Fix webob.exc.HTTPForbidden parameter miss

HTTPForbidden should use the parameter 'explanation'
instead of 'detail'.
This patch fixes this bug.

Change-Id: I0ebc01e8bbcc564debce450ea52faf94faa21eeb
Closes-Bug: #1283872
Handle exception messages with six.text_type

Handle exception messages with six.text_type instead of using
`str`. This is required to prevent of entering bytes to a database and
prevent unexpected behavior of database and database driver.

Change-Id: Idb54ee271cfb09e8523e357674b598b11704742c
Closes-Bug: #1273301
v3 endpoint create should require url

The url parameter of endpoint object is not nullable in db, but we
do not have a null check in api. So, when create a endpoint if I
do not specify url parameter I will get a 500 reponse.
This patch will add an attribute require check to url parameter.

Change-Id: I9c8aa3bcb99ea5cb5e4e4d3306d8d222c6f074d1
Closes-Bug: #1284422
revocation_list only call isotime on datetime objects

If expires is a str then isinstance six.text_type is false then the following
exception is raised:
AttributeError: 'str' object has no attribute 'strftime'

This change explicitly checks for a datetime object, which is what
timeutils.isotime expects.

Change-Id: I8012f96498fffe5f54e7f1ca08b7beb6fa168f9c
Closes-Bug: #1285871
Removes a redundant test

I mistakenly asked for the test to be added in a review because I
thought there was some LDAP specific behavior. It turns out that this is
just a copy of the test in the parent class.

Change-Id: I98e007a1a40e64a18692623f80b7d733075c63c2
Update Oslo wiki link in README

Use lastest Oslo wiki link.

Change-Id: I448aac133060fe7a4793ed5d92d7698db9984401
Lazy gettextutils behavior

gettextutils.enable_lazy() must be called before gettextutils._() is called to
ensure it has the desired lazy lookup behavior. This includes cases, like
keystone.exceptions, where gettextutils._() is called at import time.

Change-Id: I1db293978493868b6f7972b316fb6847c945ee30
Co-Authored-By: David Stanek <dstanek@dstanek.com>
Update Oslo wiki link in README

Use lastest Oslo wiki link.

Change-Id: I2a92733c506da90a27cb882bc9e9bd8498510084
Update curl api example to specify tenant

In the keystone api_curl_examples document, the curl example for
"POST /tokens" did not specify a tenant. This example utilized
the default tenant, which is not commonly used. Changed the
example to include "tenantName" as part of the example to prevent
future confusion.

DocImpact

Closes-Bug: #1269739

Change-Id: Iaad8c7c5a32bc6cff38c938dd36365cddd6741cb
Removes use of timeutils.set_time_override

The set_time_override function in timeutils was written as a
helper function to mock utcnow for unittests before 'mock' was
generally used. Now that we have mock and fixture, we no longer
need to use it.

Change-Id: I1af631f36c813740dbf22da030c2c1f50265d156
Partial-Bug: #1266962
Remove vim headers

Second round to remove all vim headers. We don't need to have the
vim headers in each source files.

More discussions:
http://lists.openstack.org/pipermail/openstack-dev/2013-October/017353.html

Change-Id: I43703e2289212389c7841f44691ae7849ed1f505
Closes-Bug: #1229324
Token Revocation Extension

Base API for reporting revocation events.

The KVS Backend uses the Dogpile backed KVS stores.

Modifies the places that were directly deleting tokens to also generate
revocation events.

Where possible the revocations are triggered by listening to the notifications.
Some places, the callers have been modified instead.  This is usually due to
the need to iterate through a collection, such as users in a group.

Adds a config file option to disable the existing mechanisms that support
revoking a token by that token's id: revoke_by_id. This flag is necessary
to test that the revocation mechanism is working as defined, but will also
be part of the phased removal of the older mechanisms. TokenRevoke tests
have been extended to test both with and without revoke-by-id enabled.

Note: The links aren't populated in the list_events response.

SQL Backend for Revocation Events

Initializes the SQL Database for the revocation backend.
This patch refactors the sql migration call from the CLI
so that the test framework can use it as well. The sql
backend for revcations is exercized by test_notifications
and must be properly initialized.

Revoke By Search Tree

Co-Authored-By: Yuriy Taraday (Yoriksar)

create a set of nested maps for the events. Look up revocation by
traversing down the tree.

Blueprint: revocation-events

Change-Id: If76c8cd5d01a5b991c58a4d1a9d534b2a3da875a
Add the last of the outstanding helpstrings to config

Add the last of the outstanding help strings to the options defined
in keystone.common.config.

Adds in periods to the end of the helpstrings that were missing
proper ending punctuation.

DocImpact

Related-Bug: #1229941
Change-Id: Iebe0358a19f645220eb7b3dfca0dc868716f5bc8
Always include 'enabled' field in endpoint response

The 'enabled' field wasn't always returned in an endpoint response.

The 'enabled' attribute for endpoints was stored in the 'extra'
column as part of a JSON string. Now the 'enabled' attribute is in
its own column. It will also be easier to filter out disabled
endpoints now that enabled is a separate column.

With the 'enabled' field being a Boolean column in the database,
the server also needs to validate that the value is a Boolean (if
it's present). This is done in the same way that the server checks
the type of the 'enabled' value when creating users.

Closes-Bug: #1282266

Change-Id: I9b9379f4531c298c14508418dbfb629bdd6c2850
allow create credential with the system admin token

We are looking up trust_id during create credential, which means caller must
use a Keystone-issued token. This is unrealistic as create credential are
often done as part of bootstrap, using the static system admin token.
Furthermore, deployments which using external authorization will break as it
may not have a token_id in the request context.

For the above reasons, we'll skip trust_id lookup if the request token_id is
either absent or it is the static system admin token.

closes bug 1275145
closes bug 1263804

Change-Id: I6cda3c5f36c9754ab84e28ff9a9289887d6c9b77
Imported Translations from Transifex

Change-Id: Ib5db4752b6c764e11587126d2285aa0af79b2cc6
Don't need session.flush in context managed by session

Within the scope of a single method, keeping all the reads and writes
within
the context managed by a single session. In this way, the session's
__exit__
handler will take care of calling flush() and commit() for you.
If using this approach, you should not explicitly call flush() or
commit().
See http://docs.sqlalchemy.org/en/rel_0_7/orm/session.html#committing

Change-Id: I8e49179cb6cb71fc7b7c06799adcf9f10164a09b
Partial-Bug: #1258044
Remove unused function from tests

_fetch_attributes_from_response from test_v3_federation is
unused.

Change-Id: I0c8f7c059498c252e9e0ebbd044012e1e583cad2
Import order is fixed

In keystone/tests/fakeldap.py built-in lib import was among third party
libs imports.

Change-Id: I94d5dc54b94193c2da2509589402b738daa4b575
Mark revoke as experimental

Change-Id: Id0872daa159c58b502060ece9748d01da59519ea