Fixes code comment to be more accurate

Change-Id: I4aaa57b05e9aab2ff223f62bd1f5fe0f37e7f247
Update man pages

The man pages were out of date.

Change-Id: I9ce00b06ce2df6fe4f12c3fbeae9ad5ddbdbb13d
Closes-Bug: #1366944
Remove trailing space from string

There was an extra space at the end of the debug log string.

Change-Id: I96a231d136a829e049a4e026ed07ff3730eeb388
improve dependency injection doc strings

This also renames the provider_name argument to better convey it's
status as a kwarg for internal use only.

Change-Id: Ie1afee4e37cfa149ddb73a001985c98aa90b97a5
Fix Policy backend driver documentation

Change-Id: If5e0655eb6733cca1294d780f3a9446ed4ada357
Closes-Bug: #1362007
Correct typos in keystone/common/base64utils.py docstrings

Closes-bug: #1366649
Change-Id: Ic3f4a3eb9da303a4da7d532f02f6c6e82a725924
Fail on empty userId/username before query

Rather than attempting to query the database for an empty userId
that results in an error, just raise an error immediately that
has a better error message than one indicating a missing 'len()'
attribute.

Change-Id: I6db54d8f6114337d37be3cab20f60d7905243cba
Closes-Bug: #1368046
Set LDAP certificate trust options for LDAPS and TLS

We currently only set the LDAP library certificate trust options
when TLS is being used (via startTLS).  If regular LDAPS is being
used, the certificate trust options that are defined in Keystone's
configuration file are never actually set.

This patch sets the certificate trust options for both LDAPS and
TLS cases.

Closes-bug: #1209343
Change-Id: Ieb94b732f623695920feb34995bb863175ddf27a
Allow users to clean up role assignments

This change allows users the ability to remove role assignments in the
event the user has been removed from the backend.

Closes-Bug: #1321378
Change-Id: I895e6e9718bc48344a53f192d5d56e6990da888e
Merge "Allow users to clean up role assignments"
Ensure identity sql driver supports domain-specific configuration.

For an identity driver to be used with a domain-specific config file,
it must accept a ConfigOpts as an optional parameter. The ldap driver
already supported this - so this patch adds this to the sql driver.

The above change is trivial, but the rest of the patch is enhancing
our testing to validate this operation, as well as enforcing the
limitation listed below.

Limitation:

Currently Keystone only supports one SQL driver - this patch
does not change that.  What it does enable is for that one SQL
driver to be assigned to a specific domain, as opposed to being just
a catch-all for domains without a specific configuration file.
This at least enables the (often requested) scenario of service users
to be stored in SQL in a predominantly LDAP installation.

Closes-Bug: 1217017
Change-Id: Ic531ebae28680fc518d8e036db516f5982241c40
Update 'Configure Federation' documentation.

Apache 2.4 becomes more and more popular version of HTTP server.
With its release some options required for proper Shibboleth Service
Provider have changed. This patch updates information about ``ShibRequireAll``
options that is no longer valid under Apache 2.4. It also adds
documentation reference so users can read more about configuring Apache
Virtual Hosts along with Shibboleth Service Provider.

Change-Id: Idbec6690fd1d75f078a6bdcaa6388b885387b45d
Add the processutils from oslo-incubator.

This is a module specific add rather than a full sync. The processutils
module will be used to determine the default number of workers for keystone
running under eventlet.

Processutils sync'd from oslo commit hash 6a60f84258

Change-Id: I6cbca7d54ca97cce962d3cc1131388840ddf9a7c
Related-Bug: #1371154
Set the default number of workers when running under eventlet

Keystone now defaults to n-cpu as the number of workers under eventlet with
a minimum number of workers when auto-calculating the number of 2.

This behavior can be overridded by changing the `admin_workers` and
`public_workers` configuration values in the Keystone config file.

Change-Id: I482cfef7ee14e995c6fb206bcef412957c54f491
Closes-Bug: #1371154
Safer check for enabled in trusts

For some LDAP backends, the enable attribute is not
directly set.  Since we have a wrapper function in identity/core,
we can use that instead.

Adds tests that disabling trustor or trustee prevents
trust execution.

Closes-Bug: 1367952

Change-Id: I6d3c26e0e6e6c0d27ea7b910340fae5792eaceda
Updated from global requirements

Change-Id: I457150384920e608998243aeb7d872742125dc22
Merge "Update 'Configure Federation' documentation."
Merge "Add the processutils from oslo-incubator."
Merge "Safer check for enabled in trusts"
Merge "Set the default number of workers when running under eventlet"