Configurable python-keystoneclient repo

The URL for the python-keystoneclient repo couldn't be configured.
With this change, the user can set the OPENSTACK_REPO environment
variable to set the URL for where the python-keystoneclient repo
should be cloned from. So for example you can use a local clone.
The default OPENSTACK_REPO is https://git.openstack.org/openstack
which gets python-keystoneclient.git added ot it to make the clone
come from
https://git.openstack.org/openstack/python-keystoneclient.git.

Change-Id: I936713af3c11e8d68d8739dc68eefabd645df294
Back off initial migration to 35

Upgrading from the Havana release to Juno is failing because the
initial Juno migration doesn't include a couple of migrations that
weren't in the initial Havana release but were added afterwards.

This change adds the 036 migration from Havana back in and moves
the initial Juno migration back to 035.

Change-Id: I1045696d66d7a63587aaaf70230a5eaf46e7d65d
Partial-Bug: #1357498
Back off initial migration to 34

Upgrading from the Havana release to Juno was failing because the
initial Juno migration didn't include a couple of migrations that
weren't in the initial Havana release but were added afterwards.

This change adds the 035 migration from Havana back in and moves
the initial Juno migration back to 034.

Change-Id: I012b3f707659557d1774bae78b1dd652bb1a4dd7
Closes-Bug: #1357498
Provide the V3 routers to the V3 extension controller

The V3 extension controller needs access to the V3 routers because
they provide the JSON Home data.

bp json-home

Change-Id: Ia455c7c5c06f7cfcefa0bc6afc91bf6954d85e3c
Enhance V3 version controller to provide JSON Home response

The V3 version controller would only respond with the normal version
JSON response. With this change, if the Accept header is
`application/json-home` it will respond with a JSON Home response
which includes all the registered JSON Home data. Note that there is
no JSON Home data yet so the response is empty.

bp json-home

Change-Id: Icfde89040b376bd6704d497966bd8ad109e32d08
Make SQL the default backend for Identity & Assignment unit tests.

We have a goal to deprecate the kvs backends for Identity and
Assignment. Before we can do this, we need to ensure our unit
tests are not dependant on them. This patch sets the Identity
backend for unit tests to SQL. Since, by default, the Assignment
backend will pick the same backend type as Identity, this also
means that it will follow suit.

As well as ensuring correct database initialization, this patch
moves a test that was erronously in v2_auth testing to v3. The
test was passing before due to the fact that the kvs assignment
driver does not correctly honor the domain boundary for all
project APIs.

Change-Id: I7b6e753b379a43d09ad8ea077ed6796d1f2e9a26
Partially-Closes: bug 1077282
assignment controller error path fix

Assignment controller error path code updated to reflect a change in the
dictionary format.

Closes-Bug: #1359376

Change-Id: I5358f8d61b60ea853fb4e2af0b05031a25c4ae6d
Merge "Configurable python-keystoneclient repo"
Merge "assignment controller error path fix"
Revoke by Audit Id / Audit Id Chain instead of expires

Instead of using the expiry of the token which can collide (is non
unique in some/many cases) use the new Audit ID for the tokens when
revoking a single token via the token revocation events.

Support for revoking by the audit_chain_id has been added to the
token provider, however, the REST API has not been updated to
accept an argument to revoke the chain. Support for revoking
the entire chain is in place to allow Keystone to internally
revoke an entire chain in certain circumstances. Exposing the
ability to revoke the entire chain via the REST API may occur
based upon further design discussions.

Change-Id: I840355ccd9bcfcd88aa139184731c056808c2c8f
bp: non-persistent-tokens
Closes-Bug: 1292283
Update AuthContextMiddleware to not use token_api

AuthContextMiddleware and the fall-through in the controller base
_build_policy_check_credentials now utilizes the KeystoneToken
model and uses token_provider_api instead of token_api.

In support of this change, the token auth plugin, the auth_context
builder, token bind check, and token controller have all been updated
to utilize the KeystoneToken model. Support for the federation data
has been added to the KeystoneToken model so that it can be used
in the auth context and associated code.

Associated tests that passed a raw token_ref to methods that now
expect the KeystoneToken model have been updated. This includes an
update to the revocation model to guard against users without domain
data (the federated user case).

Change-Id: I81da15137a0ab3778d835c8de1ec8ed9e5b301f6
bp: non-persistent-tokens
Remove trust dependency on token_api

The trust_api and controllers no longer directly depend on the
token_api. The `validate_token` call on the `token_provider_api`
is now used to retrieve token data.

The token_provider_api listens for trust deletion events to clean
up the token persistence backend. In support of this callback, it
is now possible to perform a .get_trust() and specifically request
deleted / expired / fully consumed trusts. This is done by passing
the kwarg 'deleted' with a value of 'True' to the `get_trust`
method.

This change is to ensure interactions with the token persistence
are consistent so that it is possible to support toggling
persistence of tokens.

Change-Id: Ifc7174d6473dfa279b3dc706a59bc58c812332b3
bp: non-persistent-tokens
Remove identity_api dependency on token_api

Remove the identity_api dependency on token_api. Now for each type
of event that would cause revocations (or delete of tokens) to occur
an internal callback notification is emitted and consumed by the
token_provider_api and the revoke_api (as appropriate). This required
a few new notification entity types ('user_password',
'user_removed_from_group'), but since these are not public notifications
the overhead should be minimal.

This change is to ensure interactions with the token persistence system
are consistent and supporting the ability to toggle token persistence
in the future.

Change-Id: I796f1b003a9d43b89940bb74d2c44d3cff215c72
bp: non-persistent-tokens
Remove wsgi and base controller dependency on token_api

The wsgi module and the base controller no longer depends on the
token_api, to interact with the token persistence system. The
token_provider_api.validate_token method and the KeystoneToken model
are now used.

This change is to ensure interactions with the token persistence system
are consistent and supporting the ability to toggle token persistence
in the future.

Change-Id: I5831d6a086241bc3a6691602e7527ae53c9411ce
bp: non-persistent-tokens
Add __repr__ to KeystoneToken model

For better debugging/usability, add __repr__ to the KeystoneToken model.

Change-Id: I76fc0dd416e074170ad8a0874655eaae20e3c293
Merge "Back off initial migration to 35"
Merge "Make SQL the default backend for Identity & Assignment unit tests."
Merge "Provide the V3 routers to the V3 extension controller"
Merge "Enhance V3 version controller to provide JSON Home response"
Create additional docs for role assignment events

Update docs with an example audit notification for role assignment
creation.

implements bp role-assignment-notifications

Change-Id: I70b54eaae989df0e793d9e7a6aa0df4c50891b60