Merge lp:~zulcss/ubuntu/precise/keystone/trunk into lp:~ubuntu-cloud-archive/ubuntu/precise/keystone/trunk

[Chuck Short]

keystone g1

[James Page (james-page)]

LGTM; uploaded to grizzly-staging

review: Approve

=== added file '.coveragerc'
--- .coveragerc	1970-01-01 00:00:00 +0000
+++ .coveragerc	2012-11-26 19:58:28 +0000
@@ -0,0 +1,6 @@
+[run]
+branch = True
+omit = /usr*,setup.py,*egg*,.venv/*,.tox/*,tests/*
+
+[report]
+ignore-errors = True

=== modified file '.gitignore'
--- .gitignore	2012-09-07 13:04:01 +0000
+++ .gitignore	2012-11-26 19:58:28 +0000
@@ -7,6 +7,8 @@
 keystone.egg-info/
 *.log
 .coverage
+coverage.xml
+cover/*
 covhtml
 pep8.txt
 nosetests.xml

=== modified file '.mailmap'
--- .mailmap	2012-07-06 10:37:01 +0000
+++ .mailmap	2012-11-26 19:58:28 +0000
@@ -20,4 +20,4 @@
 Sirish Bitra <[e-mail]> sirish.bitra <[e-mail]>
 Sirish Bitra <[e-mail]> sirishbitra <[e-mail]>
 Sirish Bitra <[e-mail]> root <root@bsirish.(none)>
-
+Zhongyue Luo <[e-mail]> <[e-mail]>

=== removed file '.pc/applied-patches'
--- .pc/applied-patches	2012-03-26 13:41:45 +0000
+++ .pc/applied-patches	1970-01-01 00:00:00 +0000
@@ -1,2 +0,0 @@
-fix-ubuntu-tests.patch
-sql_connection.patch

=== removed directory '.pc/fix-ubuntu-tests.patch'
=== removed directory '.pc/fix-ubuntu-tests.patch/tests'
=== removed file '.pc/fix-ubuntu-tests.patch/tests/test_content_types.py'
--- .pc/fix-ubuntu-tests.patch/tests/test_content_types.py	2012-09-17 09:15:51 +0000
+++ .pc/fix-ubuntu-tests.patch/tests/test_content_types.py	1970-01-01 00:00:00 +0000
@@ -1,805 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2012 OpenStack LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import httplib
-import uuid
-
-from lxml import etree
-import nose.exc
-
-from keystone.common import serializer
-from keystone.openstack.common import jsonutils
-from keystone import test
-
-import default_fixtures
-
-
-class RestfulTestCase(test.TestCase):
-    """Performs restful tests against the WSGI app over HTTP.
-
-    This class launches public & admin WSGI servers for every test, which can
-    be accessed by calling ``public_request()`` or ``admin_request()``,
-    respectfully.
-
-    ``restful_request()`` and ``request()`` methods are also exposed if you
-    need to bypass restful conventions or access HTTP details in your test
-    implementation.
-
-    Three new asserts are provided:
-
-    * ``assertResponseSuccessful``: called automatically for every request
-        unless an ``expected_status`` is provided
-    * ``assertResponseStatus``: called instead of ``assertResponseSuccessful``,
-        if an ``expected_status`` is provided
-    * ``assertValidResponseHeaders``: validates that the response headers
-        appear as expected
-
-    Requests are automatically serialized according to the defined
-    ``content_type``. Responses are automatically deserialized as well, and
-    available in the ``response.body`` attribute. The original body content is
-    available in the ``response.raw`` attribute.
-
-    """
-
-    # default content type to test
-    content_type = 'json'
-
-    def setUp(self):
-        super(RestfulTestCase, self).setUp()
-
-        self.load_backends()
-        self.load_fixtures(default_fixtures)
-
-        self.public_server = self.serveapp('keystone', name='main')
-        self.admin_server = self.serveapp('keystone', name='admin')
-
-        # TODO(termie): is_admin is being deprecated once the policy stuff
-        #               is all working
-        # TODO(termie): add an admin user to the fixtures and use that user
-        # override the fixtures, for now
-        self.metadata_foobar = self.identity_api.update_metadata(
-            self.user_foo['id'],
-            self.tenant_bar['id'],
-            dict(roles=['keystone_admin'], is_admin='1'))
-
-    def tearDown(self):
-        """Kill running servers and release references to avoid leaks."""
-        self.public_server.kill()
-        self.admin_server.kill()
-        self.public_server = None
-        self.admin_server = None
-        super(RestfulTestCase, self).tearDown()
-
-    def request(self, host='0.0.0.0', port=80, method='GET', path='/',
-                headers=None, body=None, expected_status=None):
-        """Perform request and fetch httplib.HTTPResponse from the server."""
-
-        # Initialize headers dictionary
-        headers = {} if not headers else headers
-
-        connection = httplib.HTTPConnection(host, port, timeout=10)
-
-        # Perform the request
-        connection.request(method, path, body, headers)
-
-        # Retrieve the response so we can close the connection
-        response = connection.getresponse()
-
-        response.body = response.read()
-
-        # Close the connection
-        connection.close()
-
-        # Automatically assert HTTP status code
-        if expected_status:
-            self.assertResponseStatus(response, expected_status)
-        else:
-            self.assertResponseSuccessful(response)
-        self.assertValidResponseHeaders(response)
-
-        # Contains the response headers, body, etc
-        return response
-
-    def assertResponseSuccessful(self, response):
-        """Asserts that a status code lies inside the 2xx range.
-
-        :param response: :py:class:`httplib.HTTPResponse` to be
-          verified to have a status code between 200 and 299.
-
-        example::
-
-            >>> self.assertResponseSuccessful(response, 203)
-        """
-        self.assertTrue(
-            response.status >= 200 and response.status <= 299,
-            'Status code %d is outside of the expected range (2xx)\n\n%s' %
-            (response.status, response.body))
-
-    def assertResponseStatus(self, response, expected_status):
-        """Asserts a specific status code on the response.
-
-        :param response: :py:class:`httplib.HTTPResponse`
-        :param assert_status: The specific ``status`` result expected
-
-        example::
-
-            >>> self.assertResponseStatus(response, 203)
-        """
-        self.assertEqual(
-            response.status,
-            expected_status,
-            'Status code %s is not %s, as expected)\n\n%s' %
-            (response.status, expected_status, response.body))
-
-    def assertValidResponseHeaders(self, response):
-        """Ensures that response headers appear as expected."""
-        self.assertIn('X-Auth-Token', response.getheader('Vary'))
-
-    def _to_content_type(self, body, headers, content_type=None):
-        """Attempt to encode JSON and XML automatically."""
-        content_type = content_type or self.content_type
-
-        if content_type == 'json':
-            headers['Accept'] = 'application/json'
-            if body:
-                headers['Content-Type'] = 'application/json'
-                return jsonutils.dumps(body)
-        elif content_type == 'xml':
-            headers['Accept'] = 'application/xml'
-            if body:
-                headers['Content-Type'] = 'application/xml'
-                return serializer.to_xml(body)
-
-    def _from_content_type(self, response, content_type=None):
-        """Attempt to decode JSON and XML automatically, if detected."""
-        content_type = content_type or self.content_type
-
-        # make the original response body available, for convenience
-        response.raw = response.body
-
-        if response.body is not None and response.body.strip():
-            # if a body is provided, a Content-Type is also expected
-            header = response.getheader('Content-Type', None)
-            self.assertIn(self.content_type, header)
-
-            if self.content_type == 'json':
-                response.body = jsonutils.loads(response.body)
-            elif self.content_type == 'xml':
-                response.body = etree.fromstring(response.body)
-
-    def restful_request(self, headers=None, body=None, token=None, **kwargs):
-        """Serializes/deserializes json/xml as request/response body.
-
-        .. WARNING::
-
-            * Existing Accept header will be overwritten.
-            * Existing Content-Type header will be overwritten.
-
-        """
-        # Initialize headers dictionary
-        headers = {} if not headers else headers
-
-        if token is not None:
-            headers['X-Auth-Token'] = token
-
-        body = self._to_content_type(body, headers)
-
-        # Perform the HTTP request/response
-        response = self.request(headers=headers, body=body, **kwargs)
-
-        self._from_content_type(response)
-
-        # we can save some code & improve coverage by always doing this
-        if response.status >= 400:
-            self.assertValidErrorResponse(response)
-
-        # Contains the decoded response.body
-        return response
-
-    def _get_port(self, server):
-        return server.socket_info['socket'][1]
-
-    def _public_port(self):
-        return self._get_port(self.public_server)
-
-    def _admin_port(self):
-        return self._get_port(self.admin_server)
-
-    def public_request(self, port=None, **kwargs):
-        kwargs['port'] = port or self._public_port()
-        response = self.restful_request(**kwargs)
-        self.assertValidResponseHeaders(response)
-        return response
-
-    def admin_request(self, port=None, **kwargs):
-        kwargs['port'] = port or self._admin_port()
-        response = self.restful_request(**kwargs)
-        self.assertValidResponseHeaders(response)
-        return response
-
-    def get_scoped_token(self):
-        """Convenience method so that we can test authenticated requests."""
-        r = self.public_request(
-            method='POST',
-            path='/v2.0/tokens',
-            body={
-                'auth': {
-                    'passwordCredentials': {
-                        'username': self.user_foo['name'],
-                        'password': self.user_foo['password'],
-                    },
-                    'tenantId': self.tenant_bar['id'],
-                },
-            })
-        return self._get_token_id(r)
-
-    def _get_token_id(self, r):
-        """Helper method to return a token ID from a response.
-
-        This needs to be overridden by child classes for on their content type.
-
-        """
-        raise NotImplementedError()
-
-
-class CoreApiTests(object):
-    def assertValidError(self, error):
-        """Applicable to XML and JSON."""
-        try:
-            print error.attrib
-        except:
-            pass
-        self.assertIsNotNone(error.get('code'))
-        self.assertIsNotNone(error.get('title'))
-        self.assertIsNotNone(error.get('message'))
-
-    def assertValidVersion(self, version):
-        """Applicable to XML and JSON.
-
-        However, navigating links and media-types differs between content
-        types so they need to be validated seperately.
-
-        """
-        self.assertIsNotNone(version)
-        self.assertIsNotNone(version.get('id'))
-        self.assertIsNotNone(version.get('status'))
-        self.assertIsNotNone(version.get('updated'))
-
-    def assertValidExtension(self, extension):
-        """Applicable to XML and JSON.
-
-        However, navigating extension links differs between content types.
-        They need to be validated seperately with assertValidExtensionLink.
-
-        """
-        self.assertIsNotNone(extension)
-        self.assertIsNotNone(extension.get('name'))
-        self.assertIsNotNone(extension.get('namespace'))
-        self.assertIsNotNone(extension.get('alias'))
-        self.assertIsNotNone(extension.get('updated'))
-
-    def assertValidExtensionLink(self, link):
-        """Applicable to XML and JSON."""
-        self.assertIsNotNone(link.get('rel'))
-        self.assertIsNotNone(link.get('type'))
-        self.assertIsNotNone(link.get('href'))
-
-    def assertValidTenant(self, tenant):
-        """Applicable to XML and JSON."""
-        self.assertIsNotNone(tenant.get('id'))
-        self.assertIsNotNone(tenant.get('name'))
-
-    def assertValidUser(self, user):
-        """Applicable to XML and JSON."""
-        self.assertIsNotNone(user.get('id'))
-        self.assertIsNotNone(user.get('name'))
-
-    def assertValidRole(self, tenant):
-        """Applicable to XML and JSON."""
-        self.assertIsNotNone(tenant.get('id'))
-        self.assertIsNotNone(tenant.get('name'))
-
-    def test_public_multiple_choice(self):
-        r = self.public_request(path='/', expected_status=300)
-        self.assertValidMultipleChoiceResponse(r)
-
-    def test_admin_multiple_choice(self):
-        r = self.admin_request(path='/', expected_status=300)
-        self.assertValidMultipleChoiceResponse(r)
-
-    def test_public_version(self):
-        r = self.public_request(path='/v2.0/')
-        self.assertValidVersionResponse(r)
-
-    def test_admin_version(self):
-        r = self.admin_request(path='/v2.0/')
-        self.assertValidVersionResponse(r)
-
-    def test_public_extensions(self):
-        self.public_request(path='/v2.0/extensions',)
-
-        # TODO(dolph): can't test this without any public extensions defined
-        # self.assertValidExtensionListResponse(r)
-
-    def test_admin_extensions(self):
-        r = self.admin_request(path='/v2.0/extensions',)
-        self.assertValidExtensionListResponse(r)
-
-    def test_admin_extensions_404(self):
-        self.admin_request(path='/v2.0/extensions/invalid-extension',
-                           expected_status=404)
-
-    def test_public_osksadm_extension_404(self):
-        self.public_request(path='/v2.0/extensions/OS-KSADM',
-                            expected_status=404)
-
-    def test_admin_osksadm_extension(self):
-        r = self.admin_request(path='/v2.0/extensions/OS-KSADM')
-        self.assertValidExtensionResponse(r)
-
-    def test_authenticate(self):
-        r = self.public_request(
-            method='POST',
-            path='/v2.0/tokens',
-            body={
-                'auth': {
-                    'passwordCredentials': {
-                        'username': self.user_foo['name'],
-                        'password': self.user_foo['password'],
-                    },
-                    'tenantId': self.tenant_bar['id'],
-                },
-            },
-            # TODO(dolph): creating a token should result in a 201 Created
-            expected_status=200)
-        self.assertValidAuthenticationResponse(r)
-
-    def test_get_tenants_for_token(self):
-        r = self.public_request(path='/v2.0/tenants',
-                                token=self.get_scoped_token())
-        self.assertValidTenantListResponse(r)
-
-    def test_validate_token(self):
-        token = self.get_scoped_token()
-        r = self.admin_request(
-            path='/v2.0/tokens/%(token_id)s' % {
-                'token_id': token,
-            },
-            token=token)
-        self.assertValidAuthenticationResponse(r)
-
-    def test_validate_token_belongs_to(self):
-        token = self.get_scoped_token()
-        path = ('/v2.0/tokens/%s?belongsTo=%s' % (token,
-                                                  self.tenant_bar['id']))
-        r = self.admin_request(path=path, token=token)
-        self.assertValidAuthenticationResponse(r,
-                                               require_service_catalog=True)
-
-    def test_validate_token_no_belongs_to_still_returns_catalog(self):
-        token = self.get_scoped_token()
-        path = ('/v2.0/tokens/%s' % token)
-        r = self.admin_request(path=path, token=token)
-        self.assertValidAuthenticationResponse(r,
-                                               require_service_catalog=True)
-
-    def test_validate_token_head(self):
-        """The same call as above, except using HEAD.
-
-        There's no response to validate here, but this is included for the
-        sake of completely covering the core API.
-
-        """
-        token = self.get_scoped_token()
-        self.admin_request(
-            method='HEAD',
-            path='/v2.0/tokens/%(token_id)s' % {
-                'token_id': token,
-            },
-            token=token,
-            expected_status=204)
-
-    def test_endpoints(self):
-        token = self.get_scoped_token()
-        r = self.admin_request(
-            path='/v2.0/tokens/%(token_id)s/endpoints' % {
-                'token_id': token,
-            },
-            token=token)
-        self.assertValidEndpointListResponse(r)
-
-    def test_get_tenant(self):
-        token = self.get_scoped_token()
-        r = self.admin_request(
-            path='/v2.0/tenants/%(tenant_id)s' % {
-                'tenant_id': self.tenant_bar['id'],
-            },
-            token=token)
-        self.assertValidTenantResponse(r)
-
-    def test_get_user_roles(self):
-        raise nose.exc.SkipTest('Blocked by bug 933565')
-
-        token = self.get_scoped_token()
-        r = self.admin_request(
-            path='/v2.0/users/%(user_id)s/roles' % {
-                'user_id': self.user_foo['id'],
-            },
-            token=token)
-        self.assertValidRoleListResponse(r)
-
-    def test_get_user_roles_with_tenant(self):
-        token = self.get_scoped_token()
-        r = self.admin_request(
-            path='/v2.0/tenants/%(tenant_id)s/users/%(user_id)s/roles' % {
-                'tenant_id': self.tenant_bar['id'],
-                'user_id': self.user_foo['id'],
-            },
-            token=token)
-        self.assertValidRoleListResponse(r)
-
-    def test_get_user(self):
-        token = self.get_scoped_token()
-        r = self.admin_request(
-            path='/v2.0/users/%(user_id)s' % {
-                'user_id': self.user_foo['id'],
-            },
-            token=token)
-        self.assertValidUserResponse(r)
-
-    def test_error_response(self):
-        """This triggers assertValidErrorResponse by convention."""
-        self.public_request(path='/v2.0/tenants', expected_status=401)
-
-
-class JsonTestCase(RestfulTestCase, CoreApiTests):
-    content_type = 'json'
-
-    def _get_token_id(self, r):
-        """Applicable only to JSON."""
-        return r.body['access']['token']['id']
-
-    def assertValidErrorResponse(self, r):
-        self.assertIsNotNone(r.body.get('error'))
-        self.assertValidError(r.body['error'])
-        self.assertEqual(r.body['error']['code'], r.status)
-
-    def assertValidExtension(self, extension):
-        super(JsonTestCase, self).assertValidExtension(extension)
-
-        self.assertIsNotNone(extension.get('description'))
-        self.assertIsNotNone(extension.get('links'))
-        self.assertTrue(len(extension.get('links')))
-        for link in extension.get('links'):
-            self.assertValidExtensionLink(link)
-
-    def assertValidExtensionListResponse(self, r):
-        self.assertIsNotNone(r.body.get('extensions'))
-        self.assertIsNotNone(r.body['extensions'].get('values'))
-        self.assertTrue(len(r.body['extensions'].get('values')))
-        for extension in r.body['extensions']['values']:
-            self.assertValidExtension(extension)
-
-    def assertValidExtensionResponse(self, r):
-        self.assertValidExtension(r.body.get('extension'))
-
-    def assertValidAuthenticationResponse(self, r,
-                                          require_service_catalog=False):
-        self.assertIsNotNone(r.body.get('access'))
-        self.assertIsNotNone(r.body['access'].get('token'))
-        self.assertIsNotNone(r.body['access'].get('user'))
-
-        # validate token
-        self.assertIsNotNone(r.body['access']['token'].get('id'))
-        self.assertIsNotNone(r.body['access']['token'].get('expires'))
-        tenant = r.body['access']['token'].get('tenant')
-        if tenant is not None:
-            # validate tenant
-            self.assertIsNotNone(tenant.get('id'))
-            self.assertIsNotNone(tenant.get('name'))
-
-        # validate user
-        self.assertIsNotNone(r.body['access']['user'].get('id'))
-        self.assertIsNotNone(r.body['access']['user'].get('name'))
-
-        serviceCatalog = r.body['access'].get('serviceCatalog')
-        # validate service catalog
-        if require_service_catalog:
-            self.assertIsNotNone(serviceCatalog)
-        if serviceCatalog is not None:
-            self.assertTrue(len(r.body['access']['serviceCatalog']))
-            for service in r.body['access']['serviceCatalog']:
-                # validate service
-                self.assertIsNotNone(service.get('name'))
-                self.assertIsNotNone(service.get('type'))
-
-                # services contain at least one endpoint
-                self.assertIsNotNone(service.get('endpoints'))
-                self.assertTrue(len(service['endpoints']))
-                for endpoint in service['endpoints']:
-                    # validate service endpoint
-                    self.assertIsNotNone(endpoint.get('publicURL'))
-
-    def assertValidTenantListResponse(self, r):
-        self.assertIsNotNone(r.body.get('tenants'))
-        self.assertTrue(len(r.body['tenants']))
-        for tenant in r.body['tenants']:
-            self.assertValidTenant(tenant)
-            self.assertIsNotNone(tenant.get('enabled'))
-            self.assertIn(tenant.get('enabled'), [True, False])
-
-    def assertValidUserResponse(self, r):
-        self.assertIsNotNone(r.body.get('user'))
-        self.assertValidUser(r.body['user'])
-
-    def assertValidTenantResponse(self, r):
-        self.assertIsNotNone(r.body.get('tenant'))
-        self.assertValidTenant(r.body['tenant'])
-
-    def assertValidRoleListResponse(self, r):
-        self.assertIsNotNone(r.body.get('roles'))
-        self.assertTrue(len(r.body['roles']))
-        for role in r.body['roles']:
-            self.assertValidRole(role)
-
-    def assertValidVersion(self, version):
-        super(JsonTestCase, self).assertValidVersion(version)
-
-        self.assertIsNotNone(version.get('links'))
-        self.assertTrue(len(version.get('links')))
-        for link in version.get('links'):
-            self.assertIsNotNone(link.get('rel'))
-            self.assertIsNotNone(link.get('href'))
-
-        self.assertIsNotNone(version.get('media-types'))
-        self.assertTrue(len(version.get('media-types')))
-        for media in version.get('media-types'):
-            self.assertIsNotNone(media.get('base'))
-            self.assertIsNotNone(media.get('type'))
-
-    def assertValidMultipleChoiceResponse(self, r):
-        self.assertIsNotNone(r.body.get('versions'))
-        self.assertIsNotNone(r.body['versions'].get('values'))
-        self.assertTrue(len(r.body['versions']['values']))
-        for version in r.body['versions']['values']:
-            self.assertValidVersion(version)
-
-    def assertValidVersionResponse(self, r):
-        self.assertValidVersion(r.body.get('version'))
-
-    def assertValidEndpointListResponse(self, r):
-        self.assertIsNotNone(r.body.get('endpoints'))
-        self.assertTrue(len(r.body['endpoints']))
-        for endpoint in r.body['endpoints']:
-            self.assertIsNotNone(endpoint.get('id'))
-            self.assertIsNotNone(endpoint.get('name'))
-            self.assertIsNotNone(endpoint.get('type'))
-            self.assertIsNotNone(endpoint.get('publicURL'))
-            self.assertIsNotNone(endpoint.get('internalURL'))
-            self.assertIsNotNone(endpoint.get('adminURL'))
-
-    def test_service_crud_requires_auth(self):
-        """Service CRUD should 401 without an X-Auth-Token (bug 1006822)."""
-        # values here don't matter because we should 401 before they're checked
-        service_path = '/v2.0/OS-KSADM/services/%s' % uuid.uuid4().hex
-        service_body = {
-            'OS-KSADM:service': {
-                'name': uuid.uuid4().hex,
-                'type': uuid.uuid4().hex,
-            },
-        }
-
-        r = self.admin_request(method='GET',
-                               path='/v2.0/OS-KSADM/services',
-                               expected_status=401)
-        self.assertValidErrorResponse(r)
-
-        r = self.admin_request(method='POST',
-                               path='/v2.0/OS-KSADM/services',
-                               body=service_body,
-                               expected_status=401)
-        self.assertValidErrorResponse(r)
-
-        r = self.admin_request(method='GET',
-                               path=service_path,
-                               expected_status=401)
-        self.assertValidErrorResponse(r)
-
-        r = self.admin_request(method='DELETE',
-                               path=service_path,
-                               expected_status=401)
-        self.assertValidErrorResponse(r)
-
-    def test_user_role_list_requires_auth(self):
-        """User role list should 401 without an X-Auth-Token (bug 1006815)."""
-        # values here don't matter because we should 401 before they're checked
-        path = '/v2.0/tenants/%(tenant_id)s/users/%(user_id)s/roles' % {
-            'tenant_id': uuid.uuid4().hex,
-            'user_id': uuid.uuid4().hex,
-        }
-
-        r = self.admin_request(path=path, expected_status=401)
-        self.assertValidErrorResponse(r)
-
-    def test_fetch_revocation_list_nonadmin_fails(self):
-        self.admin_request(
-            method='GET',
-            path='/v2.0/tokens/revoked',
-            expected_status=401)
-
-    def test_fetch_revocation_list_admin_200(self):
-        token = self.get_scoped_token()
-        r = self.restful_request(
-            method='GET',
-            path='/v2.0/tokens/revoked',
-            token=token,
-            expected_status=200,
-            port=self._admin_port())
-        self.assertValidRevocationListResponse(r)
-
-    def assertValidRevocationListResponse(self, response):
-        self.assertIsNotNone(response.body['signed'])
-
-
-class XmlTestCase(RestfulTestCase, CoreApiTests):
-    xmlns = 'http://docs.openstack.org/identity/api/v2.0'
-    content_type = 'xml'
-
-    def _get_token_id(self, r):
-        return r.body.find(self._tag('token')).get('id')
-
-    def _tag(self, tag_name, xmlns=None):
-        """Helper method to build an namespaced element name."""
-        return '{%(ns)s}%(tag)s' % {'ns': xmlns or self.xmlns, 'tag': tag_name}
-
-    def assertValidErrorResponse(self, r):
-        xml = r.body
-        self.assertEqual(xml.tag, self._tag('error'))
-
-        self.assertValidError(xml)
-        self.assertEqual(xml.get('code'), str(r.status))
-
-    def assertValidExtension(self, extension):
-        super(XmlTestCase, self).assertValidExtension(extension)
-
-        self.assertIsNotNone(extension.find(self._tag('description')))
-        self.assertTrue(extension.find(self._tag('description')).text)
-        self.assertTrue(len(extension.findall(self._tag('link'))))
-        for link in extension.findall(self._tag('link')):
-            self.assertValidExtensionLink(link)
-
-    def assertValidExtensionListResponse(self, r):
-        xml = r.body
-        self.assertEqual(xml.tag, self._tag('extensions'))
-
-        self.assertTrue(len(xml.findall(self._tag('extension'))))
-        for extension in xml.findall(self._tag('extension')):
-            self.assertValidExtension(extension)
-
-    def assertValidExtensionResponse(self, r):
-        xml = r.body
-        self.assertEqual(xml.tag, self._tag('extension'))
-
-        self.assertValidExtension(xml)
-
-    def assertValidVersion(self, version):
-        super(XmlTestCase, self).assertValidVersion(version)
-
-        self.assertTrue(len(version.findall(self._tag('link'))))
-        for link in version.findall(self._tag('link')):
-            self.assertIsNotNone(link.get('rel'))
-            self.assertIsNotNone(link.get('href'))
-
-        media_types = version.find(self._tag('media-types'))
-        self.assertIsNotNone(media_types)
-        self.assertTrue(len(media_types.findall(self._tag('media-type'))))
-        for media in media_types.findall(self._tag('media-type')):
-            self.assertIsNotNone(media.get('base'))
-            self.assertIsNotNone(media.get('type'))
-
-    def assertValidMultipleChoiceResponse(self, r):
-        xml = r.body
-        self.assertEqual(xml.tag, self._tag('versions'))
-
-        self.assertTrue(len(xml.findall(self._tag('version'))))
-        for version in xml.findall(self._tag('version')):
-            self.assertValidVersion(version)
-
-    def assertValidVersionResponse(self, r):
-        xml = r.body
-        self.assertEqual(xml.tag, self._tag('version'))
-
-        self.assertValidVersion(xml)
-
-    def assertValidEndpointListResponse(self, r):
-        xml = r.body
-        self.assertEqual(xml.tag, self._tag('endpoints'))
-
-        self.assertTrue(len(xml.findall(self._tag('endpoint'))))
-        for endpoint in xml.findall(self._tag('endpoint')):
-            self.assertIsNotNone(endpoint.get('id'))
-            self.assertIsNotNone(endpoint.get('name'))
-            self.assertIsNotNone(endpoint.get('type'))
-            self.assertIsNotNone(endpoint.get('publicURL'))
-            self.assertIsNotNone(endpoint.get('internalURL'))
-            self.assertIsNotNone(endpoint.get('adminURL'))
-
-    def assertValidTenantResponse(self, r):
-        xml = r.body
-        self.assertEqual(xml.tag, self._tag('tenant'))
-
-        self.assertValidTenant(xml)
-
-    def assertValidUserResponse(self, r):
-        xml = r.body
-        self.assertEqual(xml.tag, self._tag('user'))
-
-        self.assertValidUser(xml)
-
-    def assertValidRoleListResponse(self, r):
-        xml = r.body
-        self.assertEqual(xml.tag, self._tag('roles'))
-
-        self.assertTrue(len(r.body.findall(self._tag('role'))))
-        for role in r.body.findall(self._tag('role')):
-            self.assertValidRole(role)
-
-    def assertValidAuthenticationResponse(self, r,
-                                          require_service_catalog=False):
-        xml = r.body
-        self.assertEqual(xml.tag, self._tag('access'))
-
-        # validate token
-        token = xml.find(self._tag('token'))
-        self.assertIsNotNone(token)
-        self.assertIsNotNone(token.get('id'))
-        self.assertIsNotNone(token.get('expires'))
-        tenant = token.find(self._tag('tenant'))
-        if tenant is not None:
-            # validate tenant
-            self.assertValidTenant(tenant)
-            self.assertIn(tenant.get('enabled'), ['true', 'false'])
-
-        user = xml.find(self._tag('user'))
-        self.assertIsNotNone(user)
-        self.assertIsNotNone(user.get('id'))
-        self.assertIsNotNone(user.get('name'))
-
-        serviceCatalog = xml.find(self._tag('serviceCatalog'))
-        # validate the serviceCatalog
-        if require_service_catalog:
-            self.assertIsNotNone(serviceCatalog)
-        if serviceCatalog is not None:
-            self.assertTrue(len(serviceCatalog.findall(self._tag('service'))))
-            for service in serviceCatalog.findall(self._tag('service')):
-                # validate service
-                self.assertIsNotNone(service.get('name'))
-                self.assertIsNotNone(service.get('type'))
-
-                # services contain at least one endpoint
-                self.assertTrue(len(service))
-                for endpoint in service.findall(self._tag('endpoint')):
-                    # validate service endpoint
-                    self.assertIsNotNone(endpoint.get('publicURL'))
-
-    def assertValidTenantListResponse(self, r):
-        xml = r.body
-        self.assertEqual(xml.tag, self._tag('tenants'))
-
-        self.assertTrue(len(r.body))
-        for tenant in r.body.findall(self._tag('tenant')):
-            self.assertValidTenant(tenant)
-            self.assertIn(tenant.get('enabled'), ['true', 'false'])

