Update Keystone core to Mitaka.

Change-Id: Ia10d6add16f4a9d25d1f42d420661c46332e69db

11 files changed, 38 insertions, 745 deletions

diff --git a/keystone-moon/keystone/contrib/federation/__init__.py b/keystone-moon/keystone/contrib/federation/__init__.py
index 57c9e42c..e69de29b 100644
--- a/keystone-moon/keystone/contrib/federation/__init__.py
+++ b/keystone-moon/keystone/contrib/federation/__init__.py
@@ -1,15 +0,0 @@
-# Copyright 2014 OpenStack Foundation
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-from keystone.contrib.federation.core import *  # noqa
diff --git a/keystone-moon/keystone/contrib/federation/backends/sql.py b/keystone-moon/keystone/contrib/federation/backends/sql.py
index dbd17025..3c24d9c0 100644
--- a/keystone-moon/keystone/contrib/federation/backends/sql.py
+++ b/keystone-moon/keystone/contrib/federation/backends/sql.py
@@ -12,355 +12,18 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-from oslo_serialization import jsonutils
+from oslo_log import versionutils
 
-from keystone.common import sql
-from keystone.contrib.federation import core
-from keystone import exception
-from sqlalchemy import orm
+from keystone.federation.backends import sql
 
+_OLD = "keystone.contrib.federation.backends.sql.Federation"
+_NEW = "sql"
 
-class FederationProtocolModel(sql.ModelBase, sql.DictBase):
-    __tablename__ = 'federation_protocol'
-    attributes = ['id', 'idp_id', 'mapping_id']
-    mutable_attributes = frozenset(['mapping_id'])
 
-    id = sql.Column(sql.String(64), primary_key=True)
-    idp_id = sql.Column(sql.String(64), sql.ForeignKey('identity_provider.id',
-                        ondelete='CASCADE'), primary_key=True)
-    mapping_id = sql.Column(sql.String(64), nullable=False)
+class Federation(sql.Federation):
 
