This patch implements the new ways to get the project's hierarchy:
  'subtree_as_ids': If True, returns projects IDs down the hierarchy
                    as a structured dictionay.
  'parents_as_ids': If True, returns projects IDs up the hierarchy
                    as a structured dictionay.

Change-Id: Ia3afe994893dfca059cb8361f7ab1c14e28e1ad5
Implements: blueprint hierarchical-multitenancy-improvements

If you want to handle a NoMatchingPlugin exception rather than simply
exit then the name of the missing plugin is generally more useful than
the message.

The exception is specific enough that you can know what went wrong, but
you cannot determine the name of the missing plugin if you want to do
your own logging - only use the message that is generated.

We should keep the message but expose the plugin name as well.

Closes-Bug: #1410391
Change-Id: Ic93ec6583b8d7797529d36d63995ef0d8db754f1

Keystoneclient didn't provide translated messages. With this
change, the messages are marked for translation.

DocImpact

Implements: blueprint keystoneclient-i18n

Change-Id: I85263a71671a1dffed524185266e6bb7ae559630

The use of "#flake8: noqa" disables hacking checks for the entire
file. Switched to use of "# noqa" and fixed hacking problems.

Change-Id: I18785fb18bdce88e61e2451960e55aed0863c285

The argument to the :raises: directive is the class name. If the
class name is a valid reference it's rendered as a link to the
class. This change cleans up the :raises: directives to use the
reference correctly and use a valid class reference.

Change-Id: I84188b60de0ab4c6b5b2fb5a203c43bfde094707

also did a bit of code cleanup for consistency

Change-Id: I48832c36e1a8b5a0029598dc74aaeaa3b3d2a66f

This patch adds role assignments list support
to keystoneclient.

Created RoleAssignment resource and RoleAssignmentManager
classes. RoleAssignmentManager only implements the list()
method, the other inherited methods from base.CrudManager
raises a MethodNotImplemented error with customized messages.

This bp is complimented with the OSC part:
https://blueprints.launchpad.net/python-openstackclient/+spec/roles-assignment-list

Change-Id: I164b58b67ff42320238e943ddfa9d0a8aadd0a6d
Implements: blueprint roles-assignment-support
Closes-Bug: #1246310

Allows for a new form of document signature.

pkiz_sign will take data and encode it in a string that starts with
the substring  "PKIZ_".  This prefix indicates that the data has been:
1) Signed via PKI in Crypto Message Syntax (CMS) in binary (DER) format
2) Compressed using zlib (comparable to gzip)
3) urlsafe-base64 decoded

This process is reversed to validate the data.

middleware/auth_token.py will be capable of validating Keystone
tokens that are marshalled in the new format.  The current existing
"PKI" tokens will continue to be identified with "MII", issued by
default, and validated as well.  It will require corresponding changes
on the Keystone server to issue the new token format.

A separate script for generating the sample
data used in the unit tests,
examples/pki/gen_cmsz.py,
also serves as an example of how to
call the API from Python code.

Some of the sample data for the old tests had to be regenerated. A
stray comma in one of the JSON files made for non-parsing JSON.

Blueprint: compress-tokens
Closes-Bug: #1255321

Change-Id: Ia9a66ba3742da0bcd58c4c096b28cc8a66ad6569

There are a number of places where we expect a certain format of
response. If it's not found we often end up raising a KeyError when
accessing data.

Create a new Exception type that is raised when a HTTP response is not
appropriate for parsing and use it within authentication calls.

Closes-Bug: #1307306
Change-Id: I3cf2db07a8e76ee17702130e9efb0edf640d293a