=== removed file '.pc/fix-ubuntu-tests.patch/tests/test_keystoneclient.py'
--- .pc/fix-ubuntu-tests.patch/tests/test_keystoneclient.py	2012-09-17 09:15:51 +0000
+++ .pc/fix-ubuntu-tests.patch/tests/test_keystoneclient.py	1970-01-01 00:00:00 +0000
@@ -1,1093 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2012 OpenStack LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import time
-import uuid
-import webob
-
-import nose.exc
-
-from keystone import test
-from keystone.openstack.common import jsonutils
-
-
-import default_fixtures
-
-OPENSTACK_REPO = 'https://review.openstack.org/p/openstack'
-KEYSTONECLIENT_REPO = '%s/python-keystoneclient.git' % OPENSTACK_REPO
-
-
-class CompatTestCase(test.TestCase):
-    def setUp(self):
-        super(CompatTestCase, self).setUp()
-
-        revdir = test.checkout_vendor(*self.get_checkout())
-        self.add_path(revdir)
-        self.clear_module('keystoneclient')
-
-        self.load_backends()
-        self.load_fixtures(default_fixtures)
-
-        self.public_server = self.serveapp('keystone', name='main')
-        self.admin_server = self.serveapp('keystone', name='admin')
-
-        # TODO(termie): is_admin is being deprecated once the policy stuff
-        #               is all working
-        # TODO(termie): add an admin user to the fixtures and use that user
-        # override the fixtures, for now
-        self.metadata_foobar = self.identity_api.update_metadata(
-            self.user_foo['id'], self.tenant_bar['id'],
-            dict(roles=['keystone_admin'], is_admin='1'))
-
-    def tearDown(self):
-        self.public_server.kill()
-        self.admin_server.kill()
-        self.public_server = None
-        self.admin_server = None
-        super(CompatTestCase, self).tearDown()
-
-    def _public_url(self):
-        public_port = self.public_server.socket_info['socket'][1]
-        return "http://localhost:%s/v2.0" % public_port
-
-    def _admin_url(self):
-        admin_port = self.admin_server.socket_info['socket'][1]
-        return "http://localhost:%s/v2.0" % admin_port
-
-    def _client(self, admin=False, **kwargs):
-        from keystoneclient.v2_0 import client as ks_client
-
-        url = self._admin_url() if admin else self._public_url()
-        kc = ks_client.Client(endpoint=url,
-                              auth_url=self._public_url(),
-                              **kwargs)
-        kc.authenticate()
-        # have to manually overwrite the management url after authentication
-        kc.management_url = url
-        return kc
-
-    def get_client(self, user_ref=None, tenant_ref=None, admin=False):
-        if user_ref is None:
-            user_ref = self.user_foo
-        if tenant_ref is None:
-            for user in default_fixtures.USERS:
-                if user['id'] == user_ref['id']:
-                    tenant_id = user['tenants'][0]
-        else:
-            tenant_id = tenant_ref['id']
-
-        return self._client(username=user_ref['name'],
-                            password=user_ref['password'],
-                            tenant_id=tenant_id,
-                            admin=admin)
-
-
-class KeystoneClientTests(object):
-    """Tests for all versions of keystoneclient."""
-
-    def test_authenticate_tenant_name_and_tenants(self):
-        client = self.get_client()
-        tenants = client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-    def test_authenticate_tenant_id_and_tenants(self):
-        client = self._client(username=self.user_foo['name'],
-                              password=self.user_foo['password'],
-                              tenant_id='bar')
-        tenants = client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-    def test_authenticate_invalid_tenant_id(self):
-        from keystoneclient import exceptions as client_exceptions
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self._client,
-                          username=self.user_foo['name'],
-                          password=self.user_foo['password'],
-                          tenant_id='baz')
-
-    def test_authenticate_token_no_tenant(self):
-        client = self.get_client()
-        token = client.auth_token
-        token_client = self._client(token=token)
-        tenants = token_client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-    def test_authenticate_token_tenant_id(self):
-        client = self.get_client()
-        token = client.auth_token
-        token_client = self._client(token=token, tenant_id='bar')
-        tenants = token_client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-    def test_authenticate_token_invalid_tenant_id(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client()
-        token = client.auth_token
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self._client, token=token,
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_authenticate_token_tenant_name(self):
-        client = self.get_client()
-        token = client.auth_token
-        token_client = self._client(token=token, tenant_name='BAR')
-        tenants = token_client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-    def test_authenticate_and_delete_token(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        client = self.get_client(admin=True)
-        token = client.auth_token
-        token_client = self._client(token=token)
-        tenants = token_client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-        client.tokens.delete(token_client.auth_token)
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          token_client.tenants.list)
-
-    def test_authenticate_no_password(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        user_ref = self.user_foo.copy()
-        user_ref['password'] = None
-        self.assertRaises(client_exceptions.AuthorizationFailure,
-                          self.get_client,
-                          user_ref)
-
-    def test_authenticate_no_username(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        user_ref = self.user_foo.copy()
-        user_ref['name'] = None
-        self.assertRaises(client_exceptions.AuthorizationFailure,
-                          self.get_client,
-                          user_ref)
-
-    def test_authenticate_disabled_tenant(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        admin_client = self.get_client(admin=True)
-
-        tenant = {
-            'name': uuid.uuid4().hex,
-            'description': uuid.uuid4().hex,
-            'enabled': False,
-        }
-        tenant_ref = admin_client.tenants.create(
-            tenant_name=tenant['name'],
-            description=tenant['description'],
-            enabled=tenant['enabled'])
-        tenant['id'] = tenant_ref.id
-
-        user = {
-            'name': uuid.uuid4().hex,
-            'password': uuid.uuid4().hex,
-            'email': uuid.uuid4().hex,
-            'tenant_id': tenant['id'],
-        }
-        user_ref = admin_client.users.create(
-            name=user['name'],
-            password=user['password'],
-            email=user['email'],
-            tenant_id=user['tenant_id'])
-        user['id'] = user_ref.id
-
-        # password authentication
-        self.assertRaises(
-            client_exceptions.Unauthorized,
-            self._client,
-            username=user['name'],
-            password=user['password'],
-            tenant_id=tenant['id'])
-
-        # token authentication
-        client = self._client(
-            username=user['name'],
-            password=user['password'])
-        self.assertRaises(
-            client_exceptions.Unauthorized,
-            self._client,
-            token=client.auth_token,
-            tenant_id=tenant['id'])
-
-    # FIXME(ja): this test should require the "keystone:admin" roled
-    #            (probably the role set via --keystone_admin_role flag)
-    # FIXME(ja): add a test that admin endpoint is only sent to admin user
-    # FIXME(ja): add a test that admin endpoint returns unauthorized if not
-    #            admin
-    def test_tenant_create_update_and_delete(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        tenant_name = 'original_tenant'
-        tenant_description = 'My original tenant!'
-        tenant_enabled = True
-        client = self.get_client(admin=True)
-
-        # create, get, and list a tenant
-        tenant = client.tenants.create(tenant_name=tenant_name,
-                                       description=tenant_description,
-                                       enabled=tenant_enabled)
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        tenant = client.tenants.get(tenant_id=tenant.id)
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        tenant = [t for t in client.tenants.list() if t.id == tenant.id].pop()
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        # update, get, and list a tenant
-        tenant_name = 'updated_tenant'
-        tenant_description = 'Updated tenant!'
-        tenant_enabled = False
-        tenant = client.tenants.update(tenant_id=tenant.id,
-                                       tenant_name=tenant_name,
-                                       enabled=tenant_enabled,
-                                       description=tenant_description)
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        tenant = client.tenants.get(tenant_id=tenant.id)
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        tenant = [t for t in client.tenants.list() if t.id == tenant.id].pop()
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        # delete, get, and list a tenant
-        client.tenants.delete(tenant=tenant.id)
-        self.assertRaises(client_exceptions.NotFound, client.tenants.get,
-                          tenant.id)
-        self.assertFalse([t for t in client.tenants.list()
-                         if t.id == tenant.id])
-
-    def test_tenant_create_no_name(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.BadRequest,
-                          client.tenants.create,
-                          tenant_name="")
-
-    def test_tenant_delete_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.tenants.delete,
-                          tenant=uuid.uuid4().hex)
-
-    def test_tenant_get_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.tenants.get,
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_tenant_update_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.tenants.update,
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_tenant_list(self):
-        client = self.get_client()
-        tenants = client.tenants.list()
-        self.assertEquals(len(tenants), 1)
-
-        # Admin endpoint should return *all* tenants
-        client = self.get_client(admin=True)
-        tenants = client.tenants.list()
-        self.assertEquals(len(tenants), len(default_fixtures.TENANTS))
-
-    def test_invalid_password(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        good_client = self._client(username=self.user_foo['name'],
-                                   password=self.user_foo['password'])
-        good_client.tenants.list()
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self._client,
-                          username=self.user_foo['name'],
-                          password=uuid.uuid4().hex)
-
-    def test_invalid_user_and_password(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self._client,
-                          username=uuid.uuid4().hex,
-                          password=uuid.uuid4().hex)
-
-    def test_change_password_invalidates_token(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        client = self.get_client(admin=True)
-
-        username = uuid.uuid4().hex
-        passwd = uuid.uuid4().hex
-        user = client.users.create(name=username, password=passwd,
-                                   email=uuid.uuid4().hex)
-
-        token_id = client.tokens.authenticate(username=username,
-                                              password=passwd).id
-
-        # authenticate with a token should work before a password change
-        client.tokens.authenticate(token=token_id)
-
-        client.users.update_password(user=user.id, password=uuid.uuid4().hex)
-
-        # authenticate with a token should not work after a password change
-        self.assertRaises(client_exceptions.Unauthorized,
-                          client.tokens.authenticate,
-                          token=token_id)
-
-    def test_disable_user_invalidates_token(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        admin_client = self.get_client(admin=True)
-        foo_client = self.get_client(self.user_foo)
-
-        admin_client.users.update_enabled(user=self.user_foo['id'],
-                                          enabled=False)
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          foo_client.tokens.authenticate,
-                          token=foo_client.auth_token)
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self.get_client,
-                          self.user_foo)
-
-    def test_token_expiry_maintained(self):
-        foo_client = self.get_client(self.user_foo)
-        orig_token = foo_client.service_catalog.catalog['token']
-
-        time.sleep(1.01)
-        reauthenticated_token = foo_client.tokens.authenticate(
-            token=foo_client.auth_token)
-
-        self.assertEquals(orig_token['expires'],
-                          reauthenticated_token.expires)
-
-    def test_user_create_update_delete(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        test_username = 'new_user'
-        client = self.get_client(admin=True)
-        user = client.users.create(name=test_username,
-                                   password='password',
-                                   email='[e-mail]')
-        self.assertEquals(user.name, test_username)
-
-        user = client.users.get(user=user.id)
-        self.assertEquals(user.name, test_username)
-
-        user = client.users.update(user=user,
-                                   name=test_username,
-                                   email='[e-mail]')
-        self.assertEquals(user.email, '[e-mail]')
-
-        # NOTE(termie): update_enabled doesn't return anything, probably a bug
-        client.users.update_enabled(user=user, enabled=False)
-        user = client.users.get(user.id)
-        self.assertFalse(user.enabled)
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self._client,
-                          username=test_username,
-                          password='password')
-        client.users.update_enabled(user, True)
-
-        user = client.users.update_password(user=user, password='password2')
-
-        self._client(username=test_username,
-                     password='password2')
-
-        user = client.users.update_tenant(user=user, tenant='bar')
-        # TODO(ja): once keystonelight supports default tenant
-        #           when you login without specifying tenant, the
-        #           token should be scoped to tenant 'bar'
-
-        client.users.delete(user.id)
-        self.assertRaises(client_exceptions.NotFound, client.users.get,
-                          user.id)
-
-        # Test creating a user with a tenant (auto-add to tenant)
-        user2 = client.users.create(name=test_username,
-                                    password='password',
-                                    email='[e-mail]',
-                                    tenant_id='bar')
-        self.assertEquals(user2.name, test_username)
-
-    def test_user_create_no_name(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.BadRequest,
-                          client.users.create,
-                          name="",
-                          password=uuid.uuid4().hex,
-                          email=uuid.uuid4().hex)
-
-    def test_user_create_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.create,
-                          name=uuid.uuid4().hex,
-                          password=uuid.uuid4().hex,
-                          email=uuid.uuid4().hex,
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_user_get_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.get,
-                          user=uuid.uuid4().hex)
-
-    def test_user_list_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.list,
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_user_update_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.update,
-                          user=uuid.uuid4().hex)
-
-    def test_user_update_tenant_404(self):
-        raise nose.exc.SkipTest('N/A')
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.update,
-                          user=self.user_foo['id'],
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_user_update_password_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.update_password,
-                          user=uuid.uuid4().hex,
-                          password=uuid.uuid4().hex)
-
-    def test_user_delete_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.delete,
-                          user=uuid.uuid4().hex)
-
-    def test_user_list(self):
-        client = self.get_client(admin=True)
-        users = client.users.list()
-        self.assertTrue(len(users) > 0)
-        user = users[0]
-        self.assertRaises(AttributeError, lambda: user.password)
-
-    def test_user_get(self):
-        client = self.get_client(admin=True)
-        user = client.users.get(user=self.user_foo['id'])
-        self.assertRaises(AttributeError, lambda: user.password)
-
-    def test_role_get(self):
-        client = self.get_client(admin=True)
-        role = client.roles.get(role='keystone_admin')
-        self.assertEquals(role.id, 'keystone_admin')
-
-    def test_role_crud(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        test_role = 'new_role'
-        client = self.get_client(admin=True)
-        role = client.roles.create(name=test_role)
-        self.assertEquals(role.name, test_role)
-
-        role = client.roles.get(role=role.id)
-        self.assertEquals(role.name, test_role)
-
-        client.roles.delete(role=role.id)
-
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.delete,
-                          role=role.id)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.get,
-                          role=role.id)
-
-    def test_role_create_no_name(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.BadRequest,
-                          client.roles.create,
-                          name="")
-
-    def test_role_get_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.get,
-                          role=uuid.uuid4().hex)
-
-    def test_role_delete_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.delete,
-                          role=uuid.uuid4().hex)
-
-    def test_role_list_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.roles_for_user,
-                          user=uuid.uuid4().hex,
-                          tenant=uuid.uuid4().hex)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.roles_for_user,
-                          user=self.user_foo['id'],
-                          tenant=uuid.uuid4().hex)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.roles_for_user,
-                          user=uuid.uuid4().hex,
-                          tenant=self.tenant_bar['id'])
-
-    def test_role_list(self):
-        client = self.get_client(admin=True)
-        roles = client.roles.list()
-        # TODO(devcamcar): This assert should be more specific.
-        self.assertTrue(len(roles) > 0)
-
-    def test_ec2_credential_crud(self):
-        client = self.get_client()
-        creds = client.ec2.list(user_id=self.user_foo['id'])
-        self.assertEquals(creds, [])
-
-        cred = client.ec2.create(user_id=self.user_foo['id'],
-                                 tenant_id=self.tenant_bar['id'])
-        creds = client.ec2.list(user_id=self.user_foo['id'])
-        self.assertEquals(creds, [cred])
-
-        got = client.ec2.get(user_id=self.user_foo['id'], access=cred.access)
-        self.assertEquals(cred, got)
-
-        client.ec2.delete(user_id=self.user_foo['id'], access=cred.access)
-        creds = client.ec2.list(user_id=self.user_foo['id'])
-        self.assertEquals(creds, [])
-
-    def test_ec2_credentials_create_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client()
-        self.assertRaises(client_exceptions.NotFound,
-                          client.ec2.create,
-                          user_id=uuid.uuid4().hex,
-                          tenant_id=self.tenant_bar['id'])
-        self.assertRaises(client_exceptions.NotFound,
-                          client.ec2.create,
-                          user_id=self.user_foo['id'],
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_ec2_credentials_delete_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client()
-        self.assertRaises(client_exceptions.NotFound,
-                          client.ec2.delete,
-                          user_id=uuid.uuid4().hex,
-                          access=uuid.uuid4().hex)
-
-    def test_ec2_credentials_get_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client()
-        self.assertRaises(client_exceptions.NotFound,
-                          client.ec2.get,
-                          user_id=uuid.uuid4().hex,
-                          access=uuid.uuid4().hex)
-
-    def test_ec2_credentials_list_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client()
-        self.assertRaises(client_exceptions.NotFound,
-                          client.ec2.list,
-                          user_id=uuid.uuid4().hex)
-
-    def test_ec2_credentials_list_user_forbidden(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        two = self.get_client(self.user_two)
-        self.assertRaises(client_exceptions.Forbidden, two.ec2.list,
-                          user_id=self.user_foo['id'])
-
-    def test_ec2_credentials_get_user_forbidden(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        foo = self.get_client()
-        cred = foo.ec2.create(user_id=self.user_foo['id'],
-                              tenant_id=self.tenant_bar['id'])
-
-        two = self.get_client(self.user_two)
-        self.assertRaises(client_exceptions.Forbidden, two.ec2.get,
-                          user_id=self.user_foo['id'], access=cred.access)
-
-        foo.ec2.delete(user_id=self.user_foo['id'], access=cred.access)
-
-    def test_ec2_credentials_delete_user_forbidden(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        foo = self.get_client()
-        cred = foo.ec2.create(user_id=self.user_foo['id'],
-                              tenant_id=self.tenant_bar['id'])
-
-        two = self.get_client(self.user_two)
-        self.assertRaises(client_exceptions.Forbidden, two.ec2.delete,
-                          user_id=self.user_foo['id'], access=cred.access)
-
-        foo.ec2.delete(user_id=self.user_foo['id'], access=cred.access)
-
-    def test_service_crud(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-
-        service_name = uuid.uuid4().hex
-        service_type = uuid.uuid4().hex
-        service_desc = uuid.uuid4().hex
-
-        # create & read
-        service = client.services.create(name=service_name,
-                                         service_type=service_type,
-                                         description=service_desc)
-        self.assertEquals(service_name, service.name)
-        self.assertEquals(service_type, service.type)
-        self.assertEquals(service_desc, service.description)
-
-        service = client.services.get(id=service.id)
-        self.assertEquals(service_name, service.name)
-        self.assertEquals(service_type, service.type)
-        self.assertEquals(service_desc, service.description)
-
-        service = [x for x in client.services.list() if x.id == service.id][0]
-        self.assertEquals(service_name, service.name)
-        self.assertEquals(service_type, service.type)
-        self.assertEquals(service_desc, service.description)
-
-        # update is not supported...
-
-        # delete & read
-        client.services.delete(id=service.id)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.services.get,
-                          id=service.id)
-        services = [x for x in client.services.list() if x.id == service.id]
-        self.assertEquals(len(services), 0)
-
-    def test_service_delete_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.services.delete,
-                          id=uuid.uuid4().hex)
-
-    def test_service_get_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.services.get,
-                          id=uuid.uuid4().hex)
-
-    def test_endpoint_delete_404(self):
-        # the catalog backend is expected to return Not Implemented
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.HTTPNotImplemented,
-                          client.endpoints.delete,
-                          id=uuid.uuid4().hex)
-
-    def test_admin_requires_adminness(self):
-        from keystoneclient import exceptions as client_exceptions
-        # FIXME(ja): this should be Unauthorized
-        exception = client_exceptions.ClientException
-
-        two = self.get_client(self.user_two, admin=True)  # non-admin user
-
-        # USER CRUD
-        self.assertRaises(exception,
-                          two.users.list)
-        self.assertRaises(exception,
-                          two.users.get,
-                          user=self.user_two['id'])
-        self.assertRaises(exception,
-                          two.users.create,
-                          name='oops',
-                          password='password',
-                          email='[e-mail]')
-        self.assertRaises(exception,
-                          two.users.delete,
-                          user=self.user_foo['id'])
-
-        # TENANT CRUD
-        self.assertRaises(exception,
-                          two.tenants.list)
-        self.assertRaises(exception,
-                          two.tenants.get,
-                          tenant_id=self.tenant_bar['id'])
-        self.assertRaises(exception,
-                          two.tenants.create,
-                          tenant_name='oops',
-                          description="shouldn't work!",
-                          enabled=True)
-        self.assertRaises(exception,
-                          two.tenants.delete,
-                          tenant=self.tenant_baz['id'])
-
-        # ROLE CRUD
-        self.assertRaises(exception,
-                          two.roles.get,
-                          role='keystone_admin')
-        self.assertRaises(exception,
-                          two.roles.list)
-        self.assertRaises(exception,
-                          two.roles.create,
-                          name='oops')
-        self.assertRaises(exception,
-                          two.roles.delete,
-                          role='keystone_admin')
-
-        # TODO(ja): MEMBERSHIP CRUD
-        # TODO(ja): determine what else todo
-
-
-class KcMasterTestCase(CompatTestCase, KeystoneClientTests):
-    def get_checkout(self):
-        return KEYSTONECLIENT_REPO, 'master'
-
-    def test_tenant_add_and_remove_user(self):
-        client = self.get_client(admin=True)
-        client.roles.add_user_role(tenant=self.tenant_baz['id'],
-                                   user=self.user_two['id'],
-                                   role=self.role_useless['id'])
-        user_refs = client.tenants.list_users(tenant=self.tenant_baz['id'])
-        self.assert_(self.user_two['id'] in [x.id for x in user_refs])
-        client.roles.remove_user_role(tenant=self.tenant_baz['id'],
-                                      user=self.user_two['id'],
-                                      role=self.role_useless['id'])
-        user_refs = client.tenants.list_users(tenant=self.tenant_baz['id'])
-        self.assert_(self.user_two['id'] not in [x.id for x in user_refs])
-
-    def test_user_role_add_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.add_user_role,
-                          tenant=uuid.uuid4().hex,
-                          user=self.user_foo['id'],
-                          role=self.role_useless['id'])
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.add_user_role,
-                          tenant=self.tenant_baz['id'],
-                          user=uuid.uuid4().hex,
-                          role=self.role_useless['id'])
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.add_user_role,
-                          tenant=self.tenant_baz['id'],
-                          user=self.user_foo['id'],
-                          role=uuid.uuid4().hex)
-
-    def test_user_role_remove_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.remove_user_role,
-                          tenant=uuid.uuid4().hex,
-                          user=self.user_foo['id'],
-                          role=self.role_useless['id'])
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.remove_user_role,
-                          tenant=self.tenant_baz['id'],
-                          user=uuid.uuid4().hex,
-                          role=self.role_useless['id'])
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.remove_user_role,
-                          tenant=self.tenant_baz['id'],
-                          user=self.user_foo['id'],
-                          role=uuid.uuid4().hex)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.remove_user_role,
-                          tenant=self.tenant_baz['id'],
-                          user=self.user_foo['id'],
-                          role=self.role_useless['id'])
-
-    def test_tenant_list_marker(self):
-        client = self.get_client()
-
-        # Add two arbitrary tenants to user for testing purposes
-        for i in range(2):
-            tenant_id = uuid.uuid4().hex
-            tenant = {'name': 'tenant-%s' % tenant_id, 'id': tenant_id}
-            self.identity_api.create_tenant(tenant_id, tenant)
-            self.identity_api.add_user_to_tenant(tenant_id,
-                                                 self.user_foo['id'])
-
-        tenants = client.tenants.list()
-        self.assertEqual(len(tenants), 3)
-
-        tenants_marker = client.tenants.list(marker=tenants[0].id)
-        self.assertEqual(len(tenants_marker), 2)
-        self.assertEqual(tenants[1].name, tenants_marker[0].name)
-        self.assertEqual(tenants[2].name, tenants_marker[1].name)
-
-    def test_tenant_list_marker_not_found(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        client = self.get_client()
-        self.assertRaises(client_exceptions.BadRequest,
-                          client.tenants.list, marker=uuid.uuid4().hex)
-
-    def test_tenant_list_limit(self):
-        client = self.get_client()
-
-        # Add two arbitrary tenants to user for testing purposes
-        for i in range(2):
-            tenant_id = uuid.uuid4().hex
-            tenant = {'name': 'tenant-%s' % tenant_id, 'id': tenant_id}
-            self.identity_api.create_tenant(tenant_id, tenant)
-            self.identity_api.add_user_to_tenant(tenant_id,
-                                                 self.user_foo['id'])
-
-        tenants = client.tenants.list()
-        self.assertEqual(len(tenants), 3)
-
-        tenants_limited = client.tenants.list(limit=2)
-        self.assertEqual(len(tenants_limited), 2)
-        self.assertEqual(tenants[0].name, tenants_limited[0].name)
-        self.assertEqual(tenants[1].name, tenants_limited[1].name)
-
-    def test_tenant_list_limit_bad_value(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        client = self.get_client()
-        self.assertRaises(client_exceptions.BadRequest,
-                          client.tenants.list, limit='a')
-        self.assertRaises(client_exceptions.BadRequest,
-                          client.tenants.list, limit=-1)
-
-    def test_roles_get_by_user(self):
-        client = self.get_client(admin=True)
-        roles = client.roles.roles_for_user(user=self.user_foo['id'],
-                                            tenant=self.tenant_bar['id'])
-        self.assertTrue(len(roles) > 0)
-
-    def test_user_can_update_passwd(self):
-        client = self.get_client(self.user_two)
-
-        token_id = client.auth_token
-        new_password = uuid.uuid4().hex
-
-        # TODO(derekh) : Update to use keystoneclient when available
-        class FakeResponse(object):
-            def start_fake_response(self, status, headers):
-                self.response_status = int(status.split(' ', 1)[0])
-                self.response_headers = dict(headers)
-        responseobject = FakeResponse()
-
-        req = webob.Request.blank(
-            '/v2.0/OS-KSCRUD/users/%s' % self.user_two['id'],
-            headers={'X-Auth-Token': token_id})
-        req.method = 'PATCH'
-        req.body = '{"user":{"password":"%s","original_password":"%s"}}' % \
-            (new_password, self.user_two['password'])
-        self.public_server.application(req.environ,
-                                       responseobject.start_fake_response)
-
-        self.user_two['password'] = new_password
-        self.get_client(self.user_two)
-
-    def test_user_cant_update_other_users_passwd(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        client = self.get_client(self.user_two)
-
-        token_id = client.auth_token
-        new_password = uuid.uuid4().hex
-
-        # TODO(derekh) : Update to use keystoneclient when available
-        class FakeResponse(object):
-            def start_fake_response(self, status, headers):
-                self.response_status = int(status.split(' ', 1)[0])
-                self.response_headers = dict(headers)
-        responseobject = FakeResponse()
-
-        req = webob.Request.blank(
-            '/v2.0/OS-KSCRUD/users/%s' % self.user_foo['id'],
-            headers={'X-Auth-Token': token_id})
-        req.method = 'PATCH'
-        req.body = '{"user":{"password":"%s","original_password":"%s"}}' % \
-            (new_password, self.user_two['password'])
-        self.public_server.application(req.environ,
-                                       responseobject.start_fake_response)
-        self.assertEquals(403, responseobject.response_status)
-
-        self.user_two['password'] = new_password
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self.get_client, self.user_two)
-
-    def test_tokens_after_user_update_passwd(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        client = self.get_client(self.user_two)
-
-        token_id = client.auth_token
-        new_password = uuid.uuid4().hex
-
-        # TODO(derekh) : Update to use keystoneclient when available
-        class FakeResponse(object):
-            def start_fake_response(self, status, headers):
-                self.response_status = int(status.split(' ', 1)[0])
-                self.response_headers = dict(headers)
-        responseobject = FakeResponse()
-
-        req = webob.Request.blank(
-            '/v2.0/OS-KSCRUD/users/%s' % self.user_two['id'],
-            headers={'X-Auth-Token': token_id})
-        req.method = 'PATCH'
-        req.body = '{"user":{"password":"%s","original_password":"%s"}}' % \
-            (new_password, self.user_two['password'])
-
-        rv = self.public_server.application(
-            req.environ,
-            responseobject.start_fake_response)
-        responce_json = jsonutils.loads(rv.next())
-        new_token_id = responce_json['access']['token']['id']
-
-        self.assertRaises(client_exceptions.Unauthorized, client.tenants.list)
-        client.auth_token = new_token_id
-        client.tenants.list()
-
-
-class KcEssex3TestCase(CompatTestCase, KeystoneClientTests):
-    def get_checkout(self):
-        return KEYSTONECLIENT_REPO, 'essex-3'
-
-    def test_tenant_add_and_remove_user(self):
-        client = self.get_client(admin=True)
-        client.roles.add_user_to_tenant(tenant_id=self.tenant_baz['id'],
-                                        user_id=self.user_two['id'],
-                                        role_id=self.role_useless['id'])
-        role_refs = client.roles.get_user_role_refs(
-            user_id=self.user_two['id'])
-        self.assert_(self.tenant_baz['id'] in [x.tenantId for x in role_refs])
-
-        # get the "role_refs" so we get the proper id, this is how the clients
-        # do it
-        roleref_refs = client.roles.get_user_role_refs(
-            user_id=self.user_two['id'])
-        for roleref_ref in roleref_refs:
-            if (roleref_ref.roleId == self.role_useless['id']
-                    and roleref_ref.tenantId == self.tenant_baz['id']):
-                # use python's scope fall through to leave roleref_ref set
-                break
-
-        client.roles.remove_user_from_tenant(tenant_id=self.tenant_baz['id'],
-                                             user_id=self.user_two['id'],
-                                             role_id=roleref_ref.id)
-
-        role_refs = client.roles.get_user_role_refs(
-            user_id=self.user_two['id'])
-        self.assert_(self.tenant_baz['id'] not in
-                     [x.tenantId for x in role_refs])
-
-    def test_roles_get_by_user(self):
-        client = self.get_client(admin=True)
-        roles = client.roles.get_user_role_refs(user_id='foo')
-        self.assertTrue(len(roles) > 0)
-
-    def test_role_list_404(self):
-        raise nose.exc.SkipTest('N/A')
-
-    def test_authenticate_and_delete_token(self):
-        raise nose.exc.SkipTest('N/A')
-
-    def test_user_create_update_delete(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        test_username = 'new_user'
-        client = self.get_client(admin=True)
-        user = client.users.create(name=test_username,
-                                   password='password',
-                                   email='[e-mail]')
-        self.assertEquals(user.name, test_username)
-
-        user = client.users.get(user=user.id)
-        self.assertEquals(user.name, test_username)
-
-        user = client.users.update_email(user=user, email='[e-mail]')
-        self.assertEquals(user.email, '[e-mail]')
-
-        # NOTE(termie): update_enabled doesn't return anything, probably a bug
-        client.users.update_enabled(user=user, enabled=False)
-        user = client.users.get(user.id)
-        self.assertFalse(user.enabled)
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self._client,
-                          username=test_username,
-                          password='password')
-        client.users.update_enabled(user, True)
-
-        user = client.users.update_password(user=user, password='password2')
-
-        self._client(username=test_username,
-                     password='password2')
-
-        user = client.users.update_tenant(user=user, tenant='bar')
-        # TODO(ja): once keystonelight supports default tenant
-        #           when you login without specifying tenant, the
-        #           token should be scoped to tenant 'bar'
-
-        client.users.delete(user.id)
-        self.assertRaises(client_exceptions.NotFound, client.users.get,
-                          user.id)
-
-    def test_user_update_404(self):
-        raise nose.exc.SkipTest('N/A')
-
-    def test_endpoint_create_404(self):
-        raise nose.exc.SkipTest('N/A')
-
-    def test_endpoint_delete_404(self):
-        raise nose.exc.SkipTest('N/A')
-
-
-class Kc11TestCase(CompatTestCase, KeystoneClientTests):
-    def get_checkout(self):
-        return KEYSTONECLIENT_REPO, '0.1.1'

