Merge lp:~zulcss/keystone/keystone-cloud-g2 into lp:~ubuntu-cloud-archive/ubuntu/precise/keystone/trunk

[Chuck Short]

[Adam Gandelman (gandelman-a)]

Please maintain the 0ubuntuX versioning (2013.1~g2-0ubuntu1~cloud0)

review: Needs Fixing

[lp:~zulcss/keystone/keystone-cloud-g2]

38. By Chuck Short on 2013-01-25

Fix changelog

=== modified file 'AUTHORS'
--- AUTHORS	2012-11-23 09:01:53 +0000
+++ AUTHORS	2013-01-25 16:27:23 +0000
@@ -40,6 +40,7 @@
 Doug Hellmann <[e-mail]>
 Ed Leafe <[e-mail]>
 Édouard Thuleau <[e-mail]>
+Eduardo Patrocinio <[e-mail]>
 Eoghan Glynn <[e-mail]>
 Everett Toews <[e-mail]>
 Ewan Mellor <[e-mail]>
@@ -64,6 +65,7 @@
 Joe Heck <[e-mail]>
 Joe Savak <[e-mail]>
 Johannes Erdfelt <[e-mail]>
+John Bresnahan <[e-mail]>
 John Dickinson <[e-mail]>
 John Eo <[e-mail]>
 John Eo <[e-mail]>
@@ -85,6 +87,7 @@
 Lin Hua Cheng <[e-mail]>
 long-wang <[e-mail]>
 Mark Gius <[e-mail]>
+Mark J. Washenberger <[e-mail]>
 Mark McLoughlin <[e-mail]>
 Maru Newby <[e-mail]>
 Michael Basnight <[e-mail]>
@@ -92,6 +95,7 @@
 Mohammed Naser <[e-mail]>
 monsterxx03 <[e-mail]>
 Monty Taylor <[e-mail]>
+Nachiappan VR N <[e-mail]>
 OpenStack Jenkins <[e-mail]>
 Pádraig Brady <[e-mail]>
 Pádraig Brady <[e-mail]>
@@ -121,11 +125,13 @@
 Sirish Bitra <[e-mail]>
 Sony K. Philip <[e-mail]>
 Stef T <[e-mail]>
+Steve Martinelli <[e-mail]>
 Syed Armani <[e-mail]>
 termie <[e-mail]>
 Thierry Carrez <[e-mail]>
 Tim Simpson <[e-mail]>
 Todd Willey <[e-mail]>
+Tom Fifield <[e-mail]>
 Unmesh Gurjar <[e-mail]>
 Unmesh Gurjar <[e-mail]>
 Vincent Hou <[e-mail]>
@@ -134,6 +140,7 @@
 vishvananda <[e-mail]>
 wanglong <[e-mail]>
 Will Kelly <[e-mail]>
+Wu Wenxiang <[e-mail]>
 Yaguang Tang <[e-mail]>
 Yogeshwar Srikrishnan <[e-mail]>
 Yong Sheng Gong <[e-mail]>
 