-    @classmethod
-    def from_dict(cls, dictionary):
-        new_dictionary = dictionary.copy()
-        return cls(**new_dictionary)
-
-    def to_dict(self):
-        """Return a dictionary with model's attributes."""
-        d = dict()
-        for attr in self.__class__.attributes:
-            d[attr] = getattr(self, attr)
-        return d
-
-
-class IdentityProviderModel(sql.ModelBase, sql.DictBase):
-    __tablename__ = 'identity_provider'
-    attributes = ['id', 'enabled', 'description', 'remote_ids']
-    mutable_attributes = frozenset(['description', 'enabled', 'remote_ids'])
-
-    id = sql.Column(sql.String(64), primary_key=True)
-    enabled = sql.Column(sql.Boolean, nullable=False)
-    description = sql.Column(sql.Text(), nullable=True)
-    remote_ids = orm.relationship('IdPRemoteIdsModel',
-                                  order_by='IdPRemoteIdsModel.remote_id',
-                                  cascade='all, delete-orphan')
-
-    @classmethod
-    def from_dict(cls, dictionary):
-        new_dictionary = dictionary.copy()
-        remote_ids_list = new_dictionary.pop('remote_ids', None)
-        if not remote_ids_list:
-            remote_ids_list = []
-        identity_provider = cls(**new_dictionary)
-        remote_ids = []
-        # NOTE(fmarco76): the remote_ids_list contains only remote ids
-        # associated with the IdP because of the "relationship" established in
-        # sqlalchemy and corresponding to the FK in the idp_remote_ids table
-        for remote in remote_ids_list:
-            remote_ids.append(IdPRemoteIdsModel(remote_id=remote))
-        identity_provider.remote_ids = remote_ids
-        return identity_provider
-
-    def to_dict(self):
-        """Return a dictionary with model's attributes."""
-        d = dict()
-        for attr in self.__class__.attributes:
-            d[attr] = getattr(self, attr)
-        d['remote_ids'] = []
-        for remote in self.remote_ids:
-            d['remote_ids'].append(remote.remote_id)
-        return d
-
-
-class IdPRemoteIdsModel(sql.ModelBase, sql.DictBase):
-    __tablename__ = 'idp_remote_ids'
-    attributes = ['idp_id', 'remote_id']
-    mutable_attributes = frozenset(['idp_id', 'remote_id'])
-
-    idp_id = sql.Column(sql.String(64),
-                        sql.ForeignKey('identity_provider.id',
-                                       ondelete='CASCADE'))
-    remote_id = sql.Column(sql.String(255),
-                           primary_key=True)
-
-    @classmethod
-    def from_dict(cls, dictionary):
-        new_dictionary = dictionary.copy()
-        return cls(**new_dictionary)
-
-    def to_dict(self):
-        """Return a dictionary with model's attributes."""
-        d = dict()
-        for attr in self.__class__.attributes:
-            d[attr] = getattr(self, attr)
-        return d
-
-
-class MappingModel(sql.ModelBase, sql.DictBase):
-    __tablename__ = 'mapping'
-    attributes = ['id', 'rules']
-
-    id = sql.Column(sql.String(64), primary_key=True)
-    rules = sql.Column(sql.JsonBlob(), nullable=False)
-
-    @classmethod
-    def from_dict(cls, dictionary):
-        new_dictionary = dictionary.copy()
-        new_dictionary['rules'] = jsonutils.dumps(new_dictionary['rules'])
-        return cls(**new_dictionary)
-
-    def to_dict(self):
-        """Return a dictionary with model's attributes."""
-        d = dict()
-        for attr in self.__class__.attributes:
-            d[attr] = getattr(self, attr)
-        d['rules'] = jsonutils.loads(d['rules'])
-        return d
-
-
-class ServiceProviderModel(sql.ModelBase, sql.DictBase):
-    __tablename__ = 'service_provider'
-    attributes = ['auth_url', 'id', 'enabled', 'description',
-                  'relay_state_prefix', 'sp_url']
-    mutable_attributes = frozenset(['auth_url', 'description', 'enabled',
-                                    'relay_state_prefix', 'sp_url'])
-
-    id = sql.Column(sql.String(64), primary_key=True)
-    enabled = sql.Column(sql.Boolean, nullable=False)
-    description = sql.Column(sql.Text(), nullable=True)
-    auth_url = sql.Column(sql.String(256), nullable=False)
-    sp_url = sql.Column(sql.String(256), nullable=False)
-    relay_state_prefix = sql.Column(sql.String(256), nullable=False)
-
-    @classmethod
-    def from_dict(cls, dictionary):
-        new_dictionary = dictionary.copy()
-        return cls(**new_dictionary)
-
-    def to_dict(self):
-        """Return a dictionary with model's attributes."""
-        d = dict()
-        for attr in self.__class__.attributes:
-            d[attr] = getattr(self, attr)
-        return d
-
-
-class Federation(core.FederationDriverV8):
-
-    # Identity Provider CRUD
-    @sql.handle_conflicts(conflict_type='identity_provider')
-    def create_idp(self, idp_id, idp):
-        idp['id'] = idp_id
-        with sql.transaction() as session:
-            idp_ref = IdentityProviderModel.from_dict(idp)
-            session.add(idp_ref)
-        return idp_ref.to_dict()
-
-    def delete_idp(self, idp_id):
-        with sql.transaction() as session:
-            self._delete_assigned_protocols(session, idp_id)
-            idp_ref = self._get_idp(session, idp_id)
-            session.delete(idp_ref)
-
-    def _get_idp(self, session, idp_id):
-        idp_ref = session.query(IdentityProviderModel).get(idp_id)
-        if not idp_ref:
-            raise exception.IdentityProviderNotFound(idp_id=idp_id)
-        return idp_ref
-
-    def _get_idp_from_remote_id(self, session, remote_id):
-        q = session.query(IdPRemoteIdsModel)
-        q = q.filter_by(remote_id=remote_id)
-        try:
-            return q.one()
-        except sql.NotFound:
-            raise exception.IdentityProviderNotFound(idp_id=remote_id)
-
-    def list_idps(self):
-        with sql.transaction() as session:
-            idps = session.query(IdentityProviderModel)
-        idps_list = [idp.to_dict() for idp in idps]
-        return idps_list
-
-    def get_idp(self, idp_id):
-        with sql.transaction() as session:
-            idp_ref = self._get_idp(session, idp_id)
-        return idp_ref.to_dict()
-
-    def get_idp_from_remote_id(self, remote_id):
-        with sql.transaction() as session:
-            ref = self._get_idp_from_remote_id(session, remote_id)
-        return ref.to_dict()
-
-    def update_idp(self, idp_id, idp):
-        with sql.transaction() as session:
-            idp_ref = self._get_idp(session, idp_id)
-            old_idp = idp_ref.to_dict()
-            old_idp.update(idp)
-            new_idp = IdentityProviderModel.from_dict(old_idp)
-            for attr in IdentityProviderModel.mutable_attributes:
-                setattr(idp_ref, attr, getattr(new_idp, attr))
-        return idp_ref.to_dict()
-
-    # Protocol CRUD
-    def _get_protocol(self, session, idp_id, protocol_id):
-        q = session.query(FederationProtocolModel)
-        q = q.filter_by(id=protocol_id, idp_id=idp_id)
-        try:
-            return q.one()
-        except sql.NotFound:
-            kwargs = {'protocol_id': protocol_id,
-                      'idp_id': idp_id}
-            raise exception.FederatedProtocolNotFound(**kwargs)
-
-    @sql.handle_conflicts(conflict_type='federation_protocol')
-    def create_protocol(self, idp_id, protocol_id, protocol):
-        protocol['id'] = protocol_id
-        protocol['idp_id'] = idp_id
-        with sql.transaction() as session:
-            self._get_idp(session, idp_id)
-            protocol_ref = FederationProtocolModel.from_dict(protocol)
-            session.add(protocol_ref)
-        return protocol_ref.to_dict()
-
-    def update_protocol(self, idp_id, protocol_id, protocol):
-        with sql.transaction() as session:
-            proto_ref = self._get_protocol(session, idp_id, protocol_id)
-            old_proto = proto_ref.to_dict()
-            old_proto.update(protocol)
-            new_proto = FederationProtocolModel.from_dict(old_proto)
-            for attr in FederationProtocolModel.mutable_attributes:
-                setattr(proto_ref, attr, getattr(new_proto, attr))
-        return proto_ref.to_dict()
-
-    def get_protocol(self, idp_id, protocol_id):
-        with sql.transaction() as session:
-            protocol_ref = self._get_protocol(session, idp_id, protocol_id)
-        return protocol_ref.to_dict()
-
-    def list_protocols(self, idp_id):
-        with sql.transaction() as session:
-            q = session.query(FederationProtocolModel)
-            q = q.filter_by(idp_id=idp_id)
-        protocols = [protocol.to_dict() for protocol in q]
-        return protocols
-
-    def delete_protocol(self, idp_id, protocol_id):
-        with sql.transaction() as session:
-            key_ref = self._get_protocol(session, idp_id, protocol_id)
-            session.delete(key_ref)
-
-    def _delete_assigned_protocols(self, session, idp_id):
-        query = session.query(FederationProtocolModel)
-        query = query.filter_by(idp_id=idp_id)
-        query.delete()
-
-    # Mapping CRUD
-    def _get_mapping(self, session, mapping_id):
-        mapping_ref = session.query(MappingModel).get(mapping_id)