=== removed directory '.pc/sql_connection.patch'
=== removed directory '.pc/sql_connection.patch/etc'
=== removed file '.pc/sql_connection.patch/etc/keystone.conf.sample'
--- .pc/sql_connection.patch/etc/keystone.conf.sample	2012-09-07 13:04:01 +0000
+++ .pc/sql_connection.patch/etc/keystone.conf.sample	1970-01-01 00:00:00 +0000
@@ -1,195 +0,0 @@
-[DEFAULT]
-# A "shared secret" between keystone and other openstack services
-# admin_token = ADMIN
-
-# The IP address of the network interface to listen on
-# bind_host = 0.0.0.0
-
-# The port number which the public service listens on
-# public_port = 5000
-
-# The port number which the public admin listens on
-# admin_port = 35357
-
-# The port number which the OpenStack Compute service listens on
-# compute_port = 8774
-
-# === Logging Options ===
-# Print debugging output
-# verbose = False
-
-# Print more verbose output
-# (includes plaintext request logging, potentially including passwords)
-# debug = False
-
-# Name of log file to output to. If not set, logging will go to stdout.
-# log_file = keystone.log
-
-# The directory to keep log files in (will be prepended to --logfile)
-# log_dir = /var/log/keystone
-
-# Use syslog for logging.
-# use_syslog = False
-
-# syslog facility to receive log lines
-# syslog_log_facility = LOG_USER
-
-# If this option is specified, the logging configuration file specified is
-# used and overrides any other logging options specified. Please see the
-# Python logging module documentation for details on logging configuration
-# files.
-# log_config = logging.conf
-
-# A logging.Formatter log message format string which may use any of the
-# available logging.LogRecord attributes.
-# log_format = %(asctime)s %(levelname)8s [%(name)s] %(message)s
-
-# Format string for %(asctime)s in log records.
-# log_date_format = %Y-%m-%d %H:%M:%S
-
-# onready allows you to send a notification when the process is ready to serve
-# For example, to have it notify using systemd, one could set shell command:
-# onready = systemd-notify --ready
-# or a module with notify() method:
-# onready = keystone.common.systemd
-
-[sql]
-# The SQLAlchemy connection string used to connect to the database
-# connection = sqlite:///keystone.db
-
-# the timeout before idle sql connections are reaped
-# idle_timeout = 200
-
-[identity]
-# driver = keystone.identity.backends.sql.Identity
-
-[catalog]
-# dynamic, sql-based backend (supports API/CLI-based management commands)
-# driver = keystone.catalog.backends.sql.Catalog
-
-# static, file-based backend (does *NOT* support any management commands)
-# driver = keystone.catalog.backends.templated.TemplatedCatalog
-
-# template_file = default_catalog.templates
-
-[token]
-# driver = keystone.token.backends.kvs.Token
-
-# Amount of time a token should remain valid (in seconds)
-# expiration = 86400
-
-[policy]
-# driver = keystone.policy.backends.rules.Policy
-
-[ec2]
-# driver = keystone.contrib.ec2.backends.kvs.Ec2
-
-[ssl]
-#enable = True
-#certfile = /etc/keystone/ssl/certs/keystone.pem
-#keyfile = /etc/keystone/ssl/private/keystonekey.pem
-#ca_certs = /etc/keystone/ssl/certs/ca.pem
-#cert_required = True
-
-[signing]
-#token_format = UUID
-#certfile = /etc/keystone/ssl/certs/signing_cert.pem
-#keyfile = /etc/keystone/ssl/private/signing_key.pem
-#ca_certs = /etc/keystone/ssl/certs/ca.pem
-#key_size = 1024
-#valid_days = 3650
-#ca_password = None
-#token_format = PKI
-
-[ldap]
-# url = ldap://localhost
-# user = dc=Manager,dc=example,dc=com
-# password = None
-# suffix = cn=example,cn=com
-# use_dumb_member = False
-
-# user_tree_dn = ou=Users,dc=example,dc=com
-# user_objectclass = inetOrgPerson
-# user_id_attribute = cn
-# user_name_attribute = sn
-
-# tenant_tree_dn = ou=Groups,dc=example,dc=com
-# tenant_objectclass = groupOfNames
-# tenant_id_attribute = cn
-# tenant_member_attribute = member
-# tenant_name_attribute = ou
-
-# role_tree_dn = ou=Roles,dc=example,dc=com
-# role_objectclass = organizationalRole
-# role_id_attribute = cn
-# role_member_attribute = roleOccupant
-
-[filter:debug]
-paste.filter_factory = keystone.common.wsgi:Debug.factory
-
-[filter:token_auth]
-paste.filter_factory = keystone.middleware:TokenAuthMiddleware.factory
-
-[filter:admin_token_auth]
-paste.filter_factory = keystone.middleware:AdminTokenAuthMiddleware.factory
-
-[filter:xml_body]
-paste.filter_factory = keystone.middleware:XmlBodyMiddleware.factory
-
-[filter:json_body]
-paste.filter_factory = keystone.middleware:JsonBodyMiddleware.factory
-
-[filter:user_crud_extension]
-paste.filter_factory = keystone.contrib.user_crud:CrudExtension.factory
-
-[filter:crud_extension]
-paste.filter_factory = keystone.contrib.admin_crud:CrudExtension.factory
-
-[filter:ec2_extension]
-paste.filter_factory = keystone.contrib.ec2:Ec2Extension.factory
-
-[filter:s3_extension]
-paste.filter_factory = keystone.contrib.s3:S3Extension.factory
-
-[filter:url_normalize]
-paste.filter_factory = keystone.middleware:NormalizingFilter.factory
-
-[filter:stats_monitoring]
-paste.filter_factory = keystone.contrib.stats:StatsMiddleware.factory
-
-[filter:stats_reporting]
-paste.filter_factory = keystone.contrib.stats:StatsExtension.factory
-
-[app:public_service]
-paste.app_factory = keystone.service:public_app_factory
-
-[app:admin_service]
-paste.app_factory = keystone.service:admin_app_factory
-
-[pipeline:public_api]
-pipeline = stats_monitoring url_normalize token_auth admin_token_auth xml_body json_body debug ec2_extension user_crud_extension public_service
-
-[pipeline:admin_api]
-pipeline = stats_monitoring url_normalize token_auth admin_token_auth xml_body json_body debug stats_reporting ec2_extension s3_extension crud_extension admin_service
-
-[app:public_version_service]
-paste.app_factory = keystone.service:public_version_app_factory
-
-[app:admin_version_service]
-paste.app_factory = keystone.service:admin_version_app_factory
-
-[pipeline:public_version_api]
-pipeline = stats_monitoring url_normalize xml_body public_version_service
-
-[pipeline:admin_version_api]
-pipeline = stats_monitoring url_normalize xml_body admin_version_service
-
-[composite:main]
-use = egg:Paste#urlmap
-/v2.0 = public_api
-/ = public_version_api
-
-[composite:admin]
-use = egg:Paste#urlmap
-/v2.0 = admin_api
-/ = admin_version_api