=== modified file 'ChangeLog'
--- ChangeLog	2012-11-23 09:01:53 +0000
+++ ChangeLog	2013-01-25 16:27:23 +0000
@@ -1,3 +1,1005 @@
+commit 788f6c5ee60bea0146ae0f86a7aec9430654be8d
+Merge: 4fae928 3244451
+Author: Jenkins <[e-mail]>
+Date:   Wed Jan 9 05:38:12 2013 +0000
+
+    Merge "Add missing .po files to tarball"
+
+commit 4fae928c59beaa558306a5aa3a3aa5c6f4945b70
+Author: Henry Nash <[e-mail]>
+Date:   Thu Dec 13 16:48:13 2012 +0000
+
+    Keystone server support for user groups
+    
+    This implements the server side of groups of users.  This
+    set of code provides all the crud functionality for groups as
+    well as the corresponding support for role assignments.
+    
+    blueprint user-groups
+    
+    The following deficiencies existing with the current version and
+    will be corrected ahead of the final Grizzly release:
+    
+    1) There is only placeholder support for LDAP (Bug #1092187)
+    2) Domain role grants are accepted but not yet honored (Bug #1093248)
+    3) Token invalidation does not occur with group changes (Bug #1093493)
+    
+    This update also fills in missing v3 grant unit testing and v3 grant
+    support within the kvs backend.  In addition, there is a fix for
+    Bug #1092200 (uncaught exception when listing grants)
+    
+    DocImpact
+    
+    Change-Id: Ibd1783b04b2d7804eff90312e5ef591dca4d0695
+
+ keystone/clean.py                                  |    4 +
+ keystone/common/models.py                          |   17 +
+ .../migrate_repo/versions/013_add_group_tables.py  |   93 +++++
+ keystone/config.py                                 |   11 +
+ keystone/exception.py                              |    4 +
+ keystone/identity/backends/kvs.py                  |  201 ++++++++++-
+ keystone/identity/backends/ldap/core.py            |  109 ++++++
+ keystone/identity/backends/pam.py                  |    3 -
+ keystone/identity/backends/sql.py                  |  362 +++++++++++++++++---
+ keystone/identity/controllers.py                   |  103 ++++--
+ keystone/identity/core.py                          |  113 +++++-
+ keystone/identity/routers.py                       |   67 +++-
+ keystone/service.py                                |    1 +
+ keystone/token/controllers.py                      |   70 +++-
+ tests/test_auth.py                                 |   39 +++
+ tests/test_backend.py                              |  306 +++++++++++++++++
+ tests/test_backend_ldap.py                         |   47 +++
+ tests/test_sql_upgrade.py                          |   18 +-
+ tests/test_v3.py                                   |    8 +
+ tests/test_v3_identity.py                          |  199 ++++++++++-
+ 20 files changed, 1669 insertions(+), 106 deletions(-)
+
+commit 3244451c1beb2236c99e1bace5925e4953b6771e
+Author: Thierry Carrez <[e-mail]>
+Date:   Mon Jan 7 14:37:53 2013 +0100
+
+    Add missing .po files to tarball
+    
+    Fix MANIFEST.in to include .po files in keystone/locale.
+    Fixes bug 1096063.
+    
+    Change-Id: I4cf06a0777b5f22344ff18321bbf155f574b1e49
+
+ MANIFEST.in |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 9460ff5c35809f4911cb5a1ee5f68d6351e797f4
+Merge: 2162e4b 64672bd
+Author: Jenkins <[e-mail]>
+Date:   Sat Jan 5 23:33:29 2013 +0000
+
+    Merge "Upgrade WebOb to 1.2.3"
+
+commit 2162e4b3b54f99095aa0f5f6fc3cbcad20436cc4
+Merge: 2b08994 5a81be3
+Author: Jenkins <[e-mail]>
+Date:   Sat Jan 5 23:25:14 2013 +0000
+
+    Merge "Removed unused imports"
+
+commit 2b08994e1f9d4ea7d7659faa014f541ed9a82e0e
+Merge: 863acc7 0e5533e
+Author: Jenkins <[e-mail]>
+Date:   Fri Jan 4 22:29:31 2013 +0000
+
+    Merge "il8n some strings"
+
+commit 863acc7b6d39de3596e2bf767397774053156f45
+Merge: 76af49f 1f01d30
+Author: Jenkins <[e-mail]>
+Date:   Thu Jan 3 19:30:53 2013 +0000
+
+    Merge "shorten pep8 output"
+
+commit 64672bdeb13097285af8dec16b6cacbef4495bab
+Author: Doug Hellmann <[e-mail]>
+Date:   Thu Jan 3 11:08:15 2013 -0500
+
+    Upgrade WebOb to 1.2.3
+    
+    The version of WebOb being used in OpenStack was more than
+    1 year old. This change updates to the latest stable release.
+    
+    Upgrading WebOb resolves a version conflict between OpenStack
+    and Pecan, the web framework used by the Ceilometer team for
+    version 2 of the ceilometer API.
+    
+    Refer to http://docs.webob.org/en/latest/news.html
+    for the list of changes between 1.0.8 and 1.2.3.
+    
+    bug 1092227
+    
+    Change-Id: If68866122e6c492b03887af5953ab7cad01787ba
+    Signed-off-by: Doug Hellmann <[e-mail]>
+
+ tools/pip-requires |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 0e5533eb6f828cffac1cdd98a524f69503332cec
+Author: Chuck Short <[e-mail]>
+Date:   Thu Jan 3 08:32:34 2013 -0600
+
+    il8n some strings
+    
+    il8n some more missing strings.
+    
+    Change-Id: I56d1d83093c8a5e895571e2d2db41c7600662754
+    Signed-off-by: Chuck Short <[e-mail]>
+
+ keystone/common/controller.py           |   14 +++++++-------
+ keystone/common/ldap/core.py            |   16 ++++++++--------
+ keystone/common/sql/migration.py        |    2 +-
+ keystone/common/utils.py                |    4 ++--
+ keystone/identity/backends/ldap/core.py |    2 +-
+ 5 files changed, 19 insertions(+), 19 deletions(-)
+
+commit 76af49f11a5cd2ef7be93c5cbe3244fe48cc6b31
+Author: OpenStack Jenkins <[e-mail]>
+Date:   Wed Jan 2 00:00:46 2013 +0000
+
+    Imported Translations from Transifex
+    
+    Change-Id: I94d6360ce6f6ca8150a83c12af887452bc4a41f6
+
+ keystone/locale/hu/LC_MESSAGES/keystone.po |  313 ++++++++++++++++++++++++++++
+ keystone/locale/keystone.pot               |   18 +-
+ 2 files changed, 324 insertions(+), 7 deletions(-)
+
+commit 5a81be30de7c756716aef06a361a88f553be9b76
+Author: Chuck Short <[e-mail]>
+Date:   Fri Dec 28 10:39:33 2012 -0600
+
+    Removed unused imports
+    
+    Removed unused imports
+    
+    Change-Id: I646d79849731b87ce6c1eeb80f42c77dd789ecff
+    Signed-off-by: Chuck Short <[e-mail]>
+
+ keystone/cli.py                                    |    4 ----
+ keystone/common/router.py                          |    1 -
+ .../versions/001_add_initial_tables.py             |    1 -
+ .../sql/migrate_repo/versions/003_token_valid.py   |    4 ----
+ .../migrate_repo/versions/006_add_policy_table.py  |    1 -
+ .../migrate_repo/versions/007_add_domain_tables.py |    1 -
+ .../versions/008_normalize_identity.py             |    3 ---
+ .../versions/009_normalize_identity_migration.py   |    3 +--
+ .../sql/migrate_repo/versions/010_endpoints_v3.py  |    1 -
+ .../versions/012_drop_legacy_endpoints.py          |    1 -
+ setup.py                                           |    1 -
+ tests/_ldap_livetest.py                            |    1 -
+ 12 files changed, 1 insertion(+), 21 deletions(-)
+
+commit a0e06a8e96ccfeee1de0030da0a1a2ac9e6e5aad
+Author: Chuck Short <[e-mail]>
+Date:   Sat Dec 22 15:36:34 2012 -0600
+
+    Add pyflakes to tox.ini
+    
+    Add the ability to use pyflakes.
+    
+    Change-Id: I1c0a652258fd494bf6754b5b83c47166582a85d0
+    Signed-off-by: Chuck Short <[e-mail]>
+
+ tools/flakes.py |   22 ++++++++++++++++++++++
+ tox.ini         |    4 ++++
+ 2 files changed, 26 insertions(+)
+
+commit daf3bdae226a76926a8a877e1ed4bd7046f9192d
+Merge: 1b3b642 0f22574
+Author: Jenkins <[e-mail]>
+Date:   Mon Dec 24 03:46:16 2012 +0000
+
+    Merge "Adding a means to connect back to a pydevd debugger."
+
+commit 1b3b6428225d16162bcb9d44ab628bccd9f219b4
+Author: Chuck Short <[e-mail]>
+Date:   Sat Dec 22 18:09:13 2012 -0600
+
+    Fix spelling typo
+    
+    Fixes spelling typo should be role_id instead of roll_id.
+    
+    Change-Id: I45a994f7cbe3528ef5a9a667a67237c2a896db9c
+    Signed-off-by: Chuck Short <[e-mail]>
+
+ keystone/identity/backends/ldap/core.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 469ff6571e49f70662107a1db393b856214eea3c
+Merge: 4fb7ef4 e577cd6
+Author: Jenkins <[e-mail]>
+Date:   Sat Dec 22 20:39:42 2012 +0000
+
+    Merge "Remove swift auth."
+
+commit 4fb7ef4faf0b0ef3077c0175d158df3ab601e4bf
+Merge: b5581fe 03eb280
+Author: Jenkins <[e-mail]>
+Date:   Sat Dec 22 09:43:05 2012 +0000
+
+    Merge "Driver registry"
+
+commit 1f01d30983e3a67a146308ff8766f057bc5b7958
+Author: Adam Young <[e-mail]>
+Date:   Thu Dec 20 21:43:41 2012 -0500
+
+    shorten pep8 output
+    
+    This removes the PEP8 output that describes in detail how to fix each
+    problem. It makes pep8 review so long that the earliest lines scroll
+    out of the scrollback buffer before they can even be read.
+    
+    With this change, each violation is on line long, which is
+    much more readable.
+    
+    Change-Id: I0d8cc64fd6027419754732e314c047b3775a121c
+
+ run_tests.sh |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 03eb2801a3ad38a39e9cf127c05ab710bf38ee1d
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Dec 19 10:04:21 2012 -0600
+
+    Driver registry
+    
+    Uses automatic dependency injection to provide controllers with driver
+    interfaces (identity_api, token_api, etc).
+    
+    See tests/test_injection.py for a self-contained example.
+    
+    Change-Id: I255087de534292fbf57a45b19f97488f831f607c
+
+ keystone/catalog/controllers.py     |   11 ++-
+ keystone/catalog/core.py            |    2 +
+ keystone/catalog/routers.py         |    8 +-
+ keystone/common/controller.py       |   10 +--
+ keystone/common/dependency.py       |   67 +++++++++++++++++
+ keystone/contrib/admin_crud/core.py |   17 ++---
+ keystone/contrib/ec2/core.py        |   17 ++---
+ keystone/contrib/user_crud/core.py  |   11 +--
+ keystone/identity/controllers.py    |    4 -
+ keystone/identity/core.py           |    8 +-
+ keystone/identity/routers.py        |   28 +++----
+ keystone/policy/core.py             |    2 +
+ keystone/policy/routers.py          |    4 +-
+ keystone/routers.py                 |   13 ++--
+ keystone/service.py                 |   32 ++++----
+ keystone/test.py                    |   22 ++++--
+ keystone/token/controllers.py       |    2 +
+ keystone/token/core.py              |    4 +-
+ keystone/token/routers.py           |    6 +-
+ tests/test_auth.py                  |   14 +---
+ tests/test_injection.py             |  141 +++++++++++++++++++++++++++++++++++
+ 21 files changed, 297 insertions(+), 126 deletions(-)
+
+commit 0f225743e8644416df2f200d710912c40b7acd47
+Author: John Bresnahan <[e-mail]>
+Date:   Wed Dec 19 07:13:24 2012 -1000
+
+    Adding a means to connect back to a pydevd debugger.
+    
+    That patch allows a developer to remotely run a pydev debugger and have the
+    keystone-all process connect back to it.  Two command line options are
+    introduced:
+        --pydev-debug-host <host>
+        --pydev-debug-port <port>
+    both of the above options are required to enable this behavior.
+    
+    This patch only enables this behavior when the service is started with
+    keystone-all.  In the future parts of this patch can be used to enable
+    this behavior when running in Apache.
+    
+    Change-Id: I92f99fa34112336a96e42e8261b7313f23ee994e
+
+ bin/keystone-all         |    7 +++++++
+ keystone/common/utils.py |   19 +++++++++++++++++++
+ keystone/config.py       |    3 +++
+ 3 files changed, 29 insertions(+)
+
+commit b5581fea95f96dc7e43abe2b28c99678b5219238
+Merge: ac2d92c a591b30
+Author: Jenkins <[e-mail]>
+Date:   Fri Dec 21 03:29:40 2012 +0000
+
+    Merge "add in pip requires for requests"
+
+commit a591b3010c37f19924775f52c8076778888f1ade
+Author: Adam Young <[e-mail]>
+Date:   Thu Dec 20 16:40:20 2012 -0500
+
+    add in pip requires for requests
+    
+    Change-Id: I0f5ac9a4008dc471cefea7a6ffe44d4c51950538
+
+ tools/pip-requires  |    2 +-
+ tools/test-requires |    2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+commit ac2d92ca2eea1070f765be320acb62fd5bef6dd3
+Merge: 1a0d30b 2f85134
+Author: Jenkins <[e-mail]>
+Date:   Tue Dec 18 18:01:40 2012 +0000
+
+    Merge "Split endpoint records in SQL by interface"
+
+commit 2f851340ee8969193b9dcc1913401aa9b33c5d97
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Nov 30 12:52:26 2012 -0600
+
+    Split endpoint records in SQL by interface
+    
+    This migrates the SQL backend such that v2 endpoints containing up to 3
+    URL's (public, internal and admin) stored in 'extra' are split into
+    unique endpoints.
+    
+    Because legacy "endpoints" (each having publicUrl, internalUrl and
+    adminUrl) are no longer conceptually identical to v3's "endpoints" (each
+    having an interface and a url), new ID's are assigned to each entity and
+    each API continues to operate using with independent sets of endpoint
+    ID's.
+    
+    Endpoints created on the v3 API are not exposed on the v2 API.
+    
+    Change-Id: I2ba59d55907313ae65e908585fc49be0c4ce899a
+
+ keystone/catalog/backends/sql.py                   |   54 +++---
+ keystone/catalog/controllers.py                    |   65 ++++++-
+ .../sql/migrate_repo/versions/010_endpoints_v3.py  |   54 ++++++
+ .../versions/011_populate_endpoint_type.py         |   96 ++++++++++
+ .../versions/012_drop_legacy_endpoints.py          |   51 ++++++
+ tests/test_backend.py                              |    3 +
+ tests/test_backend_sql.py                          |   78 ++++----
+ tests/test_sql_upgrade.py                          |  191 +++++++++++++++++---
+ tests/test_v3.py                                   |    1 +
+ 9 files changed, 487 insertions(+), 106 deletions(-)
+
+commit 1a0d30bf0173f8e03abeac4bda2e807bd4f29412
+Merge: 4f4b4a7 5b3a74d
+Author: Jenkins <[e-mail]>
+Date:   Tue Dec 18 16:56:10 2012 +0000
+
+    Merge "Support non-default role_id_attribute"
+
+commit 4f4b4a7b5b0d846e308f2ce693d3c6e69f944d1e
+Merge: 7db702c f74aab2
+Author: Jenkins <[e-mail]>
+Date:   Tue Dec 18 16:55:48 2012 +0000
+
+    Merge "Expand default time delta (bug 1089988)"
+
+commit 7db702cab1f2cad8160aeadc8c1ae27853b8a34c
+Merge: ede7e20 fb963a5
+Author: Jenkins <[e-mail]>
+Date:   Tue Dec 18 14:43:26 2012 +0000
+
+    Merge "module refactoring"
+
+commit ede7e209bded5494a2453485e619b7b81f23cf3a
+Merge: 96d2ff7 23ba963
+Author: Jenkins <[e-mail]>
+Date:   Mon Dec 17 23:54:12 2012 +0000
+
+    Merge "Fix typo s/interalurl/internalurl/"
+
+commit 96d2ff71ad01d53232cdc128df9d3b6109a04f67
+Merge: 7093c55 8e2a183
+Author: Jenkins <[e-mail]>
+Date:   Mon Dec 17 21:45:00 2012 +0000
+
+    Merge "Test drivers return HTTP 501 Not Implemented"
+
+commit 7093c55d2e4722fc8ffdcef594cc5705b586a2d9
+Merge: 44e3c3e d17dfe6
+Author: Jenkins <[e-mail]>
+Date:   Mon Dec 17 21:44:38 2012 +0000
+
+    Merge "Import pysqlite2 if sqlite3 is not available."
+
+commit 23ba963af45c0243d817ae38a84f9e3c830415eb
+Author: Mark J. Washenberger <[e-mail]>
+Date:   Mon Dec 17 13:41:39 2012 -0800
+
+    Fix typo s/interalurl/internalurl/
+    
+    Change-Id: I9e9209731e5d13b21a7aff6127d932d69c457135
+
+ keystone/common/models.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit fb963a560939e6be8c98d74e5555de7283173e32
+Author: Adam Young <[e-mail]>
+Date:   Wed Dec 12 13:17:54 2012 -0500
+
+    module refactoring
+    
+    Distributes the functionality of service.py into the modules.
+    Moves ComposableRouters into the modules.
+    The routers and controllers now have short names.
+    The controllers get their APIs via the base class.
+    
+    Change-Id:  I87404b80ea9800d6792f97a7a3a64fe839065c1c
+
+ keystone/catalog/__init__.py        |    1 +
+ keystone/catalog/controllers.py     |   20 +-
+ keystone/catalog/routers.py         |   25 ++
+ keystone/common/router.py           |   57 +++++
+ keystone/contrib/admin_crud/core.py |   18 +-
+ keystone/contrib/user_crud/core.py  |   23 +-
+ keystone/controllers.py             |  144 +++++++++++
+ keystone/identity/controllers.py    |   24 +-
+ keystone/identity/routers.py        |   73 +++++-
+ keystone/policy/__init__.py         |    1 +
+ keystone/policy/routers.py          |   22 ++
+ keystone/routers.py                 |   68 +++++
+ keystone/service.py                 |  472 ++---------------------------------
+ keystone/token/__init__.py          |    1 +
+ keystone/token/routers.py           |   61 +++++
+ 15 files changed, 503 insertions(+), 507 deletions(-)
+
+commit 44e3c3ece3f6e8a596dbec37476d8fb5c85d6f6c
+Merge: ebfbd6c e093e81
+Author: OpenStack Jenkins <[e-mail]>
+Date:   Fri Dec 14 20:13:31 2012 +0000
+
+    Merge "Imported Translations from Transifex"
+
+commit ebfbd6c0844f9ab3e9a864112672164cf8b3696f
+Merge: d939d16 be3dcf9
+Author: Jenkins <[e-mail]>
+Date:   Fri Dec 14 20:13:10 2012 +0000
+
+    Merge "Test for content-type appropriate 404 (bug 1089987)"
+
+commit d939d16e747b4a2c5db1f1fdda93a01b79fe6e83
+Merge: f5d26ea 18a49ae
+Author: Jenkins <[e-mail]>
+Date:   Fri Dec 14 15:20:07 2012 +0000
+
+    Merge "syncing run_tests to match tox"
+
+commit f5d26ea9c67e2bb812f0e7a36512538b9f3e18ff
+Merge: 5b7160c 6ceb066
+Author: Jenkins <[e-mail]>
+Date:   Fri Dec 14 15:04:46 2012 +0000
+
+    Merge "fixing bug 1046862"
+
+commit be3dcf9873fb84bbb5c2cd3ed8f36444f353757e
+Author: Dolph Mathews <[e-mail]>
+Date:   Thu Dec 13 10:01:21 2012 -0600
+
+    Test for content-type appropriate 404 (bug 1089987)
+    
+    Change-Id: Idfba75f90e38de315ec50e660932beb8243f76f8
+
+ keystone/common/wsgi.py     |    2 +-
+ tests/test_content_types.py |   12 ++++++++++++
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+commit e093e81c750408478d74fafac2cb0cc7eb221d5f
+Author: OpenStack Jenkins <[e-mail]>
+Date:   Fri Dec 14 00:01:05 2012 +0000
+
+    Imported Translations from Transifex
+    
+    Change-Id: Ib2cb912443034b4d9855441ca83d103e2a9bdbe8
+
+ keystone/locale/keystone.pot |  276 +++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 275 insertions(+), 1 deletion(-)
+
+commit 5b7160cd536f0a86cf33bc294679bd19a2e90549
+Merge: 4e2be8a e4d61ac
+Author: Jenkins <[e-mail]>
+Date:   Thu Dec 13 22:11:33 2012 +0000
+
+    Merge "Add tests for contrib.s3.core."
+
+commit 6ceb06689f5f1da26584192ae9f46a5248277565
+Author: Steve Martinelli <[e-mail]>
+Date:   Thu Dec 13 11:35:01 2012 -0500
+
+    fixing bug 1046862
+    
+    adding message to readme.rst to include openSSL dependency
+    
+    fixing bug 1046862
+    
+    Change-Id: Iff1fbc95e804f9e4ddc74ea38c553426c4eabb33
+
+ README.rst |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+commit f74aab2463ccc9549c07175ed82015f23ad2694c
+Author: Dolph Mathews <[e-mail]>
+Date:   Thu Dec 13 09:42:32 2012 -0600
+
+    Expand default time delta (bug 1089988)
+    
+    Change-Id: I3d08092bf5248f75b238591586443a4daea02a20
+
+ keystone/test.py |    9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+commit e4d61ac6a7893743ff47c0a69529c5f21f249127
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Wed Dec 12 19:04:23 2012 +0100
+
+    Add tests for contrib.s3.core.
+    
+    Change-Id: I0a5ea82dcbcf29f6581d8c69e8961138fa019145
+
+ tests/test_contrib_s3_core.py |   54 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 54 insertions(+)
+
+commit 8e2a183992311fe005abbfaa40d68dd7ce1fffd3
+Author: Dolph Mathews <[e-mail]>
+Date:   Mon Dec 10 10:10:22 2012 -0600
+
+    Test drivers return HTTP 501 Not Implemented
+    
+    Change-Id: I4cd21022593e6b4c3965edd00ecea01a00584516
+
+ keystone/policy/core.py             |    2 +-
+ keystone/token/backends/kvs.py      |   14 +++++-----
+ keystone/token/backends/memcache.py |    8 +++---
+ keystone/token/backends/sql.py      |    8 +++---
+ keystone/token/controllers.py       |    5 ++--
+ keystone/token/core.py              |   44 ++++++++++++++++-------------
+ tests/test_drivers.py               |   52 +++++++++++++++++++++++++++++++++++
+ 7 files changed, 96 insertions(+), 37 deletions(-)
+
+commit 5b3a74d56a376afed64dd2515c4aa59995187433
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Dec 12 15:01:04 2012 -0600
+
+    Support non-default role_id_attribute
+    
+    As is, a default value of 'cn' is hardcoded as the attribute name (which
+    also happens to be the default value in keystone.config) used for role
+    grants, revokes, etc.
+    
+    Change-Id: Ic36e6d726e2dc48714703c2dd7a433f3d34b78b1
+
+ keystone/identity/backends/ldap/core.py |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+commit e577cd60871e1810b45236d3642d60e460dc4858
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Sat Dec 8 13:38:45 2012 +0100
+
+    Remove swift auth.
+    
+    - This has been moved since last release to swift main repository.
+    
+    Change-Id: I11fc4001fbc4a1d78823d41450cdfcc97677c420
+
+ doc/source/configuringservices.rst  |  147 +----------------
+ keystone/middleware/swift_auth.py   |  295 -----------------------------------
+ tests/test_swift_auth_middleware.py |  249 -----------------------------
+ 3 files changed, 2 insertions(+), 689 deletions(-)
+
+commit 4e2be8a8880f03b1c6d1dc663d7259dbb45ddf67
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Dec 11 14:40:27 2012 -0600
+
+    Move token controller into keystone.token
+    
+    Change-Id: Ie8277529185f645854e0aebaafa173c06a7c5164
+
+ keystone/common/controller.py |   12 +-
+ keystone/contrib/ec2/core.py  |    5 +-
+ keystone/service.py           |  556 ++---------------------------------------
+ keystone/token/__init__.py    |    1 +
+ keystone/token/controllers.py |  545 ++++++++++++++++++++++++++++++++++++++++
+ tests/test_auth.py            |  358 ++++++++++++++++++++++++++
+ tests/test_service.py         |  355 --------------------------
+ 7 files changed, 927 insertions(+), 905 deletions(-)
+
+commit 6397580a52be5288b4cb5e0a86a8c340fe4fd0ae
+Merge: bf4b9f4 0ea864b
+Author: Jenkins <[e-mail]>
+Date:   Tue Dec 11 14:03:52 2012 +0000
+
+    Merge "Adding downgrade steps for migration scripts."
+
+commit d17dfe65550d393739dc50a1eedfe65903a81d28
+Author: Yuriy Taraday <[e-mail]>
+Date:   Fri Dec 7 22:32:52 2012 +0400
+
+    Import pysqlite2 if sqlite3 is not available.
+    
+    Otherwise test_import_legacy fails on import.
+    
+    Change-Id: I902493f5b726f5bc9e23e776598b8938c85e622c
+
+ tests/test_import_legacy.py |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+commit bf4b9f49878e85000b197ea9c2627cc67fda5cdb
+Merge: d159c61 aaf61a4
+Author: Jenkins <[e-mail]>
+Date:   Mon Dec 10 22:14:15 2012 +0000
+
+    Merge "Remove mentions of essex in docs (bug 1085247)"
+
+commit d159c616fd52436760242d3254c8bdb54810bcb4
+Merge: a800fae 847d591
+Author: Jenkins <[e-mail]>
+Date:   Mon Dec 10 21:44:54 2012 +0000
+
+    Merge "Port to argparse based cfg"
+
+commit aaf61a4fc9d07a73d2a31abb097a2d862598c4e5
+Author: Eduardo Patrocinio <[e-mail]>
+Date:   Tue Dec 4 15:11:16 2012 -0500
+
+    Remove mentions of essex in docs (bug 1085247)
+    
+    Change-Id: I663e9317c2b5eb5fe7190ea6c656fcebff7078fd
+
+ doc/source/configuration.rst |   20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+commit a800fae22c627e89a09ffc35b95dd072416da14a
+Author: Brian Waldon <[e-mail]>
+Date:   Thu Dec 6 12:31:51 2012 -0800
+
+    Ensure serviceCatalog is list when empty, not dict
+    
+    Fixes bug 1087405.
+    
+    Change-Id: I152c7f418a66ccfe541e26efe75b59bffa6c3849
+
+ keystone/service.py         |    2 +-
+ tests/test_content_types.py |   19 +++++++++++++++++--
+ 2 files changed, 18 insertions(+), 3 deletions(-)
+
+commit 0ea864b26e6e2e9be44785af61fd90a9b13b5265
+Author: Justin Shepherd <[e-mail]>
+Date:   Mon Nov 26 17:37:02 2012 +0000
+
+    Adding downgrade steps for migration scripts.
+    
+    Also updated test_sql_upgrade to check the actions from 007_add_domain_tables.
+    
+    Fixes: bug #1081167
+    
+    Change-Id: I194c7de9ae8a3bb8f2f9f37d3a91f4fac2fe2913
+
+ .../versions/001_add_initial_tables.py             |    9 +++++++-
+ .../migrate_repo/versions/003_sqlite_downgrade.sql |    1 -
+ .../migrate_repo/versions/006_add_policy_table.py  |    6 ++++-
+ .../migrate_repo/versions/007_add_domain_tables.py |    5 ++++
+ tests/test_sql_upgrade.py                          |   24 ++++++++++++++++++++
+ 5 files changed, 42 insertions(+), 3 deletions(-)
+
+commit 7978bb271bf0e978a095aa088e4bb2bdb1d684f8
+Merge: 3583946 84a0b2d
+Author: Jenkins <[e-mail]>
+Date:   Wed Dec 5 21:21:39 2012 +0000
+
+    Merge "Bug 1075090 -- Fixing log messages in python source code to support internationalization."
+
+commit 3583946d933b989b14c25daa9d6c462142eb400f
+Merge: 9b529c8 c858c1b
+Author: Jenkins <[e-mail]>
+Date:   Wed Dec 5 21:08:07 2012 +0000
+
+    Merge "Only 'import *' from 'core' modules"
+
+commit 9b529c8c00fc344d5a5e33170e95ba5f1bee0fed
+Merge: 8c15e3e 77dee93
+Author: Jenkins <[e-mail]>
+Date:   Wed Dec 5 21:07:51 2012 +0000
+
+    Merge "use keystone test and change config during setUp"
+
+commit 847d5912d383072e3c38d6d19fce15981ca3110a
+Author: Mark McLoughlin <[e-mail]>
+Date:   Mon Nov 26 14:39:49 2012 +0000
+
+    Port to argparse based cfg
+    
+    Sync the following changes from oslo-incubator:
+    
+     3557d84 Fix ListOpt to trim whitespace
+     01ab910 Fix set_default() with boolean CLI options
+     af18eaa Improve cfg's argparse sub-parsers support
+     f21e1d9 Fix regression with cfg CLI arguments
+     ceb4aa7 Fix broken --help with CommonConfigOpts
+     5e9503b Hide the GroupAttr conf and group attributes
+     b6d24bb updating sphinx documentation
+     403509e Don't reference argparse._StoreAction
+     e17deb8 Fix minor coding style issue
+     0c29e1d Remove ConfigCliParser class
+     5b9cb41 Add support for positional arguments
+     dbc72a6 Use stock argparse behaviour for optional args
+     768a147 Use stock argparse --usage behaviour
+     ac180b9 Use stock argparse --version behaviour
+     0787e38 Remove add_option() method
+     5afead0 Completely remove cfg's disable_interspersed_args()
+     5f564b2 argparse support for cfg
+     d7b6397 Add a missing comma in a docstring.
+     aca1805 cfg: fix required if option has a dash
+    
+    The main API change affecting keystone is that CONF() no longer returns
+    unparsed arguments. The keystone-manage command is updated to use
+    argparse sub-parsers to achieve the same effect.
+    
+    Change-Id: Ie8972ce851f1247d8710e9e0611bb3e2f843cb45
+
+ keystone/cli.py                  |  133 +++++------
+ keystone/openstack/common/cfg.py |  451 ++++++++++++++++++++++++--------------
+ 2 files changed, 345 insertions(+), 239 deletions(-)
+
+commit c858c1b304cae6310f08a220cf54c763f684fc42
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Dec 5 09:58:54 2012 -0600
+
+    Only 'import *' from 'core' modules
+    
+    - Renamed identity.controllers.* and identity.routers.* since they
+      now occopy unique namespaces (thanks ayoung!)
+    - Moved catalog and policy controllers into their own respective modules
+    
+    Change-Id: Ib9e277355e0eac15d4d218785c816b718b493b5b
+
+ HACKING.rst                         |    2 +-
+ keystone/catalog/__init__.py        |    1 +
+ keystone/catalog/controllers.py     |  154 +++++++++++++++++++++++++++++++++++
+ keystone/catalog/core.py            |  136 -------------------------------
+ keystone/contrib/admin_crud/core.py |   10 +--
+ keystone/contrib/user_crud/core.py  |   11 ++-
+ keystone/identity/__init__.py       |    4 +-
+ keystone/identity/controllers.py    |   28 +++----
+ keystone/identity/routers.py        |   25 ++----
+ keystone/policy/__init__.py         |    1 +
+ keystone/policy/controllers.py      |   48 +++++++++++
+ keystone/policy/core.py             |   32 --------
+ keystone/service.py                 |   20 ++---
+ 13 files changed, 246 insertions(+), 226 deletions(-)
+
+commit 77dee93763e4941b07f628c1c67d925503a5df51
+Author: Ionuț Arțăriși <[e-mail]>
+Date:   Mon Dec 3 11:59:20 2012 +0100
+
+    use keystone test and change config during setUp
+    
+    Also fixes this traceback which I keep getting on devstack:
+    
+    ERROR: test_create_certs (tests.test_cert_setup.CertSetupTestCase)
+    ----------------------------------------------------------------------
+    Traceback (most recent call last):
+      File "/opt/stack/keystone/tests/test_cert_setup.py", line 52, in tearDown
+        shutil.rmtree(rootdir(SSLDIR))
+      File "/usr/lib/python2.7/shutil.py", line 237, in rmtree
+        onerror(os.listdir, path, sys.exc_info())
+      File "/usr/lib/python2.7/shutil.py", line 235, in rmtree
+        names = os.listdir(path)
+    OSError: [Errno 2] No such file or directory: '/opt/stack/keystone/tests/ssl/'
+    
+    Fixes bug 1086812
+    
+    Change-Id: Iba10822aaf1284549d610bb1172df03ffc48f363
+
+ tests/test_cert_setup.py |   16 +++++++++-------
+ 1 file changed, 9 insertions(+), 7 deletions(-)
+
+commit 84a0b2df5932fabb0cdaaaddeb86d1f55a7ac06e
+Author: Nachiappan VR N <[e-mail]>
+Date:   Wed Nov 14 10:01:59 2012 -0800
+
+    Bug 1075090 -- Fixing log messages in python source code to support internationalization.
+    
+    Change-Id: I6b50abaa82effad8feaaac8d85086ca8b5d42590
+
+ keystone/catalog/backends/templated.py |    2 +-
+ keystone/catalog/core.py               |   16 +++++-----
+ keystone/clean.py                      |   13 ++++----
+ keystone/common/bufferedhttp.py        |    4 +--
+ keystone/common/cms.py                 |    4 +--
+ keystone/common/ldap/core.py           |   17 +++++-----
+ keystone/common/ldap/fakeldap.py       |   54 +++++++++++++++++---------------
+ keystone/common/sql/core.py            |    2 +-
+ keystone/common/sql/legacy.py          |    2 +-
+ keystone/common/sql/nova.py            |   14 ++++-----
+ keystone/common/utils.py               |   10 +++---
+ keystone/common/wsgi.py                |    6 ++--
+ keystone/config.py                     |    4 +--
+ keystone/policy/backends/rules.py      |    2 +-
+ keystone/test.py                       |    2 +-
+ 15 files changed, 80 insertions(+), 72 deletions(-)
+
+commit 8c15e3eba68d4af655eacee3d1ec46e98911d119
+Author: Alvaro Lopez Garcia <[e-mail]>
+Date:   Mon Dec 3 10:12:06 2012 +0100
+
+    Added documentation for the external auth support
+    
+    This covers given authentication using REMOTE_USER and also the way to
+    implement custom auth with WSGI middleware.
+    
+    DocImpact
+    blueprint: pluggable-identity-authentication-handlers
+    Change-Id: Idbac8c38d1f0be1febbbc8056c929bada6bbb07e
+
+ doc/source/external-auth.rst |  117 ++++++++++++++++++++++++++++++++++++++++++
+ doc/source/index.rst         |    1 +
+ 2 files changed, 118 insertions(+)
+
+commit 75277cf1ae496145369e929702005ef2304e6942
+Merge: 5b73757 af8761d
+Author: Jenkins <[e-mail]>
+Date:   Mon Dec 3 09:57:36 2012 +0000
+
+    Merge "check the redirected path on the request, not the response"
+
+commit af8761d9e0add62a83604b77ab015f5a8b3120a9
+Author: Ionuț Arțăriși <[e-mail]>
+Date:   Fri Nov 30 14:04:04 2012 +0100
+
+    check the redirected path on the request, not the response
+    
+    The request object's path changes when it gets redirected. This
+    behaviour is in tune with the latest WebOb code as well as the
+    old. The response environ defaults to None in WebOb >= 1.2b1
+    http://docs.webob.org/en/latest/news.html#b1
+    
+    Change-Id: I557563ce5407a8ef1b5dae680e456e589285be25
+
+ tests/test_s3_token_middleware.py |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+commit 5b73757de94a30b7cc8566e2bf429c1aecd5c320
+Author: Wu Wenxiang <[e-mail]>
+Date:   Thu Nov 29 23:58:04 2012 +0800
+
+    Validate password type (bug 1081861)
+    
+    Raise keystone.exception.ValidationError when password type was not string
+    
+    Change-Id: Ib7538806777db0fe3a3cf9f22bf06a1d505c232f
+
+ keystone/common/utils.py |   12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+commit f57098df8e50fae95c2c532407ec5bc6a10205e1
+Author: Adam Young <[e-mail]>
+Date:   Wed Nov 28 17:27:43 2012 -0500
+
+    split identities module into logical parts
+    remove unneeded imports from core
+    
+    Change-Id: I02fc2439cc115878d8081e052faf9ff96d20f6ec
+
+ keystone/identity/__init__.py    |    2 +
+ keystone/identity/controllers.py |  607 +++++++++++++++++++++++++++++++++++++
+ keystone/identity/core.py        |  614 --------------------------------------
+ keystone/identity/routers.py     |   72 +++++
+ 4 files changed, 681 insertions(+), 614 deletions(-)
+
+commit 38c7e46a640a94da4da89a39a5a1ea9c081f1eb5
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Nov 28 10:28:07 2012 -0500
+
+    Ensure token expiration is maintained (bug 1079216)
+    
+    Change-Id: I95853ec36e9c4cd937cfac7e08b648e830f9efd0
+
+ keystone/service.py   |    1 +
+ tests/test_service.py |   57 +++++++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 58 insertions(+)
+
+commit ede63fbfe504cffb4b29f7394b1bf4872d093588
+Merge: d970e5f 1012bd4
+Author: Jenkins <[e-mail]>
+Date:   Tue Nov 27 19:49:22 2012 +0000
+
+    Merge "normalize identity"
+
+commit 1012bd42df5906bca67a82663f23b5c8a4eafe68
+Author: Adam Young <[e-mail]>
+Date:   Tue Nov 6 17:16:56 2012 -0500
+
+    normalize identity
+    
+    modify tables by adding columns, and modify entities
+    by adding attributes for password, description and enabled
+    
+    update tests to deal with change from 'False' and 'True' to the
+    python values False and True
+    
+    Added a Text type from SQL Alchemy
+    
+    Bug 1070351
+    Bug 1023544
+    
+    Change-Id: I066c788b5d08a8f42a9b5412ea9e29e4fe9ba205
+
+ keystone/common/sql/core.py                        |    1 +
+ .../versions/008_normalize_identity.py             |   61 ++++++++
+ .../migrate_repo/versions/008_sqlite_downgrade.sql |    5 +
+ .../versions/009_normalize_identity_migration.py   |  146 ++++++++++++++++++++
+ keystone/identity/backends/sql.py                  |    8 +-
+ tests/default_fixtures.py                          |    8 ++
+ tests/test_backend.py                              |   18 +--
+ tests/test_backend_sql.py                          |    2 +
+ tests/test_sql_upgrade.py                          |   53 ++++++-
+ 9 files changed, 290 insertions(+), 12 deletions(-)
+
+commit d970e5f815558706e5be642d814d08c93b0dd42a
+Merge: 3779c67 d4c4cf0
+Author: Jenkins <[e-mail]>
+Date:   Tue Nov 27 04:22:51 2012 +0000
+
+    Merge "Fixes typo in keystone setup doc"
+
+commit d4c4cf035120c22c222b16c963abb1b82c33a707
+Author: Tom Fifield <[e-mail]>
+Date:   Tue Nov 27 12:38:07 2012 +1000
+
+    Fixes typo in keystone setup doc
+    
+    fixes bug 1083391
+    
+    A one character change to fix a typo in setup doc, reported
+    by a user :s
+    
+    Change-Id: I4fefec089c9ded4b773f4b3641e30162a4faa2f8
+
+ doc/source/setup.rst |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 3779c675c54fbc2be9d341e2a2a77b520f0f3a59
+Author: OpenStack Jenkins <[e-mail]>
+Date:   Tue Nov 27 00:01:43 2012 +0000
+
+    Imported Translations from Transifex
+    
+    Change-Id: I2cb4f8bd3891b474413eef11aae62188b358d359
+
+ keystone/locale/keystone.pot |   10 +---------
+ 1 file changed, 1 insertion(+), 9 deletions(-)
+
+commit 904af119d2b84a93e416b7b297eda3b321840669
+Author: Mark McLoughlin <[e-mail]>
+Date:   Mon Nov 26 16:16:54 2012 +0000
+
+    Stop using cfg's internal implementation details
+    
+    The fact that a cfg opt register using register_opt() is available via
+    the command line is actually a bug (see bug #1082279).
+    
+    Also, using the _cli_values attribute is clearly poking into private
+    implementation details.
+    
+    Fix both issues by registering the opt using register_cli_opt() and
+    accessing its value the normal way.
+    
+    Change-Id: If170dcd96daae5b4c3d7cdebed914df417c2209b
+
+ bin/keystone-all   |    2 +-
+ keystone/config.py |    4 +++-
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+commit 18a49ae5767cc9cf0f81d3bb9616aba4f076178a
+Author: Joe Heck <[e-mail]>
+Date:   Wed Nov 21 22:02:19 2012 +0000
+
+    syncing run_tests to match tox
+    
+    Change-Id: Ide81b1ea9230ceb2ad463d4f253eb7021fc683da
+
+ run_tests.sh |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
 commit 07c1aafdf20db6d6d7c0d3e15074bc02e2f1d2aa
 Merge: d8aa7fd 01fccdb
 Author: Jenkins <[e-mail]>
 
=== modified file 'HACKING.rst'
--- HACKING.rst	2012-11-02 13:48:49 +0000
+++ HACKING.rst	2013-01-25 16:27:23 +0000
@@ -44,7 +44,7 @@
 Imports
 -------
 
-- Do not import objects, only modules
+- Import modules, not module attributes
 - Do not import more than one module per line
 - Do not make relative imports
 - Order your imports by the full module path
 
