trust creation allowed with empty roles list

The docs state "A project_id may not be specified without at least
one role, and vice versa.", however /OS-TRUST/trusts does allow you
to create a trust with an empty roles list and project_id specified.

This results in 401 responses whenever you try to consume the trust,
because there are no roles for the trustee on the authorized project.

This patch will add a check in trust creation to ensure at least one
role exists if project_id is supplied.

Change-Id: Iebad0b6b7ed62a029d1e50afb003679bafb1655d
Closes-Bug: #1214064
Sync db, db.sqlalchemy from oslo-incubator 0a3436f

This change sync's oslo-incubator's db module from commit hash
0a3436fbcd69b7e0cd1a768be15cbf794c803e3b

$ python update.py --nodeps --base keystone \
    --dest-dir ../keystone \
    --modules db,db.sqlalchemy

This includes a fix where the keystone server would log a warning
that starts with

  This application has not enabled MySQL traditional mode ...

This change includes the following commits from oslo-incubator:

a1a8280 Fix excessive logging from db.sqlalchemy.session
dc2d829 Add lockutils fixture to OpportunisticTestCase
d10f871 Adapt DB provisioning code for CI requirements
5920bed Make db utils importable without migrate
9933bdd Get mysql_sql_mode parameter from config
96a2217 Prevent incorrect usage of _wrap_db_error()
20a7510 Add from_config() method to EngineFacade
fea119e Drop special case for MySQL traditional mode, update unit tests
a584166 Make TRADITIONAL the default SQL mode
5b9e9f4 Fix doc build errors in db.sqlalchemy

The above list was generated by doing the following in oslo-incubator:

 $ git log --oneline --no-merges \
     6ba44fd..0a3436fbcd69b7e0cd1a768be15cbf794c803e3b \
     openstack/common/db/ openstack/common/db/sqlalchemy

The keystone log shows that the last sync was 6ba44fd:

 $ git log -n1 --oneline --no-merges \
     keystone/openstack/common/db \
     keystone/openstack/common/db/sqlalchemy
 8f7b87b Sync db, db.sqlalchemy, gettextutils from oslo-incubator 6ba44fd

Closes-Bug: #1271706
Change-Id: If537ff5166b8e9a6fc18c570cdd2e44943faac9c
Don't automatically enable revocation events.

Cuts any direct imports of revoke.model as that
triggers the dependency registration.

In order to fix a dependecy resolution issue, changes the syncronziation to
using the same sort of chaching mechanism as the other drivers.

Adds the ability to Lazy activate providers for future or optional dependency
resolution.

Closes-Bug: 1291099
Related-Bug: 1292283
Change-Id: I0db36b295c2040ec1fb248cf75dc55c44c059211
Removal of test .conf files

The following configuration files used for testing purposes have
been migrated to use the configuration fixture instead of relying
on a mechanism to load a large number of configuration options
from various locations on disk.

    keystone/tests/auth_plugin_external_default_legacy.conf
    keystone/tests/auth_plugin_external_disabled.conf
    keystone/tests/auth_plugin_external_domain.conf
    keystone/tests/auth_plugin_external_domain_legacy.conf
    keystone/tests/backend_rules.conf
    keystone/tests/test_associate_project_endpoint_extension.conf
    keystone/tests/test_auth_plugin_by_class_name.conf
    keystone/tests/test_overrides.conf
    keystone/tests/test_pki_token_provider.conf
    keystone/tests/test_revoke_kvs.conf
    keystone/tests/test_revoke_sql.conf
    keystone/tests/test_uuid_token_provider.conf

The following configuration files have had a number of elements
extracted to be used within the config fixture instead of the
configuration files. Most of these files contain controls that
need to be overridden to test against alternative (non internal /
in-memory) "live" configurations.

   keystone/tests/backend_ldap.conf
   keystone/tests/backend_liveldap.conf
   keystone/tests/backend_multi_ldap_sql.conf
   keystone/tests/backend_sql.conf
   keystone/tests/backend_tls_liveldap.conf

This patchset also consolidates the setting of the default
[database] ``connection`` option so that it can be overridden
as needed for testing against non-sqlite database engines.

Change-Id: I996709546f713c36bf654c5aea64cbf3472ffef1
Replace httplib.HTTPSConnection in ec2_token

httplib.HTTPSConnection is known to not verify SSL certificates in Python 2.x.
Implementation got adapted to make use of the requests module instead.

SSL Verification is from now on enabled by default.

Can be disabled via an additional introduced configuration option:

`keystone_ec2_insecure=True`

SecurityImpact
DocImpact
Partial-Bug: 1188189

Change-Id: Ie6a6620685995add56f38dc34c9a0a733558146a
Provide option to make domain_id immutable

Currently, a user, group or project entity can be moved between
domains by updating their domain_id. There are situations where
this is not desirable (and in fact could create a potential security
hole) - for example when creating a domain admin persona, using an
appropriate policy file (such as policy.v3cloudsample).

For backward compatibility, the option to make the domain_id immutable
is controlled by a config option, with the default being no change
to existing functionality.

Change-Id: Idd847f471beae7387d6cc59af0a960a923da799f
Closes-Bug: 1291393
Filter out nonstring environment variables before rules mapping.

Before the requests environment is passed to the RuleProcessor, all
parameters that are not inheriting from the basestring type should
be filtered out.

Change-Id: I469107633abfa86232e1dc1f1bc64605cd888dc2
Closes-bug: #1291981
Merge "Don't automatically enable revocation events."
Merge "Replace httplib.HTTPSConnection in ec2_token"
Merge "Sync db, db.sqlalchemy from oslo-incubator 0a3436f"
Merge "Filter out nonstring environment variables before rules mapping."
Merge "trust creation allowed with empty roles list"
Merge "Provide option to make domain_id immutable"
Merge "Removal of test .conf files"