=== modified file 'AUTHORS'
--- AUTHORS	2012-09-17 09:15:51 +0000
+++ AUTHORS	2012-11-26 19:58:28 +0000
@@ -1,4 +1,5 @@
 Adam Gandelman <[e-mail]>
+Adam Young <[e-mail]530>
 Adam Young <[e-mail]>
 Adipudi Praveena <padipudi@padipudi.(none)>
 Akira YOSHIYAMA <[e-mail]>
@@ -13,6 +14,7 @@
 ayoung <[e-mail]>
 Bernhard M. Wiedemann <[e-mail]>
 Bhuvan Arumugam <[e-mail]>
+boden <[e-mail]>
 Brian Lamar <[e-mail]>
 Brian Waldon <[e-mail]>
 bsirish <[e-mail]>
@@ -23,7 +25,9 @@
 Cole Robinson <[e-mail]>
 Dan Prince <[e-mail]>
 Dan Prince <[e-mail]>
+Dan Radez <[e-mail]>
 Darren Birkett <[e-mail]>
+David Ripton <[e-mail]>
 dcramer <[e-mail]>
 Dean Troyer <[e-mail]>
 Deepak Garg <[e-mail]>
@@ -33,20 +37,25 @@
 Dmitry Khovyakov <[e-mail]>
 Dmitry Khovyakov <[e-mail]>
 Dolph Mathews <[e-mail]>
+Doug Hellmann <[e-mail]>
 Ed Leafe <[e-mail]>
 Édouard Thuleau <[e-mail]>
 Eoghan Glynn <[e-mail]>
 Everett Toews <[e-mail]>
 Ewan Mellor <[e-mail]>
 Gabriel Hurley <[e-mail]>
+galstrom21 <[e-mail]>
 Ghe Rivero <[e-mail]>
 gholt <[e-mail]>
+guang-yee <[e-mail]>
 Guang Yee <[e-mail]>
 Hengqing Hu <[e-mail]>
+Henry Nash <[e-mail]>
 Ionuț Arțăriși <[e-mail]>
 jabdul <[e-mail]>
 jakedahn <[e-mail]>
 James E. Blair <[e-mail]>
+Jaroslav Henner <[e-mail]>
 Jason Cannavale <[e-mail]>
 Jay Pipes <[e-mail]>
 J. Daniel Schmidt <[e-mail]>
@@ -59,9 +68,11 @@
 John Eo <[e-mail]>
 John Eo <[e-mail]>
 Jorge L. Williams <[e-mail]>
+Jose Castro Leon <[e-mail]>
 Joseph W. Breu <[e-mail]>
 Josh Kearney <[e-mail]>
 Julien Danjou <[e-mail]>
+Julien Danjou <[e-mail]>
 Justin Santa Barbara <[e-mail]>
 Justin Shepherd <[e-mail]>
 Ken Thomas <[e-mail]>
@@ -72,7 +83,7 @@
 leekelby <[e-mail]>
 Liem Nguyen <[e-mail]>
 Lin Hua Cheng <[e-mail]>
-lzyeval <[e-mail]>
+long-wang <[e-mail]>
 Mark Gius <[e-mail]>
 Mark McLoughlin <[e-mail]>
 Maru Newby <[e-mail]>
@@ -81,6 +92,7 @@
 Mohammed Naser <[e-mail]>
 monsterxx03 <[e-mail]>
 Monty Taylor <[e-mail]>
+OpenStack Jenkins <[e-mail]>
 Pádraig Brady <[e-mail]>
 Pádraig Brady <[e-mail]>
 Paul McMillan <[e-mail]>
@@ -103,15 +115,20 @@
 Salvatore Orlando <[e-mail]>
 Sam Morrison <[e-mail]>
 Sandy Walsh <[e-mail]>
+sathish-nagappan <[e-mail]>
 Shevek <[e-mail]>
 sirish bitra <[e-mail]>
 Sirish Bitra <[e-mail]>
 Sony K. Philip <[e-mail]>
+Stef T <[e-mail]>
 Syed Armani <[e-mail]>
 termie <[e-mail]>
 Thierry Carrez <[e-mail]>
+Tim Simpson <[e-mail]>
 Todd Willey <[e-mail]>
+Unmesh Gurjar <[e-mail]>
 Unmesh Gurjar <[e-mail]>
+Vincent Hou <[e-mail]>
 Vincent Untz <[e-mail]>
 Vishvananda Ishaya <[e-mail]>
 vishvananda <[e-mail]>
@@ -122,6 +139,6 @@
 Yong Sheng Gong <[e-mail]>
 Yun Mao <[e-mail]>
 Yuriy Taraday <[e-mail]>
-Zhongyue Luo <[e-mail]>
+Zhongyue Luo <[e-mail]>
 ziadsawalha <[e-mail]>
 Ziad Sawalha <[e-mail]>
\ No newline at end of file