=== modified file 'MANIFEST.in'
--- MANIFEST.in	2012-08-16 13:59:29 +0000
+++ MANIFEST.in	2013-01-25 16:27:23 +0000
@@ -18,5 +18,5 @@
 graft tests
 graft tools
 graft examples
-recursive-include keystone *.json *.xml *.cfg *.pem README *.pot *.sql
+recursive-include keystone *.json *.xml *.cfg *.pem README *.po *.pot *.sql
 global-exclude *.pyc *.sdx *.log *.db *.swp
 
=== modified file 'README.rst'
--- README.rst	2012-05-24 14:04:20 +0000
+++ README.rst	2013-01-25 16:27:23 +0000
@@ -212,3 +212,10 @@
 
 In the backend this would look up the policy for 'action:nova:add_network' and
 then do what is effectively a 'Simple Match' style match against the creds.
+
+
+----------------------------------
+Dependencies
+----------------------------------
+
+Ensure an OpenSSL version of 1.0+ is installed.
 \ No newline at end of file
 
=== modified file 'bin/keystone-all'
--- bin/keystone-all	2012-11-02 13:48:49 +0000
+++ bin/keystone-all	2013-01-25 16:27:23 +0000
@@ -90,7 +90,14 @@
         CONF.print_help()
         sys.exit(1)
 
-    monkeypatch_thread = not CONF._cli_values['standard_threads']
+    monkeypatch_thread = not CONF.standard_threads
+    pydev_debug_url = utils.setup_remote_pydev_debug()
+    if pydev_debug_url:
+        # in order to work around errors caused by monkey patching we have to
+        # set the thread to False.  An explanation is here:
+        # http://lists.openstack.org/pipermail/openstack-dev/2012-August/
+        # 000794.html
+        monkeypatch_thread = False
     eventlet.patcher.monkey_patch(all=False, socket=True, time=True,
                                   thread=monkeypatch_thread)
 
 
=== modified file 'debian/changelog'
--- debian/changelog	2012-11-26 19:24:17 +0000
+++ debian/changelog	2013-01-25 16:27:23 +0000
@@ -1,3 +1,36 @@
+keystone (2013.1~g2-0ubuntu1~cloud0) precise-grizzly; urgency=low
+
+  * New upstream release for the Ubuntu Cloud Archive.
+
+ -- Chuck Short <[e-mail]>  Wed, 23 Jan 2013 12:27:47 -0600
+
+keystone (2013.1~g2-0ubuntu1) raring; urgency=low
+
+  [ James Page ]
+  * Re-enable gating of package build based on successful unit testing:
+    - d/tests/test_overrides.conf: Fixup test configuration to use
+      correct certificate locations.
+    - d/p/fix-ubuntu-tests.patch: Skip tests for older versions of 
+      keystoneclient based on checkouts of upstream git repo.
+    - d/rules: Re-enable package build failure on test failure.
+  * d/control: Bump dependencies on python-keystoneclient to >= 1:0.2.
+  * d/control: Update Vcs-Bzr location to point to correct branch.
+  * d/control,d/po/*: Setup package templates for translation.
+  * d/man/*: Corrected spellings in man pages.
+  * d/keystone.upstart: Tweak 'stop on' to be triggered on all
+    appropriate runlevel transitions, use start-stop-daemon to startup
+    keystone daemon.
+
+  [ Adam Gandelman ]
+  * debian/keystone.manpages:  Install sphinx-generated manpages instead
+    of our own outdated and unneeded versions. (LP: #1082050)
+
+  [ Chuck Short ]
+  * New upstream release.
+  * Remove incomplete/broken dbconfig-common scripts.
+
+ -- Chuck Short <[e-mail]>  Fri, 11 Jan 2013 08:47:26 -0600
+
 keystone (2013.1~g1-0ubuntu1~cloud0) precise-grizzly; urgency=low
 
   * New upstream release for the Ubuntu Cloud Archive.
 
=== modified file 'debian/control'
--- debian/control	2012-11-02 13:48:49 +0000
+++ debian/control	2013-01-25 16:27:23 +0000
@@ -6,11 +6,12 @@
 Uploaders: Soren Hansen <[e-mail]>
 Build-Depends: debhelper (>= 7.0.50),
  pep8,
+ po-debconf,
  pylint,
  python-all (>= 2.6),
  python-all-dev (>= 2.6.6-3~) | python-support,
  python-eventlet,
- python-keystoneclient ( >= 1:0.1.3 ),
+ python-keystoneclient ( >= 1:0.2 ),
  python-ldap,
  python-lxml,
  python-memcache,
@@ -33,7 +34,7 @@
 Standards-Version: 3.9.3
 XS-Python-Version: >= 2.6
 Homepage: http://launchpad.net/keystone
-Vcs-Bzr: https://code.launchpad.net/~ubuntu-server-dev/keystone/essex
+Vcs-Bzr: https://code.launchpad.net/~openstack-ubuntu-testing/keystone/grizzly
 
 Package: python-keystone
 Architecture: all
@@ -52,7 +53,7 @@
  python-sqlalchemy,
  python-migrate,
  python-prettytable,
- python-keystoneclient ( >= 1:0.1.3 ),
+ python-keystoneclient ( >= 1:0.2 ),
  python-webob,
  python-iso8601
 Suggests: python-memcache
@@ -76,8 +77,7 @@
 Depends: ${python:Depends}, ${misc:Depends},
  python-keystone (= ${source:Version}),
  adduser,
- ssl-cert (>= 1.0.12),
- dbconfig-common
+ ssl-cert (>= 1.0.12)
 Description: OpenStack identity service - Daemons
  Keystone is a proposed independent authentication service for OpenStack.
  .
 
=== removed file 'debian/keystone.config'
--- debian/keystone.config	2012-06-22 12:27:50 +0000
+++ debian/keystone.config	1970-01-01 00:00:00 +0000
@@ -1,19 +0,0 @@
-#!/bin/sh
-set -e
-
-. /usr/share/debconf/confmodule
-
-
-db_input low keystone/configure_db || true
-db_go
-db_get keystone/configure_db
-if [ "$RET" = "true" ]; then
-	if [ -f /usr/share/dbconfig-common/dpkg/config ];
-	then
-		dbc_dbtypes="sqlite3, mysql, pgsql"
-		db_authmethod_user="password"
-		dbc_basepath="/var/lib/keystone"
-		. /usr/share/dbconfig-common/dpkg/config
-		dbc_go keystone $@
-	fi
-fi
 
=== modified file 'debian/keystone.manpages'
--- debian/keystone.manpages	2011-12-16 15:38:05 +0000
+++ debian/keystone.manpages	2013-01-25 16:27:23 +0000
@@ -1,1 +1,1 @@
-debian/man/*
+doc/build/man/*
 
=== modified file 'debian/keystone.postinst'
--- debian/keystone.postinst	2012-03-02 09:55:24 +0000
+++ debian/keystone.postinst	2013-01-25 16:27:23 +0000
@@ -2,8 +2,6 @@
 
 set -e
 
-. /usr/share/debconf/confmodule
-. /usr/share/dbconfig-common/dpkg/postinst
 
 # summary of how this script can be called:
 #        * <new-preinst> `install'
@@ -19,30 +17,10 @@
 		#su -s /bin/sh -c 'exec keystone database sync' keystone
 		;;
 	configure)
-		db_get keystone/configure_db
-		if [ "$RET" = "true" ]; then
-			dbc_go keystone $@
-		
-			case "$dbc_dbtype" in
-				sqlite3)
-					SQL_CONNECTION="sqlite:///$dbc_basepath/$dbc_dbname.db"
-					;;
-				mysql)
-					[ -n "$dbc_dbport" ] && dbport=:$dbc_dbport
-					SQL_CONNECTION="mysql://$dbc_dbuser:$dbc_dbpass@${dbc_dbserver:-localhost}$dbport/$dbc_dbname"
-					;;
-				pgsql)
-					[ -n "$dbc_dbport" ] && dbport=:$dbc_dbport
-					SQL_CONNECTION="pgsql://$dbc_dbuser:$dbc_dbpass@${dbc_dbserver:-localhost}$dbport/$dbc_dbname"
-					;;
-				*)
-					SQL_CONNECTION="sqlite:////var/lib/keystone/keystone.db"
-					;;
-			esac
-			[ -z "$2" -o "$dbc_install" = "true" ] \
-				&& sed -e "s,_DBC_URL_,$SQL_CONNECTION," -i /etc/keystone/keystone.conf
+		if ! grep -q sql_connection /etc/keystone/keystone.conf
+        then
+			su -s /bin/sh -c 'exec keystone-manage db_sync' keystone
 		fi
-		su -s /bin/sh -c 'exec keystone-manage db_sync' keystone
 		;;
 	abort-upgrade)
 		echo "aport upgrade called"
 
=== modified file 'debian/keystone.postrm'
--- debian/keystone.postrm	2012-06-22 12:27:50 +0000
+++ debian/keystone.postrm	2013-01-25 16:27:23 +0000
@@ -2,20 +2,6 @@
 
 set -e
 
-if [ -f /usr/share/debconf/confmodule ]
-then
-    . /usr/share/debconf/confmodule
-fi
-
-if [ -f /etc/dbconfig-common/keystone.conf ] 
-then
-	if [ -f /usr/share/dbconfig-common/dpkg/postrm ]
-	then
-		. /usr/share/dbconfig-common/dpkg/postrm
-		dbc_go keystone $@
-	fi
-fi
-
 case "$1" in
     purge)
         rm -rf /var/log/keystone
 
=== removed file 'debian/keystone.prerm'
--- debian/keystone.prerm	2012-06-22 12:27:50 +0000
+++ debian/keystone.prerm	1970-01-01 00:00:00 +0000
@@ -1,17 +0,0 @@
-#!/bin/sh
-
-set -e
-
-. /usr/share/debconf/confmodule
-. /usr/share/dbconfig-common/dpkg/prerm
-
-
-db_get keystone/configure_db
-if [ "$RET" = "true" ]; then
-	# Only cleanup with dbconfig if it was used during
-	# installation (LP: #948719)
-	dbc_go keystone $@
-fi
-
-#DEBHELPER#
-
 
=== modified file 'debian/keystone.templates'
--- debian/keystone.templates	2012-06-22 12:27:50 +0000
+++ debian/keystone.templates	2013-01-25 16:27:23 +0000
@@ -1,7 +1,7 @@
 Template: keystone/configure_db
 Type: boolean
 Default: false
-Description: Set up a database for keystone?
+_Description: Set up a database for keystone?
  No database has been set up for keystone to use. Before continuing,
  you should make sure you have:
  .
 
=== modified file 'debian/keystone.upstart'
--- debian/keystone.upstart	2012-06-22 12:27:50 +0000
+++ debian/keystone.upstart	2013-01-25 16:27:23 +0000
@@ -2,8 +2,10 @@
 author "Soren Hansen <[e-mail]>"
 
 start on (local-filesystems and net-device-up IFACE!=lo)
-stop on runlevel [016]
+stop on runlevel [!2345]
 
 respawn
 
-exec su -s /bin/sh -c "exec keystone-all" keystone
+exec start-stop-daemon --start --chuid keystone \
+            --chdir /var/lib/keystone --name keystone \
+            --exec /usr/bin/keystone-all
 
=== removed directory 'debian/man'
=== removed file 'debian/man/keystone-admin.8'
--- debian/man/keystone-admin.8	2012-06-22 12:27:50 +0000
+++ debian/man/keystone-admin.8	1970-01-01 00:00:00 +0000
@@ -1,63 +0,0 @@
-.TH keystone 8
-.SH NAME
-keystone-admin \- provides HTTP for administrators.
-.SH SYNOPSIS
-.I [OPTION]...
-.SH DESCRIPTION
-.BR keystone is a Python implementation of the Openstack
-identity service.
-.TP
-.B --version
-show program's version number and exit
-.TP
-.B \-h, --help
-show help messag and exit
-.TP
-.B \-v, --verbose
-Print more verbose output
-.TP
-.B \-d, --debug
-Prrint debugging output to console.
-.TP
-.B \-c PATH, --config-file=PATH
-Path to the config file to use. When not specified (the default),
-we generally look at the first arguement specified to be a config file,
-and if that is also missing, we search standard directories for a config
-file.
-.TP
-.B \-p BIND_PORT, --port=BIND_PORT, --bind-port=BIND_PORT
-Specifies port to listen on.
-.TP
-.B --host=BIND_HOST, --bind-host=BIND_HOST
-Specifies host address to listen on (default is all or 0.0.0.0)
-.TP 
-.B \-t, --trace-calls
-Turns on call tracing for troubleshooting
-.TP
-.B \-a PORT, --admin-port=PORT
-Specifies port for Admin API to listen on (default is 
-35357)
-.TP
-.B --log-config=PATH
-If this opion is specified, the logging configuration
-file specified is used and overrides any other logging
-options specified. Please see the Python logging
-modules documentation for details on logging 
-confgiuration files.
-.TP
-.B --log-date-format=FORMAT
-Format string for %(asctime)s in log records.
-Default: %Y-%m-%d %H:%M:%S
-.TP
-.B --log-file=PATH
-(Optional) Name of log file to output to. If not set,
-logging will go to stdout.
-.TP
-.B --log-didr=LOG_DIR
-(Optional) The directory to keep log files in (will
-be prepended to --logfile)
-
-.SH FILES
-.IR /etc/keystone/keystone.conf
-.SH AUTHOR
-This manual page was written by Chuck Short <[e-mail]>.
 
=== removed file 'debian/man/keystone-auth.8'
--- debian/man/keystone-auth.8	2012-06-22 12:27:50 +0000
+++ debian/man/keystone-auth.8	1970-01-01 00:00:00 +0000
@@ -1,63 +0,0 @@
-.TH keystone 8
-.SH NAME
-keystone-auth \- provides HTTP for users.
-.SH SYNOPSIS
-.I [OPTION]...
-.SH DESCRIPTION
-.BR keystone is a Python implementation of the Openstack
-identity service.
-.TP
-.B --version
-show program's version number and exit
-.TP
-.B \-h, --help
-show help messag and exit
-.TP
-.B \-v, --verbose
-Print more verbose output
-.TP
-.B \-d, --debug
-Prrint debugging output to console.
-.TP
-.B \-c PATH, --config-file=PATH
-Path to the config file to use. When not specified (the default),
-we generally look at the first arguement specified to be a config file,
-and if that is also missing, we search standard directories for a config
-file.
-.TP
-.B \-p BIND_PORT, --port=BIND_PORT, --bind-port=BIND_PORT
-Specifies port to listen on.
-.TP
-.B --host=BIND_HOST, --bind-host=BIND_HOST
-Specifies host address to listen on (default is all or 0.0.0.0)
-.TP 
-.B \-t, --trace-calls
-Turns on call tracing for troubleshooting
-.TP
-.B \-a PORT, --admin-port=PORT
-Specifies port for Admin API to listen on (default is 
-35357)
-.TP
-.B --log-config=PATH
-If this opion is specified, the logging configuration
-file specified is used and overrides any other logging
-options specified. Please see the Python logging
-modules documentation for details on logging 
-confgiuration files.
-.TP
-.B --log-date-format=FORMAT
-Format string for %(asctime)s in log records.
-Default: %Y-%m-%d %H:%M:%S
-.TP
-.B --log-file=PATH
-(Optional) Name of log file to output to. If not set,
-logging will go to stdout.
-.TP
-.B --log-didr=LOG_DIR
-(Optional) The directory to keep log files in (will
-be prepended to --logfile)
-
-.SH FILES
-.IR /etc/keystone/keystone.conf
-.SH AUTHOR
-This manual page was written by Chuck Short <[e-mail]>.
 
=== removed file 'debian/man/keystone-control.8'
--- debian/man/keystone-control.8	2012-06-22 12:27:50 +0000
+++ debian/man/keystone-control.8	1970-01-01 00:00:00 +0000
@@ -1,63 +0,0 @@
-.TH keystone 8
-.SH NAME
-keystone \- Starts/Stops keystone server.
-.SH SYNOPSIS
-.I [OPTION]...
-.SH DESCRIPTION
-.BR keystone is a Python implementation of the Openstack
-identity service.
-.TP
-.B --version
-show program's version number and exit
-.TP
-.B \-h, --help
-show help messag and exit
-.TP
-.B \-v, --verbose
-Print more verbose output
-.TP
-.B \-d, --debug
-Prrint debugging output to console.
-.TP
-.B \-c PATH, --config-file=PATH
-Path to the config file to use. When not specified (the default),
-we generally look at the first arguement specified to be a config file,
-and if that is also missing, we search standard directories for a config
-file.
-.TP
-.B \-p BIND_PORT, --port=BIND_PORT, --bind-port=BIND_PORT
-Specifies port to listen on.
-.TP
-.B --host=BIND_HOST, --bind-host=BIND_HOST
-Specifies host address to listen on (default is all or 0.0.0.0)
-.TP 
-.B \-t, --trace-calls
-Turns on call tracing for troubleshooting
-.TP
-.B \-a PORT, --admin-port=PORT
-Specifies port for Admin API to listen on (default is 
-35357)
-.TP
-.B --log-config=PATH
-If this opion is specified, the logging configuration
-file specified is used and overrides any other logging
-options specified. Please see the Python logging
-modules documentation for details on logging 
-confgiuration files.
-.TP
-.B --log-date-format=FORMAT
-Format string for %(asctime)s in log records.
-Default: %Y-%m-%d %H:%M:%S
-.TP
-.B --log-file=PATH
-(Optional) Name of log file to output to. If not set,
-logging will go to stdout.
-.TP
-.B --log-didr=LOG_DIR
-(Optional) The directory to keep log files in (will
-be prepended to --logfile)
-
-.SH FILES
-.IR /etc/keystone/keystone.conf
-.SH AUTHOR
-This manual page was written by Chuck Short <[e-mail]>.
 
=== removed file 'debian/man/keystone-import.8'
--- debian/man/keystone-import.8	2012-06-22 12:27:50 +0000
+++ debian/man/keystone-import.8	1970-01-01 00:00:00 +0000
@@ -1,12 +0,0 @@
-.TH keystone 8
-.SH NAME
-keystone-import \- import users, tenants, and EC2 credentials from nova.
-.SH SYNOPSIS
-.I [OPTION]...
-.SH DESCRIPTION
-.BR keystone is a Python implementation of the Openstack
-identity service.
-.SH FILES
-.IR /etc/keystone/keystone.conf
-.SH AUTHOR
-This manual page was written by Chuck Short <[e-mail]>.
 
=== removed file 'debian/man/keystone.8'
--- debian/man/keystone.8	2012-06-22 12:27:50 +0000
+++ debian/man/keystone.8	1970-01-01 00:00:00 +0000
@@ -1,64 +0,0 @@
-.TH keystone 8
-.SH NAME
-keystone \- provides HTTP for administrators and users.
-.SH SYNOPSIS
-.I [OPTION]...
-.SH DESCRIPTION
-.B keystone is a Python implementation of the Openstack
-.B identity service. This version has a lack of SSL support.
-.B It should not be run on a trusted network.
-.TP
-.B --version
-show program's version number and exit
-.TP
-.B \-h, --help
-show help messag and exit
-.TP
-.B \-v, --verbose
-Print more verbose output
-.TP
-.B \-d, --debug
-Prrint debugging output to console.
-.TP
-.B \-c PATH, --config-file=PATH
-Path to the config file to use. When not specified (the default),
-we generally look at the first arguement specified to be a config file,
-and if that is also missing, we search standard directories for a config
-file.
-.TP
-.B \-p BIND_PORT, --port=BIND_PORT, --bind-port=BIND_PORT
-Specifies port to listen on.
-.TP
-.B --host=BIND_HOST, --bind-host=BIND_HOST
-Specifies host address to listen on (default is all or 0.0.0.0)
-.TP 
-.B \-t, --trace-calls
-Turns on call tracing for troubleshooting
-.TP
-.B \-a PORT, --admin-port=PORT
-Specifies port for Admin API to listen on (default is 
-35357)
-.TP
-.B --log-config=PATH
-If this opion is specified, the logging configuration
-file specified is used and overrides any other logging
-options specified. Please see the Python logging
-modules documentation for details on logging 
-confgiuration files.
-.TP
-.B --log-date-format=FORMAT
-Format string for %(asctime)s in log records.
-Default: %Y-%m-%d %H:%M:%S
-.TP
-.B --log-file=PATH
-(Optional) Name of log file to output to. If not set,
-logging will go to stdout.
-.TP
-.B --log-didr=LOG_DIR
-(Optional) The directory to keep log files in (will
-be prepended to --logfile)
-
-.SH FILES
-.IR /etc/keystone/keystone.conf
-.SH AUTHOR
-This manual page was written by Chuck Short <[e-mail]>.
 
