Handle invalidate in identity plugins correctly

Returning a True from the invalidate() call means that something has
changed within the plugin and the session should reissue the request and
expect the plugin to authenticate itself.

This means we should only return True if something actually changed,
because re-issuing the request if there was no auth_ref will not change
the outcome.

Change-Id: I012dacc93b1fcaee31d31a49e95db5a38044f211
Standardize AccessInfo token setting

When settings tokens via the factory v2 and v3 work completely
differently. This is somewhat expected due to tokens working differently
but it makes it hard to work with.

For example, if i have a v3 token but not the requests.Response that
created it there is no way for me to set the token data on the
AccessInfo object via factory.

Also in the case of V2 CMS tokens the value at ['token']['id'] is a fake
so that the signing process will work.

Allow overriding the token value from the factory and force setting the
token id on the AccessInfo in a standard way.

Change-Id: I856096dc5fae2ab0d1bedbac3294dc4976c3f3ad
Allow passing user_id to v2Password plugin

Whilst this is undocumented it is supported by keystone and relied upon
by other services.

Change-Id: Idf8be75e2e0b275d9c9840082079100dd13a70ff
Remove lxml as a forced depend

keystoneclient only needs lxml for saml support, which is an
optional contrib piece. Since keystoneclient is massiely used, and
as lxml is a big beefy depend that requires C compilers, move
lxml to test-requriements.

Change-Id: I01b6b702fb8f414884cb1da306d5b95406e86513
Fix handling of deprecated opts in CLI

Deprecated opts are supposed to be accessible via the CLI in a similar
way as they are available via CONF. Currently these values are ignored.

Add CLI flags for all the deprecated opts as well.

Change-Id: If5f23c7b30a0cacda893a5e3150bc6bdb95f3693
Add v3scopedsaml entry to the setup.cfg.

Since Patch https://review.openstack.org/#/c/107231/ was abandoned and
entry ``v3unscopedsaml`` stays in the setup.cfg, there should
also some room for v3scopedsaml entry which lets users scope their
unscoped tokens.

Change-Id: Ie42206c323d287b905b4c5da9c790e544a8b8433
Merge "Remove lxml as a forced depend"
Merge "Allow passing user_id to v2Password plugin"
Merge "Fix handling of deprecated opts in CLI"
Unsort pbr and hacking in requirements files

Each of these wants to come first. Python does not have a dep solver,
so order is actually important.

Change-Id: I10450de1839c41d729b606a04a944507d2427987
Remove cruft from setup.cfg

We haven't needed to register a setup_hook in about 6 months.

Change-Id: I446e9385e1545a0a4cdfb02d8d3bd4b498fa51cd
Allow unauthenticated discovery

The default state for session requests is that if there is an auth
plugin available then it should include a token in any requests. This is
a problem for cases where it is the authentication plugin itself trying
to do discovery (like in the case of version independent plugins)
because you end up in an infinite loop.

Allow controlling the authenticated parameter on discovery requests.

Closes-Bug: #1359457
Change-Id: Ib5ab0a3a30fe79139b7b5dcaae698438281b6d36
Allow providing a default value to CLI loading

Allow users to specify a default value to loading auth plugins from the
CLI so that you can fallback to some default behaviour if the user
doesn't specify a plugin.

Change-Id: I44eb838f7ccc3b377dd1ba53dbb941e973e4a22e
Merge "Add v3scopedsaml entry to the setup.cfg."
Move fake session to HTTPClient

The fake session object is to prevent a cyclical dependency between
HTTPClient and the session from leaving hanging session objects around.

This is still necessary if you construct a client the old way however if
you are using the session properly then there is no cyclical dependency
and so we shouldn't prevent people using the connection pooling
advantages of the session.

Related-Bug: #1282089
Change-Id: Ifca2c7ddd95a81af01ee43246ecc8e74abf95602
Merge "Unsort pbr and hacking in requirements files"
Merge "Remove cruft from setup.cfg"
Distinguish between name not provided and incorrect

When loading from config we need a way to determine if a plugin name was
specified incorrectly or was not specified at all. We need this to
determine if we need to load a fallback plugin.

This is much more in line with how CLI loading works and how it should
have worked initially.

Change-Id: I5547b6e169abc4f1850ff205a8f054a617785c2c
Closes-Bug: #1359618
Hash for PKIZ

Only PKI (asn1) based tokens were checked for format and hashed

Closes-Bug: 1355125

SecurityImpact

Change-Id: Iefedde7f168e2ff1870905041fa95301934452e5
Merge "Allow unauthenticated discovery"