-        if not mapping_ref:
-            raise exception.MappingNotFound(mapping_id=mapping_id)
-        return mapping_ref
-
-    @sql.handle_conflicts(conflict_type='mapping')
-    def create_mapping(self, mapping_id, mapping):
-        ref = {}
-        ref['id'] = mapping_id
-        ref['rules'] = mapping.get('rules')
-        with sql.transaction() as session:
-            mapping_ref = MappingModel.from_dict(ref)
-            session.add(mapping_ref)
-        return mapping_ref.to_dict()
-
-    def delete_mapping(self, mapping_id):
-        with sql.transaction() as session:
-            mapping_ref = self._get_mapping(session, mapping_id)
-            session.delete(mapping_ref)
-
-    def list_mappings(self):
-        with sql.transaction() as session:
-            mappings = session.query(MappingModel)
-        return [x.to_dict() for x in mappings]
-
-    def get_mapping(self, mapping_id):
-        with sql.transaction() as session:
-            mapping_ref = self._get_mapping(session, mapping_id)
-        return mapping_ref.to_dict()
-
-    @sql.handle_conflicts(conflict_type='mapping')
-    def update_mapping(self, mapping_id, mapping):
-        ref = {}
-        ref['id'] = mapping_id
-        ref['rules'] = mapping.get('rules')
-        with sql.transaction() as session:
-            mapping_ref = self._get_mapping(session, mapping_id)
-            old_mapping = mapping_ref.to_dict()
-            old_mapping.update(ref)
-            new_mapping = MappingModel.from_dict(old_mapping)
-            for attr in MappingModel.attributes:
-                setattr(mapping_ref, attr, getattr(new_mapping, attr))
-        return mapping_ref.to_dict()
-
-    def get_mapping_from_idp_and_protocol(self, idp_id, protocol_id):
-        with sql.transaction() as session:
-            protocol_ref = self._get_protocol(session, idp_id, protocol_id)
-            mapping_id = protocol_ref.mapping_id
-            mapping_ref = self._get_mapping(session, mapping_id)
-        return mapping_ref.to_dict()
-
-    # Service Provider CRUD
-    @sql.handle_conflicts(conflict_type='service_provider')
-    def create_sp(self, sp_id, sp):
-        sp['id'] = sp_id
-        with sql.transaction() as session:
-            sp_ref = ServiceProviderModel.from_dict(sp)
-            session.add(sp_ref)
-        return sp_ref.to_dict()
-
-    def delete_sp(self, sp_id):
-        with sql.transaction() as session:
-            sp_ref = self._get_sp(session, sp_id)
-            session.delete(sp_ref)
-
-    def _get_sp(self, session, sp_id):
-        sp_ref = session.query(ServiceProviderModel).get(sp_id)
-        if not sp_ref:
-            raise exception.ServiceProviderNotFound(sp_id=sp_id)
-        return sp_ref
-
-    def list_sps(self):
-        with sql.transaction() as session:
-            sps = session.query(ServiceProviderModel)
-        sps_list = [sp.to_dict() for sp in sps]
-        return sps_list
-
-    def get_sp(self, sp_id):
-        with sql.transaction() as session:
-            sp_ref = self._get_sp(session, sp_id)
-        return sp_ref.to_dict()
-
-    def update_sp(self, sp_id, sp):
-        with sql.transaction() as session:
-            sp_ref = self._get_sp(session, sp_id)
-            old_sp = sp_ref.to_dict()
-            old_sp.update(sp)
-            new_sp = ServiceProviderModel.from_dict(old_sp)
-            for attr in ServiceProviderModel.mutable_attributes:
-                setattr(sp_ref, attr, getattr(new_sp, attr))
-        return sp_ref.to_dict()
-
-    def get_enabled_service_providers(self):
-        with sql.transaction() as session:
-            service_providers = session.query(ServiceProviderModel)
-            service_providers = service_providers.filter_by(enabled=True)
-        return service_providers
+    @versionutils.deprecated(versionutils.deprecated.MITAKA,
+                             in_favor_of=_NEW,
+                             what=_OLD)
+    def __init__(self, *args, **kwargs):
+        super(Federation, self).__init__(*args, **kwargs)
diff --git a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/001_add_identity_provider_table.py b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/001_add_identity_provider_table.py
index 9a4d574b..d9b24a00 100644
--- a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/001_add_identity_provider_table.py
+++ b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/001_add_identity_provider_table.py
@@ -10,33 +10,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import sqlalchemy as sql
+from keystone import exception
 