=== modified file 'debian/patches/fix-ubuntu-tests.patch'
--- debian/patches/fix-ubuntu-tests.patch	2012-11-23 09:01:53 +0000
+++ debian/patches/fix-ubuntu-tests.patch	2013-01-25 16:27:23 +0000
@@ -1,6 +1,16 @@
-diff -Naurp keystone-2013.1.orig/tests/test_keystoneclient.py keystone-2013.1/tests/test_keystoneclient.py
---- keystone-2013.1.orig/tests/test_keystoneclient.py	2012-11-22 03:19:01.000000000 -0600
-+++ keystone-2013.1/tests/test_keystoneclient.py	2012-11-22 10:24:20.729138227 -0600
+Description: Fix test execution during package build
+ The keystoneclient testsuite includes a number of tests
+ for older version of keystone which are retrieved from
+ the upstream source repo during testing.
+ .
+ This is not possible during an offline package build so
+ the checkout and tests are disabled/skipped.
+Author: Chuck Short <[e-mail]>
+Author: James Page <[e-mail]>
+Forwarded: not-needed
+
+--- a/tests/test_keystoneclient.py
++++ b/tests/test_keystoneclient.py
 @@ -35,10 +35,6 @@ class CompatTestCase(test.TestCase):
      def setUp(self):
          super(CompatTestCase, self).setUp()
@@ -12,3 +22,28 @@
          self.load_backends()
          self.load_fixtures(default_fixtures)
  
+@@ -1003,6 +999,16 @@ class KcMasterTestCase(CompatTestCase, K
+         client.tenants.list()
+ 
+ 
++def skipped(func):
++    from nose.plugins.skip import SkipTest
++
++    def _():
++        raise SkipTest("Test %s is skipped" % func.__name__)
++    _.__name__ = func.__name__
++    return _
++
++
++@skipped
+ class KcEssex3TestCase(CompatTestCase, KeystoneClientTests):
+     def get_checkout(self):
+         return KEYSTONECLIENT_REPO, 'essex-3'
+@@ -1101,6 +1107,7 @@ class KcEssex3TestCase(CompatTestCase, K
+         raise nose.exc.SkipTest('N/A')
+ 
+ 
++@skipped
+ class Kc11TestCase(CompatTestCase, KeystoneClientTests):
+     def get_checkout(self):
+         return KEYSTONECLIENT_REPO, '0.1.1'
 
=== added directory 'debian/po'
=== added file 'debian/po/POTFILES.in'
--- debian/po/POTFILES.in	1970-01-01 00:00:00 +0000
+++ debian/po/POTFILES.in	2013-01-25 16:27:23 +0000
@@ -0,0 +1,1 @@
+[type: gettext/rfc822deb] keystone.templates
 
=== added file 'debian/po/templates.pot'
--- debian/po/templates.pot	1970-01-01 00:00:00 +0000
+++ debian/po/templates.pot	2013-01-25 16:27:23 +0000
@@ -0,0 +1,58 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: keystone\n"
+"Report-Msgid-Bugs-To: [e-mail]\n"
+"POT-Creation-Date: 2012-11-25 22:21+0000\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <[e-mail]>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: boolean
+#. Description
+#: ../keystone.templates:1001
+msgid "Set up a database for keystone?"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../keystone.templates:1001
+msgid ""
+"No database has been set up for keystone to use. Before continuing, you "
+"should make sure you have:"
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../keystone.templates:1001
+msgid ""
+" - the server host name (that server must allow TCP connections\n"
+"   from this machine);\n"
+" - a username and password to access the database.\n"
+" - A database type that you want to use."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../keystone.templates:1001
+msgid ""
+"If some of these requirements are missing, reject this option and run with "
+"regular sqlite support."
+msgstr ""
+
+#. Type: boolean
+#. Description
+#: ../keystone.templates:1001
+msgid ""
+"Database configuration can be reconfigured later by running 'dpkg-"
+"reconfigure -plow keystone'."
+msgstr ""
 
=== modified file 'debian/rules'
--- debian/rules	2012-11-23 09:01:53 +0000
+++ debian/rules	2013-01-25 16:27:23 +0000
@@ -26,7 +26,7 @@
 	cp tests/test_overrides.conf tests/test_overrides.conf.orig
 	cp $(CURDIR)/debian/tests/test_overrides.conf $(CURDIR)/tests/test_overrides.conf
 	sed -i 's|%CUR_DIR%|$(CURDIR)|g' $(CURDIR)/tests/test_overrides.conf
-	PYTHONPATH=$(CURDIR) bash run_tests.sh -N || true
+	PYTHONPATH=$(CURDIR) bash run_tests.sh -N
 	mv $(CURDIR)/tests/test_overrides.conf.orig $(CURDIR)/tests/test_overrides.conf
 	rm -rf $(CURDIR)/debian/tests/testing.db $(CURDIR)/debian/tests/keystone-signing
 endif
 
=== modified file 'debian/tests/test_overrides.conf'
--- debian/tests/test_overrides.conf	2012-11-02 13:48:49 +0000
+++ debian/tests/test_overrides.conf	2013-01-25 16:27:23 +0000
@@ -13,6 +13,6 @@
 idle_timeout = 200
 
 [signing]
-certfile = signing/signing_cert.pem
-keyfile = signing/private_key.pem
-ca_certs = signing/cacert.pem
+certfile = ../examples/pki/certs/signing_cert.pem
+keyfile = ../examples/pki/private/signing_key.pem
+ca_certs = ../examples/pki/certs/cacert.pem
 
=== modified file 'doc/source/configuration.rst'
--- doc/source/configuration.rst	2012-11-23 09:01:53 +0000
+++ doc/source/configuration.rst	2013-01-25 16:27:23 +0000
@@ -388,10 +388,10 @@
 * ``etc/logging.conf.sample``
 * ``etc/default_catalog.templates``
 
-.. _`prepare your Essex deployment`:
+.. _`prepare your deployment`:
 
-Preparing your Essex deployment
-===============================
+Preparing your deployment
+=========================
 
 Step 1: Configure keystone.conf
 -------------------------------
@@ -450,9 +450,9 @@
 .. NOTE::
 
     Before you can import your legacy data, you must first
-    `prepare your Essex deployment`_.
+    `prepare your deployment`_.
 
-Step 1: Ensure your Essex deployment can access your legacy database
+Step 1: Ensure your deployment can access your legacy database
 --------------------------------------------------------------------
 
 Your legacy ``keystone.conf`` contains a SQL configuration section called
@@ -461,7 +461,7 @@
 
     sql_connection = sqlite:///keystone.db
 
-This connection string needs to be accessible from your Essex deployment (e.g.
+This connection string needs to be accessible from your deployment (e.g.
 you may need to copy your SQLite ``*.db`` file to a new server, adjust the
 relative path as appropriate, or open a firewall for MySQL, etc).
 
@@ -474,7 +474,7 @@
     $ keystone-manage import_legacy <sql_connection>
 
 You should now be able to run the same command you used to test your new
-database above, but now you'll see your legacy Keystone data in Essex::
+database above, but now you'll see your legacy Keystone data::
 
     $ keystone --token ADMIN --endpoint http://127.0.0.1:35357/v2.0/ tenant-list
     +----------------------------------+----------------+---------+
@@ -491,7 +491,7 @@
 ===============================================================
 
 While legacy Keystone deployments stored the service catalog in the database,
-the service catalog in Essex is stored in a flat ``template_file``. An example
+the service catalog is stored in a flat ``template_file``. An example
 service catalog template file may be found in
 ``etc/default_catalog.templates``. You can change the path to your service
 catalog template in ``keystone.conf`` by changing the value of
@@ -510,13 +510,13 @@
 ========================
 
 Migration of users, projects (aka tenants), roles and EC2 credentials
-is supported for the Essex release of Nova. To migrate your auth
+is supported for the Essex and later releases of Nova. To migrate your auth
 data from Nova, use the following steps:
 
 .. NOTE::
 
     Before you can migrate from nova auth, you must first
-    `prepare your Essex deployment`_.
+    `prepare your deployment`_.
 
 Step 1: Export your data from Nova
 ----------------------------------
 
=== modified file 'doc/source/configuringservices.rst'
--- doc/source/configuringservices.rst	2012-09-07 13:04:01 +0000
+++ doc/source/configuringservices.rst	2013-01-25 16:27:23 +0000
@@ -176,151 +176,8 @@
 ---------------------------------
 
 Similar to Nova, swift can be configured to use Keystone for authentication
-rather than its built in 'tempauth'.
-
-1. Add a service endpoint for Swift to Keystone
-
-2. Configure the paste file for swift-proxy (`/etc/swift/swift-proxy.conf`)
-
-3. Reconfigure Swift's proxy server to use Keystone instead of TempAuth.
-   Here's an example `/etc/swift/proxy-server.conf`::
-
-    [DEFAULT]
-    bind_port = 8888
-    user = <user>
-
-    [pipeline:main]
-    pipeline = catch_errors healthcheck cache authtoken keystone proxy-server
-
-    [app:proxy-server]
-    use = egg:swift#proxy
-    account_autocreate = true
-
-    [filter:keystone]
-    paste.filter_factory = keystone.middleware.swift_auth:filter_factory
-    operator_roles = admin, swiftoperator
-
-    [filter:authtoken]
-    paste.filter_factory = keystone.middleware.auth_token:filter_factory
-    # Delaying the auth decision is required to support token-less
-    # usage for anonymous referrers ('.r:*') or for tempurl/formpost
-    # middleware.
-    delay_auth_decision = 1
-    auth_port = 35357
-    auth_host = 127.0.0.1
-    auth_token = ADMIN
-    admin_token = ADMIN
-
-    [filter:cache]
-    use = egg:swift#memcache
-    set log_name = cache
-
-    [filter:catch_errors]
-    use = egg:swift#catch_errors
-
-    [filter:healthcheck]
-    use = egg:swift#healthcheck
-
-.. Note::
-   Your user needs to have the role swiftoperator or admin by default
-   to be able to operate on an swift account or as specified by the
-   variable `operator_roles`.
-
-4. Restart swift
-
-5. Verify that keystone is providing authentication to Swift
-
-    $ swift -V 2 -A http://localhost:5000/v2.0 -U admin:admin -K ADMIN stat
-
-.. NOTE::
-   Instead of connecting to Swift here, as you would with other services, we
-   are connecting directly to Keystone.
-
-Configuring Swift with S3 emulation to use Keystone
----------------------------------------------------
-
-Keystone supports validating S3 tokens using the same tokens as the
-generated EC2 tokens. When you have generated a pair of EC2 access
-token and secret you can access your swift cluster directly with the
-S3 API.
-
-1. Ensure you have defined the S3 service in your `keystone.conf`. First, define the filter as follows::
-
-    [filter:s3_extension]
-    paste.filter_factory = keystone.contrib.s3:S3Extension.factory
-
-Then, ensure that the filter is being called by the admin_api pipeline, as follows::
-
-    [pipeline:admin_api]
-    pipeline = token_auth [....] ec2_extension s3_extension [...]
-
-2. Configure the paste file for swift-proxy
-   (`/etc/swift/swift-proxy.conf` to use S3token and Swift3
-   middleware.
-
-   Here's an example that by default communicates with keystone via https ::
-
-    [DEFAULT]
-    bind_port = 8080
-    user = <user>
-
-    [pipeline:main]
-    pipeline = catch_errors healthcheck cache swift3 s3token authtoken keystone proxy-server
-
-    [app:proxy-server]
-    use = egg:swift#proxy
-    account_autocreate = true
-
-    [filter:catch_errors]
-    use = egg:swift#catch_errors
-
-    [filter:healthcheck]
-    use = egg:swift#healthcheck
-
-    [filter:cache]
-    use = egg:swift#memcache
-
-    [filter:swift3]
-    use = egg:swift#swift3
-
-    [filter:keystone]
-    paste.filter_factory = keystone.middleware.swift_auth:filter_factory
-    operator_roles = admin, swiftoperator
-
-    [filter:s3token]
-    paste.filter_factory = keystone.middleware.s3_token:filter_factory
-    # uncomment the following line if you don't want to use SSL
-    # auth_protocol = http
-    auth_port = 35357
-    auth_host = 127.0.0.1
-
-    [filter:authtoken]
-    paste.filter_factory = keystone.middleware.auth_token:filter_factory
-    # uncomment the following line if you don't want to use SSL
-    # auth_protocol = http
-    auth_port = 35357
-    auth_host = 127.0.0.1
-    auth_token = ADMIN
-    admin_token = ADMIN
-
-3. You can then access directly your Swift via the S3 API, here's an
-   example with the `boto` library::
-
-    import boto
-    import boto.s3.connection
-
-    connection = boto.connect_s3(
-        aws_access_key_id='<ec2 access key for user>',
-        aws_secret_access_key='<ec2 secret access key for user>',
-        port=8080,
-        host='localhost',
-        is_secure=False,
-        calling_format=boto.s3.connection.OrdinaryCallingFormat())
-
-
-.. Note::
-   With the S3 middleware you are connecting to the `Swift` proxy and
-   not to `keystone`.
+rather than its built in 'tempauth'. Refer to the `overview_auth` documentation
+in Swift. 
 
 Auth-Token Middleware with Username and Password
 ------------------------------------------------
 
=== added file 'doc/source/external-auth.rst'
--- doc/source/external-auth.rst	1970-01-01 00:00:00 +0000
+++ doc/source/external-auth.rst	2013-01-25 16:27:23 +0000
@@ -0,0 +1,117 @@
+===========================================
+Using external authentication with Keystone
+===========================================
+
+When Keystone is executed in :doc:`HTTPD <apache-httpd>` it is possible to
+use external authentication methods different from the authentication
+provided by the identity store backend. For example, this makes possible to
+use a SQL identity backend together with X.509 authentication, Kerberos, etc.
+instead of using the username/password combination.
+
+Using HTTPD authentication
+==========================
+
+Webservers like Apache HTTP support many methods of authentication. Keystone can
+profit from this feature and let the authentication be done in the webserver,
+that will pass down the authenticated user to Keystone using the ``REMOTE_USER``
+environment variable. This user must exist in advance in the identity backend
+so as to get a token from the controller.
+
+To use this method, Keystone should be running on :doc:`HTTPD <apache-httpd>`.
+
+X.509 example
+-------------
+
+The following snippet for the Apache conf will authenticate the user based on
+a valid X.509 certificate from a known CA::
+
+    <VirtualHost _default_:5000>
+        SSLEngine on
+        SSLCertificateFile    /etc/ssl/certs/ssl.cert
+        SSLCertificateKeyFile /etc/ssl/private/ssl.key
+
+        SSLCACertificatePath /etc/ssl/allowed_cas
+        SSLCARevocationPath  /etc/ssl/allowed_cas
+        SSLUserName          SSL_CLIENT_S_DN_CN
+        SSLVerifyClient      require
+        SSLVerifyDepth       10
+
+        (...)
+    </VirtualHost>
+
+Developing a WSGI middleware for authentication
+===============================================
+
+In addition to the method described above, it is possible to implement other
+custom authentication mechanisms using the ``REMOTE_USER`` WSGI environment
+variable.
+
+.. ATTENTION::
+    Please note that even if it is possible to develop a custom authentication
+    module, it is preferable to use the modules in the HTTPD server. Such
+    authentication modules in webservers like Apache have normally undergone
+    years of development and use in production systems and are actively maintained
+    upstream. Developing a custom authentication module that implements the same
+    authentication as an existing Apache module likely introduces a higher
+    security risk.
+
+If you find you must implement a custom authentication mechanism, you will need
+to develop a custom WSGI middleware pipeline component. This middleware should
+set the environment variable ``REMOTE_USER`` to the authenticated username.
+Keystone then will assume that the user has been already authenticated upstream
+and will not try to authenticate it. However, as with HTTPD authentication, the
+user must exist in advance in the identity backend so that a proper token can
+be issued.
+
+Your code should set the ``REMOTE_USER`` if the user is properly authenticated,
+following the semantics below::
+
+    class MyMiddlewareAuth(wsgi.Middleware):
+        def __init__(self, *args, **kwargs):
+            super(MyMiddlewareAuth, self).__init__(*args, **kwargs)
+
+        def process_request(self, request):
+            if request.environ.get('REMOTE_USER', None) is not None:
+                # Assume that it is authenticated upstream
+                return self.application
+
+            if not self.is_auth_applicable(request):
+                # Not applicable
+                return self.application
+
+            username = self.do_auth(request):
+            if username is not None:
+                # User is authenticated
+                request.environ['REMOTE_USER'] = username
+            else:
+                # User is not authenticated
+                raise exception.Unauthorized("Invalid user")
+
+
+Pipeline configuration
+----------------------
+
+Once you have your WSGI middleware component developed you have to add it to
+your pipeline. The first step is to add the middleware to your configuration file.
+Assuming that your middleware module is ``keystone.middleware.MyMiddlewareAuth``,
+you can configure it in your ``keystone.conf`` as::
+
+    [filter:my_auth]
+    paste.filter_factory = keystone.middleware.MyMiddlewareAuth.factory
+
+The second step is to add your middleware to the pipeline. The exact place where
+you should place it will depend on your code (i.e. if you need for example that
+the request body is converted from JSON before perform the authentication you
+should place it after the ``json_body`` filter) but it should be set before the
+``public_service`` (for the ``public_api`` pipeline) or ``admin_service`` (for
+the ``admin_api`` pipeline), since they consume authentication.
+
+For example, if the original pipeline looks like this::
+
+    [pipeline:public_api]
+    pipeline = stats_monitoring url_normalize token_auth admin_token_auth xml_body json_body debug ec2_extension user_crud_extension public_service
+
+Your modified pipeline might then look like this::
+
+    [pipeline:public_api]
+    pipeline = stats_monitoring url_normalize token_auth admin_token_auth xml_body json_body my_auth debug ec2_extension user_crud_extension public_service
 
=== modified file 'doc/source/index.rst'
--- doc/source/index.rst	2012-11-23 09:01:53 +0000
+++ doc/source/index.rst	2013-01-25 16:27:23 +0000
@@ -66,6 +66,7 @@
    middlewarearchitecture
    api_curl_examples
    apache-httpd
+   external-auth
 
 Code Documentation
 ==================
 
=== modified file 'doc/source/setup.rst'
--- doc/source/setup.rst	2012-03-16 11:19:40 +0000
+++ doc/source/setup.rst	2013-01-25 16:27:23 +0000
@@ -70,7 +70,7 @@
 
 The first is the list of dependencies needed for running keystone, the second list includes dependencies used for active development and testing of keystone itself.
 
-These depdendencies can be installed from PyPi_ using the python tool pip_.
+These dependencies can be installed from PyPi_ using the python tool pip_.
 
 .. _PyPi: http://pypi.python.org/
 .. _pip: http://pypi.python.org/pypi/pip
 
=== modified file 'keystone.egg-info/SOURCES.txt'
--- keystone.egg-info/SOURCES.txt	2012-11-23 09:01:53 +0000
+++ keystone.egg-info/SOURCES.txt	2013-01-25 16:27:23 +0000
@@ -26,6 +26,7 @@
 doc/source/configuration.rst
 doc/source/configuringservices.rst
 doc/source/developing.rst
+doc/source/external-auth.rst
 doc/source/index.rst
 doc/source/installing.rst
 doc/source/middlewarearchitecture.rst
@@ -81,7 +82,9 @@
 keystone/clean.py
 keystone/cli.py
 keystone/config.py
+keystone/controllers.py
 keystone/exception.py
+keystone/routers.py
 keystone/service.py
 keystone/test.py
 keystone.egg-info/PKG-INFO
@@ -91,7 +94,9 @@
 keystone.egg-info/requires.txt
 keystone.egg-info/top_level.txt
 keystone/catalog/__init__.py
+keystone/catalog/controllers.py
 keystone/catalog/core.py
+keystone/catalog/routers.py
 keystone/catalog/backends/__init__.py
 keystone/catalog/backends/kvs.py
 keystone/catalog/backends/sql.py
@@ -100,12 +105,14 @@
 keystone/common/bufferedhttp.py
 keystone/common/cms.py
 keystone/common/controller.py
+keystone/common/dependency.py
 keystone/common/kvs.py
 keystone/common/logging.py
 keystone/common/manager.py
 keystone/common/models.py
 keystone/common/openssl.py
 keystone/common/policy.py
+keystone/common/router.py
 keystone/common/serializer.py
 keystone/common/systemd.py
 keystone/common/utils.py
@@ -127,13 +134,19 @@
 keystone/common/sql/migrate_repo/versions/002_sqlite_downgrade.sql
 keystone/common/sql/migrate_repo/versions/002_sqlite_upgrade.sql
 keystone/common/sql/migrate_repo/versions/002_token_id_hash.py
-keystone/common/sql/migrate_repo/versions/003_sqlite_downgrade.sql
 keystone/common/sql/migrate_repo/versions/003_sqlite_upgrade.sql
 keystone/common/sql/migrate_repo/versions/003_token_valid.py
 keystone/common/sql/migrate_repo/versions/004_undo_token_id_hash.py
 keystone/common/sql/migrate_repo/versions/005_set_utf8_character_set.py
 keystone/common/sql/migrate_repo/versions/006_add_policy_table.py
 keystone/common/sql/migrate_repo/versions/007_add_domain_tables.py
+keystone/common/sql/migrate_repo/versions/008_normalize_identity.py
+keystone/common/sql/migrate_repo/versions/008_sqlite_downgrade.sql
+keystone/common/sql/migrate_repo/versions/009_normalize_identity_migration.py
+keystone/common/sql/migrate_repo/versions/010_endpoints_v3.py
+keystone/common/sql/migrate_repo/versions/011_populate_endpoint_type.py
+keystone/common/sql/migrate_repo/versions/012_drop_legacy_endpoints.py
+keystone/common/sql/migrate_repo/versions/013_add_group_tables.py
 keystone/common/sql/migrate_repo/versions/__init__.py
 keystone/contrib/__init__.py
 keystone/contrib/admin_crud/__init__.py
@@ -152,7 +165,9 @@
 keystone/contrib/user_crud/__init__.py
 keystone/contrib/user_crud/core.py
 keystone/identity/__init__.py
+keystone/identity/controllers.py
 keystone/identity/core.py
+keystone/identity/routers.py
 keystone/identity/backends/__init__.py
 keystone/identity/backends/kvs.py
 keystone/identity/backends/pam.py
@@ -161,13 +176,13 @@
 keystone/identity/backends/ldap/core.py
 keystone/locale/keystone.pot
 keystone/locale/ca/LC_MESSAGES/keystone.po
+keystone/locale/hu/LC_MESSAGES/keystone.po
 keystone/locale/ja/LC_MESSAGES/keystone.po
 keystone/middleware/__init__.py
 keystone/middleware/auth_token.py
 keystone/middleware/core.py
 keystone/middleware/ec2_token.py
 keystone/middleware/s3_token.py
-keystone/middleware/swift_auth.py
 keystone/openstack/__init__.py
 keystone/openstack/common/README
 keystone/openstack/common/__init__.py
@@ -178,12 +193,16 @@
 keystone/openstack/common/setup.py
 keystone/openstack/common/timeutils.py
 keystone/policy/__init__.py
+keystone/policy/controllers.py
 keystone/policy/core.py
+keystone/policy/routers.py
 keystone/policy/backends/__init__.py
 keystone/policy/backends/rules.py
 keystone/policy/backends/sql.py
 keystone/token/__init__.py
+keystone/token/controllers.py
 keystone/token/core.py
+keystone/token/routers.py
 keystone/token/backends/__init__.py
 keystone/token/backends/kvs.py
 keystone/token/backends/memcache.py
@@ -203,6 +222,7 @@
 tests/legacy_essex.mysql
 tests/legacy_essex.sqlite
 tests/policy.json
+tests/test_auth.py
 tests/test_auth_token_middleware.py
 tests/test_backend.py
 tests/test_backend_kvs.py
@@ -213,8 +233,11 @@
 tests/test_backend_templated.py
 tests/test_cert_setup.py
 tests/test_content_types.py
+tests/test_contrib_s3_core.py
+tests/test_drivers.py
 tests/test_exception.py
 tests/test_import_legacy.py
+tests/test_injection.py
 tests/test_keystoneclient.py
 tests/test_keystoneclient_sql.py
 tests/test_middleware.py
@@ -223,12 +246,10 @@
 tests/test_policy.py
 tests/test_s3_token_middleware.py
 tests/test_serializer.py
-tests/test_service.py
 tests/test_setup.py
 tests/test_singular_plural.py
 tests/test_sql_upgrade.py
 tests/test_ssl.py
-tests/test_swift_auth_middleware.py
 tests/test_url_middleware.py
 tests/test_utils.py
 tests/test_v3.py
@@ -238,6 +259,7 @@
 tests/test_versions.py
 tests/test_wsgi.py
 tools/convert_to_sqlite.sh
+tools/flakes.py
 tools/install_venv.py
 tools/pip-requires
 tools/sample_data.sh
 
=== modified file 'keystone.egg-info/requires.txt'
--- keystone.egg-info/requires.txt	2012-11-23 09:01:53 +0000
+++ keystone.egg-info/requires.txt	2013-01-25 16:27:23 +0000
@@ -1,5 +1,5 @@
 pam==0.1.4
-WebOb==1.0.8
+WebOb==1.2.3
 eventlet
 greenlet
 PasteDeploy
 