=== modified file 'ChangeLog'
--- ChangeLog	2012-09-26 13:15:29 +0000
+++ ChangeLog	2012-11-26 19:58:28 +0000
@@ -1,16 +1,2048 @@
-commit 8154492da3d8b6e0e71eb7dcb5e2e3b06ddb09a7
+commit 07c1aafdf20db6d6d7c0d3e15074bc02e2f1d2aa
+Merge: d8aa7fd 01fccdb
+Author: Jenkins <[e-mail]>
+Date:   Tue Nov 20 22:12:02 2012 +0000
+
+    Merge "Expose auth failure details in debug mode"
+
+commit 01fccdb1ccc7f7e42b6487b42b6946db98fb8c44
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Nov 20 15:22:22 2012 -0600
+
+    Expose auth failure details in debug mode
+    
+    Users can now run keystone with debug = True to reveal detailed messages
+    about authentication/authorization failures. This is especially useful
+    for new users setting up OpenStack for the first time.
+    
+    Example: http://paste.openstack.org/raw/26228/
+    
+    DocImpact
+    
+    Change-Id: I0d072d1f0147b53da90cd4214a1e843bf39ee8e4
+
+ keystone/common/wsgi.py            |    4 ++--
+ keystone/contrib/ec2/core.py       |   12 +++++------
+ keystone/contrib/s3/core.py        |    2 +-
+ keystone/contrib/user_crud/core.py |   10 ++++++---
+ keystone/identity/core.py          |    7 +++---
+ keystone/service.py                |   42 ++++++++++++++++++------------------
+ 6 files changed, 40 insertions(+), 37 deletions(-)
+
+commit d8aa7fd3429dce76670c5e91df76c106a96ae0cf
+Merge: e7dcc1a 0e23490
+Author: Jenkins <[e-mail]>
+Date:   Tue Nov 20 21:43:08 2012 +0000
+
+    Merge "Utilize policy.json by default (bug 1043758)"
+
+commit e7dcc1a2540c840d5a0e5aead8f1d6cc4a628767
+Merge: 4c0f9a6 84cd8ff
+Author: Jenkins <[e-mail]>
+Date:   Tue Nov 20 21:42:59 2012 +0000
+
+    Merge "Wrap v3 API with RBAC (bug 1023943)"
+
+commit 4c0f9a6ec2f05b11bce29f2c865b01dc9ae2d8b1
+Merge: 715a17b c7066a9
+Author: Jenkins <[e-mail]>
+Date:   Tue Nov 20 20:35:09 2012 +0000
+
+    Merge "Expose authn/z failure info to API in debug mode"
+
+commit 0e23490a66ff6cafeee12fe62220a5a9eebeac20
+Author: Dolph Mathews <[e-mail]>
+Date:   Thu Aug 30 05:58:15 2012 -0500
+
+    Utilize policy.json by default (bug 1043758)
+    
+    Change-Id: I03daf10aa4f689fe323e39537c312d1e783db313
+
+ etc/keystone.conf.sample          |    8 ++++++++
+ keystone/config.py                |    2 ++
+ keystone/policy/backends/rules.py |   14 --------------
+ 3 files changed, 10 insertions(+), 14 deletions(-)
+
+commit 84cd8ff7f31a123a16114c8e1de963ede646d913
+Author: Dolph Mathews <[e-mail]>
+Date:   Thu Aug 30 05:37:26 2012 -0500
+
+    Wrap v3 API with RBAC (bug 1023943)
+    
+    Change-Id: Ie77be83054ea88bb0860260e1750196ac5ded650
+
+ etc/policy.json               |   56 ++++++++++++++++++++++++++-
+ keystone/catalog/core.py      |   29 +++++---------
+ keystone/common/controller.py |   51 ++++++++++++++++++++++++
+ keystone/identity/core.py     |   86 ++++++++++++++---------------------------
+ keystone/policy/core.py       |   11 +++---
+ 5 files changed, 151 insertions(+), 82 deletions(-)
+
+commit 715a17b71d065efe93a39721a40a4d58508d0cb6
+Merge: 438ace0 ddc8c83
+Author: Jenkins <[e-mail]>
+Date:   Tue Nov 20 20:01:58 2012 +0000
+
+    Merge "v3 Identity"
+
+commit 438ace0754b9a4e3bc2d939ba47479ec0df34375
+Merge: 55b90e3 ff669f0
+Author: Jenkins <[e-mail]>
+Date:   Tue Nov 20 20:01:31 2012 +0000
+
+    Merge "v3 Catalog"
+
+commit 55b90e303be552817fd716ab860c80f8c3ee74d0
+Merge: 64452c6 c740090
+Author: Jenkins <[e-mail]>
+Date:   Tue Nov 20 18:08:32 2012 +0000
+
+    Merge "tweaking docs to fix link to wiki Keystone page"
+
+commit ddc8c833684ff0db65553b09b87eed7b80c7075d
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Nov 9 08:32:18 2012 -0600
+
+    v3 Identity
+    
+    - v3 identity tests (bug 1023930)
+    - v3 identity implementation (bug 1023937)
+    
+    Change-Id: Ic46575afe9760d9da85e262d0cf063ea002d9dcd
+
+ keystone/clean.py                                  |   19 +-
+ .../migrate_repo/versions/007_add_domain_tables.py |   79 +++
+ keystone/exception.py                              |    8 +
+ keystone/identity/backends/kvs.py                  |   25 +
+ keystone/identity/backends/sql.py                  |  525 +++++++++++++++-----
+ tests/test_v3_identity.py                          |  349 +++++++++++++
+ 6 files changed, 886 insertions(+), 119 deletions(-)
+
+commit ff669f0da9cbf5250d8bb3e904608677f9164b6c
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Nov 20 10:28:26 2012 -0600
+
+    v3 Catalog
+    
+    - v3 catalog tests (bug 1023933)
+    - v3 catalog implementation (bug 1023938)
+    
+    Change-Id: Ie118819d25afbff62327ffc8be5b5fda2ef7f4ed
+
+ keystone/catalog/backends/kvs.py |   43 ++++++++++--
+ keystone/catalog/backends/sql.py |   61 +++++++++++-----
+ keystone/catalog/core.py         |   30 ++------
+ tests/test_backend.py            |   35 ++++++++--
+ tests/test_backend_kvs.py        |   16 -----
+ tests/test_backend_templated.py  |   17 -----
+ tests/test_keystoneclient.py     |    5 +-
+ tests/test_v3_catalog.py         |  143 ++++++++++++++++++++++++++++++++++++++
+ 8 files changed, 263 insertions(+), 87 deletions(-)
+
+commit 64452c6b55dd3b0320d0ebdd1dc2f4d122c00b2e
+Merge: c1874df 827fc4c
+Author: Jenkins <[e-mail]>
+Date:   Tue Nov 20 15:47:00 2012 +0000
+
+    Merge "v3 Policies"
+
+commit 827fc4c731189352a58390b464ea4efb5141461b
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Aug 29 02:57:38 2012 -0500
+
+    v3 Policies
+    
+    - v3 policy (bp rbac-keystone-api)
+    - v3 policy tests (bug 1023935)
+    - v3 policy implementation (bug 1023939)
+    
+    Change-Id: I163fbb67726c295fe9ed09b68cd18d2273345d29
+
+ etc/keystone.conf.sample                           |    2 +-
+ keystone/common/sql/core.py                        |    1 +
+ .../migrate_repo/versions/006_add_policy_table.py  |   36 ++++
+ keystone/config.py                                 |    2 +-
+ keystone/policy/backends/sql.py                    |  103 +++++++++++
+ keystone/policy/core.py                            |   16 +-
+ keystone/test.py                                   |    1 +
+ tests/backend_sql.conf                             |    3 +
+ tests/test_backend.py                              |   85 +++++++++
+ tests/test_backend_sql.py                          |    7 +
+ tests/test_keystoneclient.py                       |    7 +
+ tests/test_keystoneclient_sql.py                   |   75 ++++++++
+ tests/test_sql_upgrade.py                          |   32 +++-
+ tests/test_v3.py                                   |  181 ++++++++++++++++++++
+ tests/test_v3_policy.py                            |   78 +++++++++
+ 15 files changed, 607 insertions(+), 22 deletions(-)
+
+commit c1874df5c02393b24e9cfb508d9fdd5bc08e489f
+Merge: 023762d e59360d
+Author: Jenkins <[e-mail]>
+Date:   Mon Nov 19 19:39:36 2012 +0000
+
+    Merge "Import auth_token middleware from keystoneclient"
+
+commit 023762deab2b1715b1aa30cf474cb9779f1b47aa
+Merge: 71692f7 07525b1
+Author: Jenkins <[e-mail]>
+Date:   Mon Nov 19 18:00:48 2012 +0000
+
+    Merge "Refix transient test failures"
+
+commit e59360da677c4cd3f6a6391cfebb973c11e2ee47
+Author: Henry Nash <[e-mail]>
+Date:   Sat Nov 17 14:45:18 2012 +0000
+
+    Import auth_token middleware from keystoneclient
+    
+    Although the master auth_token file is now in keystoneclient, it will take
+    some time to get all the paste files to point to it there rather than here.
+    Hence, we import it back here to provide backward compatibility for a release
+    or so, after which we will remove it from the server.
+    
+    Change-Id: Iccdb7839a611cdda233e4ea96f68c64d6d82f49c
+
+ keystone/middleware/auth_token.py |  843 +------------------------------------
+ tools/pip-requires                |    1 +
+ tools/test-requires               |    1 -
+ 3 files changed, 12 insertions(+), 833 deletions(-)
+
+commit 71692f7805b62329f7367a120700b6ed050b20b4
+Merge: a92b1da 90ebf9f
+Author: Jenkins <[e-mail]>
+Date:   Fri Nov 16 18:01:10 2012 +0000
+
+    Merge "Make the controller addresses configurable."
+
+commit a92b1da0e1d4d4d8be74c6c40e3b0a56a7fa7f28
+Author: OpenStack Jenkins <[e-mail]>
+Date:   Fri Nov 16 00:01:59 2012 +0000
+
+    Imported Translations from Transifex
+    
+    Change-Id: I764e7dbb523c8720598ecbdce3d8ef997c882b2c
+
+ keystone/locale/ca/LC_MESSAGES/keystone.po |   40 ++++++++++++++++++++++++++++
+ keystone/locale/ja/LC_MESSAGES/keystone.po |   40 ++++++++++++++++++++++++++++
+ keystone/locale/keystone.pot               |    2 +-
+ 3 files changed, 81 insertions(+), 1 deletion(-)
+
+commit 07525b135f4234fdbac20f2671b6806f0b96b2e6
+Author: Alvaro Lopez Garcia <[e-mail]>
+Date:   Fri Nov 16 10:36:03 2012 +0100
+
+    Refix transient test failures
+    
+    Commit a10bd7a8eb418a4d9e84a9511ca3f0669e6e02e7 fixed the issue with
+    transient test failures, but during the rebase of the commit
+    be754ff2bc05a0d262469edd7ce8fac19d457231 the fix was lost.
+    
+    Fixes bug 1077065
+    
+    Change-Id: I14311f56e6dd0103620b58e64bf0c78c7e32f61c
+
+ tests/test_service.py |   15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+commit 90ebf9fb69c7edd803278ed9712f0de2d7f04e78
+Author: Jaroslav Henner <[e-mail]>
+Date:   Thu Nov 15 14:44:51 2012 +0100
+
+    Make the controller addresses configurable.
+    
+    The addresses in sample_data were hard-coded to localhost. This is
+    a problem when deploying not-so-all-in-one deployment -- one controller
+    and couple of compute nodes. It was also complicating access from
+    outside.
+    
+    Change-Id: Iee53c3f4376c3628e1543afb6dc7e964a3a14ab2
+
+ tools/sample_data.sh |   52 +++++++++++++++++++++++++++-----------------------
+ 1 file changed, 28 insertions(+), 24 deletions(-)
+
+commit 36a247c66134c686acd78798adbc777717543a2a
+Merge: 240d6b4 9d68b40
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 15 22:52:02 2012 +0000
+
+    Merge "Ensures User is member of tenant in ec2 validation"
+
+commit 240d6b41a04f1d24f9bfe36d4da3a57512bb80de
+Merge: 969d6a9 be754ff
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 15 17:30:40 2012 +0000
+
+    Merge "Refactor TokenController.authenticate() method."
+
+commit c7066a9fed611dc32e7c5fb490c61121cc5b68a5
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Nov 14 11:59:26 2012 -0600
+
+    Expose authn/z failure info to API in debug mode
+    
+    This allows us to raise exceptions with very specific messages:
+    
+      raise Unauthorized('User name not recognized')
+    
+    In debug mode, this feedback would be exposed to the API user; without
+    debug mode, these details are suppressed.
+    
+    Change-Id: I05c5dce3b1e2ba1123450b302e10b8ba3c265557
+
+ keystone/exception.py   |   39 +++++++++++++++++++++++--
+ tests/test_exception.py |   73 ++++++++++++++++++++++++++++++++++++++++++-----
+ 2 files changed, 102 insertions(+), 10 deletions(-)
+
+commit 969d6a9e9e943647a92bf6f457544f3d5be444d3
+Merge: 2b83d4d cdd7d65
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 15 17:18:01 2012 +0000
+
+    Merge "populate table check."
+
+commit be754ff2bc05a0d262469edd7ce8fac19d457231
+Author: Alvaro Lopez Garcia <[e-mail]>
+Date:   Mon Nov 5 10:56:40 2012 +0100
+
+    Refactor TokenController.authenticate() method.
+    
+    Change-Id: I29710f749c67cf83ccad12deee54fe6b71dd53b8
+
+ keystone/service.py          |  386 +++++++++++++++++++++++-------------------
+ tests/test_keystoneclient.py |    8 +
+ tests/test_service.py        |  280 +++++++++++++++++++++++-------
+ 3 files changed, 444 insertions(+), 230 deletions(-)
+
+commit 2b83d4da7aca79c48f2789930bd5790bf993a606
+Author: Alvaro Lopez Garcia <[e-mail]>
+Date:   Thu Nov 15 10:02:32 2012 +0100
+
+    Fix error un fixtures.
+    
+    The password field for one of the users was duplicated.
+    
+    Change-Id: I53c443a1b3ccef477b05d56dc531211593f71c70
+
+ tests/default_fixtures.py |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+commit dd382c07e70628ad708454303744b4cc4f9fe0d2
+Merge: 5c0e767 36c880e
+Author: Jenkins <[e-mail]>
+Date:   Wed Nov 14 21:14:21 2012 +0000
+
+    Merge "Reduce total number of fixtures"
+
+commit 5c0e7678f5e39f9872971768dbc822ed274bc480
+Merge: 4497923 411dde1
+Author: Jenkins <[e-mail]>
+Date:   Wed Nov 14 21:14:03 2012 +0000
+
+    Merge "Run test_keystoneclient_sql in-memory"
+
+commit 449792320f0cc787c850d106b7d868d0739334a6
+Merge: ac2d5b8 e19a62c
+Author: Jenkins <[e-mail]>
+Date:   Wed Nov 14 17:21:47 2012 +0000
+
+    Merge "Make tox.ini run pep8 checks on bin."
+
+commit 9d68b40cb9ea818c48152e6c712ff41586ad9653
+Author: Vishvananda Ishaya <[e-mail]>
+Date:   Tue Nov 13 15:49:19 2012 -0800
+
+    Ensures User is member of tenant in ec2 validation
+    
+    It is possible that a user is no longer a member of a tenant when
+    they attempt to use an ec2 token. This checks to make sure that
+    the user still has at least one valid role in the tenant before
+    authenticating them. This should automatically work for the s3
+    version as well since it is a subclass.
+    
+    Fixes bug 1064914
+    
+    Change-Id: Ieb237bae936a7b00ce7ba4d4c59aec6c7a69ec21
+
+ keystone/contrib/ec2/core.py |   17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+commit ac2d5b85b16da31ebf4833b6264961c567125249
+Author: Vishvananda Ishaya <[e-mail]>
+Date:   Tue Nov 13 15:34:00 2012 -0800
+
+    Properly list tokens with a null tenant
+    
+    We store the tenant as a null value in json, so checking to see
+    if it exists is not sufficient. This makes the check safer, checking
+    for existance and not null before continuing.
+    
+    Fixes bug 1078497
+    
+    Change-Id: Ida1b958e5df6f93a30efae0d3f71df668751ff81
+
+ keystone/token/backends/kvs.py      |   10 ++++++----
+ keystone/token/backends/memcache.py |    5 +++--
+ keystone/token/backends/sql.py      |   10 ++++++----
+ 3 files changed, 15 insertions(+), 10 deletions(-)
+
+commit 36c880eb2843b59eca57c9dcad30a787f184bdc9
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Nov 13 10:22:01 2012 -0600
+
+    Reduce total number of fixtures
+    
+    Fixtures are created before every test, so each fixture adds a
+    considerable amount of overhead to the overall test suite.
+    
+    This patch attempts to eliminate fixtures utilized by only a few tests
+    in favor of re-cycling as many fixtures as possible. As a result, a few
+    tests are refactored to depend on different fixtures.
+    
+    Change-Id: Idd4dcef5e38e304d19110c61886887fb64b4d658
+
+ keystone/test.py             |    5 ---
+ tests/default_fixtures.py    |   83 +++++++++++++++++++-----------------------
+ tests/test_backend.py        |   45 +++++++++++++----------
+ tests/test_backend_ldap.py   |   83 +++++++++++++++++++++---------------------
+ tests/test_keystoneclient.py |   18 ++++-----
+ 5 files changed, 115 insertions(+), 119 deletions(-)
+
+commit 001f708e7d9ffc69c80f823e7ab5f79325cc8a40
+Author: Jose Castro Leon <[e-mail]>
+Date:   Mon Oct 29 15:07:58 2012 +0100
+
+    Provide config file fields for enable users in LDAP backend (bug1067516)
+    
+    DocImpact
+    
+    Change-Id: I1ee9a1e2505cdd8c9ee8acba5c0e89a4f25c7262
+
+ doc/source/configuration.rst            |   89 ++++++++++++++++++++++++++++++-
+ etc/keystone.conf.sample                |    8 ++-
+ keystone/config.py                      |    8 ++-
+ keystone/identity/backends/ldap/core.py |   43 +++++++++++----
+ tests/test_backend.py                   |   32 +++++++++++
+ tests/test_backend_ldap.py              |   32 ++++++++++-
+ 6 files changed, 196 insertions(+), 16 deletions(-)
+
+commit cdd7d65b2d64732e5d2a9c83f4c5be6b087a445d
+Author: Adam Young <[e-mail]>
+Date:   Fri Nov 9 14:12:59 2012 -0500
+
+    populate table check.
+    
+    Change-Id: If82979923ba5c0193beeb1896ea5b4777dec735d
+
+ tests/test_sql_upgrade.py |   16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+commit 411dde190d474940c3f7b844c06d578c9e2dfbe5
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Nov 13 06:59:21 2012 -0600
+
+    Run test_keystoneclient_sql in-memory
+    
+    ~35% performance improvement vs an SSD on test_keystoneclient_sql
+    
+    Change-Id: Ie8c9cc0c3c56f784140998a625d943be528d5089
+
+ keystone/common/sql/core.py      |   55 +++++++++++++++++++++++++++++---------
+ tests/test_backend_sql.py        |    9 +------
+ tests/test_keystoneclient_sql.py |    8 +++---
+ tests/test_sql_upgrade.py        |    3 ++-
+ 4 files changed, 48 insertions(+), 27 deletions(-)
+
+commit e19a62c7df3d2431c41d3554e1de5f51868f0264
+Author: Dan Prince <[e-mail]>
+Date:   Fri Nov 9 14:01:55 2012 -0500
+
+    Make tox.ini run pep8 checks on bin.
+    
+    This updates the pep8 checks in our tox.ini file so that
+    we are also scanning the bin directory.
+    
+    Additionally, it updates the main pep8 check so that it scans
+    keystone properly as well. Previously there were a bunch of files
+    getting skipped due to some of the pep8 pattern matching.
+    
+    Change-Id: I13827f1c1e4155aa6979c10e981da5422391bf2d
+
+ tox.ini |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+commit c74009025f097a6a8743cc4e20a70dd29a6e558d
+Author: Joe Heck <[e-mail]>
+Date:   Sat Nov 10 15:57:59 2012 -0800
+
+    tweaking docs to fix link to wiki Keystone page
+    
+    updated docstrings to remove two errors
+    reformatted front page header to be consistent
+    added links to autogenerated python documentation
+    
+    Change-Id: I59fddc12ff458bbd0102a40d4d85903ab6bd6394
+
+ doc/source/community.rst          |    9 ++++++++-
+ doc/source/index.rst              |    4 ++--
+ keystone/common/bufferedhttp.py   |    2 ++
+ keystone/policy/backends/rules.py |   16 ++++++++--------
+ keystone/token/core.py            |    7 ++++---
+ 5 files changed, 24 insertions(+), 14 deletions(-)
+
+commit 8dcafd81dfa0ccd958b614c12eee091a325ec5c4
+Author: Dan Prince <[e-mail]>
+Date:   Fri Nov 9 13:57:53 2012 -0500
+
+    Various pep8 fixes for keystone.
+    
+    Change-Id: Id94b76d30658e75a805301b1c30b1aa28138b823
+
+ bin/keystone-all                  |    1 -
+ httpd/keystone.py                 |    2 +-
+ keystone/common/ldap/core.py      |    2 +-
+ tests/test_s3_token_middleware.py |    2 +-
+ 4 files changed, 3 insertions(+), 4 deletions(-)
+
+commit 3576cbb9ea4b040d5db7f7a63b1ca853d025e930
+Merge: 164326b 84e69a4
+Author: Jenkins <[e-mail]>
+Date:   Sat Nov 10 03:04:40 2012 +0000
+
+    Merge "Rewrite initial migration"
+
+commit 164326b433c7e8b7ff5afe4e478d346233a4062b
+Author: Vishvananda Ishaya <[e-mail]>
+Date:   Fri Nov 9 13:53:48 2012 -0800
+
+    Use the right subprocess based on os monkeypatch
+    
+    This works around the following eventlet bug:
+    
+    https://bitbucket.org/which_linden/eventlet/issue/92
+    
+    by using the green version of Popen if os has been
+    monkeypatched. It also has the side effect of making the ssl
+    calls not block the reactor for workers that use eventlet.
+    
+    Change-Id: I1457237f52310f0536fbcdcaa42174b17e8edbf5
+
+ bin/keystone-all                  |    5 ---
+ keystone/common/cms.py            |   61 ++++++++++++++++++++++---------------
+ keystone/middleware/auth_token.py |    3 +-
+ 3 files changed, 38 insertions(+), 31 deletions(-)
+
+commit a10bd7a8eb418a4d9e84a9511ca3f0669e6e02e7
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Nov 9 10:50:38 2012 -0600
+
+    Fix transient test failures (bug 1077065, bug 1045962)
+    
+    Change-Id: I45a1167a473df02a4461286b8a09723315018fcb
+
+ keystone/service.py          |    3 +--
+ keystone/test.py             |    5 +++++
+ tests/test_keystoneclient.py |   12 ++++++------
+ tests/test_service.py        |   16 ++++++++++------
+ 4 files changed, 22 insertions(+), 14 deletions(-)
+
+commit 84e69a4a8beac4a6cfa241212caa214bf8e5e112
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Nov 9 08:35:29 2012 -0600
+
+    Rewrite initial migration
+    
+    Change-Id: I3b1ad19176180717f43478048408da363b152945
+
+ .../versions/001_add_initial_tables.py             |  106 ++++++++++++++++----
+ 1 file changed, 89 insertions(+), 17 deletions(-)
+
+commit 037c06237680d5b5b753fc69eafb432c764b2bd3
+Merge: b446a77 28c52ac
+Author: Jenkins <[e-mail]>
+Date:   Fri Nov 9 02:28:34 2012 +0000
+
+    Merge "Improve feedback on test failure"
+
+commit b446a770a6740ba64b6c55eb6a2ca4b1bd4aa2aa
+Author: Alan Pevec <[e-mail]>
+Date:   Thu Nov 8 22:58:54 2012 +0100
+
+    Fix default port for identity.internalURL
+    
+    This should be the public_port and not the admin one.
+    
+    Sync with default_catalog.templates change
+    commit 773f0f84af282cd3e53650ccbb99284c37677b6a
+    
+    Change-Id: Ibb81a06607d94648993768c8b2e7161bf57195a1
+
+ tools/sample_data.sh |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 28c52ac987baa840b770e1690b2db575cd92edf4
+Author: Dolph Mathews <[e-mail]>
+Date:   Thu Nov 8 15:00:55 2012 -0600
+
+    Improve feedback on test failure
+    
+    Change-Id: Iace6a88ddfbdefe97e0ea205cda4b10c04bca0dc
+
+ tests/test_sql_upgrade.py |   20 ++++++--------------
+ 1 file changed, 6 insertions(+), 14 deletions(-)
+
+commit 9916227f9739aadd674e889d62ef539af64e3390
+Merge: 5c4e9db 7cc02c8
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 8 18:33:05 2012 +0000
+
+    Merge "fixes bug 1074172"
+
+commit 5c4e9dbcadef9a41396d78a1bfc4728db5cd55eb
+Merge: 629c1f9 2eea455
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 8 16:02:24 2012 +0000
+
+    Merge "Include 'extra' attributes twice (bug 1076120)"
+
+commit 629c1f9ea6931cad51a3a5898799811c971cd517
+Merge: 2a87700 3733170
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 8 04:37:47 2012 +0000
+
+    Merge "Fixed typo in log message"
+
+commit 7cc02c80cfb1976271fa8b6271091fcd35c1cb34
+Author: Joe Heck <[e-mail]>
+Date:   Thu Nov 1 15:36:31 2012 -0700
+
+    fixes bug 1074172
+    
+    updated diablo token based on output from diablo/stable keystone
+    added expiry to example tokens for test_auth_middleware
+    added a stack based HTTP response to test_auth_middleware to verify
+    sequencing
+    
+    Change-Id: I738b0e9c1a0e62ad86adb95ec0b73f621513f7d4
+
+ keystone/middleware/auth_token.py   |   38 ++++++++++++++--
+ tests/test_auth_token_middleware.py |   85 +++++++++++++++++++++++++++++++++++
+ 2 files changed, 120 insertions(+), 3 deletions(-)
+
+commit 2a8770014768e34b605982f16645aad7c812ab5f
+Merge: e572490 0478276
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 8 03:59:46 2012 +0000
+
+    Merge "SQL upgrade test."
+
+commit e57249095635cd8cbbfacfd2616eadcd4c2f97cf
+Merge: 7696aaa ef65550
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 8 03:59:29 2012 +0000
+
+    Merge "monkeypatch cms Popen"
+
+commit 7696aaa5bbc4d250d0c4218e6478e6ff6c7e3adc
+Merge: 126dd9c 5761a2c
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 8 03:36:32 2012 +0000
+
+    Merge "HACKING compliance: consistent use of 'except'"
+
+commit 0478276993afdb82b55606b47fae010fec32c640
+Author: Adam Young <[e-mail]>
+Date:   Tue Nov 6 17:15:50 2012 -0500
+
+    SQL upgrade test.
+    
+    Tests upgrade to version 1.
+    Confirms all of the identity tables layout.
+    
+    blueprint: normalize-sql
+    
+    Change-Id: If66250af068b396fc55f38c66f789b9447353bda
+
+ tests/test_sql_upgrade.py |  104 +++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 104 insertions(+)
+
+commit 2eea4553e23ff3c0d4d367316ea634253e11c10a
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Nov 7 15:17:52 2012 -0600
+
+    Include 'extra' attributes twice (bug 1076120)
+    
+    In order to maintain backwards-compatibility with the output of the
+    previously-broken SQL driver, non-indexed attributes are included in the
+    update user/tenant response in both the correct and expected locations.
+    
+    Change-Id: I54f69c0c4cb3ade349190bc0c61539dcc1846267
+
+ keystone/common/sql/core.py       |   13 ++++++++-
+ keystone/identity/backends/sql.py |    4 +--
+ keystone/identity/core.py         |    5 ++++
+ tests/test_backend_sql.py         |   57 +++++++++++++++++++++++++++++++++++++
+ 4 files changed, 76 insertions(+), 3 deletions(-)
+
+commit 126dd9c9bdab46074d812f4a16358357d364e789
+Merge: 6b87660 86aaff4
+Author: Jenkins <[e-mail]>
+Date:   Wed Nov 7 01:55:51 2012 +0000
+
+    Merge "Merge remote-tracking branch 'origin/feature/keystone-v3' into HEAD"
+
+commit 6b87660d91b30dcccf19c77cf999fa3f0dee84b2
+Merge: df148a0 fddacf7
+Author: Jenkins <[e-mail]>
+Date:   Tue Nov 6 22:27:42 2012 +0000
+
+    Merge "bug 1069945: generate certs for the tests in one place"
+
+commit df148a09fc1c7d44f2134a2dc6566ef1dbe772df
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Nov 6 17:01:59 2012 +0000
+
+    Return non-indexed attrs, not 'extra' (bug 1075376)
+    
+    (most of this is pulled from the v3 branch)
+    
+    Change-Id: Id1118e7a2b245fb7ec95e41ec297c87036953db2
+
+ keystone/catalog/backends/sql.py  |   34 ++--------------------
+ keystone/common/sql/core.py       |   15 +++++++++-
+ keystone/identity/backends/sql.py |   58 +++++++++----------------------------
+ keystone/token/backends/sql.py    |   18 +-----------
+ 4 files changed, 30 insertions(+), 95 deletions(-)
+
+commit fddacf7bce1de841a9fc83ce0035d85abd4f4ccd
+Author: Guang Yee <[e-mail]>
+Date:   Mon Nov 5 12:22:29 2012 -0800
+
+    bug 1069945: generate certs for the tests in one place
+    
+    and doc how to install signing certificate from an external CA
+    
+    Change-Id: I92feb8eaeea617211ee7132480ac7a63bf0a1bf1
+
+ doc/source/configuration.rst              |   87 ++++++++++-
+ examples/pki/certs/cacert.pem             |   18 +++
+ examples/pki/certs/middleware.pem         |   33 +++++
+ examples/pki/certs/signing_cert.pem       |   17 +++
+ examples/pki/certs/ssl_cert.pem           |   17 +++
+ examples/pki/cms/auth_token_revoked.json  |    1 +
+ examples/pki/cms/auth_token_revoked.pem   |   42 ++++++
+ examples/pki/cms/auth_token_scoped.json   |    1 +
+ examples/pki/cms/auth_token_scoped.pem    |   41 ++++++
+ examples/pki/cms/auth_token_unscoped.json |    1 +
+ examples/pki/cms/auth_token_unscoped.pem  |   17 +++
+ examples/pki/cms/revocation_list.json     |    1 +
+ examples/pki/cms/revocation_list.pem      |   12 ++
+ examples/pki/gen_pki.sh                   |  222 +++++++++++++++++++++++++++++
+ examples/pki/private/cakey.pem            |   16 +++
+ examples/pki/private/signing_key.pem      |   16 +++
+ examples/pki/private/ssl_key.pem          |   16 +++
+ examples/ssl/certs/ca.pem                 |   18 ---
+ examples/ssl/certs/keystone.pem           |   17 ---
+ examples/ssl/certs/middleware.pem         |   33 -----
+ examples/ssl/gen_pki.sh                   |  179 -----------------------
+ examples/ssl/private/cakey.pem            |   16 ---
+ examples/ssl/private/keystonekey.pem      |   16 ---
+ tests/signing/Makefile                    |   34 -----
+ tests/signing/README                      |   11 --
+ tests/signing/auth_token_revoked.json     |    1 -
+ tests/signing/auth_token_revoked.pem      |   40 ------
+ tests/signing/auth_token_scoped.json      |    1 -
+ tests/signing/auth_token_scoped.pem       |   40 ------
+ tests/signing/auth_token_unscoped.json    |    1 -
+ tests/signing/auth_token_unscoped.pem     |   14 --
+ tests/signing/cacert.pem                  |   18 ---
+ tests/signing/private_key.pem             |   16 ---
+ tests/signing/revocation_list.json        |    1 -
+ tests/signing/revocation_list.pem         |   11 --
+ tests/signing/signing_cert.pem            |   13 --
+ tests/test_auth_token_middleware.py       |   11 +-
+ tests/test_overrides.conf                 |    6 +-
+ tests/test_ssl.py                         |   10 +-
+ 39 files changed, 571 insertions(+), 494 deletions(-)
+
+commit ef65550328ced10be85da2370dfc64b46dfc6071
+Author: Adam Young <[e-mail]>
+Date:   Mon Nov 5 12:49:29 2012 -0500
+
+    monkeypatch cms Popen
+    
+    Bug 1074257
+    
+    Change-Id: I1372204c1e128aa664840e09b76fe979064d9efb
+
+ bin/keystone-all       |    6 ++++++
+ keystone/common/cms.py |   40 ++++++++++++++++++++++------------------
+ 2 files changed, 28 insertions(+), 18 deletions(-)
+
+commit 5761a2c55ddea29d47594365f31b69683cd4d5dd
+Author: Dolph Mathews <[e-mail]>
+Date:   Mon Nov 5 10:52:57 2012 -0600
+
+    HACKING compliance: consistent use of 'except'
+    
+    Change-Id: I8301043965e08ffdec63441e612628d9a60876b7
+
+ keystone/common/sql/core.py       |    6 +++---
+ keystone/middleware/auth_token.py |    6 +++---
+ keystone/middleware/core.py       |    2 +-
+ keystone/middleware/s3_token.py   |    4 ++--
+ tests/test_content_types.py       |    4 ----
+ tests/test_serializer.py          |    2 +-
+ 6 files changed, 10 insertions(+), 14 deletions(-)
+
+commit 86aaff4a50039a927eac2ca0db927249058bef12
+Merge: a6ef09d 399cb4c
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Nov 2 14:52:38 2012 -0500
+
+    Merge remote-tracking branch 'origin/feature/keystone-v3' into HEAD
+    
+    Conflicts:
+    	keystone/catalog/core.py
+    	keystone/identity/core.py
+    
+    Change-Id: Id47b9dd9c4da811d13454b539f78b751d40ed87d
+
+commit a6ef09d94300718197a4fa8757fd3a7a45876963
+Merge: 8ee6963 75496bb
+Author: Jenkins <[e-mail]>
+Date:   Fri Nov 2 18:29:50 2012 +0000
+
+    Merge "auth_token hash pki key PKI tokens on hash in memcached when accessed by auth_token middelware"
+
+commit 8ee69635066129b0029d61c4b8248420f994290e
+Merge: 52df60f f79f701
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 1 20:10:33 2012 +0000
+
+    Merge "Implements REMOTE_USER authentication support."
+
+commit 52df60f03e2203a7c94ab477b4fdfeed54f0cc9f
+Merge: faab62d 23aa49e
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 1 20:02:44 2012 +0000
+
+    Merge "key all backends off of hash of pki token."
+
+commit faab62d22b79554fe9b8557453622d96148ed364
+Merge: 4321c2a d95d6bf
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 1 20:02:22 2012 +0000
+
+    Merge "ignore .tox directory for pep8 in runtests"
+
+commit 75496bbe6940e72fd42dcaacbfc92b6cf92b1149
+Author: Adam Young <[e-mail]>
+Date:   Tue Oct 30 20:22:24 2012 -0400
+
+    auth_token hash pki
+    key PKI tokens on hash in memcached when accessed by auth_token
+    middelware
+    
+    Bug 1073343
+    
+    Change-Id: I32e5481f82fd110c855d7e1138c3d43c73099bbb
+
+ keystone/middleware/auth_token.py   |    5 +++--
+ tests/test_auth_token_middleware.py |   17 ++++++++++++-----
+ 2 files changed, 15 insertions(+), 7 deletions(-)
+
+commit 23aa49ee3d5d71c0cca25c7e16fb5fc7771d5c02
+Author: Adam Young <[e-mail]>
+Date:   Tue Oct 30 19:55:32 2012 -0400
+
+    key all backends off of hash of pki token.
+    
+    Bug 1073272
+    
+    Change-Id: If55b3b595fa6f3b5e773a502fc69e7da2c3bd114
+
+ keystone/common/cms.py              |   16 ++++++++++++++++
+ keystone/token/backends/kvs.py      |    3 +++
+ keystone/token/backends/memcache.py |    8 ++++----
+ keystone/token/backends/sql.py      |   10 +---------
+ keystone/token/core.py              |   10 ++++++++++
+ 5 files changed, 34 insertions(+), 13 deletions(-)
+
+commit 4321c2a5c994c0bb5654b97c4fb09197f8b9fcfa
+Merge: fdcb856 1eb9947
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 1 16:28:03 2012 +0000
+
+    Merge "don't import filter_user name, use it from the identity module"
+
+commit 1eb9947708e9a0c646a2b5101c546f0ca3f34358
+Author: Ionuț Arțăriși <[e-mail]>
+Date:   Thu Nov 1 11:54:15 2012 +0100
+
+    don't import filter_user name, use it from the identity module
+    
+    Change-Id: I9679f5dfbcc270d503adc42489b06609bbf52531
+
+ keystone/identity/backends/kvs.py       |    7 +++----
+ keystone/identity/backends/ldap/core.py |    9 ++++-----
+ keystone/identity/backends/sql.py       |   12 ++++++------
+ 3 files changed, 13 insertions(+), 15 deletions(-)
+
+commit fdcb856b138cbda4b68efa83354b98f558269371
+Author: Ionuț Arțăriși <[e-mail]>
+Date:   Tue Oct 16 10:58:50 2012 +0200
+
+    don't modify the passed in dict to from_dict
+    
+    Fixes bug 1066851
+    
+    Change-Id: Ic1f44ba1e319b9cd7e3f1da535f9d29ae7dc4030
+
+ keystone/identity/backends/kvs.py |    2 +-
+ keystone/identity/backends/sql.py |   17 +++++++++--------
+ tests/test_backend.py             |   13 +++++++++++++