 
 def upgrade(migrate_engine):
-    meta = sql.MetaData()
-    meta.bind = migrate_engine
-
-    idp_table = sql.Table(
-        'identity_provider',
-        meta,
-        sql.Column('id', sql.String(64), primary_key=True),
-        sql.Column('enabled', sql.Boolean, nullable=False),
-        sql.Column('description', sql.Text(), nullable=True),
-        mysql_engine='InnoDB',
-        mysql_charset='utf8')
-
-    idp_table.create(migrate_engine, checkfirst=True)
-
-    federation_protocol_table = sql.Table(
-        'federation_protocol',
-        meta,
-        sql.Column('id', sql.String(64), primary_key=True),
-        sql.Column('idp_id', sql.String(64),
-                   sql.ForeignKey('identity_provider.id', ondelete='CASCADE'),
-                   primary_key=True),
-        sql.Column('mapping_id', sql.String(64), nullable=True),
-        mysql_engine='InnoDB',
-        mysql_charset='utf8')
-
-    federation_protocol_table.create(migrate_engine, checkfirst=True)
+    raise exception.MigrationMovedFailure(extension='federation')
diff --git a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/002_add_mapping_tables.py b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/002_add_mapping_tables.py
index 9a155f5c..d9b24a00 100644
--- a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/002_add_mapping_tables.py
+++ b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/002_add_mapping_tables.py
@@ -10,18 +10,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import sqlalchemy as sql
+from keystone import exception
 
