User password update hardcoded the endpoint_filter to always use the public
endpoint. This will break deployments where services behind the firewall have
no access to the public endpoint. Endpoint selection should be allowed
by the end user (i.e. openstack --os-interface internal user password set).

Closes-Bug: 1503459

Change-Id: Ib11d60cd8e81b99aedb27f1cbbf6b79218045cf0
(cherry picked from commit d47da3b59c581dd3bb6bd4d75de819d0fd734fa5)

We should sanitize the response body before logging to make sure we
aren't leaking through credentials like in the case of the response from
the os-initialize_connection volume API.

Closes-Bug: #1490693

NOTE(mriedem): The test is slightly different in kilo because the
_http_log_response method requires kwargs.

Change-Id: Ifd95d3fb624b4636fb72cc11762af62e00a026a0
(cherry picked from commit 3e26ff824801d5084791a52980021784e794e35f)

The SAML plugin handles redirects in a custom manner but currently only
checks for the 302 redirect code. This doesn't cover the mod_auth_mellon
case which responds with a 303.

Also handle the 303 redirect case.

Change-Id: Idab5f381fcbfb8c561184845d3aa5c8aab142ecd
Closes-Bug: #1501918
(cherry picked from commit 9cd71c064c77a22a0a58084a2abab77b023017b5)

Sync common code to address changes made in dependencies and make branch
"stable/kilo" workable.

Cherry-pick commits 0cc741a, 2aacb111, ac17de97 from oslo-incubator

Change-Id: If746912c99a83806137ca96e0863c4ff2ea8d96c
Closes-Bug: #1480314

Per:

http://lists.openstack.org/pipermail/openstack-dev/2015-August/072982.html

The location of subunit2html changed on the images in the gate
so update the path used in the post_test_hook.

Long-term we should just use what's in devstack-gate.

Change-Id: I5e50e7d7ad845aba26403df1df412c0a139a6dc7
Closes-Bug: #1491646
(cherry picked from commit 3e862bbb1e2a7b488cf2de43651270e6afbb82ad)

The ; separator allows providing parameters to a type not separating
type options. This means that in strict type checks like those performed
by mod_auth_mellon the check for accept type fails.

Change-Id: Ieeaa74b304921daef68497fec77cc6629ab2f0a2
Closes-Bug: #1488722
(cherry picked from commit e0276c65364bcb8a4a3fe1ad1c91899b1325836c)

OAuth test verifies that access_token manager's methods make requests with
certain parameters. It is supposed to use values from mocked http handler
and compare them with referential values acquired from oauth client.

But instead of using values from mocked handler, it used the values from
oauth client and compared them with values from the client acquired using
attributes, basically testing oauthlib and not access_token manager's
methods.

Make the test compare correct values and remove check of timestamp,
which was useless because it is always mocked in tests and not provided in
actual requests.

As a consequence, use of get_oauth_params, which changed in oauthlib
1.0 and blocked the gate, was removed.

Closes-Bug: 1477177
Closes-Bug: 1477247
Change-Id: I5e049163f84fde5827104fd4a6441222eb08468f
(cherry picked from commit 7d5d8b343232ee5faf4de3381024095619335929)

The "insecure" option was being treated as a bool when it was
actually provided as a string. The fix is to parse the string to
a bool.

Closes-Bug: 1411063
Change-Id: Id674f40532215788675c97a8fdfa91d4420347b3