=== modified file 'keystone/catalog/__init__.py'
--- keystone/catalog/__init__.py	2012-03-16 11:19:40 +0000
+++ keystone/catalog/__init__.py	2013-01-25 16:27:23 +0000
@@ -15,3 +15,5 @@
 # under the License.
 
 from keystone.catalog.core import *
+from keystone.catalog import controllers
+from keystone.catalog import routers
 
=== modified file 'keystone/catalog/backends/sql.py'
--- keystone/catalog/backends/sql.py	2012-11-23 09:01:53 +0000
+++ keystone/catalog/backends/sql.py	2013-01-25 16:27:23 +0000
@@ -36,12 +36,14 @@
 
 class Endpoint(sql.ModelBase, sql.DictBase):
     __tablename__ = 'endpoint'
-    attributes = ['id', 'region', 'service_id']
+    attributes = ['id', 'interface', 'region', 'service_id', 'url']
     id = sql.Column(sql.String(64), primary_key=True)
+    interface = sql.Column(sql.String(8), primary_key=True)
     region = sql.Column('region', sql.String(255))
     service_id = sql.Column(sql.String(64),
                             sql.ForeignKey('service.id'),
                             nullable=False)
+    url = sql.Column(sql.Text())
     extra = sql.Column(sql.JsonBlob())
 
 
@@ -88,7 +90,9 @@
             old_dict = ref.to_dict()
             old_dict.update(service_ref)
             new_service = Service.from_dict(old_dict)
-            ref.type = new_service.type
+            for attr in Service.attributes:
+                if attr != 'id':
+                    setattr(ref, attr, getattr(new_service, attr))
             ref.extra = new_service.extra
             session.flush()
         return ref.to_dict()
@@ -132,8 +136,9 @@
             old_dict = ref.to_dict()
             old_dict.update(endpoint_ref)
             new_endpoint = Endpoint.from_dict(old_dict)
-            ref.service_id = new_endpoint.service_id
-            ref.region = new_endpoint.region
+            for attr in Endpoint.attributes:
+                if attr != 'id':
+                    setattr(ref, attr, getattr(new_endpoint, attr))
             ref.extra = new_endpoint.extra
             session.flush()
         return ref.to_dict()
@@ -142,25 +147,28 @@
         d = dict(CONF.iteritems())
         d.update({'tenant_id': tenant_id,
                   'user_id': user_id})
+
         catalog = {}
-
-        endpoints = self.list_endpoints()
-        for ep in endpoints:
-            service = self.get_service(ep['service_id'])
-            srv_type = service['type']
-            srv_name = service['name']
-            region = ep['region']
-
-            if region not in catalog:
-                catalog[region] = {}
-
-            catalog[region][srv_type] = {}
-
-            srv_type = catalog[region][srv_type]
-            srv_type['id'] = ep['id']
-            srv_type['name'] = srv_name
-            srv_type['publicURL'] = core.format_url(ep.get('publicurl', ''), d)
-            srv_type['internalURL'] = core.format_url(ep.get('internalurl'), d)
-            srv_type['adminURL'] = core.format_url(ep.get('adminurl'), d)
+        services = {}
+        for endpoint in self.list_endpoints():
+            # look up the service
+            services.setdefault(
+                endpoint['service_id'],
+                self.get_service(endpoint['service_id']))
+            service = services[endpoint['service_id']]
+
+            # add the endpoint to the catalog if it's not already there
+            catalog.setdefault(endpoint['region'], {})
+            catalog[endpoint['region']].setdefault(
+                service['type'], {
+                    'id': endpoint['id'],
+                    'name': service['name'],
+                    'publicURL': '',  # this may be overridden, but must exist
+                })
+
+            # add the interface's url
+            url = core.format_url(endpoint.get('url'), d)
+            interface_url = '%sURL' % endpoint['interface']
+            catalog[endpoint['region']][service['type']][interface_url] = url
 
         return catalog
 
=== modified file 'keystone/catalog/backends/templated.py'
--- keystone/catalog/backends/templated.py	2012-11-02 13:48:49 +0000
+++ keystone/catalog/backends/templated.py	2013-01-25 16:27:23 +0000
@@ -106,7 +106,7 @@
         try:
             self.templates = parse_templates(open(template_file))
         except IOError:
-            LOG.critical('Unable to open template file %s' % template_file)
+            LOG.critical(_('Unable to open template file %s') % template_file)
             raise
 
     def get_catalog(self, user_id, tenant_id, metadata=None):
 
=== added file 'keystone/catalog/controllers.py'
--- keystone/catalog/controllers.py	1970-01-01 00:00:00 +0000
+++ keystone/catalog/controllers.py	2013-01-25 16:27:23 +0000
@@ -0,0 +1,184 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2012 OpenStack LLC
+# Copyright 2012 Canonical Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import uuid
+
+from keystone.common import controller
+from keystone.common import dependency
+from keystone import exception
+
+
+INTERFACES = ['public', 'internal', 'admin']
+
+
[e-mail]('catalog_api')
+class Service(controller.V2Controller):
+    def get_services(self, context):
+        self.assert_admin(context)
+        service_list = self.catalog_api.list_services(context)
+        return {'OS-KSADM:services': service_list}
+
+    def get_service(self, context, service_id):
+        self.assert_admin(context)
+        service_ref = self.catalog_api.get_service(context, service_id)
+        return {'OS-KSADM:service': service_ref}
+
+    def delete_service(self, context, service_id):
+        self.assert_admin(context)
+        self.catalog_api.delete_service(context, service_id)
+
+    def create_service(self, context, OS_KSADM_service):
+        self.assert_admin(context)
+        service_id = uuid.uuid4().hex
+        service_ref = OS_KSADM_service.copy()
+        service_ref['id'] = service_id
+        new_service_ref = self.catalog_api.create_service(
+            context, service_id, service_ref)
+        return {'OS-KSADM:service': new_service_ref}
+
+
[e-mail]('catalog_api')
+class Endpoint(controller.V2Controller):
+    def get_endpoints(self, context):
+        """Merge matching v3 endpoint refs into legacy refs."""
+        self.assert_admin(context)
+        legacy_endpoints = {}
+        for endpoint in self.catalog_api.list_endpoints(context):
+            if not endpoint['legacy_endpoint_id']:
+                # endpoints created in v3 should not appear on the v2 API
+                continue
+
+            # is this is a legacy endpoint we haven't indexed yet?
+            if endpoint['legacy_endpoint_id'] not in legacy_endpoints:
+                legacy_ep = endpoint.copy()
+                legacy_ep['id'] = legacy_ep.pop('legacy_endpoint_id')
+                legacy_ep.pop('interface')
+                legacy_ep.pop('url')
+
+                legacy_endpoints[endpoint['legacy_endpoint_id']] = legacy_ep
+            else:
+                legacy_ep = legacy_endpoints[endpoint['legacy_endpoint_id']]
+
+            # add the legacy endpoint with an interface url
+            legacy_ep['%surl' % endpoint['interface']] = endpoint['url']
+        return {'endpoints': legacy_endpoints.values()}
+
+    def create_endpoint(self, context, endpoint):
+        """Create three v3 endpoint refs based on a legacy ref."""
+        self.assert_admin(context)
+
+        legacy_endpoint_ref = endpoint.copy()
+
+        urls = dict((i, endpoint.pop('%surl' % i)) for i in INTERFACES)
+        legacy_endpoint_id = uuid.uuid4().hex
+        for interface, url in urls.iteritems():
+            endpoint_ref = endpoint.copy()
+            endpoint_ref['id'] = uuid.uuid4().hex
+            endpoint_ref['legacy_endpoint_id'] = legacy_endpoint_id
+            endpoint_ref['interface'] = interface
+            endpoint_ref['url'] = url
+
+            self.catalog_api.create_endpoint(
+                context, endpoint_ref['id'], endpoint_ref)
+
+        legacy_endpoint_ref['id'] = legacy_endpoint_id
+        return {'endpoint': legacy_endpoint_ref}
+
+    def delete_endpoint(self, context, endpoint_id):
+        """Delete up to three v3 endpoint refs based on a legacy ref ID."""
+        self.assert_admin(context)
+
+        deleted_at_least_one = False
+        for endpoint in self.catalog_api.list_endpoints(context):
+            if endpoint['legacy_endpoint_id'] == endpoint_id:
+                self.catalog_api.delete_endpoint(context, endpoint['id'])
+                deleted_at_least_one = True
+
+        if not deleted_at_least_one:
+            raise exception.EndpointNotFound(endpoint_id=endpoint_id)
+
+
[e-mail]('catalog_api')
+class ServiceV3(controller.V3Controller):
+    @controller.protected
+    def create_service(self, context, service):
+        ref = self._assign_unique_id(self._normalize_dict(service))
+        self._require_attribute(ref, 'type')
+
+        ref = self.catalog_api.create_service(context, ref['id'], ref)
+        return {'service': ref}
+
+    @controller.protected
+    def list_services(self, context):
+        refs = self.catalog_api.list_services(context)
+        refs = self._filter_by_attribute(context, refs, 'type')
+        return {'services': self._paginate(context, refs)}
+
+    @controller.protected
+    def get_service(self, context, service_id):
+        ref = self.catalog_api.get_service(context, service_id)
+        return {'service': ref}
+
+    @controller.protected
+    def update_service(self, context, service_id, service):
+        self._require_matching_id(service_id, service)
+
+        ref = self.catalog_api.update_service(context, service_id, service)
+        return {'service': ref}
+
+    @controller.protected
+    def delete_service(self, context, service_id):
+        return self.catalog_api.delete_service(context, service_id)
+
+
[e-mail]('catalog_api')
+class EndpointV3(controller.V3Controller):
+    @controller.protected
+    def create_endpoint(self, context, endpoint):
+        ref = self._assign_unique_id(self._normalize_dict(endpoint))
+        self._require_attribute(ref, 'service_id')
+        self._require_attribute(ref, 'interface')
+        self.catalog_api.get_service(context, ref['service_id'])
+
+        ref = self.catalog_api.create_endpoint(context, ref['id'], ref)
+        return {'endpoint': ref}
+
+    @controller.protected
+    def list_endpoints(self, context):
+        refs = self.catalog_api.list_endpoints(context)
+        refs = self._filter_by_attribute(context, refs, 'service_id')
+        refs = self._filter_by_attribute(context, refs, 'interface')
+        return {'endpoints': self._paginate(context, refs)}
+
+    @controller.protected
+    def get_endpoint(self, context, endpoint_id):
+        ref = self.catalog_api.get_endpoint(context, endpoint_id)
+        return {'endpoint': ref}
+
+    @controller.protected
+    def update_endpoint(self, context, endpoint_id, endpoint):
+        self._require_matching_id(endpoint_id, endpoint)
+
+        if 'service_id' in endpoint:
+            self.catalog_api.get_service(context, endpoint['service_id'])
+
+        ref = self.catalog_api.update_endpoint(context, endpoint_id, endpoint)
+        return {'endpoint': ref}
+
+    @controller.protected
+    def delete_endpoint(self, context, endpoint_id):
+        return self.catalog_api.delete_endpoint(context, endpoint_id)
 
=== modified file 'keystone/catalog/core.py'
--- keystone/catalog/core.py	2012-11-23 09:01:53 +0000
+++ keystone/catalog/core.py	2013-01-25 16:27:23 +0000
@@ -17,17 +17,11 @@
 
 """Main entry point into the Catalog service."""
 
-import uuid
-
-from keystone.common import controller
+from keystone.common import dependency
 from keystone.common import logging
 from keystone.common import manager
-from keystone.common import wsgi
 from keystone import config
 from keystone import exception
-from keystone import identity
-from keystone import policy
-from keystone import token
 
 
 CONF = config.CONF
@@ -41,21 +35,24 @@
     except AttributeError:
         return None
     except KeyError as e:
-        LOG.error("Malformed endpoint %s - unknown key %s" %
-                  (url, str(e)))
+        LOG.error(_("Malformed endpoint %(url)s - unknown key %(keyerror)s") %
+                  {"url": url,
+                   "keyerror": str(e)})
         raise exception.MalformedEndpoint(endpoint=url)
     except TypeError as e:
-        LOG.error("Malformed endpoint %s - type mismatch %s \
-                  (are you missing brackets ?)" %
-                  (url, str(e)))
+        LOG.error(_("Malformed endpoint %(url)s - unknown key %(keyerror)s"
+                    "(are you missing brackets ?)") %
+                  {"url": url,
+                   "keyerror": str(e)})
         raise exception.MalformedEndpoint(endpoint=url)
     except ValueError as e:
-        LOG.error("Malformed endpoint %s - incomplete format \
-                  (are you missing a type notifier ?)" % url)
+        LOG.error(_("Malformed endpoint %s - incomplete format \
+                  (are you missing a type notifier ?)") % url)
         raise exception.MalformedEndpoint(endpoint=url)
     return result
 
 
[e-mail]('catalog_api')
 class Manager(manager.Manager):
     """Default pivot point for the Catalog backend.
 
@@ -216,132 +213,3 @@
 
         """
         raise exception.NotImplemented()
-
-
-class ServiceController(wsgi.Application):
-    def __init__(self):
-        self.catalog_api = Manager()
-        self.identity_api = identity.Manager()
-        self.policy_api = policy.Manager()
-        self.token_api = token.Manager()
-        super(ServiceController, self).__init__()
-
-    def get_services(self, context):
-        self.assert_admin(context)
-        service_list = self.catalog_api.list_services(context)
-        return {'OS-KSADM:services': service_list}
-
-    def get_service(self, context, service_id):
-        self.assert_admin(context)
-        service_ref = self.catalog_api.get_service(context, service_id)
-        return {'OS-KSADM:service': service_ref}
-
-    def delete_service(self, context, service_id):
-        self.assert_admin(context)
-        self.catalog_api.delete_service(context, service_id)
-
-    def create_service(self, context, OS_KSADM_service):
-        self.assert_admin(context)
-        service_id = uuid.uuid4().hex
-        service_ref = OS_KSADM_service.copy()
-        service_ref['id'] = service_id
-        new_service_ref = self.catalog_api.create_service(
-            context, service_id, service_ref)
-        return {'OS-KSADM:service': new_service_ref}
-
-
-class EndpointController(wsgi.Application):
-    def __init__(self):
-        self.catalog_api = Manager()
-        self.identity_api = identity.Manager()
-        self.policy_api = policy.Manager()
-        self.token_api = token.Manager()
-        super(EndpointController, self).__init__()
-
-    def get_endpoints(self, context):
-        self.assert_admin(context)
-        endpoint_list = self.catalog_api.list_endpoints(context)
-        return {'endpoints': endpoint_list}
-
-    def create_endpoint(self, context, endpoint):
-        self.assert_admin(context)
-        endpoint_id = uuid.uuid4().hex
-        endpoint_ref = endpoint.copy()
-        endpoint_ref['id'] = endpoint_id
-        new_endpoint_ref = self.catalog_api.create_endpoint(
-            context, endpoint_id, endpoint_ref)
-        return {'endpoint': new_endpoint_ref}
-
-    def delete_endpoint(self, context, endpoint_id):
-        self.assert_admin(context)
-        self.catalog_api.delete_endpoint(context, endpoint_id)
-
-
-class ServiceControllerV3(controller.V3Controller):
-    @controller.protected
-    def create_service(self, context, service):
-        ref = self._assign_unique_id(self._normalize_dict(service))
-        self._require_attribute(ref, 'type')
-
-        ref = self.catalog_api.create_service(context, ref['id'], ref)
-        return {'service': ref}
-
-    @controller.protected
-    def list_services(self, context):
-        refs = self.catalog_api.list_services(context)
-        refs = self._filter_by_attribute(context, refs, 'type')
-        return {'services': self._paginate(context, refs)}
-
-    @controller.protected
-    def get_service(self, context, service_id):
-        ref = self.catalog_api.get_service(context, service_id)
-        return {'service': ref}
-
-    @controller.protected
-    def update_service(self, context, service_id, service):
-        self._require_matching_id(service_id, service)
-
-        ref = self.catalog_api.update_service(context, service_id, service)
-        return {'service': ref}
-
-    @controller.protected
-    def delete_service(self, context, service_id):
-        return self.catalog_api.delete_service(context, service_id)
-
-
-class EndpointControllerV3(controller.V3Controller):
-    @controller.protected
-    def create_endpoint(self, context, endpoint):
-        ref = self._assign_unique_id(self._normalize_dict(endpoint))
-        self._require_attribute(ref, 'service_id')
-        self._require_attribute(ref, 'interface')
-        self.catalog_api.get_service(context, ref['service_id'])
-
-        ref = self.catalog_api.create_endpoint(context, ref['id'], ref)
-        return {'endpoint': ref}
-
-    @controller.protected
-    def list_endpoints(self, context):
-        refs = self.catalog_api.list_endpoints(context)
-        refs = self._filter_by_attribute(context, refs, 'service_id')
-        refs = self._filter_by_attribute(context, refs, 'interface')
-        return {'endpoints': self._paginate(context, refs)}
-
-    @controller.protected
-    def get_endpoint(self, context, endpoint_id):
-        ref = self.catalog_api.get_endpoint(context, endpoint_id)
-        return {'endpoint': ref}
-
-    @controller.protected
-    def update_endpoint(self, context, endpoint_id, endpoint):
-        self._require_matching_id(endpoint_id, endpoint)
-
-        if 'service_id' in endpoint:
-            self.catalog_api.get_service(context, endpoint['service_id'])
-
-        ref = self.catalog_api.update_endpoint(context, endpoint_id, endpoint)
-        return {'endpoint': ref}
-
-    @controller.protected
-    def delete_endpoint(self, context, endpoint_id):
-        return self.catalog_api.delete_endpoint(context, endpoint_id)
 
=== added file 'keystone/catalog/routers.py'
--- keystone/catalog/routers.py	1970-01-01 00:00:00 +0000
+++ keystone/catalog/routers.py	2013-01-25 16:27:23 +0000
@@ -0,0 +1,25 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2012 OpenStack LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from keystone.catalog import controllers
+from keystone.common import router
+
+
+def append_v3_routers(mapper, routers):
+    routers.append(router.Router(controllers.ServiceV3(),
+                                 'services', 'service'))
+    routers.append(router.Router(controllers.EndpointV3(),
+                                 'endpoints', 'endpoint'))
 
=== modified file 'keystone/clean.py'
--- keystone/clean.py	2012-11-23 09:01:53 +0000
+++ keystone/clean.py	2013-01-25 16:27:23 +0000
@@ -20,20 +20,21 @@
 def check_length(property_name, value, min_length=1, max_length=64):
     if len(value) < min_length:
         if min_length == 1:
-            msg = "%s cannot be empty." % property_name
+            msg = _("%s cannot be empty.") % property_name
         else:
-            msg = ("%(property_name)s cannot be less than "
-                   "%(min_length)s characters.") % locals()
+            msg = (_("%(property_name)s cannot be less than "
+                   "%(min_length)s characters.")) % locals()
         raise exception.ValidationError(msg)
     if len(value) > max_length:
-        msg = ("%(property_name)s should not be greater than "
-               "%(max_length)s characters.") % locals()
+        msg = (_("%(property_name)s should not be greater than "
+               "%(max_length)s characters.")) % locals()
         raise exception.ValidationError(msg)
 
 
 def check_type(property_name, value, expected_type, display_expected_type):
     if not isinstance(value, expected_type):
-        msg = "%(property_name)s is not a %(display_expected_type)s" % locals()
+        msg = _("%(property_name)s is not a"
+                "%(display_expected_type)s") % locals()
         raise exception.ValidationError(msg)
 
 
@@ -54,3 +55,7 @@
 
 def user_name(name):
     return check_name('User', name)
+
+
+def group_name(name):
+    return check_name('Group', name)
 
=== modified file 'keystone/cli.py'
--- keystone/cli.py	2012-07-06 10:37:01 +0000
+++ keystone/cli.py	2013-01-25 16:27:23 +0000
@@ -16,11 +16,9 @@
 
 from __future__ import absolute_import
 
-import sys
-import textwrap
-
 from keystone import config
 from keystone.common import openssl
+from keystone.openstack.common import cfg
 from keystone.openstack.common import importutils
 from keystone.openstack.common import jsonutils
 
@@ -28,17 +26,14 @@
 
 
 class BaseApp(object):
-    def __init__(self, argv=None):
-        self.argv = argv
-
-    def run(self):
-        return self.main()
-
-    def missing_param(self, param):
-        print 'Missing parameter: %s' % param
-        CONF.print_help()
-        print_commands(CMDS)
-        sys.exit(1)
+
+    name = None
+
+    @classmethod
+    def add_argument_parser(cls, subparsers):
+        parser = subparsers.add_parser(cls.name, help=cls.__doc__)
+        parser.set_defaults(cmd_class=cls)
+        return parser
 
 
 class DbSync(BaseApp):
@@ -46,10 +41,8 @@
 
     name = 'db_sync'
 
-    def __init__(self, *args, **kw):
-        super(DbSync, self).__init__(*args, **kw)
-
-    def main(self):
+    @staticmethod
+    def main():
         for k in ['identity', 'catalog', 'policy', 'token']:
             driver = importutils.import_object(getattr(CONF, k).driver)
             if hasattr(driver, 'db_sync'):
@@ -61,10 +54,8 @@
 
     name = 'pki_setup'
 
-    def __init__(self, *args, **kw):
-        super(PKISetup, self).__init__(*args, **kw)
-
-    def main(self):
+    @staticmethod
+    def main():
         conf_ssl = openssl.ConfigurePKI()
         conf_ssl.run()
 
@@ -74,15 +65,16 @@
 
     name = 'import_legacy'
 
-    def __init__(self, *args, **kw):
-        super(ImportLegacy, self).__init__(*args, **kw)
+    @classmethod
+    def add_argument_parser(cls, subparsers):
+        parser = super(ImportLegacy, cls).add_argument_parser(subparsers)
+        parser.add_argument('old_db')
+        return parser
 
-    def main(self):
+    @staticmethod
+    def main():
         from keystone.common.sql import legacy
-        if len(self.argv) < 2:
-            return self.missing_param('old_db')
-        old_db = self.argv[1]
-        migration = legacy.LegacyMigration(old_db)
+        migration = legacy.LegacyMigration(CONF.command.old_db)
         migration.migrate_all()
 
 
@@ -91,15 +83,17 @@
 
     name = 'export_legacy_catalog'
 
-    def __init__(self, *args, **kw):
-        super(ExportLegacyCatalog, self).__init__(*args, **kw)
+    @classmethod
+    def add_argument_parser(cls, subparsers):
+        parser = super(ExportLegacyCatalog,
+                       cls).add_argument_parser(subparsers)
+        parser.add_argument('old_db')
+        return parser
 