 
 def upgrade(migrate_engine):
-    meta = sql.MetaData()
-    meta.bind = migrate_engine
-
-    mapping_table = sql.Table(
-        'mapping',
-        meta,
-        sql.Column('id', sql.String(64), primary_key=True),
-        sql.Column('rules', sql.Text(), nullable=False),
-        mysql_engine='InnoDB',
-        mysql_charset='utf8')
-    mapping_table.create(migrate_engine, checkfirst=True)
+    raise exception.MigrationMovedFailure(extension='federation')
diff --git a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/003_mapping_id_nullable_false.py b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/003_mapping_id_nullable_false.py
index 1731b0d3..8ce8c6fa 100644
--- a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/003_mapping_id_nullable_false.py
+++ b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/003_mapping_id_nullable_false.py
@@ -13,17 +13,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import sqlalchemy as sa
+from keystone import exception
 
 
 def upgrade(migrate_engine):
-    meta = sa.MetaData(bind=migrate_engine)
-    federation_protocol = sa.Table('federation_protocol', meta, autoload=True)
-    # NOTE(i159): The column is changed to non-nullable. To prevent
-    # database errors when the column will be altered, all the existing
-    # null-records should be filled with not null values.
-    stmt = (federation_protocol.update().
-            where(federation_protocol.c.mapping_id.is_(None)).
-            values(mapping_id=''))
-    migrate_engine.execute(stmt)
-    federation_protocol.c.mapping_id.alter(nullable=False)
+    raise exception.MigrationMovedFailure(extension='federation')
diff --git a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/004_add_remote_id_column.py b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/004_add_remote_id_column.py
index 2e0aaf93..d9b24a00 100644
--- a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/004_add_remote_id_column.py
+++ b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/004_add_remote_id_column.py
@@ -10,14 +10,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-from oslo_db.sqlalchemy import utils
-import sqlalchemy as sql
+from keystone import exception
 
 
 def upgrade(migrate_engine):
-    meta = sql.MetaData()
-    meta.bind = migrate_engine
-
-    idp_table = utils.get_table(migrate_engine, 'identity_provider')
-    remote_id = sql.Column('remote_id', sql.String(256), nullable=True)
-    idp_table.create_column(remote_id)
+    raise exception.MigrationMovedFailure(extension='federation')
diff --git a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/005_add_service_provider_table.py b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/005_add_service_provider_table.py
index 1594f893..d9b24a00 100644
--- a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/005_add_service_provider_table.py
+++ b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/005_add_service_provider_table.py
@@ -10,22 +10,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import sqlalchemy as sql
+from keystone import exception
 
 
 def upgrade(migrate_engine):
-    meta = sql.MetaData()
-    meta.bind = migrate_engine
-
-    sp_table = sql.Table(
-        'service_provider',
-        meta,
-        sql.Column('auth_url', sql.String(256), nullable=True),
-        sql.Column('id', sql.String(64), primary_key=True),
-        sql.Column('enabled', sql.Boolean, nullable=False),
-        sql.Column('description', sql.Text(), nullable=True),
-        sql.Column('sp_url', sql.String(256), nullable=True),
-        mysql_engine='InnoDB',
-        mysql_charset='utf8')
-
-    sp_table.create(migrate_engine, checkfirst=True)
+    raise exception.MigrationMovedFailure(extension='federation')
diff --git a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/006_fixup_service_provider_attributes.py b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/006_fixup_service_provider_attributes.py
index dc18f548..d9b24a00 100644
--- a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/006_fixup_service_provider_attributes.py
+++ b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/006_fixup_service_provider_attributes.py
@@ -10,31 +10,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import sqlalchemy as sql
-
-_SP_TABLE_NAME = 'service_provider'
-
-
-def _update_null_columns(migrate_engine, sp_table):
-    stmt = (sp_table.update().
-            where(sp_table.c.auth_url.is_(None)).
-            values(auth_url=''))
-    migrate_engine.execute(stmt)
-
-    stmt = (sp_table.update().
-            where(sp_table.c.sp_url.is_(None)).
-            values(sp_url=''))
-    migrate_engine.execute(stmt)
+from keystone import exception
 
 
 def upgrade(migrate_engine):
-    meta = sql.MetaData()
-    meta.bind = migrate_engine
-    sp_table = sql.Table(_SP_TABLE_NAME, meta, autoload=True)
-    # The columns are being changed to non-nullable. To prevent
-    # database errors when both are altered, all the existing
-    # null-records should be filled with not null values.
-    _update_null_columns(migrate_engine, sp_table)
-
-    sp_table.c.auth_url.alter(nullable=False)
-    sp_table.c.sp_url.alter(nullable=False)
+    raise exception.MigrationMovedFailure(extension='federation')
diff --git a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/007_add_remote_id_table.py b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/007_add_remote_id_table.py
index 77012aad..d9b24a00 100644
--- a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/007_add_remote_id_table.py
+++ b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/007_add_remote_id_table.py
@@ -10,34 +10,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import sqlalchemy as orm
+from keystone import exception
 