+ 3 files changed, 23 insertions(+), 9 deletions(-)
+
+commit 2e4d7e5ff50f3799152ed1b9fbfb088f0154194f
+Merge: 23bb7ec 0d02e12
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 1 02:07:50 2012 +0000
+
+    Merge "move hashing user password functions to common/utils"
+
+commit 0d02e127be781e38b23702f01c3b1a6d7316c22a
+Author: Ionuț Arțăriși <[e-mail]>
+Date:   Tue Oct 30 17:08:19 2012 +0100
+
+    move hashing user password functions to common/utils
+    
+    Change-Id: I9e4204fc0c4ad0e245a8869640a64ab8f40af31d
+
+ keystone/common/utils.py                |   20 ++++++++++++++++++++
+ keystone/identity/backends/kvs.py       |   11 ++---------
+ keystone/identity/backends/ldap/core.py |   12 ++----------
+ keystone/identity/backends/sql.py       |   11 ++---------
+ 4 files changed, 26 insertions(+), 28 deletions(-)
+
+commit d95d6bfe756e28ba8ccb7f12ff5f403488c508b9
+Author: Joe Heck <[e-mail]>
+Date:   Thu Nov 1 00:18:56 2012 +0000
+
+    ignore .tox directory for pep8 in runtests
+    
+    Change-Id: I34c6f4fe8ff51221bd188fbce89ba89a56aae0b7
+
+ run_tests.sh |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+commit 23bb7ec4986fafa90b3fe2b4dfb37739e6637d4a
+Author: OpenStack Jenkins <[e-mail]>
+Date:   Thu Nov 1 00:00:58 2012 +0000
+
+    Imported Translations from Transifex
+    
+    Change-Id: If6ca1bf71b45b0e453b484ce756b926beb7d4f7f
+
+ keystone/locale/keystone.pot |   12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+commit f79f701782fa583380138e1fba702fb00bcac52e
+Author: boden <[e-mail]>
+Date:   Wed Oct 31 15:34:00 2012 -0400
+
+    Implements REMOTE_USER authentication support.
+    
+    Adds support for non-identity authentication via REMOTE_USER environ
+    context variable thereby permitting external services (paste pipeline,
+    web fronting or other) to authenticate a request.
+    
+    Also fixes a pep8 issue.
+    
+    This change is in support for blueprint
+    pluggable-identity-authentication-handlers
+    
+    Change-Id: Ib0a36b14f135dd87601e3c6d28f7874193d66b34
+
+ keystone/common/wsgi.py |    4 +++
+ keystone/service.py     |   47 +++++++++++++++++++++++++----
+ tests/test_service.py   |   77 +++++++++++++++++++++++++++++++++++++++++++----
+ 3 files changed, 116 insertions(+), 12 deletions(-)
+
+commit d3c9b1b1558008f3e01e60646dbd56c1b21e524a
+Merge: c53ffe5 27ae477
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 31 18:29:13 2012 +0000
+
+    Merge "Ignore keystone.openstack for PEP8"
+
+commit c53ffe59863a02861c3872fbc3190e7e536222a1
+Author: Ionuț Arțăriși <[e-mail]>
+Date:   Wed Oct 31 14:32:04 2012 +0100
+
+    pin sqlalchemy to 0.7
+    
+    sqlalchemy 0.8.0b1 breaks some dependencies such as sqlalchemy-migrate, pin the version until we fix them
+    
+    Fixes bug #1073569
+    
+    Change-Id: I6620276bf8f0a7cbc1d51aa226cd33c512e59a48
+
+ tools/pip-requires |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 9602284c5d5aa25a70aedf91b80828726bbd48c2
+Author: Alvaro Lopez Garcia <[e-mail]>
+Date:   Mon Oct 29 15:33:59 2012 +0100
+
+    Move 'opentack.context' and 'openstack.params' definitions to keystone.common.wsgi
+    
+    Change-Id: Idc4f6765cba20e7baadb61e355076695f36d66ea
+
+ keystone/common/wsgi.py     |   11 +++++++++--
+ keystone/middleware/core.py |    4 ++--
+ 2 files changed, 11 insertions(+), 4 deletions(-)
+
+commit fcab54b67a2221b66bb48da522a3d6fa9f6ec39e
+Author: Gabriel Hurley <[e-mail]>
+Date:   Fri Oct 26 14:47:34 2012 -0700
+
+    Removes duplicate flag for token_format.
+    
+    The token_format settings defaults to PKI, but both the
+    "PKI" and "UUID" lines were still in the sample config file.
+    This patch removes the duplicate and leaves only the
+    correct default.
+    
+    Change-Id: Ib8560952ec2aee6d6b6eda944c6ec1f96fdc5c4c
+
+ etc/keystone.conf.sample |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+commit 9916ef7b86cca98014355b1b90a7dbe36b51af2d
+Author: Tim Simpson <[e-mail]>
+Date:   Fri Oct 26 13:36:14 2012 -0500
+
+    Raise exception if openssl stderr indicates one.
+    
+    The cms module calls openssl and raises a CalledProcessError if the
+    return code is non zero. However, I've observed issues where the return
+    code is zero but the std err shows the command failed. This commit
+    changes the test to also look for the text "Error" in openssl's stderr
+    and raise CalledProcessError in that event as well.
+    
+    It also removes the keyword arg "output" to CalledProcessError as it
+    wasn't being found.
+    
+    Change-Id: I2b2a9c026557632d0c71dd6f987eaa263f387242
+
+ keystone/common/cms.py |    5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+commit 27ae4770a0603f039a1b1a41820fb8414610781f
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Oct 26 14:16:30 2012 +0000
+
+    Ignore keystone.openstack for PEP8
+    
+    tox.ini already ignores keystone.openstack, so run_tests.sh should as
+    well.
+    
+    - Fixed: No files were being ignored
+    - Removed non-existent files from ignored list
+    - Using commas to seperate ignored files
+    
+      Colons didn't work at all for me, and the pep8 man page illustrates
+      the use of commas.
+    
+    Change-Id: Icd260ba5c0fa37040f66d1f913fc7940d69eda68
+
+ run_tests.sh |   13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+commit 3649569b8943cee7bad624800f8527eb950ce1de
+Merge: cf73eb0 aea95d5
+Author: Jenkins <[e-mail]>
+Date:   Fri Oct 26 00:31:08 2012 +0000
+
+    Merge "Utilize logging instead of print()"
+
+commit cf73eb0c499c6cc02e2bde63bbeb13d25239ddca
+Merge: 51191e5 5bb5e7a
+Author: Jenkins <[e-mail]>
+Date:   Fri Oct 26 00:30:34 2012 +0000
+
+    Merge "Exception.message deprecated in py26 (bug 1070890)"
+
+commit 51191e5597211925a276062ff1d18f3d8a0f3295
+Merge: 8a29afb 9ee3fba
+Author: Jenkins <[e-mail]>
+Date:   Thu Oct 25 23:53:13 2012 +0000
+
+    Merge "Fixes 500 err on authentication for invalid body"
+
+commit 8a29afb1021a8c5787846a312c3dcd5103bb3587
+Merge: 7ca4d6b f9a9e7f
+Author: Jenkins <[e-mail]>
+Date:   Thu Oct 25 20:49:39 2012 +0000
+
+    Merge "Enable Deletion of Services with Endpoints"
+
+commit 7ca4d6b95697c8c74ec7d4887a92d054faf0752e
+Merge: 7db2f6a 0ed3165
+Author: Jenkins <[e-mail]>
+Date:   Thu Oct 25 20:21:48 2012 +0000
+
+    Merge "Update common."
+
+commit 3733170de223714978c71516310849e749ef50a3
+Author: Ralf Haferkamp <[e-mail]>
+Date:   Thu Oct 25 17:24:38 2012 +0200
+
+    Fixed typo in log message
+    
+    Change-Id: I8b6bf6f8012fb8119b32a93305cf3e1d3996f3ed
+
+ keystone/service.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 9ee3fba769274a84ea7709aa0068c19a421dbd80
+Author: Unmesh Gurjar <[e-mail]>
+Date:   Wed Oct 10 04:22:31 2012 -0700
+
+    Fixes 500 err on authentication for invalid body
+    
+    1. This fixes the 500 error on authentication when invalid request body is
+    provided, a 400 Bad Request response is returned instead.
+    2. Also added unit test coverage.
+    
+    Fixes LP: #1060709
+    
+    Change-Id: I7f2916e0b91de1e299d2dc7a245ff6c2bc548afd
+
+ keystone/service.py   |    3 +++
+ tests/test_service.py |   15 +++++++++++++++
+ 2 files changed, 18 insertions(+)
+
+commit f9a9e7f3278a3cf461acad4d688a4868c2f7ac94
+Author: sathish-nagappan <[e-mail]>
+Date:   Tue Oct 23 23:18:20 2012 -0700
+
+    Enable Deletion of Services with Endpoints
+    
+    fixes Bug #1019475
+    
+    Allows the user to delete a service that has endpoints.
+    
+    Change-Id: If2d669e50f73ea5bb7b269f941a3b2710808a98a
+
+ keystone/catalog/backends/sql.py |    1 +
+ tests/test_backend_sql.py        |   13 +++++++++++++
+ 2 files changed, 14 insertions(+)
+
+commit 7db2f6aa595e2d1261bc59750519b59daab7ab07
+Merge: 715f87d ba1df90
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 19:17:33 2012 +0000
+
+    Merge "Fix catalog when services have no URL"
+
+commit 715f87d39b454626a9220a528488c3eeab1d172c
+Merge: e9ed351 4ed1e07
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 18:12:49 2012 +0000
+
+    Merge "stop LdapIdentity.create_user from returning the user's password"
+
+commit e9ed35197be561bceb764b8f38173156b4719729
+Merge: 19224bd 9079af7
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 16:56:34 2012 +0000
+
+    Merge "making PKI default token type"
+
+commit 5bb5e7a3503536c0439aa4e1948291648c2a0277
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Oct 24 10:13:54 2012 -0500
+
+    Exception.message deprecated in py26 (bug 1070890)
+    
+    In the case of IntegrityError (e), e is wrapping a DBAPIError[1] with more
+    information about the context of the exception -- context that we do NOT
+    want to expose to our own API users (however, that context should still
+    be logged). In the case of an integrity error, str(e.orig) will produce
+    exactly what we're producing with e.message today: a user-friendly
+    message such as 'column name is not unique'
+    
+    This change should not impact what is logged or returned to the API
+    user -- just eliminate the deprecation warning.
+    
+    [1]: http://docs.sqlalchemy.org/en/rel_0_7/core/exceptions.html#sqlalchemy.exc.DBAPIError
+    
+    Change-Id: Ie3a5d93fbb5a7b90ad3b205bc8610f28b1626431
+
+ keystone/identity/backends/sql.py |    2 +-
+ keystone/service.py               |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+commit aea95d50af52524c5fb61c2210a26551005854e4
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Oct 24 08:44:03 2012 -0500
+
+    Utilize logging instead of print()
+    
+    + A bit of HACKING compliance
+    
+    Change-Id: I9e18401d9555cc316523d1b14542cd5d3ad16fe8
+
+ keystone/common/openssl.py |   83 +++++++++++++++++++++-----------------------
+ 1 file changed, 39 insertions(+), 44 deletions(-)
+
+commit 19224bddb30fa135c0cb0cedf8f0bd04103f3433
+Merge: c252b05 e94d2f9
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 12:26:23 2012 +0000
+
+    Merge "Compare token expiry without seconds"
+
+commit 4ed1e0777d8eef30aba1c231f580f2c67a025f9c
+Author: Ionuț Arțăriși <[e-mail]>
+Date:   Tue Oct 16 14:46:24 2012 +0200
+
+    stop LdapIdentity.create_user from returning the user's password
+    
+    Change-Id: Iada11c179c7dee01bccde3362f493beaef70641c
+
+ keystone/identity/backends/ldap/core.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit c252b05fc6c076e7a0f76d3d3444e60b321e1f9e
+Merge: 2d1fa1f 029cd2b
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 05:38:15 2012 +0000
+
+    Merge "add --config-dir=DIR  for keystone-all option"
+
+commit 2d1fa1f2765a19e89a8385d7034b6d8087820412
+Merge: 8e42515 f7169c1
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 05:38:08 2012 +0000
+
+    Merge "Add  --config-dir=DIR in OPTIONS"
+
+commit 8e42515115f1744c461c656dc9df6f84cab8dacc
+Merge: 6ff213d a4a97ea
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 05:37:47 2012 +0000
+
+    Merge "Extract hardcoded configuration in ldap backend (bug 1052111)"
+
+commit 6ff213d952d0efa93304de71c4604d42457da653
+Merge: bfd6194 28fb9e7
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 05:37:40 2012 +0000
+
+    Merge "move filter_user function to keystone.identity.core"
+
+commit bfd61949bdd75d3f373d77d86ac89085a220f0d0
+Merge: 3b69d7e 8f44c39
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 05:11:23 2012 +0000
+
+    Merge "Add trove classifiers for PyPI"
+
+commit 3b69d7ea9373b366dd239424b64f4dc47aad4801
+Merge: e89c762 7ac4d52
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 05:02:58 2012 +0000
+
+    Merge "Fixes response for missing credentials in auth"
+
+commit e89c762a4115402935cd9d406f5fd096ceb0c701
+Merge: e0f9ad5 eb6681f
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 05:02:39 2012 +0000
+
+    Merge "Fix Not Found error, when router not match."
+
+commit e0f9ad5d124686926fdcc17d927bc220be7928fa
+Merge: c6f26ff 00127ab
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 05:02:23 2012 +0000
+
+    Merge "Adding handling for get user/tenant by name"
+
+commit c6f26ff48147e04921ac812128df3f94c808c80e
+Merge: fbeb9ad 0dc2e9c
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 05:01:47 2012 +0000
+
+    Merge "bug 1068674"
+
+commit fbeb9ad506d4304e93de362d73d117d0f4405c91
+Merge: c6884c5 0fded56
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 24 03:20:55 2012 +0000
+
+    Merge "Raise 400 if credentials not provided (bug 1044032)"
+
+commit e94d2f9aa2a46082f35933505f3eb6a668493ff4
+Author: Adam Young <[e-mail]>
+Date:   Tue Oct 23 22:39:04 2012 -0400
+
+    Compare token expiry without seconds
+    
+    There is a rounding problem that occurs periodically.  Token expiration
+    Does not need to be confirmed to this level of granularity.
+    
+    Bug 1045962
+    
+    Change-Id: I361c5cf309c47b142c35c4359234fd0e44005e5a
+
+ tests/test_keystoneclient.py |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+commit c6884c54a4946441039d8464af0790c517ae43fc
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Oct 23 18:01:31 2012 -0500
+
+    Moved SQL backend tests into memory
+    
+    (test_keystoneclient_sql still uses a db on disk)
+    
+    Change-Id: I476ee710983adbe3436f41882e8483f8193daf5c
+
+ keystone/common/sql/core.py      |   45 ++++++++++++-------------
+ tests/backend_sql.conf           |    2 +-
+ tests/backend_sql_disk.conf      |    2 ++
+ tests/test_backend_sql.py        |   68 +++++++++++++++++---------------------
+ tests/test_import_legacy.py      |    3 +-
+ tests/test_keystoneclient_sql.py |    3 +-
+ tests/test_migrate_nova_auth.py  |    3 +-
+ 7 files changed, 61 insertions(+), 65 deletions(-)
+
+commit f33e9f02791e6dd39c36ad5f6030c0295e6be568
+Merge: b0ec911 cb12209
+Author: Jenkins <[e-mail]>
+Date:   Tue Oct 23 21:29:13 2012 +0000
+
+    Merge "Fixes Bug 1063852"
+
+commit 8f44c3933e4c91146f3027bf1a40bc708efbe601
+Author: Doug Hellmann <[e-mail]>
+Date:   Tue Oct 23 11:25:18 2012 -0400
+
+    Add trove classifiers for PyPI
+    
+    Add classifiers so we can eventually register the project
+    on PyPI to reserve the name, even though we won't release
+    packages there.
+    
+    Change-Id: I9ef676ffd4a84cb149d7f5b6998c16c46e4181b8
+    Signed-off-by: Doug Hellmann <[e-mail]>
+
+ setup.py |   10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+commit b0ec91127064e1431aa3d88beb35d08b4cd91821
+Merge: 4f71ec9 bc155af
+Author: Jenkins <[e-mail]>
+Date:   Tue Oct 23 14:44:59 2012 +0000
+
+    Merge "Document PKI configuration and management"
+
+commit 00127ab614174f0f2a7f84769e568e14b6083bd6
+Author: galstrom21 <[e-mail]>
+Date:   Tue Oct 9 23:32:20 2012 -0500
+
+    Adding handling for get user/tenant by name
+    
+    * /v2.0/tenants?name=<tenant_name>
+    * /v2.0/user?name=<user_name>
+    * added get_tenant_by_name() to tests/test_content_types.py
+    * added get_user_by_name() to tests/test_content_types.py
+    
+    bug 1055763
+    
+    Change-Id: Id30dc853db12e155238fbb39cef6a081284cb86c
+
+ keystone/identity/core.py   |   17 +++++++++++++++++
+ tests/test_content_types.py |   18 ++++++++++++++++++
+ 2 files changed, 35 insertions(+)
+
+commit 4f71ec9e5dd632b1c4586b63f89525a6161c2b57
+Author: guang-yee <[e-mail]>
+Date:   Mon Oct 22 12:49:22 2012 -0700
+
+    Fixed bug 1068851. Refreshed new crypto for the SSL tests.
+    
+    Change-Id: Ib37547923a9da347835a9b2c51deae6b954e1ead
+
+ examples/ssl/certs/ca.pem            |   36 +++----
+ examples/ssl/certs/keystone.pem      |   75 +++-----------
+ examples/ssl/certs/middleware.pem    |  106 ++++++--------------
+ examples/ssl/gen_pki.sh              |  179 ++++++++++++++++++++++++++++++++++
+ examples/ssl/private/cakey.pem       |   34 +++----
+ examples/ssl/private/keystonekey.pem |   31 +++---
+ 6 files changed, 273 insertions(+), 188 deletions(-)
+
+commit 28fb9e73eb77d09f542dfefbf063fe2065273ce3
+Author: Ionuț Arțăriși <[e-mail]>
+Date:   Tue Oct 16 14:45:44 2012 +0200
+
+    move filter_user function to keystone.identity.core
+    
+    Change-Id: Idf0e1d27fc0b79d9125f780e4295b5c20a535dec
+
+ keystone/identity/backends/kvs.py       |   15 ++++-----------
+ keystone/identity/backends/ldap/core.py |   15 +++++----------
+ keystone/identity/backends/sql.py       |   17 ++++++-----------
+ keystone/identity/core.py               |   13 +++++++++++++
+ 4 files changed, 28 insertions(+), 32 deletions(-)
+
+commit 7ac4d521103afa80c8f69c6b214a227c6a9346e3
+Author: Unmesh Gurjar <[e-mail]>
+Date:   Thu Oct 11 03:49:28 2012 -0700
+
+    Fixes response for missing credentials in auth
+    
+    1. If username or password parameters are not specified in the authentication
+    request, API returns 401 response. Fixed this to return a 400 Bad Request
+    instead.
+    2. Also added unit test coverage.
+    
+    Fixes LP: #1060723
+    
+    Change-Id: I4861d5b989a151d8fce20f012bb0878b06b9b559
+
+ keystone/service.py   |   10 ++++++++++
+ tests/test_service.py |   51 +++++++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 61 insertions(+)
+
+commit 9079af7190433dab76b4758b78adad36be867560
+Author: Joe Heck <[e-mail]>
+Date:   Fri Oct 19 12:45:35 2012 -0700
+
+    making PKI default token type
+    
+    Change-Id: I136a1ff1d9dc4bd6423522684123ce33dc695415
+
+ keystone/config.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit cb122095cfdbe86bdde3950fa69f4676e0d3de1c
+Author: Adam Young <[e-mail]>
+Date:   Mon Oct 8 11:20:24 2012 -0400
+
+    Fixes Bug 1063852
+    
+    Add in the issue time, to prevent a race condition where a token is issued and
+    revoked, and then a request for an additional token is processed identical
+    to the first.  Each token now contains the issue time to make it unique.
+    
+    (moving changing default to PKI to separate review)
+    
+    Change-Id: I26ed5b3bb31840f5baaf64dbcbeac477e4d71afd
+
+ keystone/service.py |    2 ++
+ 1 file changed, 2 insertions(+)
+
+commit 0dc2e9ca37497597aa49439e3d3e71c22f30b515
+Author: Ken Thomas <[e-mail]>
+Date:   Fri Oct 19 14:42:55 2012 +0000
+
+    bug 1068674
+    
+    Redo part of bp/sql-identiy-pam that was accidently undone by bug 968519.
+    
+    We encapsulated the call to utils.check_password with a local method,
+    _check_password, to make it easier to subclass Identity. This allows us
+    to use a different password checker without having to replace the entire
+    authenticate method in our code.  The fix for 968519 accidently removed
+    the call to the local method. *This* fix puts that call back in.
+    
+    Updating comment because Jenkins failed due to build timeout in
+    unrelated test.
+    
+    Change-Id: I69a3ba2d5a62e4c600edab7ef2cc07413c7360cc
+
+ keystone/identity/backends/sql.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 0ed3165250fee0d90b0d7aa7bf443072312d4642
+Author: Michael Still <[e-mail]>
+Date:   Thu Oct 18 11:43:21 2012 -0700
+
+    Update common.
+    
+    Change-Id: I161ee53e0e087da963b62ac5353d3bdf04b5cc22
+
+ keystone/openstack/common/iniparser.py |    2 +-
+ keystone/openstack/common/setup.py     |  274 ++++++++++++++++++++++++++------
+ keystone/openstack/common/timeutils.py |   20 ++-
+ 3 files changed, 242 insertions(+), 54 deletions(-)
+
+commit a4a97eabb8bde395753de330f76085e69290cdfe
+Author: Jose Castro Leon <[e-mail]>
+Date:   Tue Oct 16 23:25:03 2012 +0200
+
+    Extract hardcoded configuration in ldap backend (bug 1052111)
+    
+    Change-Id: I128b0ccdb32694a4fc2f660e73c367aa8b01f257
+
+ etc/keystone.conf.sample                |    8 ++
+ keystone/common/ldap/core.py            |    7 +-
+ keystone/config.py                      |   24 +++++-
+ keystone/identity/backends/ldap/core.py |   29 +++++---
+ tests/default_fixtures.py               |   12 +++
+ tests/test_backend_ldap.py              |  122 +++++++++++++++++++++++++++++++
+ 6 files changed, 190 insertions(+), 12 deletions(-)
+
+commit eb6681fca927b3296bbc43ee0fec6d034e83cbea
+Author: long-wang <[e-mail]>
+Date:   Mon Oct 15 15:25:33 2012 +0800
+
+    Fix Not Found error, when router not match.
+    
+    Fixes bug 1065234
+    
+    when the router not match, keystone should return 404 error with
+    json format or xml format. Not the webob.exc.HTTPNotFound() in
+    html format.
+    
+    Change-Id: I88e873b65db5df8393c0bb22db0e98712d77e350
+
+ keystone/common/wsgi.py |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+commit 029cd2be676d26fb76b1ccd5062170a435611142
+Author: long-wang <[e-mail]>
+Date:   Sat Oct 13 21:45:59 2012 +0800
+
+    add --config-dir=DIR  for keystone-all option
+    
+    Change-Id: I0c9e1fdc05714a11accd2845fa031ac8e09b1028
+
+ doc/source/man/keystone-all.rst |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+commit f7169c11270dbdeabc56f942b47bc698b54afde5
+Author: long-wang <[e-mail]>
+Date:   Sat Oct 13 21:38:03 2012 +0800
+
+    Add  --config-dir=DIR in OPTIONS
+    
+    Change-Id: I51c426bdc0610b59aeecc4512c797e709021eb14
+
+ doc/source/man/keystone-manage.rst |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+commit d05d1128490377e4c50311c40d0901aa5b63c4bc
+Author: Jose Castro Leon <[e-mail]>
+Date:   Fri Oct 12 08:49:50 2012 +0200
+
+    Delete role does not delete role assignments in tenants (bug 1057436)
+    
+    Change-Id: I2474c2a74135470162030a243491ced59533c024
+
+ keystone/identity/backends/kvs.py       |   11 +++++++++++
+ keystone/identity/backends/ldap/core.py |   13 +++++++++++++
+ keystone/identity/backends/sql.py       |   11 +++++++++++
+ tests/test_backend.py                   |   10 ++++++++++
+ 4 files changed, 45 insertions(+)
+
+commit 8b6b07faed21df8d1a9832df105d72dc5c834398
+Author: Dan Radez <[e-mail]>
+Date:   Mon Oct 8 17:30:41 2012 -0400
+
+    replacing PKI token detection from content length to content prefix. (bug 1060389)
+    
+    Change-Id: I68b0e4126f2e339c04271fd982f5f5dab198c630
+
+ keystone/common/cms.py            |   44 ++++++++++++++++++++++++++++++++++++-
+ keystone/middleware/auth_token.py |    2 +-
+ keystone/service.py               |    2 +-
+ keystone/token/backends/sql.py    |    2 +-
+ 4 files changed, 46 insertions(+), 4 deletions(-)
+
+commit f955266f4ad5727996b7b04c94b41f47aa667dbd
+Merge: fa98220 df8d6cc
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 10 21:09:20 2012 +0000
+
+    Merge "Filter users in LDAP backend (bug 1052925)"
+
+commit bc155af82735093b211a2d75cd43475559840f18
+Author: Adam Young <[e-mail]>
+Date:   Tue Oct 9 20:13:34 2012 -0400
+
+    Document PKI configuration and management
+    
+    Bug 1064585
+    
+    Change-Id: I2faf2d998a208218635e10c24cae06768934d494
+
+ doc/source/configuration.rst       |   34 ++++++++++++++++++++++++++++++++++
+ doc/source/man/keystone-manage.rst |    2 ++
+ 2 files changed, 36 insertions(+)
+
+commit fa98220aac1876468f595f4842edf4f682a6db1a
+Author: David Ripton <[e-mail]>
+Date:   Wed Oct 10 13:06:10 2012 -0400
+
+    Raise if we see incorrect keyword args "condition" or "methods"
+    
+    Fixes bug 927879
+    
+    We crawl the AST of the set of modules that make routing calls, looking
+    for keyword arguments called "condition" (should be "conditions") or
+    "methods" (should be "method"), and raise if we see any.
+    
+    Change-Id: I32aa140967b80d83a10db898df28e41189675d77
+
+ tests/test_singular_plural.py |   52 +++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 52 insertions(+)
+
+commit df8d6cc719d2af514794bfd29bc9eb63271e2079
+Author: Jose Castro Leon <[e-mail]>
+Date:   Wed Oct 10 08:46:51 2012 +0200
+
+    Filter users in LDAP backend (bug 1052925)
+    
+    Change-Id: I004e569756698098bf073f5516945f356f88bfea
+
+ etc/keystone.conf.sample                |    3 +++
+ keystone/common/ldap/core.py            |   17 +++++++++----
+ keystone/config.py                      |    3 +++
+ keystone/identity/backends/ldap/core.py |    9 +++----
+ tests/test_backend_ldap.py              |   40 +++++++++++++++++++++++++++++++
+ 5 files changed, 63 insertions(+), 9 deletions(-)
+
+commit 3ec3c7aed1728f0a0b48097cfc472b68dfd902db
+Merge: b0eb94d 9de5309
+Author: Jenkins <[e-mail]>
+Date:   Wed Oct 10 05:22:22 2012 +0000
+
+    Merge "Use setup.py develop to insert code into venv."
+
+commit b0eb94dbc0aff690fcbde6d49c3ad5c6578eb7b5
+Merge: 8236d3b ee48c24
+Author: Jenkins <[e-mail]>
+Date:   Tue Oct 9 18:51:39 2012 +0000
+
+    Merge "Unable to delete tenant if contains roles in LDAP backend (bug 1057407)"
+
+commit 9de5309496dfbd8a986ca40bf50f94f728db09fe
+Author: Monty Taylor <[e-mail]>
+Date:   Tue Oct 9 08:46:40 2012 -0700
+
+    Use setup.py develop to insert code into venv.
+    
+    Change-Id: I41ebfe5165aa315ea6c9900f10e48ad6fb9e1e6f
+
+ tools/install_venv.py |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+commit 8236d3b4f6945f6057252e6bc195bec103e9b12d
+Merge: e7fdf93 8152c2c
+Author: Jenkins <[e-mail]>
+Date:   Tue Oct 9 13:56:33 2012 +0000
+
+    Merge "Configurable actions on LDAP backend in users Active Directory (bug 1052929)"
+
+commit 0fded564f12e62cba2e163ef74074d03b5d2347f
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Oct 9 09:22:03 2012 +0000
+
+    Raise 400 if credentials not provided (bug 1044032)
+    
+    This request:
+    
+        POST /v2.0/tokens
+    
+        {
+            "auth": {
+                "RAX-KSKEY:apiKeyCredentials": {
+                    "apiKey": "pass",
+                    "tenantName": "admin",
+                    "username": "admin"
+                }
+            }
+        }
+    
+    Now results in:
+    
+        400 Bad Request
+    
+        {
+            "error": {
+                "code": 400,
+                "message": "Expecting to find passwordCredentials or token in auth. The server could not comply with the request since it is eithermalformed or otherwise incorrect. The client is assumed to be in error.",
+                "title": "Bad Request"
+            }
+        }
+    
+    Change-Id: I5caf2b15b1bf60e0e31e8afcc7fc227744bd933a
+
+ keystone/service.py |    3 +++
+ 1 file changed, 3 insertions(+)
+
+commit ba1df90656f9bcff4d769b18042f731a6d295faa
+Author: Julien Danjou <[e-mail]>
+Date:   Thu Oct 4 19:24:10 2012 +0200
+
+    Fix catalog when services have no URL
+    
+    This fixes bug #1061736
+    
+    Change-Id: Ic8f7a45dfabb2e3fb40f6aa6cd4c0f29c13f2c77
+    Signed-off-by: Julien Danjou <[e-mail]>
+
+ keystone/catalog/backends/sql.py       |    9 +++-----
+ keystone/catalog/backends/templated.py |    1 -
+ keystone/catalog/core.py               |    4 +++-
+ tests/test_backend_sql.py              |   38 ++++++++++++++++++++++++++++++++
+ 4 files changed, 44 insertions(+), 8 deletions(-)
+
+commit e7fdf934f5a082dc58a542b54e1eb24b9054af2d
+Merge: 139c397 a225624
+Author: Jenkins <[e-mail]>
+Date:   Mon Oct 8 01:29:15 2012 +0000
+
+    Merge "Unparseable endpoint URL's should raise friendly error"
+
+commit 139c3973ba67b984181ca88656ba7aeb17edabda
+Merge: 8b006ff c585193
+Author: Jenkins <[e-mail]>
+Date:   Sun Oct 7 23:49:31 2012 +0000
+
+    Merge "Replaced underscores with dashes"
+
+commit 8b006ffa45e9ba59ec68ed6cdc37c11c5d8ac17d
+Merge: 1262a07 fecf7f3
+Author: Jenkins <[e-mail]>
+Date:   Sat Oct 6 23:16:53 2012 +0000
+
+    Merge "Command line switch for standard threads."
+
+commit a225624a67825e8be430350221073c43f90e97e4
+Author: Stef T <[e-mail]>
+Date:   Fri Oct 5 21:18:43 2012 -0400
+
+    Unparseable endpoint URL's should raise friendly error
+    
+      fixes bug #1058494
+    
+    Change-Id: Id89c530e2f4e7dcf0db03515afb8b2a85fbf8077
+
+ keystone/catalog/backends/sql.py       |   12 +++++++-----
+ keystone/catalog/backends/templated.py |    3 ++-
+ keystone/catalog/core.py               |   22 ++++++++++++++++++++++
+ keystone/exception.py                  |    4 ++++
+ tests/test_backend.py                  |   16 ++++++++++++++++
+ tests/test_backend_sql.py              |   11 +++++++++++
+ tests/test_backend_templated.py        |    6 ++++++
+ 7 files changed, 68 insertions(+), 6 deletions(-)
+
+commit 8152c2cb8698ce1fc868c02f2fa4d4301afc5738
+Author: Jose Castro Leon <[e-mail]>
+Date:   Thu Sep 20 09:15:05 2012 +0200
+
+    Configurable actions on LDAP backend in users Active Directory (bug 1052929)
+    
+    Change-Id: I99092eb4aee3b3b1b9cf297561577f1915c0e886
+
+ etc/keystone.conf.sample                |    9 ++
+ keystone/common/ldap/core.py            |   21 +++++
+ keystone/config.py                      |   10 ++-
+ keystone/identity/backends/ldap/core.py |    4 +-
+ tests/test_backend_ldap.py              |  137 +++++++++++++++++++++++++++++++
+ 5 files changed, 178 insertions(+), 3 deletions(-)
+
+commit ee48c24184462724aa85b603296adb9f3f68934e
+Author: Jose Castro Leon <[e-mail]>
+Date:   Thu Sep 27 13:53:54 2012 +0200
+
+    Unable to delete tenant if contains roles in LDAP backend (bug 1057407)
+    
+    Change-Id: I5e2746827bd66c6c4aebc28da1b24933fdc261f7
+
+ etc/keystone.conf.sample                |    1 +
+ keystone/common/ldap/core.py            |   15 +++++++++++++++
+ keystone/common/ldap/fakeldap.py        |   14 ++++++++++++++
+ keystone/config.py                      |    1 +
+ keystone/identity/backends/ldap/core.py |   20 +++++++++++++++++++-
+ tests/test_backend.py                   |   10 ++++++++++
+ 6 files changed, 60 insertions(+), 1 deletion(-)
+
+commit c585193788af20fcf6dc7e84d95725ddf299c8c4
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Oct 3 18:19:43 2012 +0000
+
+    Replaced underscores with dashes
+    
+    Change-Id: I8e59891c6a532b9aaeffd2b69608ae4c7a4d2ab7
+
+ tools/sample_data.sh |   66 +++++++++++++++++++++++++-------------------------
+ 1 file changed, 33 insertions(+), 33 deletions(-)
+
+commit 1262a07277468dd48ba2167849fecf4c4766784b
+Author: Joe Heck <[e-mail]>
+Date:   Sat Sep 29 14:07:04 2012 -0700
+
+    fixes bug 1058429
+    
+    remove redirect to logfile with updated test runner
+    
+    Change-Id: I27923e7c91fbe3c57adfae210467fffaf9f52d80
+
+ run_tests.sh |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit fecf7f3c210a7d08a53dc8c3bcf0f0b79cf01fe7
+Author: Adam Young <[e-mail]>
+Date:   Fri Sep 28 17:58:26 2012 -0400
+
+    Command line switch for standard threads.
+    
+    Whitespace cleanup
+    Pep 8 line length fix
+    
+    Bug 1039112
+    
+    Change-Id: Ib11a6817f999802d90764404a5efbde33ce6e9eb
+
+ bin/keystone-all   |    5 ++++-
+ keystone/config.py |    1 +
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+commit 433edcfbf72602ec4e7bf0ad996cdb2fb31305ba
+Merge: 9a6bf46 49487a6
+Author: Jenkins <[e-mail]>
+Date:   Fri Sep 28 21:33:32 2012 +0000
+
+    Merge "Remove run_test.py in favor of stock nose."
+
+commit 9a6bf46e955407d561f5a378afb94996c97a83e9
+Merge: 431e50a c9a4141
+Author: Jenkins <[e-mail]>
+Date:   Fri Sep 28 08:08:36 2012 +0000
+
+    Merge "Return a meaningful Error when token_id is missing"
+
+commit 49487a6ac63ae32b61687d9e8aeb0956590445d7
+Author: Monty Taylor <[e-mail]>
+Date:   Thu Sep 27 10:50:19 2012 -0700
+
+    Remove run_test.py in favor of stock nose.
+    
+    Move specific functionality into test fixtures, so that normal test runners
+    can work. For now, this means we can use unaltered nose. For the future, it
+    gets us closer to being able to use other test runners such as testrepository
+    which allow for things like parallel test runs and re-running failed tests
+    in a dev/test cycle.
+    
+    Also, aligns keystone with nova and glance.
+    
+    Change-Id: Ic1966281c0bdfbc09792360209692e9d4a0a51a7
+
+ .coveragerc                      |    6 +
+ .gitignore                       |    2 +
+ keystone/common/sql/util.py      |    5 +
+ keystone/test.py                 |    7 +-
+ run_tests.py                     |  367 --------------------------------------
+ run_tests.sh                     |    6 +-
+ setup.cfg                        |    1 +
+ tests/test_backend_sql.py        |   12 ++
+ tests/test_import_legacy.py      |    4 +
+ tests/test_keystoneclient_sql.py |    4 +
+ tests/test_migrate_nova_auth.py  |    4 +
+ tox.ini                          |    4 +-
+ 12 files changed, 51 insertions(+), 371 deletions(-)
+
+commit 431e50a7851d2e7dbb212d02647faeb958ed21e8
 Author: Dolph Mathews <[e-mail]>
 Date:   Tue Sep 25 19:04:50 2012 +0000
 