-    def main(self):
+    @staticmethod
+    def main():
         from keystone.common.sql import legacy
-        if len(self.argv) < 2:
-            return self.missing_param('old_db')
-        old_db = self.argv[1]
-        migration = legacy.LegacyMigration(old_db)
+        migration = legacy.LegacyMigration(CONF.command.old_db)
         print '\n'.join(migration.dump_catalog())
 
 
@@ -108,60 +102,43 @@
 
     name = 'import_nova_auth'
 
-    def __init__(self, *args, **kw):
-        super(ImportNovaAuth, self).__init__(*args, **kw)
+    @classmethod
+    def add_argument_parser(cls, subparsers):
+        parser = super(ImportNovaAuth, cls).add_argument_parser(subparsers)
+        parser.add_argument('dump_file')
+        return parser
 
-    def main(self):
+    @staticmethod
+    def main():
         from keystone.common.sql import nova
-        if len(self.argv) < 2:
-            return self.missing_param('dump_file')
-        dump_file = self.argv[1]
-        dump_data = jsonutils.loads(open(dump_file).read())
+        dump_data = jsonutils.loads(open(CONF.command.dump_file).read())
         nova.import_auth(dump_data)
 
 
-CMDS = {'db_sync': DbSync,
-        'import_legacy': ImportLegacy,
-        'export_legacy_catalog': ExportLegacyCatalog,
-        'import_nova_auth': ImportNovaAuth,
-        'pki_setup': PKISetup,
-        }
-
-
-def print_commands(cmds):
-    print
-    print 'Available commands:'
-    o = []
-    max_length = max([len(k) for k in cmds]) + 2
-    for k, cmd in sorted(cmds.iteritems()):
-        initial_indent = '%s%s: ' % (' ' * (max_length - len(k)), k)
-        tw = textwrap.TextWrapper(initial_indent=initial_indent,
-                                  subsequent_indent=' ' * (max_length + 2),
-                                  width=80)
-        o.extend(tw.wrap(
-            (cmd.__doc__ and cmd.__doc__ or 'no docs').strip().split('\n')[0]))
-    print '\n'.join(o)
-
-
-def run(cmd, args):
-    return CMDS[cmd](argv=args).run()
+CMDS = [
+    DbSync,
+    ExportLegacyCatalog,
+    ImportLegacy,
+    ImportNovaAuth,
+    PKISetup,
+]
+
+
+def add_command_parsers(subparsers):
+    for cmd in CMDS:
+        cmd.add_argument_parser(subparsers)
+
+
+command_opt = cfg.SubCommandOpt('command',
+                                title='Commands',
+                                help='Available commands',
+                                handler=add_command_parsers)
 
 
 def main(argv=None, config_files=None):
-    CONF.reset()
-    args = CONF(args=argv,
-                project='keystone',
-                usage='%prog COMMAND',
-                default_config_files=config_files)
-
-    if len(args) < 2:
-        CONF.print_help()
-        print_commands(CMDS)
-        sys.exit(1)
-
-    cmd = args[1]
-    if cmd in CMDS:
-        return run(cmd, (args[:1] + args[2:]))
-    else:
-        print_commands(CMDS)
-        sys.exit("Unknown command: %s" % cmd)
+    CONF.register_cli_opt(command_opt)
+    CONF(args=argv[1:],
+         project='keystone',
+         usage='%(prog)s [' + '|'.join([cmd.name for cmd in CMDS]) + ']',
+         default_config_files=config_files)
+    CONF.command.cmd_class.main()
 
=== modified file 'keystone/common/bufferedhttp.py'
--- keystone/common/bufferedhttp.py	2012-11-23 09:01:53 +0000
+++ keystone/common/bufferedhttp.py	2013-01-25 16:27:23 +0000
@@ -99,8 +99,8 @@
 
     def getresponse(self):
         response = HTTPConnection.getresponse(self)
-        LOG.debug('HTTP PERF: %(time).5f seconds to %(method)s '
-                  '%(host)s:%(port)s %(path)s)',
+        LOG.debug(_('HTTP PERF: %(time).5f seconds to %(method)s '
+                  '%(host)s:%(port)s %(path)s)'),
                   {'time': time.time() - self._connected_time,
                    'method': self._method,
                    'host': self.host,
 
=== modified file 'keystone/common/cms.py'
--- keystone/common/cms.py	2012-11-23 09:01:53 +0000
+++ keystone/common/cms.py	2013-01-25 16:27:23 +0000
@@ -41,7 +41,7 @@
     output, err = process.communicate(formatted)
     retcode = process.poll()
     if retcode:
-        LOG.error('Verify error: %s' % err)
+        LOG.error(_('Verify error: %s') % err)
         raise subprocess.CalledProcessError(retcode, "openssl", output=err)
     return output
 
@@ -131,7 +131,7 @@
     output, err = process.communicate(text)
     retcode = process.poll()
     if retcode or "Error" in err:
-        LOG.error('Signing error: %s' % err)
+        LOG.error(_('Signing error: %s') % err)
         raise subprocess.CalledProcessError(retcode, "openssl")
     return output
 
 
=== modified file 'keystone/common/controller.py'
--- keystone/common/controller.py	2012-11-23 09:01:53 +0000
+++ keystone/common/controller.py	2013-01-25 16:27:23 +0000
@@ -1,6 +1,7 @@
 import uuid
 import functools
 
+from keystone.common import dependency
 from keystone.common import logging
 from keystone.common import wsgi
 from keystone import exception
@@ -17,15 +18,15 @@
         if not context['is_admin']:
             action = 'identity:%s' % f.__name__
 
-            LOG.debug('RBAC: Authorizing %s(%s)' % (
+            LOG.debug(_('RBAC: Authorizing %s(%s)' % (
                 action,
-                ', '.join(['%s=%s' % (k, kwargs[k]) for k in kwargs])))
+                ', '.join(['%s=%s' % (k, kwargs[k]) for k in kwargs]))))
 
             try:
                 token_ref = self.token_api.get_token(
                     context=context, token_id=context['token_id'])
             except exception.TokenNotFound:
-                LOG.warning('RBAC: Invalid token')
+                LOG.warning(_('RBAC: Invalid token'))
                 raise exception.Unauthorized()
 
             creds = token_ref['metadata'].copy()
@@ -33,13 +34,13 @@
             try:
                 creds['user_id'] = token_ref['user'].get('id')
             except AttributeError:
-                LOG.warning('RBAC: Invalid user')
+                LOG.warning(_('RBAC: Invalid user'))
                 raise exception.Unauthorized()
 
             try:
                 creds['tenant_id'] = token_ref['tenant'].get('id')
             except AttributeError:
-                LOG.debug('RBAC: Proceeding without tenant')
+                LOG.debug(_('RBAC: Proceeding without tenant'))
 
             # NOTE(vish): this is pretty inefficient
             creds['roles'] = [self.identity_api.get_role(context, role)['name']
@@ -47,24 +48,23 @@
 
             self.policy_api.enforce(context, creds, action, kwargs)
 
-            LOG.debug('RBAC: Authorization granted')
+            LOG.debug(_('RBAC: Authorization granted'))
         else:
-            LOG.warning('RBAC: Bypassing authorization')
+            LOG.warning(_('RBAC: Bypassing authorization'))
 
         return f(self, context, **kwargs)
     return wrapper
 
 
-class V3Controller(wsgi.Application):
[e-mail]('identity_api', 'policy_api', 'token_api')
+class V2Controller(wsgi.Application):
+    """Base controller class for Identity API v2."""
+    pass
+
+
+class V3Controller(V2Controller):
     """Base controller class for Identity API v3."""
 
-    def __init__(self, catalog_api, identity_api, token_api, policy_api):
-        self.catalog_api = catalog_api
-        self.identity_api = identity_api
-        self.policy_api = policy_api
-        self.token_api = token_api
-        super(V3Controller, self).__init__()
-
     def _paginate(self, context, refs):
         """Paginates a list of references by page & per_page query strings."""
         page = context['query_string'].get('page', 1)
 
=== added file 'keystone/common/dependency.py'
--- keystone/common/dependency.py	1970-01-01 00:00:00 +0000
+++ keystone/common/dependency.py	2013-01-25 16:27:23 +0000
@@ -0,0 +1,67 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2012 OpenStack LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+REGISTRY = {}
+
+
+class UnresolvableDependencyException(Exception):
+    def __init__(self, name):
+        msg = 'Unregistered dependency: %s' % name
+        super(UnresolvableDependencyException, self).__init__(msg)
+
+
+def provider(name):
+    """Register the wrapped dependency provider under the specified name."""
+    def wrapper(cls):
+        def wrapped(init):
+            def __wrapped_init__(self, *args, **kwargs):
+                """Initialize the wrapped object and add it to the registry."""
+                init(self, *args, **kwargs)
+                REGISTRY[name] = self
+
+            return __wrapped_init__
+
+        cls.__init__ = wrapped(cls.__init__)
+        return cls
+
+    return wrapper
+
+
+def requires(*dependencies):
+    """Inject specified dependencies from the registry into the instance."""
+    def wrapper(self, *args, **kwargs):
+        """Inject each dependency from the registry."""
+        self.__wrapped_init__(*args, **kwargs)
+
+        for dependency in self._dependencies:
+            if dependency not in REGISTRY:
+                raise UnresolvableDependencyException(dependency)
+            setattr(self, dependency, REGISTRY[dependency])
+
+    def wrapped(cls):
+        """Note the required dependencies on the object for later injection.
+
+        The dependencies of the parent class are combined with that of the
+        child class to create a new set of dependencies.
+        """
+        existing_dependencies = getattr(cls, '_dependencies', set())
+        cls._dependencies = existing_dependencies.union(dependencies)
+        if not hasattr(cls, '__wrapped_init__'):
+            cls.__wrapped_init__ = cls.__init__
+            cls.__init__ = wrapper
+        return cls
+
+    return wrapped
 
=== modified file 'keystone/common/ldap/core.py'
--- keystone/common/ldap/core.py	2012-11-23 09:01:53 +0000
+++ keystone/common/ldap/core.py	2013-01-25 16:27:23 +0000
@@ -168,8 +168,8 @@
                 pass
             else:
                 raise exception.Conflict(type=self.options_name,
-                                         details='Duplicate name, %s.' %
-                                                 values['name'])
+                                         details=_('Duplicate name, %s.') %
+                                         values['name'])
 
         if values.get('id') is not None:
             try:
@@ -178,12 +178,13 @@
                 pass
             else:
                 raise exception.Conflict(type=self.options_name,
-                                         details='Duplicate ID, %s.' %
-                                                 values['id'])
+                                         details=_('Duplicate ID, %s.') %
+                                         values['id'])
 
     def create(self, values):
         if not self.allow_create:
-            msg = 'LDAP backend does not allow %s create' % self.options_name
+            msg = _('LDAP backend does not allow %s create') \
+                % self.options_name
             raise exception.ForbiddenAction(msg)
 
         conn = self.get_connection()
@@ -289,7 +290,8 @@
 
     def update(self, id, values, old_obj=None):
         if not self.allow_update:
-            msg = 'LDAP backend does not allow %s update' % self.options_name
+            msg = _('LDAP backend does not allow %s update') \
+                % self.options_name
             raise exception.ForbiddenAction(msg)
 
         if old_obj is None:
@@ -316,7 +318,8 @@
 
     def delete(self, id):
         if not self.allow_delete:
-            msg = 'LDAP backend does not allow %s delete' % self.options_name
+            msg = _('LDAP backend does not allow %s delete') \
+                % self.options_name
             raise exception.ForbiddenAction(msg)
 
         conn = self.get_connection()
@@ -333,11 +336,11 @@
 
 class LdapWrapper(object):
     def __init__(self, url):
-        LOG.debug("LDAP init: url=%s", url)
+        LOG.debug(_("LDAP init: url=%s", url))
         self.conn = ldap.initialize(url)
 
     def simple_bind_s(self, user, password):
-        LOG.debug("LDAP bind: dn=%s", user)
+        LOG.debug(_("LDAP bind: dn=%s", user))
         return self.conn.simple_bind_s(user, password)
 
     def add_s(self, dn, attrs):
@@ -348,15 +351,15 @@
                            if kind != 'userPassword'
                            else ['****'])
                           for kind, values in ldap_attrs]
-            LOG.debug('LDAP add: dn=%s, attrs=%s', dn, sane_attrs)
+            LOG.debug(_('LDAP add: dn=%s, attrs=%s', dn, sane_attrs))
         return self.conn.add_s(dn, ldap_attrs)
 
     def search_s(self, dn, scope, query):
         if LOG.isEnabledFor(logging.DEBUG):
-            LOG.debug('LDAP search: dn=%s, scope=%s, query=%s',
+            LOG.debug(_('LDAP search: dn=%s, scope=%s, query=%s',
                       dn,
                       scope,
-                      query)
+                      query))
         res = self.conn.search_s(dn, scope, query)
 
         o = []
@@ -376,14 +379,14 @@
             sane_modlist = [(op, kind, (values if kind != 'userPassword'
                                         else ['****']))
                             for op, kind, values in ldap_modlist]
-            LOG.debug("LDAP modify: dn=%s, modlist=%s", dn, sane_modlist)
+            LOG.debug(_("LDAP modify: dn=%s, modlist=%s", dn, sane_modlist))
 
         return self.conn.modify_s(dn, ldap_modlist)
 
     def delete_s(self, dn):
-        LOG.debug("LDAP delete: dn=%s", dn)
+        LOG.debug(_("LDAP delete: dn=%s", dn))
         return self.conn.delete_s(dn)
 
     def delete_ext_s(self, dn, serverctrls):
-        LOG.debug("LDAP delete_ext: dn=%s, serverctrls=%s", dn, serverctrls)
+        LOG.debug(_("LDAP delete_ext: dn=%s, serverctrls=%s", dn, serverctrls))
         return self.conn.delete_ext_s(dn, serverctrls)
 
=== modified file 'keystone/common/ldap/fakeldap.py'
--- keystone/common/ldap/fakeldap.py	2012-11-02 13:48:49 +0000
+++ keystone/common/ldap/fakeldap.py	2013-01-25 16:27:23 +0000
@@ -145,7 +145,7 @@
     __prefix = 'ldap:'
 
     def __init__(self, url):
-        LOG.debug('FakeLdap initialize url=%s', url)
+        LOG.debug(_('FakeLdap initialize url=%s'), url)
         if url == 'fake://memory':
             self.db = FakeShelve.get_instance()
         else:
@@ -155,26 +155,27 @@
         """This method is ignored, but provided for compatibility."""
         if server_fail:
             raise ldap.SERVER_DOWN
-        LOG.debug('FakeLdap bind dn=%s', dn)
+        LOG.debug(_('FakeLdap bind dn=%s'), dn)
         if dn == 'cn=Admin' and password == 'password':
             return
 
         try:
             attrs = self.db['%s%s' % (self.__prefix, dn)]
         except KeyError:
-            LOG.error('FakeLdap bind fail: dn=%s not found', dn)
+            LOG.error(_('FakeLdap bind fail: dn=%s not found'), dn)
             raise ldap.NO_SUCH_OBJECT
 
         db_password = None
         try:
             db_password = attrs['userPassword'][0]
         except (KeyError, IndexError):
-            LOG.error('FakeLdap bind fail: password for dn=%s not found', dn)
+            LOG.error(_('FakeLdap bind fail: password for dn=%s not found'),
+                      dn)
             raise ldap.INAPPROPRIATE_AUTH
 
         if not utils.ldap_check_password(password, db_password):
-            LOG.error('FakeLdap bind fail: password for dn=%s does'
-                      ' not match' % dn)
+            LOG.error(_('FakeLdap bind fail: password for dn=%s does'
+                      ' not match') % dn)
             raise ldap.INVALID_CREDENTIALS
 
     def unbind_s(self):
@@ -188,10 +189,10 @@
             raise ldap.SERVER_DOWN
 
         key = '%s%s' % (self.__prefix, dn)
-        LOG.debug('FakeLdap add item: dn=%s, attrs=%s', dn, attrs)
+        LOG.debug(_('FakeLdap add item: dn=%s, attrs=%s'), dn, attrs)
         if key in self.db:
-            LOG.error('FakeLdap add item failed: dn=%s is'
-                      ' already in store.', dn)
+            LOG.error(_('FakeLdap add item failed: dn=%s is'
+                      ' already in store.'), dn)
             raise ldap.ALREADY_EXISTS(dn)
 
         self.db[key] = dict([(k, v if isinstance(v, list) else [v])
@@ -204,11 +205,11 @@
             raise ldap.SERVER_DOWN
 
         key = '%s%s' % (self.__prefix, dn)
-        LOG.debug('FakeLdap delete item: dn=%s', dn)
+        LOG.debug(_('FakeLdap delete item: dn=%s'), dn)
         try:
             del self.db[key]
         except KeyError:
-            LOG.error('FakeLdap delete item failed: dn=%s not found.', dn)
+            LOG.error(_('FakeLdap delete item failed: dn=%s not found.'), dn)
             raise ldap.NO_SUCH_OBJECT
         self.db.sync()
 
@@ -218,11 +219,11 @@
             raise ldap.SERVER_DOWN
 
         key = '%s%s' % (self.__prefix, dn)
-        LOG.debug('FakeLdap delete item: dn=%s', dn)
+        LOG.debug(_('FakeLdap delete item: dn=%s'), dn)
         try:
             del self.db[key]
         except KeyError:
-            LOG.error('FakeLdap delete item failed: dn=%s not found.', dn)
+            LOG.error(_('FakeLdap delete item failed: dn=%s not found.'), dn)
             raise ldap.NO_SUCH_OBJECT
         self.db.sync()
 
@@ -237,11 +238,11 @@
             raise ldap.SERVER_DOWN
 
         key = '%s%s' % (self.__prefix, dn)
-        LOG.debug('FakeLdap modify item: dn=%s attrs=%s', dn, attrs)
+        LOG.debug(_('FakeLdap modify item: dn=%s attrs=%s'), dn, attrs)
         try:
             entry = self.db[key]
         except KeyError:
-            LOG.error('FakeLdap modify item failed: dn=%s not found.', dn)
+            LOG.error(_('FakeLdap modify item failed: dn=%s not found.'), dn)
             raise ldap.NO_SUCH_OBJECT
 
         for cmd, k, v in attrs:
@@ -258,8 +259,8 @@
             elif cmd == ldap.MOD_DELETE:
                 if v is None:
                     if len(values) == 0:
-                        LOG.error('FakeLdap modify item failed: '
-                                  'item has no attribute "%s" to delete', k)
+                        LOG.error(_('FakeLdap modify item failed: '
+                                  'item has no attribute "%s" to delete'), k)
                         raise ldap.NO_SUCH_ATTRIBUTE
                     values[:] = []
                 else:
@@ -269,15 +270,15 @@
                         try:
                             values.remove(val)
                         except ValueError:
-                            LOG.error('FakeLdap modify item failed:'
+                            LOG.error(_('FakeLdap modify item failed:'
                                       ' item has no attribute "%s" with'
-                                      ' value "%s" to delete', k, val)
+                                      ' value "%s" to delete'), k, val)
                             raise ldap.NO_SUCH_ATTRIBUTE
             else:
-                LOG.error('FakeLdap modify item failed: unknown'
-                          ' command %s', cmd)
-                raise NotImplementedError('modify_s action %s not implemented'
-                                          % cmd)
+                LOG.error(_('FakeLdap modify item failed: unknown'
+                          ' command %s'), cmd)
+                raise NotImplementedError(_('modify_s action %s not'
+                                            ' implemented') % cmd)
         self.db[key] = entry
         self.db.sync()
 
@@ -294,13 +295,14 @@
         if server_fail:
             raise ldap.SERVER_DOWN
 
-        LOG.debug('FakeLdap search at dn=%s scope=%s query=%s',
+        LOG.debug(_('FakeLdap search at dn=%s scope=%s query=%s'),
                   dn, SCOPE_NAMES.get(scope, scope), query)
         if scope == ldap.SCOPE_BASE:
             try:
                 item_dict = self.db['%s%s' % (self.__prefix, dn)]
             except KeyError:
-                LOG.debug('FakeLdap search fail: dn not found for SCOPE_BASE')
+                LOG.debug(_('FakeLdap search fail: dn not found for'
+                            ' SCOPE_BASE'))
                 raise ldap.NO_SUCH_OBJECT
             results = [(dn, item_dict)]
         elif scope == ldap.SCOPE_SUBTREE:
@@ -313,7 +315,7 @@
                        if re.match('%s\w+=[^,]+,%s' % (self.__prefix, dn), k)]
         else:
             LOG.error('FakeLdap search fail: unknown scope %s', scope)
-            raise NotImplementedError('Search scope %s not implemented.'
+            raise NotImplementedError(_('Search scope %s not implemented.')
                                       % scope)
 
         objects = []
 
=== modified file 'keystone/common/models.py'
--- keystone/common/models.py	2012-11-02 13:48:49 +0000
+++ keystone/common/models.py	2013-01-25 16:27:23 +0000
@@ -78,7 +78,7 @@
     """
 
     required_keys = ('id', 'region', 'service_id')
-    optional_keys = ('interalurl', 'publicurl', 'adminurl')
+    optional_keys = ('internalurl', 'publicurl', 'adminurl')
 
 
 class User(Model):
@@ -99,6 +99,23 @@
     optional_keys = ('password', 'description', 'email', 'enabled')
 
 
+class Group(Model):
+    """Group object.
+
+    Required keys:
+        id
+        name
+
+    Optional keys:
+        domain_id
+        description
+
+    """
+
+    required_keys = ('id', 'name')
+    optional_keys = ('domain_id', 'description')
+
+
 class Tenant(Model):
     """Tenant object.
 
