Updated openstack/openstack
Project: openstack/glance  bc8d10457c96a5c945c017dd40e046dc82cb81b9
null
Sync Log levels from OSLO

Copy changes from just 1 commit:
I0736fd62190fd0b3b26133916f8b3d4d9f0499c2 Default iso8601 logging to warn

Change-Id: I1c90705d4d9b37e5472eeebce0192d4d7aa1febe
Updated openstack/openstack
Project: openstack/keystone  47592766224cae00df0f3ba4423943c800ff830b
null
Fix external auth (REMOTE_USER) plugin support

According to the WSGI specification "REMOTE_USER should be the string
username of the user, nothing more" [1], therefore no modifications
should be made to the REMOTE_USER variable and it should be fully
considered as the username. Otherwise the expected semantics of the
REMOTE_USER variable change, and an site administrator could get
undesirable side-effects.

[1] http://wsgi.readthedocs.org/en/latest/specifications/simple_authentication.html#specification

Moreover, it is important to have a consistent behaviour regarding
external authentication in V2 (not domain aware), V3 with default
domain and V3 with domain (see Bug #1253484) so that we produce similar
results with the three methods.

This change aims to solve this issues by removing the split of the
REMOTE_USER variable by "@" at all:

- In external.DefaultDomain, we cannot split REMOTE_USER by "@". This split
  will cause errors for remote users containing an "@" (not only
  emails, but also X.509 subjects, etc). The external.DefaultDomain plugin
  considers the REMOTE_USER variable as the username, and the configured
  default domain as the domain

- In external.Domain we should not split also the REMOTE_USER by "@". A
  new environment variable (REMOTE_DOMAIN) is introduced, so that any
  external plugin can pass down the right domain for the user. The
  external.Domain plugin considers the REMOTE_USER as the username, the
  REMOTE_DOMAIN as the domain if it is present, otherwise it takes the
  configured default domain.

- Two legacy plugins are also provided with the same behaviour as the
  Havana shipped ones. This plugins should not be used and are provided
  for compatibility reasons (see Bug #1254619)

Closes-Bug: #1254619
Closes-Bug: #1211233
Closes-Bug: #1253484

DocImpact: This change breaks backwards compatibility in favour of
security (see bug #1254619), therefore an upgrade not is needed. It is
needed to document the new plugins and state clearly the semantics of
the REMOTE_USER and REMOTE_DOMAIN variable for the WSGI filters. The
default external authentication plugin has been changed from
exernal.ExternalDefault to external.Default.

Change-Id: I1b2521a526fa976146dfe2fcf4d4c1851416d8ae
Updated openstack/openstack
Project: openstack/python-neutronclient  8aacb125df8b1739f2225f62bc0172693c35d3f7
null
Fix description of ListSubnet

The help texts for both "neutron net-list" and "neutron subnet-list"
give the same text "List networks that belong to a given tenant."

Fix it so that subnet-list output the proper "subnet"

Change-Id: I0877b51ad10ac0e04b24effa7cbd1e412098e363
Partial-Bug: #1244618