils,lockutils,log, and
db.sqlalchemy.session modules from oslo-incubator
commit 19e0a51204df247dc38de880d08e6d66e89e6572 .

 $ python update.py --nodeps --base keystone --dest-dir ../keystone \
     --modules  excutils,lockutils,log,db.sqlalchemy.session

This includes fixes for 2 problems:

"keystone=INFO" was in the default_log_levels. This made it
more difficult than necessary to debug the Keystone server,
since you can set debug=True but then the keystone logging
level is overridden and you get no debug output for keystone.

"keystone=INFO" may have been in the default_log_levels because
of the auth_token middleware, but this has been moved to
python-keystoneclient now and the logging config for the
python APIs is done differently.

Closes-Bug: 1245629

Also, fixes some warnings and errors when docs are generated.

Change-Id: I53868bef975f73b4aee35695b6387b718c4179f9
Clean up docstrings in contrib.oauth1.core

The docstrings were using the wrong parameter name.

Change-Id: I237b2b137fa8c8f6138a4a7eacf6140843517225
Merge db.sqlalchemy from oslo-incubator af5f710

The db.sqlalchemy module was not recent with oslo-incubator.

 $ git checkout af5f71096c7bb83fe2f956588a9ec643b0d9a2f6
 $ python update.py --nodeps --base keystone \
   --dest-dir ../keystone --modules db.sqlalchemy

The af5f710 oslo-incubator db.sqlalchemy contains a fix for the
following problem, which caused a regression in Keystone:

The database connection string was not marked as secret, so it
would be printed out in cleartext in the logs when config settings
were logged.

The database connection string typically contains the password
that's used to connect to the database, so it should be marked as
secret so that it doesn't get logged.

Change-Id: Ibdc63480a836646c5571a368f3c3a1d0c82d6aba
Closes-Bug: #1266590
derive custom exceptions directly from Exception

Although StandardError derives from Exception, the python docs for
Exception read:

    All user-defined exceptions should also be derived from this class.

http://docs.python.org/2/library/exceptions.html#exceptions.Exception

Change-Id: If0f009cd0ad5a30329f0f97d869137aeef66af23
Sync with global requirements

Change-Id: Ibdd73aa142be103d285ce0f15701dc96c1ec34ae
Enhance tests for non-default default_domain_id

There were no tests that show what happens when the
default_domain_id is changed from the default. The new tests show
that in some cases the behavior is incorrect, and in other cases
it is correct.

Change-Id: Ia167e153f488617f94afce7fddfc52e1e2c8e79c
Related-Bug: #1265108
Remove unused member from KVS assignment

The KVS assignment backend's _get_user_by_name method was not used.
This change removes it.

Change-Id: I357adf745095b2ac868c3c6eb78e4ab6db2ca0fc
KVS support domain as namespace for users

The KVS identity backend didn't support having users with the
same name in different domains.

Change-Id: I4f6a9010ed085aef9cba5f368e292dd28339a0fa
Related-bug: #1265108
Enhance auth tests for non-default default_domain_id

There wasn't an authentication test that showed what happens when
the default_domain_id option is changed from the default. The new
tests show that the behavior is incorrect.

This test is split out because it uses a new feature of the KVS
backend to allow adding users with the same name in different
domains, because I don't think we'll backport that change.

Change-Id: I890a1c798d7f4a8a345404cd7754708ab0d36651
Related-Bug: #1265108
Fix using non-default default_domain_id

Changing the default_domain_id to something other than the
default would cause several operations to not work correctly.
This is because the value of default_domain_id was read and
cached in several parts on import, which is before the call to
CONF() so the cached value is the original default ('default')
rather than the value that the operator has in the config file.

This change removes the cached default_domain_id and instead
reads the value when it's needed at runtime so that the
user-configured value is used instead of the original default.

Change-Id: I9543e2108866ed66000d75f868bbd2b1ed978b97
Closes-Bug: #1265108
remove unused LOG

Change-Id: I5dec1b23667c7226697f064fe793c556c71e3abe
Drop unsused "extras" dependency

Change-Id: I9264d983f809fafa249536f1b321ee1db02aad4d
description is wrong in endpoint filter rst doc

Literal block must start and end with blank line.

Change-Id: Ib80bc76101da34b8251d731cee5b60bde45ec099
Closes-Bug: #1269300
Identity Providers CRUD operations

Implementation of CRUD operations for:

- Identity Providers
- Protocols used to authenticate remote users (SAML, OpenId, etc)

Change-Id: I0ce62e720e797718dbfde6bfcd4b22a213985867
Implements: blueprint identity-providers
Switch from 400 to 403 on ImmutableAttributeError

Change-Id: Ib34903487e6a2322dd9ef3afd02793916f22207e
Add mapping function to keystone

Add a mapping implementation for the federation extension.
This will allow a set of rules to be added, that map
relationships between identity providers and keystone

api spec: https://review.openstack.org/#/c/59848/

Implements: bp mapping-distributed-admin
Change-Id: Iab93dc6759f195fecd88dcdf1c635c81ad59165a
Simple Certificate Extension

Implement the Simple Certificate Extension for retrieving token signing
certificates from a server.

Change-Id: I653c527ca2b39628658a24b4d484683d1ac6acf2
Closes-Bug: #1259011
Fixup incorrect comment

This was a left over from a previous draft of the API. It is submitted
as a separate patch so as not to interrupt the gate during I2.

Change-Id: Id160466f6c05b3c0a7f1568cdd694fe0a411f295
Remove kwargs from trust_api.create_trust

This change allows notifications to be sent using the existing
implementation and the resulting trust ID is stored in args[1], instead
of kwargs. Using args this way maintains consistency with
trust_api.delete_trust().

Change-Id: I8169b9ea6fabcd8aff864c3bf900ceb1b32676f3
Closes-Bug: #1269157