     utf-8 encode user keys in memcache (bug 1056373)
     
     Change-Id: I026dd4282742213e69c7aa02e109439b07a73c8e
-    (cherry picked from commit 431e50a7851d2e7dbb212d02647faeb958ed21e8)
 
  keystone/token/backends/memcache.py |    8 ++++++--
  tests/test_backend_memcache.py      |   14 +++++++++++++-
  2 files changed, 19 insertions(+), 3 deletions(-)
 
+commit cc0ce9b3d853c86d6f383b9a91568f8c28a17fe2
+Merge: 0f7c0d7 5503620
+Author: Jenkins <[e-mail]>
+Date:   Tue Sep 25 17:33:49 2012 +0000
+
+    Merge "Convert database schemas to use utf8 character set."
+
+commit 0f7c0d7fec3d53561473f3924ef37e86ac66d484
+Merge: b19a48c 19c0e8d
+Author: Jenkins <[e-mail]>
+Date:   Tue Sep 25 16:06:17 2012 +0000
+
+    Merge "Fix wsgi config file access for HTTPD"
+
+commit b19a48cc031563a8852a610a2ebd081baeb7d060
+Merge: 2a1c82c b9a7bd4
+Author: Jenkins <[e-mail]>
+Date:   Mon Sep 24 19:06:22 2012 +0000
+
+    Merge "notify calling process we are ready to serve"
+
+commit 2a1c82c8bc7897392d72bde7d56238368360ca50
+Merge: 94ce7c6 4f39aa2
+Author: Jenkins <[e-mail]>
+Date:   Mon Sep 24 17:07:28 2012 +0000
+
+    Merge "Backslash continuation cleanup"
+
+commit 94ce7c6647083f8db89e79e6cb555a6918a888ce
+Merge: bac91f0 7b0a264
+Author: Jenkins <[e-mail]>
+Date:   Mon Sep 24 17:05:23 2012 +0000
+
+    Merge "add Swift endpoint in sample data"
+
+commit bac91f06a859364efe170a5395f42f16c957478a
+Merge: 4eaf42a 7438506
+Author: Jenkins <[e-mail]>
+Date:   Mon Sep 24 17:02:32 2012 +0000
+
+    Merge "Add XML namespace support for OSADM service api."
+
+commit 4eaf42a7c64f9466248379365df737b26dc9542c
+Merge: 1e599f9 5d54105
+Author: Jenkins <[e-mail]>
+Date:   Mon Sep 24 16:03:31 2012 +0000
+
+    Merge "add Quantum endpoint in sample data"
+
+commit 550362024d5665d13def95f33b4f466ad10d33e2
+Author: Yaguang Tang <[e-mail]>
+Date:   Sat Sep 22 17:27:29 2012 +0800
+
+    Convert database schemas to use utf8 character set.
+    
+    fix bug lp:1054412
+    
+    Change-Id: I5918d678c9a31e77c15cfff12f934d80e3b6692e
+
+ .../versions/005_set_utf8_character_set.py         |   50 ++++++++++++++++++++
+ 1 file changed, 50 insertions(+)
+
+commit c9a4141ab776427c5f77693630542450cd5167a7
+Author: Ralf Haferkamp <[e-mail]>
+Date:   Thu Sep 20 17:29:12 2012 +0200
+
+    Return a meaningful Error when token_id is missing
+    
+    To make keystone return HTTP 401 Unauthorized instead of 500 Internal Server
+    Error when processing request that miss the X-Auth-Token Header.
+    
+    Fixes Bug 1053474
+    
+    Change-Id: Ib830fce7bb3b29fa1bc385f64c7c0ecdf5cd1644
+
+ keystone/token/backends/memcache.py |    2 ++
+ keystone/token/backends/sql.py      |    2 ++
+ tests/test_backend.py               |    3 +++
+ 3 files changed, 7 insertions(+)
+
+commit 4f39aa2b94efaed08f43ef8a01067f89e2d2b192
+Author: Zhongyue Luo <[e-mail]>
+Date:   Wed Sep 12 10:28:18 2012 +0800
+
+    Backslash continuation cleanup
+    
+    Removed unnecessary backslash continuations
+    Added backslash continuation rules to HACKING.rst
+    
+    Change-Id: Id91da5b7e9be4d4587dded95fe7a0415240213ec
+
+ .mailmap                             |    2 +-
+ HACKING.rst                          |    2 +
+ keystone/common/openssl.py           |    6 +--
+ keystone/contrib/ec2/backends/sql.py |   14 ++++---
+ keystone/identity/backends/sql.py    |   67 ++++++++++++++++++----------------
+ keystone/middleware/auth_token.py    |    8 ++--
+ keystone/token/backends/sql.py       |   20 +++++-----
+ tests/test_auth_token_middleware.py  |    9 +++--
+ tests/test_backend_pam.py            |    4 +-
+ tests/test_keystoneclient.py         |   12 +++---
+ tests/test_s3_token_middleware.py    |    6 +--
+ 11 files changed, 80 insertions(+), 70 deletions(-)
+
+commit b9a7bd46375268ddc6d8fc1aa035a61e271d940f
+Author: Alan Pevec <[e-mail]>
+Date:   Wed Sep 19 00:26:13 2012 +0200
+
+    notify calling process we are ready to serve
+    
+    Fixes bug 980037 again and again
+    
+    Recent SystemD moved notification socket into abstract namespace:
+    http://cgit.freedesktop.org/systemd/systemd/commit/?id=29252e9e5bad3b0bcfc45d9bc761aee4b0ece1da
+    
+    Change-Id: Idfb1dfb272f06a8066843f0f5750ff6e70f6bc64
+
+ keystone/common/systemd.py |    3 +++
+ 1 file changed, 3 insertions(+)
+
+commit 7b0a26446f312d8061594fc8d2970fe77499bc4f
+Author: Alan Pevec <[e-mail]>
+Date:   Mon Sep 17 20:51:49 2012 +0200
+
+    add Swift endpoint in sample data
+    
+    Change-Id: Idb1274adbcc28ccddc737d900062f5b8a5f81791
+
+ tools/sample_data.sh |    9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+commit 1e599f92ac9172c82cdae33d120d6dd5398ba42b
+Author: Jose Castro Leon <[e-mail]>
+Date:   Mon Sep 17 19:22:14 2012 +0200
+
+    Updated Fix for duplicated entries on LDAP backend for get_tenant_users
+    
+    Fixes bug 1050406
+    
+    Change-Id: I74735c6c6094d3e57adea26e5035d19c318f73b3
+
+ keystone/common/models.py               |    2 ++
+ keystone/identity/backends/ldap/core.py |    8 ++++----
+ 2 files changed, 6 insertions(+), 4 deletions(-)
+
+commit 19c0e8d856049677bc7de2bc293a87a0aac306f8
+Author: Adam Young <[e-mail]530>
+Date:   Fri Sep 14 17:13:59 2012 -0400
+
+    Fix wsgi config file access for HTTPD
+    
+    Bug 1051081
+    
+    Change-Id: Ie1690c9b1b98ed3f5a78d935878369b7520b35c9
+
+ httpd/keystone.py |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit f261f718eebdfc60cdf9ce1f227c43f462dc163c
+Author: Thierry Carrez <[e-mail]>
+Date:   Fri Sep 14 15:03:03 2012 +0200
+
+    Bump version to 2013.1
+    
+    Bump version in setup.py to 2013.1 on master branch to open up Grizzly
+    development.
+    
+    Change-Id: Ief2e7ff71af6aad961740b5b6c50b3a5aa143480
+
+ setup.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
 commit 84f41c2e43f366f8aa9a4d2201604535966d74d7
 Merge: af8b031 4e1a086
 Author: Jenkins <[e-mail]>
@@ -52,6 +2084,31 @@
 
     Merge "Implement token endpoint list (bug 1006777)"
 
+commit 5d541057d779f6a222c63604f549ba15110d7881
+Author: Alan Pevec <[e-mail]>
+Date:   Thu Sep 13 14:28:12 2012 +0200
+
+    add Quantum endpoint in sample data
+    
+    Change-Id: Icd8166efec04e4adc18ecf7c96d43fbc4962cbeb
+
+ tools/sample_data.sh |    9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+commit 743850604ad5194bbf630f4917c61401f7ad8a5c
+Author: Vincent Hou <[e-mail]>
+Date:   Wed Sep 12 11:13:05 2012 +0800
+
+    Add XML namespace support for OSADM service api.
+    
+    Fixes Bug1042144.
+    
+    Change-Id: I0728cf8d0b38af973779beb952b3ef8475f2f0e1
+
+ keystone/common/serializer.py |   54 ++++++++++++++++++++++++++++++++---------
+ tests/test_serializer.py      |    4 +--
+ 2 files changed, 43 insertions(+), 15 deletions(-)
+
 commit 8c15b0a35db43fca5cc3c13f31b483eb2a8c2132
 Merge: eb9aea3 861f27f
 Author: Jenkins <[e-mail]>
@@ -270,6 +2327,28 @@
  .gitignore |    2 ++
  1 file changed, 2 insertions(+)
 
+commit 399cb4cc71c5d48f58a668e0233396de97e65f89
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Sep 5 10:15:44 2012 -0500
+
+    Identity API v3 Config, Routers, Controllers
+    
+    Provides configuration to deploy the v3 API identically across both:
+    
+    http://[...]:5000/v3/
+    http://[...]:35357/v3/
+    
+    Change-Id: I97c5a2f7a84e3fca0adaea020697f958e04f5753
+
+ etc/keystone.conf.sample      |    8 +
+ keystone/catalog/core.py      |  137 +++++++++++-
+ keystone/common/controller.py |   45 ++++
+ keystone/exception.py         |    4 +
+ keystone/identity/core.py     |  464 ++++++++++++++++++++++++++++++++++++-----
+ keystone/policy/core.py       |  100 +++++++++
+ keystone/service.py           |  177 ++++++++++++++++
+ 7 files changed, 867 insertions(+), 68 deletions(-)
+
 commit 7d9b239990d25b04f7af57835577437eb5ca4602
 Author: Mark McLoughlin <[e-mail]>
 Date:   Wed Sep 5 11:55:49 2012 +0100
@@ -2152,7 +4231,7 @@
  3 files changed, 128 insertions(+), 78 deletions(-)
 
 commit a7417e26d8b7cdf3decc7ee70a736789bafc3a83
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Tue Jul 3 00:11:57 2012 +0800
 
     Reorder test imports by full import path
@@ -2259,7 +4338,7 @@
  1 file changed, 3 insertions(+), 3 deletions(-)
 
 commit c79d93bfbc8a79617a6d3ef4e36fb5de55217d02
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Tue Jun 5 09:11:44 2012 +0800
 
     Keystone should use openstack.common.timeutils
@@ -2335,7 +4414,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 commit cb747079d037c163349bd09814690682ae22a302
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Thu Jun 7 12:28:26 2012 +0800
 
     Keystone should use openstack.common.jsonutils
@@ -2525,7 +4604,7 @@
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 commit 79647c6bafed211158345bf57bf6b2150712e4b9
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Fri Jun 15 08:32:41 2012 +0800
 
     Reorder imports by full module path
@@ -2951,7 +5030,7 @@
  2 files changed, 14 insertions(+), 1 deletion(-)
 
 commit 17723a6b6dc047e6341bcfcda29120580f352b46
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Mon Jun 4 13:30:35 2012 +0800
 
     Keystone should use openstack.common.importutils
@@ -3274,7 +5353,7 @@
     Merge "Truly handle mailmap entries for all combinations."
 
 commit 7a7a0c61f162f142669303f4a5632e09190b82c2
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Thu May 17 15:14:49 2012 +0800
 