 
 def upgrade(migrate_engine):
-    meta = orm.MetaData()
-    meta.bind = migrate_engine
-    idp_table = orm.Table('identity_provider', meta, autoload=True)
-    remote_id_table = orm.Table(
-        'idp_remote_ids',
-        meta,
-        orm.Column('idp_id',
-                   orm.String(64),
-                   orm.ForeignKey('identity_provider.id',
-                                  ondelete='CASCADE')),
-        orm.Column('remote_id',
-                   orm.String(255),
-                   primary_key=True),
-        mysql_engine='InnoDB',
-        mysql_charset='utf8')
-
-    remote_id_table.create(migrate_engine, checkfirst=True)
-
-    select = orm.sql.select([idp_table.c.id, idp_table.c.remote_id]).where(
-        idp_table.c.remote_id.isnot(None))
-
-    for identity in migrate_engine.execute(select):
-        remote_idp_entry = {'idp_id': identity.id,
-                            'remote_id': identity.remote_id}
-        remote_id_table.insert(remote_idp_entry).execute()
-
-    idp_table.drop_column('remote_id')
+    raise exception.MigrationMovedFailure(extension='federation')
diff --git a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/008_add_relay_state_to_sp.py b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/008_add_relay_state_to_sp.py
index 150dcfed..d9b24a00 100644
--- a/keystone-moon/keystone/contrib/federation/migrate_repo/versions/008_add_relay_state_to_sp.py
+++ b/keystone-moon/keystone/contrib/federation/migrate_repo/versions/008_add_relay_state_to_sp.py
@@ -10,30 +10,8 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-from oslo_config import cfg
-from oslo_db.sqlalchemy import utils
-import sqlalchemy as sql
-
-
-CONF = cfg.CONF
-_SP_TABLE_NAME = 'service_provider'
-_RELAY_STATE_PREFIX = 'relay_state_prefix'
+from keystone import exception
 
 
 def upgrade(migrate_engine):
-    meta = sql.MetaData()
-    meta.bind = migrate_engine
-
-    idp_table = utils.get_table(migrate_engine, _SP_TABLE_NAME)
-    relay_state_prefix_default = CONF.saml.relay_state_prefix
-    relay_state_prefix = sql.Column(_RELAY_STATE_PREFIX, sql.String(256),
-                                    nullable=False,
-                                    server_default=relay_state_prefix_default)
-    idp_table.create_column(relay_state_prefix)
-
-
-def downgrade(migrate_engine):
-    meta = sql.MetaData()
-    meta.bind = migrate_engine
-    idp_table = utils.get_table(migrate_engine, _SP_TABLE_NAME)
-    idp_table.drop_column(_RELAY_STATE_PREFIX)
+    raise exception.MigrationMovedFailure(extension='federation')
diff --git a/keystone-moon/keystone/contrib/federation/routers.py b/keystone-moon/keystone/contrib/federation/routers.py
index ddf2f61f..d5857ca6 100644
--- a/keystone-moon/keystone/contrib/federation/routers.py
+++ b/keystone-moon/keystone/contrib/federation/routers.py
@@ -10,242 +10,22 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-import functools
+from oslo_log import log
+from oslo_log import versionutils
 
-from keystone.common import json_home
 from keystone.common import wsgi
-from keystone.contrib.federation import controllers
+from keystone.i18n import _
 
 
-build_resource_relation = functools.partial(
-    json_home.build_v3_extension_resource_relation,
-    extension_name='OS-FEDERATION', extension_version='1.0')
+LOG = log.getLogger(__name__)
 
-build_parameter_relation = functools.partial(
-    json_home.build_v3_extension_parameter_relation,
-    extension_name='OS-FEDERATION', extension_version='1.0')
 
-IDP_ID_PARAMETER_RELATION = build_parameter_relation(parameter_name='idp_id')
-PROTOCOL_ID_PARAMETER_RELATION = build_parameter_relation(
-    parameter_name='protocol_id')
-SP_ID_PARAMETER_RELATION = build_parameter_relation(parameter_name='sp_id')
+class FederationExtension(wsgi.Middleware):
 
