Merge db.sqlalchemy from oslo-incubator af5f710

The db.sqlalchemy module was not recent with oslo-incubator.

 $ git checkout af5f71096c7bb83fe2f956588a9ec643b0d9a2f6
 $ python update.py --nodeps --base keystone \
   --dest-dir ../keystone --modules db.sqlalchemy

The af5f710 oslo-incubator db.sqlalchemy contains a fix for the
following problem, which caused a regression in Keystone:

The database connection string was not marked as secret, so it
would be printed out in cleartext in the logs when config settings
were logged.

The database connection string typically contains the password
that's used to connect to the database, so it should be marked as
secret so that it doesn't get logged.

Change-Id: Ibdc63480a836646c5571a368f3c3a1d0c82d6aba
Closes-Bug: #1266590
Identity Providers CRUD operations

Implementation of CRUD operations for:

- Identity Providers
- Protocols used to authenticate remote users (SAML, OpenId, etc)

Change-Id: I0ce62e720e797718dbfde6bfcd4b22a213985867
Implements: blueprint identity-providers
Switch from 400 to 403 on ImmutableAttributeError

Change-Id: Ib34903487e6a2322dd9ef3afd02793916f22207e
Add mapping function to keystone

Add a mapping implementation for the federation extension.
This will allow a set of rules to be added, that map
relationships between identity providers and keystone

api spec: https://review.openstack.org/#/c/59848/

Implements: bp mapping-distributed-admin
Change-Id: Iab93dc6759f195fecd88dcdf1c635c81ad59165a
Simple Certificate Extension

Implement the Simple Certificate Extension for retrieving token signing
certificates from a server.

Change-Id: I653c527ca2b39628658a24b4d484683d1ac6acf2
Closes-Bug: #1259011
Fixup incorrect comment

This was a left over from a previous draft of the API. It is submitted
as a separate patch so as not to interrupt the gate during I2.

Change-Id: Id160466f6c05b3c0a7f1568cdd694fe0a411f295
Remove kwargs from trust_api.create_trust

This change allows notifications to be sent using the existing
implementation and the resulting trust ID is stored in args[1], instead
of kwargs. Using args this way maintains consistency with
trust_api.delete_trust().

Change-Id: I8169b9ea6fabcd8aff864c3bf900ceb1b32676f3
Closes-Bug: #1269157
Implement notifications for trusts

Use the existing notifications wrapper to send notifications when a
trust is created or deleted. There is no need to send a notification on
a trust update since trusts are immutable. This change adds
trusts to the event_notifications.rst documentation.

Change-Id: I777ad4594ce9b93c36af675ac677cfa61524a3e7
blueprint: trust-notifications
Merge "Identity Providers CRUD operations"
Merge "Add mapping function to keystone"
Merge "Switch from 400 to 403 on ImmutableAttributeError"
Merge "Simple Certificate Extension"
Merge "Fixup incorrect comment"
Merge "Remove kwargs from trust_api.create_trust"
Merge "Implement notifications for trusts"
Merge "Merge db.sqlalchemy from oslo-incubator af5f710"