Fix revoking domain-scoped tokens

A token scoped to a domain wouldn't be revoked for a domain-wide
revocation event. This is because the code to convert a token to a
dict for revocation event processing didn't handle domain-scoped
tokens.

Partial-Bug: #1349597

Change-Id: Ib2c58f3fc8790dbe7f8b073d18d3fa9b0dff608d
Add a test for revoking a scoped token from an unscoped

There was no test that showed that when a scoped token created from
an unscoped token is revoked that the unscoped token also winds up
being revoked.

Change-Id: I2c1574573488bb60a059c5d7f8747d6a1977aab7
Partial-Bug: #1347318
Fix revoking a scoped token from an unscoped token

When a scoped token that was created from an unscoped token was
revoked, the original token wound up being revoked. This is because
the scope wasn't included in the revocation event. By including the
scope in the revocation event only the scoped token is revoked.

Change-Id: I5652663ab7e1176d3b1efc5d218a8a020498067e
Closes-Bug: #1347318
Fix revocation event handling with MySQL

When MySQL is used to store revocation events, events are returned
from the database with the timestamps truncated to the second. This
causes a revocation event for a token (which has the issued_at
timestamp to the microsecond) to not match the revocation event and
therefore the token is not considered to be revoked.

The fix is to have the revocation events and token timestamps both
always be truncated to the second. This will cause all tokens for a
user that are issued within a second to be revoked when any of those
tokens are revoked, which shouldn't be a problem.

Change-Id: Ibd82b4ce910206dfd504c396614ae2ebed025e9b
Closes-Bug: #1347961
Don't override tox envdir for pep8 and cover jobs

infra's run-pep8 and run-coverage jobs assume the envdir for pep8 and
cover jobs are not overwritten, so it can call out to .tox/pep8/bin/pip
and .tox/coverage/bin/pip respectively.

This bug is causing keystone pep8 and coverage jobs to occasionally fail
in the gate.

If the motivation behind overriding the envdir jobs to use venv, one can
use devpi and/or wheels to speed up the process of building a venv.

Change-Id: I32cd46152caa73e1308fdd216ba016c80a5a9b4f
Closes-Bug: #1352134
Remove debug CADF payload for every authN request

Since we already provide a generic mechanism for logging notifications
(setting the notification_driver value to 'log'), having an additional
debug log just for this case seems unnecessary.

Closes-Bug: #1352115
Change-Id: I3bdf726ee2b32c434497b8c9372e2ab4cc8853cf
Imported Translations from Transifex

Change-Id: I9bac9ccee2daac1af753c587c5f17e8846c18beb
Do not override venvs

OpenStack infra jobs assume the virtual environments are setup in
a specific way. Do not override the virtual environments in any
tox target.

Change-Id: I7fa964207be08a99ef7b3573e2b8bb49b7b96f55
related-bug: #1352134
Improve instructions about federation

This patch clarifies two elements:

1. According to Shibboleth's documentation the ShibRequireAll command
is not supported on Apache 2.4+, details can be found at
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig

2. Some configurations of Apache + Shibboleth SP will always set the
REMOTE_USER env variable, even if it is an empty value; this can
lead to unexplained authentication errors that can be avoided if the
external auth method is disabled.

Change-Id: Iaf4e57e7e3d79a2e87e805bbe8340861ee9c3db3
Merge "Don't override tox envdir for pep8 and cover jobs"
Merge "Fix revoking domain-scoped tokens"
Merge "Do not override venvs"
Merge "Imported Translations from Transifex"
Merge "Remove debug CADF payload for every authN request"
Merge "Add a test for revoking a scoped token from an unscoped"
Merge "Fix revoking a scoped token from an unscoped token"
Merge "Improve instructions about federation"
Merge "Fix revocation event handling with MySQL"