-
-class FederationExtension(wsgi.V3ExtensionRouter):
-    """API Endpoints for the Federation extension.
-
-    The API looks like::
-
-        PUT /OS-FEDERATION/identity_providers/{idp_id}
-        GET /OS-FEDERATION/identity_providers
-        GET /OS-FEDERATION/identity_providers/{idp_id}
-        DELETE /OS-FEDERATION/identity_providers/{idp_id}
-        PATCH /OS-FEDERATION/identity_providers/{idp_id}
-
-        PUT /OS-FEDERATION/identity_providers/
-            {idp_id}/protocols/{protocol_id}
-        GET /OS-FEDERATION/identity_providers/
-            {idp_id}/protocols
-        GET /OS-FEDERATION/identity_providers/
-            {idp_id}/protocols/{protocol_id}
-        PATCH /OS-FEDERATION/identity_providers/
-            {idp_id}/protocols/{protocol_id}
-        DELETE /OS-FEDERATION/identity_providers/
-            {idp_id}/protocols/{protocol_id}
-
-        PUT /OS-FEDERATION/mappings
-        GET /OS-FEDERATION/mappings
-        PATCH /OS-FEDERATION/mappings/{mapping_id}
-        GET /OS-FEDERATION/mappings/{mapping_id}
-        DELETE /OS-FEDERATION/mappings/{mapping_id}
-
-        GET /OS-FEDERATION/projects
-        GET /OS-FEDERATION/domains
-
-        PUT /OS-FEDERATION/service_providers/{sp_id}
-        GET /OS-FEDERATION/service_providers
-        GET /OS-FEDERATION/service_providers/{sp_id}
-        DELETE /OS-FEDERATION/service_providers/{sp_id}
-        PATCH /OS-FEDERATION/service_providers/{sp_id}
-
-        GET /OS-FEDERATION/identity_providers/{identity_provider}/
-            protocols/{protocol}/auth
-        POST /OS-FEDERATION/identity_providers/{identity_provider}/
-            protocols/{protocol}/auth
-        GET /auth/OS-FEDERATION/identity_providers/
-            {idp_id}/protocols/{protocol_id}/websso
-            ?origin=https%3A//horizon.example.com
-        POST /auth/OS-FEDERATION/identity_providers/
-            {idp_id}/protocols/{protocol_id}/websso
-            ?origin=https%3A//horizon.example.com
-
-
-        POST /auth/OS-FEDERATION/saml2
-        POST /auth/OS-FEDERATION/saml2/ecp
-        GET /OS-FEDERATION/saml2/metadata
-
-        GET /auth/OS-FEDERATION/websso/{protocol_id}
-            ?origin=https%3A//horizon.example.com
-
-        POST /auth/OS-FEDERATION/websso/{protocol_id}
-             ?origin=https%3A//horizon.example.com
-
-    """
-    def _construct_url(self, suffix):
-        return "/OS-FEDERATION/%s" % suffix
-
-    def add_routes(self, mapper):
-        auth_controller = controllers.Auth()
-        idp_controller = controllers.IdentityProvider()
-        protocol_controller = controllers.FederationProtocol()
-        mapping_controller = controllers.MappingController()
-        project_controller = controllers.ProjectAssignmentV3()
-        domain_controller = controllers.DomainV3()
-        saml_metadata_controller = controllers.SAMLMetadataV3()
-        sp_controller = controllers.ServiceProvider()
-
-        # Identity Provider CRUD operations
-
-        self._add_resource(
-            mapper, idp_controller,
-            path=self._construct_url('identity_providers/{idp_id}'),
-            get_action='get_identity_provider',
-            put_action='create_identity_provider',
-            patch_action='update_identity_provider',
-            delete_action='delete_identity_provider',
-            rel=build_resource_relation(resource_name='identity_provider'),
-            path_vars={
-                'idp_id': IDP_ID_PARAMETER_RELATION,
-            })
-        self._add_resource(
-            mapper, idp_controller,
-            path=self._construct_url('identity_providers'),
-            get_action='list_identity_providers',
-            rel=build_resource_relation(resource_name='identity_providers'))
-
-        # Protocol CRUD operations
-
-        self._add_resource(
-            mapper, protocol_controller,
-            path=self._construct_url('identity_providers/{idp_id}/protocols/'
-                                     '{protocol_id}'),
-            get_action='get_protocol',
-            put_action='create_protocol',
-            patch_action='update_protocol',
-            delete_action='delete_protocol',
-            rel=build_resource_relation(
-                resource_name='identity_provider_protocol'),
-            path_vars={
-                'idp_id': IDP_ID_PARAMETER_RELATION,
-                'protocol_id': PROTOCOL_ID_PARAMETER_RELATION,
-            })
-        self._add_resource(
-            mapper, protocol_controller,
-            path=self._construct_url('identity_providers/{idp_id}/protocols'),
-            get_action='list_protocols',
-            rel=build_resource_relation(
-                resource_name='identity_provider_protocols'),
-            path_vars={
-                'idp_id': IDP_ID_PARAMETER_RELATION,
-            })
-
-        # Mapping CRUD operations
-
-        self._add_resource(
-            mapper, mapping_controller,
-            path=self._construct_url('mappings/{mapping_id}'),
-            get_action='get_mapping',
-            put_action='create_mapping',
-            patch_action='update_mapping',
-            delete_action='delete_mapping',
-            rel=build_resource_relation(resource_name='mapping'),
-            path_vars={
-                'mapping_id': build_parameter_relation(
-                    parameter_name='mapping_id'),
-            })
-        self._add_resource(
-            mapper, mapping_controller,
-            path=self._construct_url('mappings'),
-            get_action='list_mappings',
-            rel=build_resource_relation(resource_name='mappings'))
-
-        # Service Providers CRUD operations
-
-        self._add_resource(
-            mapper, sp_controller,
-            path=self._construct_url('service_providers/{sp_id}'),
-            get_action='get_service_provider',
-            put_action='create_service_provider',
-            patch_action='update_service_provider',
-            delete_action='delete_service_provider',
-            rel=build_resource_relation(resource_name='service_provider'),
-            path_vars={
-                'sp_id': SP_ID_PARAMETER_RELATION,
-            })
-
-        self._add_resource(
-            mapper, sp_controller,
-            path=self._construct_url('service_providers'),
-            get_action='list_service_providers',
-            rel=build_resource_relation(resource_name='service_providers'))
-
-        self._add_resource(
-            mapper, domain_controller,
-            path=self._construct_url('domains'),
-            new_path='/auth/domains',
-            get_action='list_domains_for_groups',
-            rel=build_resource_relation(resource_name='domains'))
-        self._add_resource(
-            mapper, project_controller,
-            path=self._construct_url('projects'),
-            new_path='/auth/projects',
-            get_action='list_projects_for_groups',
-            rel=build_resource_relation(resource_name='projects'))
-
-        # Auth operations
-        self._add_resource(
-            mapper, auth_controller,
-            path=self._construct_url('identity_providers/{identity_provider}/'
-                                     'protocols/{protocol}/auth'),
-            get_post_action='federated_authentication',
-            rel=build_resource_relation(
-                resource_name='identity_provider_protocol_auth'),
-            path_vars={
-                'identity_provider': IDP_ID_PARAMETER_RELATION,
-                'protocol': PROTOCOL_ID_PARAMETER_RELATION,
-            })
-        self._add_resource(
-            mapper, auth_controller,
-            path='/auth' + self._construct_url('saml2'),
-            post_action='create_saml_assertion',
-            rel=build_resource_relation(resource_name='saml2'))
-        self._add_resource(
-            mapper, auth_controller,
-            path='/auth' + self._construct_url('saml2/ecp'),
-            post_action='create_ecp_assertion',
-            rel=build_resource_relation(resource_name='ecp'))
-        self._add_resource(
-            mapper, auth_controller,
-            path='/auth' + self._construct_url('websso/{protocol_id}'),
-            get_post_action='federated_sso_auth',
-            rel=build_resource_relation(resource_name='websso'),
-            path_vars={
-                'protocol_id': PROTOCOL_ID_PARAMETER_RELATION,
-            })
-        self._add_resource(
-            mapper, auth_controller,
-            path='/auth' + self._construct_url(
-                 'identity_providers/{idp_id}/protocols/{protocol_id}/websso'),
-            get_post_action='federated_idp_specific_sso_auth',
-            rel=build_resource_relation(resource_name='identity_providers'),
-            path_vars={
-                'idp_id': IDP_ID_PARAMETER_RELATION,
-                'protocol_id': PROTOCOL_ID_PARAMETER_RELATION,
-            })
-
-        # Keystone-Identity-Provider metadata endpoint
-        self._add_resource(
-            mapper, saml_metadata_controller,
-            path=self._construct_url('saml2/metadata'),
-            get_action='get_metadata',
-            rel=build_resource_relation(resource_name='metadata'))
+    def __init__(self, *args, **kwargs):
+        super(FederationExtension, self).__init__(*args, **kwargs)
+        msg = _("Remove federation_extension from the paste pipeline, the "
+                "federation extension is now always available. Update the "
+                "[pipeline:api_v3] section in keystone-paste.ini accordingly, "
+                "as it will be removed in the O release.")
+        versionutils.report_deprecated_feature(LOG, msg)