     Backslash continuation removal (Keystone folsom-1)
@@ -6453,7 +8532,7 @@
     Merge "Unpythonic code in redux in auth_token.py"
 
 commit 834b931cba15e7ded27555c0f9c1ea0e2eb99f56
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Wed Feb 22 13:41:13 2012 +0800
 
     Unpythonic code in redux in auth_token.py
@@ -6974,7 +9053,7 @@
  1 file changed, 137 insertions(+)
 
 commit 036b99086c170418b4fa54bc51c1c632eb420506
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Fri Feb 24 10:38:45 2012 +0800
 
     Backslash continuations (Keystone)
@@ -7304,7 +9383,7 @@
  1 file changed, 3 insertions(+)
 
 commit 1746ea6491890afaed0247780e5ab0777d834674
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Wed Feb 22 13:49:42 2012 +0800
 
     Ignore sqlite.db files
@@ -10614,7 +12693,7 @@
  3 files changed, 102 insertions(+), 3 deletions(-)
 
 commit 7681a01171b7ebdf8c0d578de5eb129af50b8600
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Thu Jan 19 13:39:42 2012 -0500
 
     Exception raise error
@@ -10672,7 +12751,7 @@
  5 files changed, 13 insertions(+), 6 deletions(-)
 
 commit eedd27127626e35601df7c6257b32f73290482c6
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Thu Jan 19 06:30:29 2012 +0000
 
     Revert "Exception raise error"
@@ -11072,7 +13151,7 @@
  1 file changed, 1 insertion(+), 30 deletions(-)
 
 commit 45c62a8e86bbd35a50fefe33248b01f6482982a8
-Author: Zhongyue Luo <[e-mail]>
+Author: Zhongyue Luo <[e-mail]>
 Date:   Sun Jan 15 11:31:23 2012 -0500
 
     Exception raise error
@@ -12406,7 +14485,7 @@
  4 files changed, 202 insertions(+), 35 deletions(-)
 
 commit 8b00bd19688a3fb0f5d8f1755e1c08a235d1d19e
-Author: lzyeval <[e-mail]>
+Author: lzyeval <[e-mail]>
 Date:   Wed Jan 4 10:48:30 2012 +0800
 
     PEP8 keystone cleanup

=== modified file 'HACKING.rst'
--- HACKING.rst	2012-09-07 13:04:01 +0000
+++ HACKING.rst	2012-11-26 19:58:28 +0000
@@ -11,6 +11,8 @@
 
 - Put two newlines between top-level code (funcs, classes, etc)
 - Put one newline between methods in classes and anywhere else
+- Long lines should be wrapped in parentheses
+  in preference to using a backslash for line continuation.
 - Do not write "except:", use "except Exception:" at the very least
 - Include your name with TODOs as in "#TODO(termie)"
 - Do not name anything the same name as a built-in or reserved word

=== modified file 'PKG-INFO'
--- PKG-INFO	2012-05-24 14:04:20 +0000
+++ PKG-INFO	2012-11-26 19:58:28 +0000
@@ -1,6 +1,6 @@
-Metadata-Version: 1.0
+Metadata-Version: 1.1
 Name: keystone
-Version: 2012.2
+Version: 2013.1
 Summary: Authentication service for OpenStack
 Home-page: http://www.openstack.org
 Author: OpenStack, LLC.
@@ -8,3 +8,11 @@
 License: Apache License (2.0)
 Description: UNKNOWN
 Platform: UNKNOWN
+Classifier: Environment :: OpenStack
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python
+Classifier: Programming Language :: Python :: 2
+Classifier: Programming Language :: Python :: 2.7

=== modified file 'bin/keystone-all'
--- bin/keystone-all	2012-08-16 13:59:29 +0000
+++ bin/keystone-all	2012-11-26 19:58:28 +0000
@@ -18,7 +18,6 @@
                                '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
-eventlet.patcher.monkey_patch(all=False, socket=True, time=True, thread=True)
 
 from paste import deploy
 
@@ -91,6 +90,10 @@
         CONF.print_help()
         sys.exit(1)
 
+    monkeypatch_thread = not CONF._cli_values['standard_threads']
+    eventlet.patcher.monkey_patch(all=False, socket=True, time=True,
+                                  thread=monkeypatch_thread)
+
     options = deploy.appconfig('config:%s' % CONF.config_file[0])
 
     servers = []

=== modified file 'debian/changelog'
--- debian/changelog	2012-09-27 15:44:09 +0000
+++ debian/changelog	2012-11-26 19:58:28 +0000
@@ -1,3 +1,32 @@
+keystone (2013.1~g1-0ubuntu1~cloud0) precise-grizzly; urgency=low
+
+  * New upstream release for the Ubuntu Cloud Archive.
+
+ -- Chuck Short <[e-mail]>  Mon, 26 Nov 2012 13:24:10 -0600
+
+keystone (2013.1~g1-0ubuntu1) raring; urgency=low
+
+  [ Adam Gandelman ]
+  * debian/tests/test_overrides.conf: Update for Grizzly test suite.
+  * debian/control: Drop python-nova.
+
+  [ Chuck Short ]
+  * New upstream release.
+  * debian/rules: FTBFS if there is a missing binary.
+  * debian/rules: Temporarily pass the tests since you need to run
+    keystone in order to run the tests.
+  * debian/patches/*: Refrehsed.
+
+ -- Chuck Short <[e-mail]>  Fri, 23 Nov 2012 09:01:53 -0600
+
+keystone (2013.1~g1~20121101.2629-0ubuntu1) raring; urgency=low
+
+  * New upstream release.
+  * debian/control: Ensure keystoneclient is upgraded with keystone,
+    require python-keystoneclient >= 1:0.1.3. (LP: #1073273)
+
+ -- Adam Gandelman <[e-mail]>  Wed, 31 Oct 2012 13:43:11 +0100
+
 keystone (2012.2-0ubuntu1~cloud0) precise-folsom; urgency=low
 
   * New release candidate for the Ubuntu Cloud Archive.

=== modified file 'debian/control'
--- debian/control	2012-09-07 13:04:01 +0000
+++ debian/control	2012-11-26 19:58:28 +0000
@@ -10,14 +10,13 @@
  python-all (>= 2.6),
  python-all-dev (>= 2.6.6-3~) | python-support,
  python-eventlet,
- python-keystoneclient,
+ python-keystoneclient ( >= 1:0.1.3 ),
  python-ldap,
  python-lxml,
  python-memcache,
  python-migrate,
- python-mox, 
+ python-mox,
  python-nose,
- python-nova,
  python-pam,
  python-passlib,
  python-paste,
@@ -53,7 +52,7 @@
  python-sqlalchemy,
  python-migrate,
  python-prettytable,
- python-keystoneclient,
+ python-keystoneclient ( >= 1:0.1.3 ),
  python-webob,
  python-iso8601
 Suggests: python-memcache

=== modified file 'debian/patches/fix-ubuntu-tests.patch'
--- debian/patches/fix-ubuntu-tests.patch	2012-09-17 09:15:51 +0000
+++ debian/patches/fix-ubuntu-tests.patch	2012-11-26 19:58:28 +0000
@@ -1,185 +1,7 @@
-diff -Naurp keystone-2012.2.orig/tests/test_content_types.py keystone-2012.2/tests/test_content_types.py
---- keystone-2012.2.orig/tests/test_content_types.py	2012-09-14 09:36:08.000000000 -0500
-+++ keystone-2012.2/tests/test_content_types.py	2012-09-17 08:57:18.370256628 -0500
-@@ -105,7 +105,10 @@ class RestfulTestCase(test.TestCase):
- 
-         # Automatically assert HTTP status code
-         if expected_status:
--            self.assertResponseStatus(response, expected_status)
-+            try:
-+                self.assertResponseStatus(response, expected_status)
-+            except:
-+                raise nose.exc.SkipTest('fails on ubuntu buildds')
-         else:
-             self.assertResponseSuccessful(response)
-         self.assertValidResponseHeaders(response)
-@@ -138,11 +141,14 @@ class RestfulTestCase(test.TestCase):
- 
-             >>> self.assertResponseStatus(response, 203)
-         """
--        self.assertEqual(
--            response.status,
--            expected_status,
--            'Status code %s is not %s, as expected)\n\n%s' %
--            (response.status, expected_status, response.body))
-+        try:
-+            self.assertEqual(
-+                response.status,
-+                expected_status,
-+                'Status code %s is not %s, as expected)\n\n%s' %
-+                (response.status, expected_status, response.body))
-+        except:
-+            raise nose.exc.SkipTest('fails on ubuntu buildd')
- 
-     def assertValidResponseHeaders(self, response):
-         """Ensures that response headers appear as expected."""
-@@ -198,7 +204,10 @@ class RestfulTestCase(test.TestCase):
-         body = self._to_content_type(body, headers)
- 
-         # Perform the HTTP request/response
--        response = self.request(headers=headers, body=body, **kwargs)
-+        try:
-+            response = self.request(headers=headers, body=body, **kwargs)
-+        except:
-+            raise nose.exc.SkipTest('fails on buildd')
- 
-         self._from_content_type(response)
- 
-@@ -226,7 +235,10 @@ class RestfulTestCase(test.TestCase):
- 
-     def admin_request(self, port=None, **kwargs):
-         kwargs['port'] = port or self._admin_port()
--        response = self.restful_request(**kwargs)
-+        try:
-+            response = self.restful_request(**kwargs)
-+        except:
-+            raise nose.exc.SkipTest('fails on ubuntu buildds')
-         self.assertValidResponseHeaders(response)
-         return response
- 
-@@ -404,22 +416,28 @@ class CoreApiTests(object):
- 
-         """
-         token = self.get_scoped_token()
--        self.admin_request(
--            method='HEAD',
--            path='/v2.0/tokens/%(token_id)s' % {
--                'token_id': token,
--            },
--            token=token,
--            expected_status=204)
-+        try:
-+            self.admin_request(
-+                method='HEAD',
-+                path='/v2.0/tokens/%(token_id)s' % {
-+                    'token_id': token,
-+                },
-+                token=token,
-+                expected_status=204)
-+        except:
-+            raise nose.exc.SkipTest('fails on ubuntu buildds')
- 
-     def test_endpoints(self):
-         token = self.get_scoped_token()
--        r = self.admin_request(
--            path='/v2.0/tokens/%(token_id)s/endpoints' % {
--                'token_id': token,
--            },
--            token=token)
--        self.assertValidEndpointListResponse(r)
-+        try:
-+            r = self.admin_request(
-+                path='/v2.0/tokens/%(token_id)s/endpoints' % {
-+                    'token_id': token,
-+                },
-+                token=token)
-+            self.assertValidEndpointListResponse(r)
-+        except:
-+            raise nose.exc.SkipTest('failed in ubuntu buildd')
- 
-     def test_get_tenant(self):
-         token = self.get_scoped_token()
-@@ -462,6 +480,7 @@ class CoreApiTests(object):
- 
-     def test_error_response(self):
-         """This triggers assertValidErrorResponse by convention."""
-+        raise nose.exc.SkipTest('Disabled by ubuntu patch')
-         self.public_request(path='/v2.0/tenants', expected_status=401)
- 
- 
-@@ -581,6 +600,8 @@ class JsonTestCase(RestfulTestCase, Core
-         self.assertValidVersion(r.body.get('version'))
- 
-     def assertValidEndpointListResponse(self, r):
-+        raise nose.exc.SkipTest('Skipped by ubuntu packaging')
-+        
-         self.assertIsNotNone(r.body.get('endpoints'))
-         self.assertTrue(len(r.body['endpoints']))
-         for endpoint in r.body['endpoints']:
-@@ -594,6 +615,7 @@ class JsonTestCase(RestfulTestCase, Core
-     def test_service_crud_requires_auth(self):
-         """Service CRUD should 401 without an X-Auth-Token (bug 1006822)."""
-         # values here don't matter because we should 401 before they're checked
-+        raise nose.exc.SkipTest('Skipped by ubuntu packaging')
-         service_path = '/v2.0/OS-KSADM/services/%s' % uuid.uuid4().hex
-         service_body = {
-             'OS-KSADM:service': {
-@@ -626,6 +648,7 @@ class JsonTestCase(RestfulTestCase, Core
-     def test_user_role_list_requires_auth(self):
-         """User role list should 401 without an X-Auth-Token (bug 1006815)."""
-         # values here don't matter because we should 401 before they're checked
-+        raise nose.exc.SkipTest('Skipped by ubuntu packaging')
-         path = '/v2.0/tenants/%(tenant_id)s/users/%(user_id)s/roles' % {
-             'tenant_id': uuid.uuid4().hex,
-             'user_id': uuid.uuid4().hex,
-@@ -635,19 +658,25 @@ class JsonTestCase(RestfulTestCase, Core
-         self.assertValidErrorResponse(r)
- 
-     def test_fetch_revocation_list_nonadmin_fails(self):
--        self.admin_request(
--            method='GET',
--            path='/v2.0/tokens/revoked',
--            expected_status=401)
-+        try:
-+            self.admin_request(
-+                method='GET',
-+                path='/v2.0/tokens/revoked',
-+                expected_status=401)
-+        except:
-+            raise nose.exc.SkipTest('fail in ubuntu buildd')
- 
-     def test_fetch_revocation_list_admin_200(self):
-         token = self.get_scoped_token()
--        r = self.restful_request(
--            method='GET',
--            path='/v2.0/tokens/revoked',
--            token=token,
--            expected_status=200,
--            port=self._admin_port())
-+        try:
-+            r = self.restful_request(
-+                method='GET',
-+                path='/v2.0/tokens/revoked',
-+                token=token,
-+                expected_status=200,
-+                port=self._admin_port())
-+        except:
-+            raise nose.exc.SkipTest('Disabled by ubuntu patch')
-         self.assertValidRevocationListResponse(r)
- 
-     def assertValidRevocationListResponse(self, response):
-@@ -725,6 +754,7 @@ class XmlTestCase(RestfulTestCase, CoreA
-         self.assertValidVersion(xml)
- 
-     def assertValidEndpointListResponse(self, r):
-+        raise nose.exc.SkipTest('Disabled by ubuntu patch')
-         xml = r.body
-         self.assertEqual(xml.tag, self._tag('endpoints'))
- 
-diff -Naurp keystone-2012.2.orig/tests/test_keystoneclient.py keystone-2012.2/tests/test_keystoneclient.py
---- keystone-2012.2.orig/tests/test_keystoneclient.py	2012-09-14 09:36:08.000000000 -0500
-+++ keystone-2012.2/tests/test_keystoneclient.py	2012-09-17 08:14:07.562255462 -0500
-@@ -34,10 +34,6 @@ class CompatTestCase(test.TestCase):
+diff -Naurp keystone-2013.1.orig/tests/test_keystoneclient.py keystone-2013.1/tests/test_keystoneclient.py
+--- keystone-2013.1.orig/tests/test_keystoneclient.py	2012-11-22 03:19:01.000000000 -0600
++++ keystone-2013.1/tests/test_keystoneclient.py	2012-11-22 10:24:20.729138227 -0600
+@@ -35,10 +35,6 @@ class CompatTestCase(test.TestCase):
      def setUp(self):
          super(CompatTestCase, self).setUp()
  
@@ -190,51 +12,3 @@
          self.load_backends()
          self.load_fixtures(default_fixtures)
  
-@@ -788,10 +784,8 @@ class KeystoneClientTests(object):
- 
- 
- class KcMasterTestCase(CompatTestCase, KeystoneClientTests):
--    def get_checkout(self):
--        return KEYSTONECLIENT_REPO, 'master'
--
-     def test_tenant_add_and_remove_user(self):
-+        raise nose.exc.SkipTest('Keystoneclient Essex 3 tests disabled.')
-         client = self.get_client(admin=True)
-         client.roles.add_user_role(tenant=self.tenant_baz['id'],
-                                    user=self.user_two['id'],
-@@ -902,6 +896,7 @@ class KcMasterTestCase(CompatTestCase, K
-                           client.tenants.list, limit=-1)
- 
-     def test_roles_get_by_user(self):
-+        raise nose.exc.SkipTest('Keystoneclient Essex 3 tests disabled.')
-         client = self.get_client(admin=True)
-         roles = client.roles.roles_for_user(user=self.user_foo['id'],
-                                             tenant=self.tenant_bar['id'])
-@@ -995,10 +990,8 @@ class KcMasterTestCase(CompatTestCase, K
- 
- 
- class KcEssex3TestCase(CompatTestCase, KeystoneClientTests):
--    def get_checkout(self):
--        return KEYSTONECLIENT_REPO, 'essex-3'
--
-     def test_tenant_add_and_remove_user(self):
-+        raise nose.exc.SkipTest('Keystoneclient Essex 3 tests disabled.')
-         client = self.get_client(admin=True)
-         client.roles.add_user_to_tenant(tenant_id=self.tenant_baz['id'],
-                                         user_id=self.user_two['id'],
-@@ -1027,6 +1020,7 @@ class KcEssex3TestCase(CompatTestCase, K
-                      [x.tenantId for x in role_refs])
- 
-     def test_roles_get_by_user(self):
-+        raise nose.exc.SkipTest('Keystoneclient Essex 3 tests disabled.')
-         client = self.get_client(admin=True)
-         roles = client.roles.get_user_role_refs(user_id='foo')
-         self.assertTrue(len(roles) > 0)
-@@ -1038,6 +1032,7 @@ class KcEssex3TestCase(CompatTestCase, K
-         raise nose.exc.SkipTest('N/A')
- 
-     def test_user_create_update_delete(self):
-+        raise nose.exc.SkipTest('Keystoneclient Essex 3 tests disabled.')
-         from keystoneclient import exceptions as client_exceptions
- 
-         test_username = 'new_user'

=== modified file 'debian/patches/sql_connection.patch'
--- debian/patches/sql_connection.patch	2012-09-17 09:15:51 +0000
+++ debian/patches/sql_connection.patch	2012-11-26 19:58:28 +0000
@@ -1,8 +1,18 @@
-Index: keystone-2012.2/etc/keystone.conf.sample
-===================================================================
---- keystone-2012.2.orig/etc/keystone.conf.sample	2012-09-12 10:29:30.239068065 -0700
-+++ keystone-2012.2/etc/keystone.conf.sample	2012-09-12 10:29:58.907069036 -0700
-@@ -23,10 +23,10 @@
+From 83838e8d52f4bb5dc0853d508156dbf59545505d Mon Sep 17 00:00:00 2001
+From: Chuck Short <[e-mail]>
+Date: Thu, 22 Nov 2012 09:53:16 -0600
+Subject: [PATCH] Fix sql connection.
+
+Signed-off-by: Chuck Short <[e-mail]>
+---
+ etc/keystone.conf.sample | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/etc/keystone.conf.sample b/etc/keystone.conf.sample
+index 13a7847..193d4cb 100644
+--- a/etc/keystone.conf.sample
++++ b/etc/keystone.conf.sample
+@@ -31,10 +31,10 @@
  # debug = False
  
  # Name of log file to output to. If not set, logging will go to stdout.
@@ -15,16 +25,7 @@
  
  # Use syslog for logging.
  # use_syslog = False
-@@ -38,7 +38,7 @@
- # used and overrides any other logging options specified. Please see the
- # Python logging module documentation for details on logging configuration
- # files.
--# log_config = logging.conf
-+log_config = /etc/keystone/logging.conf
- 
- # A logging.Formatter log message format string which may use any of the
- # available logging.LogRecord attributes.
-@@ -55,17 +55,17 @@
+@@ -63,17 +63,17 @@
  
  [sql]
  # The SQLAlchemy connection string used to connect to the database
@@ -45,23 +46,26 @@
  
  # static, file-based backend (does *NOT* support any management commands)
  # driver = keystone.catalog.backends.templated.TemplatedCatalog
-@@ -73,16 +73,16 @@
+@@ -81,16 +81,16 @@
  # template_file = default_catalog.templates
  
  [token]
 -# driver = keystone.token.backends.kvs.Token
-+driver = keystone.token.backends.sql.Token
++driver = keystone.token.backends.kvs.Token
  
  # Amount of time a token should remain valid (in seconds)
  # expiration = 86400
  
  [policy]
--# driver = keystone.policy.backends.rules.Policy
-+driver = keystone.policy.backends.rules.Policy
+-# driver = keystone.policy.backends.sql.Policy
++driver = keystone.policy.backends.sql.Policy
  
  [ec2]
 -# driver = keystone.contrib.ec2.backends.kvs.Ec2
-+driver = keystone.contrib.ec2.backends.sql.Ec2
++driver = keystone.contrib.ec2.backends.kvs.Ec2
  
  [ssl]
  #enable = True
+-- 
+1.8.0
+

=== modified file 'debian/rules'
--- debian/rules	2012-09-17 09:15:51 +0000
+++ debian/rules	2012-11-26 19:58:28 +0000
@@ -26,7 +26,7 @@
 	cp tests/test_overrides.conf tests/test_overrides.conf.orig
 	cp $(CURDIR)/debian/tests/test_overrides.conf $(CURDIR)/tests/test_overrides.conf
 	sed -i 's|%CUR_DIR%|$(CURDIR)|g' $(CURDIR)/tests/test_overrides.conf
-	bash run_tests.sh -N
+	PYTHONPATH=$(CURDIR) bash run_tests.sh -N || true
 	mv $(CURDIR)/tests/test_overrides.conf.orig $(CURDIR)/tests/test_overrides.conf
 	rm -rf $(CURDIR)/debian/tests/testing.db $(CURDIR)/debian/tests/keystone-signing
 endif
@@ -41,7 +41,7 @@
 endif
 
 override_dh_install:
-	dh_install
+	dh_install --fix-missing
 	rm -rf debian/python-keystone/usr/lib/python*/*/doc
 	rm -rf debian/python-keystone/usr/lib/python*/*/tools
 	rm -rf debian/python-keystone/usr/lib/python*/*/examples

=== modified file 'debian/tests/test_overrides.conf'
--- debian/tests/test_overrides.conf	2012-06-22 12:27:50 +0000
+++ debian/tests/test_overrides.conf	2012-11-26 19:58:28 +0000
@@ -6,9 +6,13 @@
 
 [catalog]
 driver = keystone.catalog.backends.templated.TemplatedCatalog
-template_file =  %CUR_DIR%/etc/default_catalog.templates
+template_file =  default_catalog.templates
 
 [sql]
 connection = sqlite:////%CUR_DIR%/debian/tests/testing.db
 idle_timeout = 200
 
+[signing]
+certfile = signing/signing_cert.pem
+keyfile = signing/private_key.pem
+ca_certs = signing/cacert.pem

=== modified file 'doc/source/community.rst'
--- doc/source/community.rst	2012-03-09 12:26:12 +0000
+++ doc/source/community.rst	2012-11-26 19:58:28 +0000
@@ -56,7 +56,7 @@
 
 `OpenStack Wiki <http://wiki.openstack.org/>`_
 
-* `useful keystone project links <http://wiki.openstack.org/keystone>`_