 
=== added file 'keystone/common/router.py'
--- keystone/common/router.py	1970-01-01 00:00:00 +0000
+++ keystone/common/router.py	2013-01-25 16:27:23 +0000
@@ -0,0 +1,56 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2012 OpenStack LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+from keystone.common import wsgi
+
+
+class Router(wsgi.ComposableRouter):
+    def __init__(self, controller, collection_key, key):
+        self.controller = controller
+        self.key = key
+        self.collection_key = collection_key
+
+    def add_routes(self, mapper):
+        collection_path = '/%(collection_key)s' % {
+            'collection_key': self.collection_key}
+        entity_path = '/%(collection_key)s/{%(key)s_id}' % {
+            'collection_key': self.collection_key,
+            'key': self.key}
+
+        mapper.connect(
+            collection_path,
+            controller=self.controller,
+            action='create_%s' % self.key,
+            conditions=dict(method=['POST']))
+        mapper.connect(
+            collection_path,
+            controller=self.controller,
+            action='list_%s' % self.collection_key,
+            conditions=dict(method=['GET']))
+        mapper.connect(
+            entity_path,
+            controller=self.controller,
+            action='get_%s' % self.key,
+            conditions=dict(method=['GET']))
+        mapper.connect(
+            entity_path,
+            controller=self.controller,
+            action='update_%s' % self.key,
+            conditions=dict(method=['PATCH']))
+        mapper.connect(
+            entity_path,
+            controller=self.controller,
+            action='delete_%s' % self.key,
+            conditions=dict(method=['DELETE']))
 
=== modified file 'keystone/common/sql/core.py'
--- keystone/common/sql/core.py	2012-11-23 09:01:53 +0000
+++ keystone/common/sql/core.py	2013-01-25 16:27:23 +0000
@@ -46,6 +46,7 @@
 IntegrityError = sql.exc.IntegrityError
 NotFound = sql.orm.exc.NoResultFound
 Boolean = sql.Boolean
+Text = sql.Text
 
 
 def set_global_engine(engine):
@@ -159,7 +160,7 @@
             dbapi_con.cursor().execute('select 1')
         except dbapi_con.OperationalError as e:
             if e.args[0] in (2006, 2013, 2014, 2045, 2055):
-                logging.warn('Got mysql server has gone away: %s', e)
+                logging.warn(_('Got mysql server has gone away: %s'), e)
                 raise DisconnectionError("Database server went away")
             else:
                 raise
 
=== modified file 'keystone/common/sql/legacy.py'
--- keystone/common/sql/legacy.py	2012-08-16 13:59:29 +0000
+++ keystone/common/sql/legacy.py	2013-01-25 16:27:23 +0000
@@ -171,4 +171,4 @@
             try:
                 self.ec2_driver.create_credential(None, new_dict)
             except exc.IntegrityError:
-                LOG.exception('Cannot migrate EC2 credential: %s' % x)
+                LOG.exception(_('Cannot migrate EC2 credential: %s') % x)
 
=== modified file 'keystone/common/sql/migrate_repo/versions/001_add_initial_tables.py'
--- keystone/common/sql/migrate_repo/versions/001_add_initial_tables.py	2012-11-23 09:01:53 +0000
+++ keystone/common/sql/migrate_repo/versions/001_add_initial_tables.py	2013-01-25 16:27:23 +0000
@@ -14,7 +14,6 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import migrate
 import sqlalchemy as sql
 
 
@@ -116,4 +115,11 @@
 
 def downgrade(migrate_engine):
     # Operations to reverse the above upgrade go here.
-    pass
+    meta = sql.MetaData()
+    meta.bind = migrate_engine
+
+    tables = ['user_tenant_membership', 'token', 'user', 'tenant', 'role',
+              'metadata', 'ec2_credential', 'endpoint', 'service']
+    for t in tables:
+        table = sql.Table(t, meta, autoload=True)
+        table.drop(migrate_engine, checkfirst=True)
 
=== removed file 'keystone/common/sql/migrate_repo/versions/003_sqlite_downgrade.sql'
--- keystone/common/sql/migrate_repo/versions/003_sqlite_downgrade.sql	2012-09-07 13:04:01 +0000
+++ keystone/common/sql/migrate_repo/versions/003_sqlite_downgrade.sql	1970-01-01 00:00:00 +0000
@@ -1,1 +0,0 @@
-alter TABLE token  drop column valid;
 
=== modified file 'keystone/common/sql/migrate_repo/versions/003_token_valid.py'
--- keystone/common/sql/migrate_repo/versions/003_token_valid.py	2012-09-07 13:04:01 +0000
+++ keystone/common/sql/migrate_repo/versions/003_token_valid.py	2013-01-25 16:27:23 +0000
@@ -15,13 +15,9 @@
 # under the License.
 
 
-from migrate import *
 from sqlalchemy import *
 
 
-from keystone.common import sql
-
-
 def upgrade(migrate_engine):
     # Upgrade operations go here. Don't create your own engine; bind
 
 
=== modified file 'keystone/common/sql/migrate_repo/versions/006_add_policy_table.py'
--- keystone/common/sql/migrate_repo/versions/006_add_policy_table.py	2012-11-23 09:01:53 +0000
+++ keystone/common/sql/migrate_repo/versions/006_add_policy_table.py	2013-01-25 16:27:23 +0000
@@ -14,7 +14,6 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import migrate
 import sqlalchemy as sql
 
 
@@ -33,4 +32,8 @@
 
 
 def downgrade(migrate_engine):
-    pass
+    meta = sql.MetaData()
+    meta.bind = migrate_engine
+
+    policy_table = sql.Table('policy', meta, autoload=True)
+    policy_table.drop(migrate_engine, checkfirst=True)
 
=== modified file 'keystone/common/sql/migrate_repo/versions/007_add_domain_tables.py'
--- keystone/common/sql/migrate_repo/versions/007_add_domain_tables.py	2012-11-23 09:01:53 +0000
+++ keystone/common/sql/migrate_repo/versions/007_add_domain_tables.py	2013-01-25 16:27:23 +0000
@@ -14,7 +14,6 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import migrate
 import sqlalchemy as sql
 
 
@@ -77,3 +76,8 @@
 
     role = sql.Table('role', meta, autoload=True)
     role.drop_column('extra')
+
+    tables = ['domain', 'user_domain_metadata', 'credential']
+    for t in tables:
+        table = sql.Table(t, meta, autoload=True)
+        table.drop(migrate_engine, checkfirst=True)
 
=== added file 'keystone/common/sql/migrate_repo/versions/008_normalize_identity.py'
--- keystone/common/sql/migrate_repo/versions/008_normalize_identity.py	1970-01-01 00:00:00 +0000
+++ keystone/common/sql/migrate_repo/versions/008_normalize_identity.py	2013-01-25 16:27:23 +0000
@@ -0,0 +1,58 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2012 OpenStack LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+
+from sqlalchemy import Column, MetaData, String, Table, Text, types
+
+
+#this won't work on sqlite.  It doesn't support dropping columns
+def downgrade_user_table(meta, migrate_engine):
+    user_table = Table('user', meta, autoload=True)
+    user_table.columns["password"].drop()
+    user_table.columns["enabled"].drop()
+
+
+def downgrade_tenant_table(meta, migrate_engine):
+    tenant_table = Table('tenant', meta, autoload=True)
+    tenant_table.columns["description"].drop()
+    tenant_table.columns["enabled"].drop()
+
+
+def upgrade_user_table(meta, migrate_engine):
+    user_table = Table('user', meta, autoload=True)
+    user_table.create_column(Column("password", String(128)))
+    user_table.create_column(Column("enabled", types.Boolean,
+                                    default=True))
+
+
+def upgrade_tenant_table(meta, migrate_engine):
+    tenant_table = Table('tenant', meta, autoload=True)
+    tenant_table.create_column(Column("description", Text()))
+    tenant_table.create_column(Column("enabled", types.Boolean))
+
+
+def upgrade(migrate_engine):
+    meta = MetaData()
+    meta.bind = migrate_engine
+    upgrade_user_table(meta, migrate_engine)
+    upgrade_tenant_table(meta, migrate_engine)
+
+
+def downgrade(migrate_engine):
+    meta = MetaData()
+    meta.bind = migrate_engine
+    downgrade_user_table(meta, migrate_engine)
+    downgrade_tenant_table(meta, migrate_engine)
 
=== added file 'keystone/common/sql/migrate_repo/versions/008_sqlite_downgrade.sql'
--- keystone/common/sql/migrate_repo/versions/008_sqlite_downgrade.sql	1970-01-01 00:00:00 +0000
+++ keystone/common/sql/migrate_repo/versions/008_sqlite_downgrade.sql	2013-01-25 16:27:23 +0000
@@ -0,0 +1,5 @@
+-- not supported by sqlite, but should be:
+-- alter TABLE tenant drop column description;
+-- alter TABLE tenant drop column enabled;
+-- The downgrade process will fail without valid SQL in this file
+select count(*) from tenant;
 
=== added file 'keystone/common/sql/migrate_repo/versions/009_normalize_identity_migration.py'
--- keystone/common/sql/migrate_repo/versions/009_normalize_identity_migration.py	1970-01-01 00:00:00 +0000
+++ keystone/common/sql/migrate_repo/versions/009_normalize_identity_migration.py	2013-01-25 16:27:23 +0000
@@ -0,0 +1,145 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2012 OpenStack LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import json
+
+from sqlalchemy import MetaData, Table
+from sqlalchemy.orm import sessionmaker
+
+disabled_values = ['false', 'disabled', 'no', '0']
+
+
+def is_enabled(enabled):
+    #no explicit value means enabled
+    if enabled is None:
+        return 1
+    if enabled is str:
+        if str(enabled).lower() in disabled_values:
+            return 0
+    if enabled:
+        return 1
+    else:
+        return 0
+
+
+def downgrade_user_table(meta, migrate_engine):
+    user_table = Table('user', meta, autoload=True)
+    maker = sessionmaker(bind=migrate_engine)
+    session = maker()
+    user_data = []
+    for a_user in session.query(user_table):
+        id, name, extra, password, enabled = a_user
+        extra_parsed = json.loads(extra)
+        extra_parsed['password'] = password
+        extra_parsed['enabled'] = "%r" % enabled
+        user_data.append((password,
+                          json.dumps(extra_parsed),
+                          is_enabled(enabled), id))
+    for user in user_data:
+        session.execute("update user "
+                        "set extra = '%s' "
+                        "where id = '%s'" %
+                        user)
+
+    session.commit()
+
+
+def downgrade_tenant_table(meta, migrate_engine):
+    tenant_table = Table('tenant', meta, autoload=True)
+    maker = sessionmaker(bind=migrate_engine)
+    session = maker()
+    tenant_data = []
+    for a_tenant in session.query(tenant_table):
+        id, name, extra, password, enabled = a_tenant
+        extra_parsed = json.loads(extra)
+        extra_parsed['description'] = description
+        extra_parsed['enabled'] = "%r" % enabled
+        tenant_data.append((password,
+                            json.dumps(extra_parsed),
+                            is_enabled(enabled), id))
+    for tenant in tenant_data:
+        session.execute("update tenant "
+                        "set extra = '%s' "
+                        "where id = '%s'" %
+                        tenant)
+
+    session.commit()
+
+
+def upgrade_user_table(meta, migrate_engine):
+    user_table = Table('user', meta, autoload=True)
+    maker = sessionmaker(bind=migrate_engine)
+    session = maker()
+
+    new_user_data = []
+    for a_user in session.query(user_table):
+        id, name, extra, password, enabled = a_user
+        extra_parsed = json.loads(extra)
+        if 'password' in extra_parsed:
+            password = extra_parsed['password']
+            extra_parsed.pop('password')
+        if 'enabled' in extra_parsed:
+            enabled = extra_parsed['enabled']
+            extra_parsed.pop('enabled')
+        new_user_data.append((password,
+                              json.dumps(extra_parsed),
+                              is_enabled(enabled), id))
+    for new_user in new_user_data:
+        session.execute("update user "
+                        "set password = '%s', extra = '%s', enabled = '%s' "
+                        "where id = '%s'" %
+                        new_user)
+    session.commit()
+
+
+def upgrade_tenant_table(meta, migrate_engine):
+    tenant_table = Table('tenant', meta, autoload=True)
+
+    maker = sessionmaker(bind=migrate_engine)
+    session = maker()
+    new_tenant_data = []
+    for a_tenant in session.query(tenant_table):
+        id, name, extra, description, enabled = a_tenant
+        extra_parsed = json.loads(extra)
+        if 'description' in extra_parsed:
+            description = extra_parsed['description']
+            extra_parsed.pop('description')
+        if 'enabled' in extra_parsed:
+            enabled = extra_parsed['enabled']
+            extra_parsed.pop('enabled')
+        new_tenant_data.append((description,
+                                json.dumps(extra_parsed),
+                                is_enabled(enabled), id))
+    for new_tenant in new_tenant_data:
+        session.execute("update tenant "
+                        "set description = '%s', extra = '%s', enabled = '%s' "
+                        "where id = '%s'" %
+                        new_tenant)
+    session.commit()
+
+
+def upgrade(migrate_engine):
+    meta = MetaData()
+    meta.bind = migrate_engine
+    upgrade_user_table(meta, migrate_engine)
+    upgrade_tenant_table(meta, migrate_engine)
+
+
+def downgrade(migrate_engine):
+    meta = MetaData()
+    meta.bind = migrate_engine
+    downgrade_user_table(meta, migrate_engine)
+    downgrade_tenant_table(meta, migrate_engine)
 
=== added file 'keystone/common/sql/migrate_repo/versions/010_endpoints_v3.py'
--- keystone/common/sql/migrate_repo/versions/010_endpoints_v3.py	1970-01-01 00:00:00 +0000
+++ keystone/common/sql/migrate_repo/versions/010_endpoints_v3.py	2013-01-25 16:27:23 +0000
@@ -0,0 +1,53 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2012 OpenStack LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import sqlalchemy as sql
+
+
+def upgrade(migrate_engine):
+    """Create API-version specific endpoint tables."""
+    meta = sql.MetaData()
+    meta.bind = migrate_engine
+
+    legacy_table = sql.Table('endpoint', meta, autoload=True)
+    legacy_table.rename('endpoint_v2')
+
+    new_table = sql.Table(
+        'endpoint_v3',
+        meta,
+        sql.Column('id', sql.String(64), primary_key=True),
+        sql.Column('legacy_endpoint_id', sql.String(64)),
+        sql.Column('interface', sql.String(8), nullable=False),
+        sql.Column('region', sql.String(255)),
+        sql.Column('service_id',
+                   sql.String(64),
+                   sql.ForeignKey('service.id'),
+                   nullable=False),
+        sql.Column('url', sql.Text(), nullable=False),
+        sql.Column('extra', sql.Text()))
+    new_table.create(migrate_engine, checkfirst=True)
+
+
+def downgrade(migrate_engine):
+    """Replace API-version specific endpoint tables with one based on v2."""
+    meta = sql.MetaData()
+    meta.bind = migrate_engine
+
+    new_table = sql.Table('endpoint_v3', meta, autoload=True)
+    new_table.drop()
+
+    legacy_table = sql.Table('endpoint_v2', meta, autoload=True)
+    legacy_table.rename('endpoint')
 
=== added file 'keystone/common/sql/migrate_repo/versions/011_populate_endpoint_type.py'
--- keystone/common/sql/migrate_repo/versions/011_populate_endpoint_type.py	1970-01-01 00:00:00 +0000
+++ keystone/common/sql/migrate_repo/versions/011_populate_endpoint_type.py	2013-01-25 16:27:23 +0000
@@ -0,0 +1,96 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2012 OpenStack LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import json
+import uuid
+
+import sqlalchemy as sql
+from sqlalchemy import orm
+
+
+ENDPOINT_TYPES = ['public', 'internal', 'admin']
+
+
+def upgrade(migrate_engine):
+    """Split each legacy endpoint into seperate records for each interface."""
+    meta = sql.MetaData()
+    meta.bind = migrate_engine
+
+    legacy_table = sql.Table('endpoint_v2', meta, autoload=True)
+    new_table = sql.Table('endpoint_v3', meta, autoload=True)
+
+    session = orm.sessionmaker(bind=migrate_engine)()
+    for ref in session.query(legacy_table).all():
+        # pull urls out of extra
+        extra = json.loads(ref.extra)
+        urls = dict((i, extra.pop('%surl' % i)) for i in ENDPOINT_TYPES)
+
+        for interface in ENDPOINT_TYPES:
+            endpoint = {
+                'id': uuid.uuid4().hex,
+                'legacy_endpoint_id': ref.id,
+                'interface': interface,
+                'region': ref.region,
+                'service_id': ref.service_id,
+                'url': urls[interface],
+                'extra': json.dumps(extra),
+            }
+            session.execute(
+                'INSERT INTO `%s` (%s) VALUES (%s)' % (
+                new_table.name,
+                ', '.join('%s' % k for k in endpoint.keys()),
+                ', '.join("'%s'" % v for v in endpoint.values())))
+    session.commit()
+
+
+def downgrade(migrate_engine):
+    """Re-create the v2 endpoints table based on v3 endpoints."""
+    meta = sql.MetaData()
+    meta.bind = migrate_engine
+
+    legacy_table = sql.Table('endpoint_v2', meta, autoload=True)
+    new_table = sql.Table('endpoint_v3', meta, autoload=True)
+
+    session = orm.sessionmaker(bind=migrate_engine)()
+    for ref in session.query(new_table).all():
+        extra = json.loads(ref.extra)
+        extra['%surl' % ref.interface] = ref.url
+        endpoint = {
+            'id': ref.legacy_endpoint_id,
+            'region': ref.region,
+            'service_id': ref.service_id,
+            'extra': json.dumps(extra),
+        }
+
+        try:
+            session.execute(
+                'INSERT INTO `%s` (%s) VALUES (%s)' % (
+                legacy_table.name,
+                ', '.join('%s' % k for k in endpoint.keys()),
+                ', '.join("'%s'" % v for v in endpoint.values())))
+        except sql.exc.IntegrityError:
+            q = session.query(legacy_table)
+            q = q.filter_by(id=ref.legacy_endpoint_id)
+            legacy_ref = q.one()
+            extra = json.loads(legacy_ref.extra)
+            extra['%surl' % ref.interface] = ref.url
+
+            session.execute(
+                'UPDATE `%s` SET extra=\'%s\' WHERE id="%s"' % (
+                legacy_table.name,
+                json.dumps(extra),
+                legacy_ref.id))
+    session.commit()
 
=== added file 'keystone/common/sql/migrate_repo/versions/012_drop_legacy_endpoints.py'
--- keystone/common/sql/migrate_repo/versions/012_drop_legacy_endpoints.py	1970-01-01 00:00:00 +0000
+++ keystone/common/sql/migrate_repo/versions/012_drop_legacy_endpoints.py	2013-01-25 16:27:23 +0000
@@ -0,0 +1,50 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2012 OpenStack LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import sqlalchemy as sql
+
+
+def upgrade(migrate_engine):
+    """Replace API-version specific endpoint tables with one based on v3."""
+    meta = sql.MetaData()
+    meta.bind = migrate_engine
+
+    legacy_table = sql.Table('endpoint_v2', meta, autoload=True)
+    legacy_table.drop()
+
+    new_table = sql.Table('endpoint_v3', meta, autoload=True)
+    new_table.rename('endpoint')
+
+
+def downgrade(migrate_engine):
+    """Create API-version specific endpoint tables."""
+    meta = sql.MetaData()
+    meta.bind = migrate_engine
+
+    new_table = sql.Table('endpoint', meta, autoload=True)
+    new_table.rename('endpoint_v3')
+
+    legacy_table = sql.Table(
+        'endpoint_v2',
+        meta,
+        sql.Column('id', sql.String(64), primary_key=True),
+        sql.Column('region', sql.String(255)),
+        sql.Column('service_id',
+                   sql.String(64),
+                   sql.ForeignKey('service.id'),
+                   nullable=False),
+        sql.Column('extra', sql.Text()))
+    legacy_table.create(migrate_engine, checkfirst=True)
 
=== added file 'keystone/common/sql/migrate_repo/versions/013_add_group_tables.py'
--- keystone/common/sql/migrate_repo/versions/013_add_group_tables.py	1970-01-01 00:00:00 +0000
+++ keystone/common/sql/migrate_repo/versions/013_add_group_tables.py	2013-01-25 16:27:23 +0000
@@ -0,0 +1,93 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2012 OpenStack LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import sqlalchemy as sql
+
+
+def upgrade(migrate_engine):
+    meta = sql.MetaData()
+    meta.bind = migrate_engine
+
+    sql.Table('domain', meta, autoload=True)
+    group_table = sql.Table(
+        'group',
+        meta,
+        sql.Column('id', sql.String(64), primary_key=True),
+        sql.Column('domain_id', sql.String(64), sql.ForeignKey('domain.id')),
+        sql.Column('name', sql.String(64), unique=True, nullable=False),
+        sql.Column('description', sql.Text()),
+        sql.Column('extra', sql.Text()))
+    group_table.create(migrate_engine, checkfirst=True)
+
+    sql.Table('user', meta, autoload=True)
+    user_group_membership_table = sql.Table(
+        'user_group_membership',
+        meta,
+        sql.Column(
+            'user_id',
+            sql.String(64),
+            sql.ForeignKey('user.id'),
+            primary_key=True),
+        sql.Column(
+            'group_id',
+            sql.String(64),
+            sql.ForeignKey('group.id'),
+            primary_key=True))
+    user_group_membership_table.create(migrate_engine, checkfirst=True)
+
+    sql.Table('tenant', meta, autoload=True)
+    group_project_metadata_table = sql.Table(
+        'group_project_metadata',
+        meta,
+        sql.Column(
+            'group_id',
+            sql.String(64),
+            sql.ForeignKey('group.id'),
+            primary_key=True),
+        sql.Column(
+            'project_id',
+            sql.String(64),
+            sql.ForeignKey('tenant.id'),
+            primary_key=True),
+        sql.Column('data', sql.Text()))
+    group_project_metadata_table.create(migrate_engine, checkfirst=True)
+
+    group_domain_metadata_table = sql.Table(
+        'group_domain_metadata',
+        meta,
+        sql.Column(
+            'group_id',
+            sql.String(64),
+            sql.ForeignKey('group.id'),
+            primary_key=True),
+        sql.Column(
+            'domain_id',
+            sql.String(64),
+            sql.ForeignKey('domain.id'),
+            primary_key=True),
+        sql.Column('data', sql.Text()))
+    group_domain_metadata_table.create(migrate_engine, checkfirst=True)
+
+
+def downgrade(migrate_engine):
+    meta = sql.MetaData()
+    meta.bind = migrate_engine
+
+    tables = ['user_group_membership', 'group_project_metadata',
+              'group_domain_metadata', 'group']
+    for t in tables:
+        table = sql.Table(t, meta, autoload=True)
+        table.drop(migrate_engine, checkfirst=True)
 
=== modified file 'keystone/common/sql/migration.py'
--- keystone/common/sql/migration.py	2012-06-22 12:27:50 +0000
+++ keystone/common/sql/migration.py	2013-01-25 16:27:23 +0000
@@ -44,7 +44,7 @@
         try:
             version = int(version)
         except ValueError:
-            raise Exception('version should be an integer')
+            raise Exception(_('version should be an integer'))
 
     current_version = db_version()
     repo_path = _find_migrate_repo()
 
=== modified file 'keystone/common/sql/nova.py'
--- keystone/common/sql/nova.py	2012-06-22 12:27:50 +0000
+++ keystone/common/sql/nova.py	2013-01-25 16:27:23 +0000
@@ -55,7 +55,7 @@
             'enabled': True,
         }
         tenant_map[tenant['id']] = tenant_dict['id']
-        LOG.debug('Create tenant %s' % tenant_dict)
+        LOG.debug(_('Create tenant %s') % tenant_dict)
         api.create_tenant(tenant_dict['id'], tenant_dict)
     return tenant_map
 
@@ -71,7 +71,7 @@
             'enabled': True,
         }
         user_map[user['id']] = user_dict['id']
-        LOG.debug('Create user %s' % user_dict)
+        LOG.debug(_('Create user %s') % user_dict)
         api.create_user(user_dict['id'], user_dict)
     return user_map
 
@@ -80,7 +80,7 @@
     for membership in memberships:
         user_id = user_map[membership['user_id']]
         tenant_id = tenant_map[membership['tenant_id']]
-        LOG.debug('Add user %s to tenant %s' % (user_id, tenant_id))
+        LOG.debug(_('Add user %s to tenant %s') % (user_id, tenant_id))
         api.add_user_to_tenant(tenant_id, user_id)
 
 
@@ -88,14 +88,14 @@
     role_map = dict((r['name'], r['id']) for r in api.list_roles())
     for role in roles:
         if role in role_map:
-            LOG.debug('Ignoring existing role %s' % role)
+            LOG.debug(_('Ignoring existing role %s') % role)
             continue
         role_dict = {
             'id': _generate_uuid(),
             'name': role,
         }
         role_map[role] = role_dict['id']
-        LOG.debug('Create role %s' % role_dict)
+        LOG.debug(_('Create role %s') % role_dict)
         api.create_role(role_dict['id'], role_dict)
     return role_map
 
@@ -105,7 +105,7 @@
         role_id = role_map[assignment['role']]
         user_id = user_map[assignment['user_id']]
         tenant_id = tenant_map[assignment['tenant_id']]
-        LOG.debug('Assign role %s to user %s on tenant %s' %
+        LOG.debug(_('Assign role %s to user %s on tenant %s') %
                   (role_id, user_id, tenant_id))
         api.add_role_to_user_and_tenant(user_id, tenant_id, role_id)
 
@@ -120,6 +120,6 @@
                 'user_id': user_id,
                 'tenant_id': tenant_id,
             }
-            LOG.debug('Creating ec2 cred for user %s and tenant %s' %
+            LOG.debug(_('Creating ec2 cred for user %s and tenant %s') %
                       (user_id, tenant_id))
             ec2_api.create_credential(None, cred_dict)
 
=== modified file 'keystone/common/utils.py'
--- keystone/common/utils.py	2012-11-02 13:48:49 +0000
+++ keystone/common/utils.py	2013-01-25 16:27:23 +0000
@@ -31,6 +31,7 @@
 
 from keystone.common import logging
 from keystone import config
+from keystone import exception
 
 
 CONF = config.CONF
@@ -89,8 +90,8 @@
                                           credentials['verb'],
                                           credentials['host'],
                                           credentials['path'])
-        raise Exception('Unknown Signature Version: %s' %
-                        credentials['params']['SignatureVersion'])
+        raise Exception(_('Unknown Signature Version: %s' %
+                        credentials['params']['SignatureVersion']))
 
     @staticmethod
     def _get_utf8_value(value):
@@ -120,7 +121,7 @@
 
     def _calc_signature_2(self, params, verb, server_string, path):
         """Generate AWS signature version 2 string."""
-        LOG.debug('using _calc_signature_2')
+        LOG.debug(_('using _calc_signature_2'))
         string_to_sign = '%s\n%s\n%s\n' % (verb, server_string, path)
         if self.hmac_256:
             current_hmac = self.hmac_256
@@ -136,22 +137,25 @@
             val = urllib.quote(val, safe='-_~')
             pairs.append(urllib.quote(key, safe='') + '=' + val)
         qs = '&'.join(pairs)
-        LOG.debug('query string: %s', qs)
+        LOG.debug(_('query string: %s'), qs)
         string_to_sign += qs
-        LOG.debug('string_to_sign: %s', string_to_sign)
+        LOG.debug(_('string_to_sign: %s'), string_to_sign)
         current_hmac.update(string_to_sign)
         b64 = base64.b64encode(current_hmac.digest())
-        LOG.debug('len(b64)=%d', len(b64))
-        LOG.debug('base64 encoded digest: %s', b64)
+        LOG.debug(_('len(b64)=%d'), len(b64))
+        LOG.debug(_('base64 encoded digest: %s'), b64)
         return b64
 
 
 def trunc_password(password):
     """Truncate passwords to the MAX_PASSWORD_LENGTH."""
-    if len(password) > MAX_PASSWORD_LENGTH:
-        return password[:MAX_PASSWORD_LENGTH]
-    else:
-        return password
+    try:
+        if len(password) > MAX_PASSWORD_LENGTH:
+            return password[:MAX_PASSWORD_LENGTH]
+        else:
+            return password
+    except TypeError:
+        raise exception.ValidationError(attribute='string', target='password')
 
 
 def hash_user_password(user):
@@ -288,3 +292,22 @@
     hash_ = hashlib.md5()
     hash_.update(signed_text)
     return hash_.hexdigest()
+
+
+def setup_remote_pydev_debug():
+    if CONF.pydev_debug_host and CONF.pydev_debug_port:
+        error_msg = ('Error setting up the debug environment.  Verify that the'
+                     ' option --debug-url has the format <host>:<port> and '
+                     'that a debugger processes is listening on that port.')
+
+        try:
+            from pydev import pydevd
+
+            pydevd.settrace(CONF.pydev_debug_host,
+                            port=CONF.pydev_debug_port,
+                            stdoutToServer=True,
+                            stderrToServer=True)
+            return True
+        except:
+            LOG.exception(_(error_msg))
+            raise
 
=== modified file 'keystone/common/wsgi.py'
--- keystone/common/wsgi.py	2012-11-23 09:01:53 +0000
+++ keystone/common/wsgi.py	2013-01-25 16:27:23 +0000
@@ -70,7 +70,7 @@
 
     def start(self, key=None, backlog=128):
         """Run a WSGI server with the given application."""
-        LOG.debug('Starting %(arg0)s on %(host)s:%(port)s' %
+        LOG.debug(_('Starting %(arg0)s on %(host)s:%(port)s') %
                   {'arg0': sys.argv[0],
                    'host': self.host,
                    'port': self.port})
@@ -193,7 +193,7 @@
         arg_dict = req.environ['wsgiorg.routing_args'][1]
         action = arg_dict.pop('action')
         del arg_dict['controller']
-        LOG.debug('arg_dict: %s', arg_dict)
+        LOG.debug(_('arg_dict: %s'), arg_dict)
 
         # allow middleware up the stack to provide context & params
         context = req.environ.get(CONTEXT_ENV, {})
@@ -214,7 +214,7 @@
         try:
             result = method(context, **params)
         except exception.Unauthorized as e:
-            LOG.warning("Authorization failed. %s from %s"
+            LOG.warning(_("Authorization failed. %s from %s")
                         % (e, req.environ['REMOTE_ADDR']))
             return render_exception(e)
         except exception.Error as e:
@@ -427,7 +427,7 @@
         match = req.environ['wsgiorg.routing_args'][1]
         if not match:
             return render_exception(
-                exception.NotFound(message='The resource could not be found.'))
+                exception.NotFound(_('The resource could not be found.')))
         app = match['controller']
         return app
 
 
=== modified file 'keystone/config.py'
--- keystone/config.py	2012-11-23 09:01:53 +0000
+++ keystone/config.py	2013-01-25 16:27:23 +0000
@@ -41,8 +41,8 @@
             logging.config.fileConfig(conf.log_config)
             return
         else:
-            raise RuntimeError('Unable to locate specified logging '
-                               'config file: %s' % conf.log_config)
+            raise RuntimeError(_('Unable to locate specified logging '
+                               'config file: %s') % conf.log_config)
 
     root_logger = logging.root
     if conf.debug:
@@ -122,6 +122,12 @@
     group = kw.pop('group', None)
     return conf.register_cli_opt(cfg.IntOpt(*args, **kw), group=group)
 
+
+register_cli_bool('standard-threads', default=False)
+
+register_cli_str('pydev-debug-host', default=None)
+register_cli_int('pydev-debug-port', default=None)
+
 register_str('admin_token', default='ADMIN')
 register_str('bind_host', default='0.0.0.0')
 register_str('compute_port', default=8774)
@@ -129,7 +135,6 @@
 register_str('public_port', default=5000)
 register_str('onready')
 register_str('auth_admin_prefix', default='')
-register_bool('standard-threads', default=False)
 register_str('policy_file', default='policy.json')
 register_str('policy_default_rule', default=None)
 
@@ -221,6 +226,17 @@
 register_bool('role_allow_update', group='ldap', default=True)
 register_bool('role_allow_delete', group='ldap', default=True)
 
+register_str('group_tree_dn', group='ldap', default=None)
+register_str('group_filter', group='ldap', default=None)
+register_str('group_objectclass', group='ldap', default='groupOfNames')
+register_str('group_id_attribute', group='ldap', default='cn')
+register_str('group_name_attribute', group='ldap', default='ou')
+register_str('group_member_attribute', group='ldap', default='member')
+register_str('group_desc_attribute', group='ldap', default='desc')
+register_list('group_attribute_ignore', group='ldap', default='')
+register_bool('group_allow_create', group='ldap', default=True)
+register_bool('group_allow_update', group='ldap', default=True)
+register_bool('group_allow_delete', group='ldap', default=True)
 #pam
 register_str('url', group='pam', default=None)
 register_str('userid', group='pam', default=None)
 
=== modified file 'keystone/contrib/admin_crud/core.py'
--- keystone/contrib/admin_crud/core.py	2012-07-06 10:37:01 +0000
+++ keystone/contrib/admin_crud/core.py	2013-01-25 16:27:23 +0000
@@ -13,7 +13,6 @@
 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 # License for the specific language governing permissions and limitations
 # under the License.
-
 from keystone import catalog
 from keystone.common import wsgi
 from keystone import identity
@@ -27,11 +26,11 @@
     """
 
     def add_routes(self, mapper):
-        tenant_controller = identity.TenantController()
-        user_controller = identity.UserController()
-        role_controller = identity.RoleController()
-        service_controller = catalog.ServiceController()
-        endpoint_controller = catalog.EndpointController()
+        tenant_controller = identity.controllers.Tenant()
+        user_controller = identity.controllers.User()
+        role_controller = identity.controllers.Role()
+        service_controller = catalog.controllers.Service()
+        endpoint_controller = catalog.controllers.Endpoint()
 
         # Tenant Operations
         mapper.connect(
 
=== modified file 'keystone/contrib/ec2/core.py'
--- keystone/contrib/ec2/core.py	2012-11-23 09:01:53 +0000
+++ keystone/contrib/ec2/core.py	2013-01-25 16:27:23 +0000
@@ -36,21 +36,20 @@
 
 import uuid
 
-from keystone import catalog
+from keystone.common import controller
+from keystone.common import dependency
 from keystone.common import manager
 from keystone.common import utils
 from keystone.common import wsgi
 from keystone import config
 from keystone import exception
-from keystone import identity
-from keystone import policy
-from keystone import service
 from keystone import token
 
 
 CONF = config.CONF
 
 
[e-mail]('ec2_api')
 class Manager(manager.Manager):
     """Default pivot point for the EC2 Credentials backend.
 
@@ -96,15 +95,8 @@
             conditions=dict(method=['DELETE']))
 
 
-class Ec2Controller(wsgi.Application):
-    def __init__(self):
-        self.catalog_api = catalog.Manager()
-        self.identity_api = identity.Manager()
-        self.token_api = token.Manager()
-        self.policy_api = policy.Manager()
-        self.ec2_api = Manager()
-        super(Ec2Controller, self).__init__()
-
[e-mail]('catalog_api', 'ec2_api')
+class Ec2Controller(controller.V2Controller):
     def check_signature(self, creds_ref, credentials):
         signer = utils.Ec2Signer(creds_ref['secret'])
         signature = signer.generate(credentials)
@@ -190,12 +182,10 @@
                                     tenant=tenant_ref,
                                     metadata=metadata_ref))
 
-        # TODO(termie): make this a util function or something
         # TODO(termie): i don't think the ec2 middleware currently expects a
         #               full return, but it contains a note saying that it
         #               would be better to expect a full return
-        token_controller = service.TokenController()
-        return token_controller._format_authenticate(
+        return token.controllers.Auth.format_authenticate(
             token_ref, roles_ref, catalog_ref)
 
     def create_credential(self, context, user_id, tenant_id):
 
=== modified file 'keystone/contrib/user_crud/core.py'
--- keystone/contrib/user_crud/core.py	2012-11-23 09:01:53 +0000
+++ keystone/contrib/user_crud/core.py	2013-01-25 16:27:23 +0000
@@ -20,20 +20,13 @@
 from keystone import exception
 from keystone.common import logging
 from keystone.common import wsgi
-from keystone.identity import Manager as IdentityManager
-from keystone.identity import UserController as UserManager
-from keystone.token import Manager as TokenManager
+from keystone import identity
 
 
 LOG = logging.getLogger(__name__)
 
 
-class UserController(wsgi.Application):
-    def __init__(self):
-        self.identity_api = IdentityManager()
-        self.token_api = TokenManager()
-        self.user_controller = UserManager()
-
+class UserController(identity.controllers.User):
     def set_user_password(self, context, user_id, user):
         token_id = context.get('token_id')
         original_password = user.get('original_password')
@@ -63,9 +56,9 @@
 
         admin_context = copy.copy(context)
         admin_context['is_admin'] = True
-        self.user_controller.set_user_password(admin_context,
-                                               user_id,
-                                               update_dict)
+        super(UserController, self).set_user_password(admin_context,
+                                                      user_id,
+                                                      update_dict)
 
         token_id = uuid.uuid4().hex
         new_token_ref = copy.copy(token_ref)
 
=== added file 'keystone/controllers.py'
--- keystone/controllers.py	1970-01-01 00:00:00 +0000
+++ keystone/controllers.py	2013-01-25 16:27:23 +0000
@@ -0,0 +1,144 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2012 OpenStack LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+from keystone.common import wsgi
+from keystone import catalog
+from keystone import exception
+
+
+class Extensions(wsgi.Application):
+    """Base extensions controller to be extended by public and admin API's."""
+
+    def __init__(self, extensions=None):
+        super(Extensions, self).__init__()
+
+        self.extensions = extensions or {}
+
+    def get_extensions_info(self, context):
+        return {'extensions': {'values': self.extensions.values()}}
+
+    def get_extension_info(self, context, extension_alias):
+        try:
+            return {'extension': self.extensions[extension_alias]}
+        except KeyError:
+            raise exception.NotFound(target=extension_alias)
+
+
+class AdminExtensions(Extensions):
+    def __init__(self, *args, **kwargs):
+        super(AdminExtensions, self).__init__(*args, **kwargs)
+
+        # TODO(dolph): Extensions should obviously provide this information
+        #               themselves, but hardcoding it here allows us to match
+        #               the API spec in the short term with minimal complexity.
+        self.extensions['OS-KSADM'] = {
+            'name': 'Openstack Keystone Admin',
+            'namespace': 'http://docs.openstack.org/identity/api/ext/'
+                         'OS-KSADM/v1.0',
+            'alias': 'OS-KSADM',
+            'updated': '2011-08-19T13:25:27-06:00',
+            'description': 'Openstack extensions to Keystone v2.0 API '
+                           'enabling Admin Operations.',
+            'links': [
+                {
+                    'rel': 'describedby',
+                    # TODO(dolph): link needs to be revised after
+                    #              bug 928059 merges
+                    'type': 'text/html',
+                    'href': 'https://github.com/openstack/identity-api',
+                }
+            ]
+        }
+
+
+class PublicExtensions(Extensions):
+    pass
+
+
+class Version(wsgi.Application):
+    def __init__(self, version_type):
+        self.catalog_api = catalog.Manager()
+        self.url_key = '%sURL' % version_type
+
+        super(Version, self).__init__()
+
+    def _get_identity_url(self, context):
+        catalog_ref = self.catalog_api.get_catalog(context=context,
+                                                   user_id=None,
+                                                   tenant_id=None)
+        for region, region_ref in catalog_ref.iteritems():
+            for service, service_ref in region_ref.iteritems():
+                if service == 'identity':
+                    return service_ref[self.url_key]
+
+        raise exception.NotImplemented()
+
+    def _get_versions_list(self, context):
+        """The list of versions is dependent on the context."""
+        identity_url = self._get_identity_url(context)
+        if not identity_url.endswith('/'):
+            identity_url = identity_url + '/'
+
+        versions = {}
+        versions['v2.0'] = {
+            'id': 'v2.0',
+            'status': 'beta',
+            'updated': '2011-11-19T00:00:00Z',
+            'links': [
+                {
+                    'rel': 'self',
+                    'href': identity_url,
+                }, {
+                    'rel': 'describedby',
+                    'type': 'text/html',
+                    'href': 'http://docs.openstack.org/api/openstack-'
+                            'identity-service/2.0/content/'
+                }, {
+                    'rel': 'describedby',
+                    'type': 'application/pdf',
+                    'href': 'http://docs.openstack.org/api/openstack-'
+                            'identity-service/2.0/identity-dev-guide-'
+                            '2.0.pdf'
+                }
+            ],
+            'media-types': [
+                {
+                    'base': 'application/json',
+                    'type': 'application/vnd.openstack.identity-v2.0'
+                            '+json'
+                }, {
+                    'base': 'application/xml',
+                    'type': 'application/vnd.openstack.identity-v2.0'
+                            '+xml'
+                }
+            ]
+        }
+
+        return versions
+
+    def get_versions(self, context):
+        versions = self._get_versions_list(context)
+        return wsgi.render_response(status=(300, 'Multiple Choices'), body={
+            'versions': {
+                'values': versions.values()
+            }
+        })
+
+    def get_version(self, context):
+        versions = self._get_versions_list(context)
+        return wsgi.render_response(body={
+            'version': versions['v2.0']
+        })
 
=== modified file 'keystone/exception.py'
--- keystone/exception.py	2012-11-23 09:01:53 +0000
+++ keystone/exception.py	2013-01-25 16:27:23 +0000
@@ -148,6 +148,10 @@
     """Could not find user: %(user_id)s"""
 
 
+class GroupNotFound(NotFound):
+    """Could not find group: %(group_id)s"""
+
+
 class Conflict(Error):
     """Conflict occurred attempting to store %(type)s.
 
 
=== modified file 'keystone/identity/__init__.py'
--- keystone/identity/__init__.py	2012-03-16 11:19:40 +0000
+++ keystone/identity/__init__.py	2013-01-25 16:27:23 +0000
@@ -15,3 +15,5 @@
 # under the License.
 
 from keystone.identity.core import *
+from keystone.identity import controllers
+from keystone.identity import routers
 
=== modified file 'keystone/identity/backends/kvs.py'
--- keystone/identity/backends/kvs.py	2012-11-23 09:01:53 +0000
+++ keystone/identity/backends/kvs.py	2013-01-25 16:27:23 +0000
@@ -97,9 +97,13 @@
     def get_user_by_name(self, user_name):
         return identity.filter_user(self._get_user_by_name(user_name))
 
-    def get_metadata(self, user_id, tenant_id):
+    def get_metadata(self, user_id=None, tenant_id=None,
+                     domain_id=None, group_id=None):
         try:
-            return self.db.get('metadata-%s-%s' % (tenant_id, user_id))
+            if user_id:
+                return self.db.get('metadata-%s-%s' % (tenant_id, user_id))
+            else:
+                return self.db.get('metadata-%s-%s' % (tenant_id, group_id))
         except exception.NotFound:
             raise exception.MetadataNotFound()
 
@@ -199,12 +203,16 @@
             raise exception.Conflict(type='user', details=msg)
 
         user = utils.hash_user_password(user)
-        self.db.set('user-%s' % user_id, user)
-        self.db.set('user_name-%s' % user['name'], user)
+        new_user = user.copy()
+
+        new_user.setdefault('groups', [])
+
+        self.db.set('user-%s' % user_id, new_user)
+        self.db.set('user_name-%s' % new_user['name'], new_user)
         user_list = set(self.db.get('user_list', []))
         user_list.add(user_id)
         self.db.set('user_list', list(user_list))
-        return identity.filter_user(user)
+        return identity.filter_user(new_user)
 
     def update_user(self, user_id, user):
         if 'name' in user:
@@ -228,6 +236,42 @@
         self.db.set('user_name-%s' % new_user['name'], new_user)
         return new_user
 
+    def add_user_to_group(self, user_id, group_id):
+        self.get_group(group_id)
+        user_ref = self._get_user(user_id)
+        groups = set(user_ref.get('groups', []))
+        groups.add(group_id)
+        self.update_user(user_id, {'groups': list(groups)})
+
+    def check_user_in_group(self, user_id, group_id):
+        self.get_group(group_id)
+        user_ref = self._get_user(user_id)
+        if not group_id in set(user_ref.get('groups', [])):
+            raise exception.NotFound(_('User not found in group'))
+
+    def remove_user_from_group(self, user_id, group_id):
+        self.get_group(group_id)
+        user_ref = self._get_user(user_id)
+        groups = set(user_ref.get('groups', []))
+        try:
+            groups.remove(group_id)
+        except KeyError:
+            raise exception.NotFound(_('User not found in group'))
+        self.update_user(user_id, {'groups': list(groups)})
+
+    def list_users_in_group(self, group_id):
+        self.get_group(group_id)
+        user_keys = filter(lambda x: x.startswith("user-"), self.db.keys())
+        user_refs = [self.db.get(key) for key in user_keys]
+        user_refs_for_group = filter(lambda x: group_id in x['groups'],
+                                     user_refs)
+        return [identity.filter_user(x) for x in user_refs_for_group]
+
+    def list_groups_for_user(self, user_id):
+        user_ref = self._get_user(user_id)
+        group_ids = user_ref.get('groups', [])
+        return [self.get_group(x) for x in group_ids]
+
     def delete_user(self, user_id):
         try:
             old_user = self.db.get('user-%s' % user_id)
@@ -292,16 +336,21 @@
         self.db.delete('tenant_name-%s' % old_tenant['name'])
         self.db.delete('tenant-%s' % tenant_id)
 
-    def create_metadata(self, user_id, tenant_id, metadata):
-        self.db.set('metadata-%s-%s' % (tenant_id, user_id), metadata)
-        return metadata
-
-    def update_metadata(self, user_id, tenant_id, metadata):
-        self.db.set('metadata-%s-%s' % (tenant_id, user_id), metadata)
-        return metadata
-
-    def delete_metadata(self, user_id, tenant_id):
-        self.db.delete('metadata-%s-%s' % (tenant_id, user_id))
+    def create_metadata(self, user_id, tenant_id, metadata,
+                        domain_id=None, group_id=None):
+        if user_id:
+            self.db.set('metadata-%s-%s' % (tenant_id, user_id), metadata)
+        else:
+            self.db.set('metadata-%s-%s' % (tenant_id, group_id), metadata)