Update Keystone core to Mitaka.

Change-Id: Ia10d6add16f4a9d25d1f42d420661c46332e69db

48 files changed, 486 insertions, 0 deletions

diff --git a/keystone-moon/releasenotes/notes/Assignment_V9_driver-c22be069f7baccb0.yaml b/keystone-moon/releasenotes/notes/Assignment_V9_driver-c22be069f7baccb0.yaml
new file mode 100644
index 00000000..89ef1082
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/Assignment_V9_driver-c22be069f7baccb0.yaml
@@ -0,0 +1,13 @@
+---
+deprecations:
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    The V8 Assignment driver interface is deprecated. Support for the V8
+    Assignment driver interface is planned to be removed in the 'O' release of
+    OpenStack.
+other:
+  - The list_project_ids_for_user(), list_domain_ids_for_user(),
+    list_user_ids_for_project(), list_project_ids_for_groups(),
+    list_domain_ids_for_groups(), list_role_ids_for_groups_on_project() and
+    list_role_ids_for_groups_on_domain() methods have been removed from the
+    V9 version of the Assignment driver.
diff --git a/keystone-moon/releasenotes/notes/DomainSpecificRoles-fc5dd2ef74a1442c.yaml b/keystone-moon/releasenotes/notes/DomainSpecificRoles-fc5dd2ef74a1442c.yaml
new file mode 100644
index 00000000..98306f3e
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/DomainSpecificRoles-fc5dd2ef74a1442c.yaml
@@ -0,0 +1,11 @@
+---
+features:
+  - >
+    [`blueprint domain-specific-roles <https://blueprints.launchpad.net/keystone/+spec/domain-specific-roles>`_]
+    Roles can now be optionally defined as domain specific. Domain specific
+    roles are not referenced in policy files, rather they can be used to allow
+    a domain to build their own private inference rules with implied roles. A
+    domain specific role can be assigned to a domain or project within its
+    domain, and any subset of global roles it implies will appear in a token
+    scoped to the respective domain or project. The domain specific role
+    itself, however, will not appear in the token.
diff --git a/keystone-moon/releasenotes/notes/Role_V9_driver-971c3aae14d9963d.yaml b/keystone-moon/releasenotes/notes/Role_V9_driver-971c3aae14d9963d.yaml
new file mode 100644
index 00000000..08bda86f
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/Role_V9_driver-971c3aae14d9963d.yaml
@@ -0,0 +1,6 @@
+---
+deprecations:
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    The V8 Role driver interface is deprecated. Support for the V8 Role driver
+    interface is planned to be removed in the 'O' release of OpenStack.
diff --git a/keystone-moon/releasenotes/notes/V9ResourceDriver-26716f97c0cc1a80.yaml b/keystone-moon/releasenotes/notes/V9ResourceDriver-26716f97c0cc1a80.yaml
new file mode 100644
index 00000000..8003b702
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/V9ResourceDriver-26716f97c0cc1a80.yaml
@@ -0,0 +1,5 @@
+---
+deprecations:
+  - The V8 Resource driver interface is deprecated. Support for the V8
+    Resource driver interface is planned to be removed in the 'O' release of
+    OpenStack.
diff --git a/keystone-moon/releasenotes/notes/add-bootstrap-cli-192500228cc6e574.yaml b/keystone-moon/releasenotes/notes/add-bootstrap-cli-192500228cc6e574.yaml
new file mode 100644
index 00000000..997ee64a
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/add-bootstrap-cli-192500228cc6e574.yaml
@@ -0,0 +1,17 @@
+---
+features:
+  - >
+    [`blueprint bootstrap <https://blueprints.launchpad.net/keystone/+spec/bootstrap>`_]
+    keystone-manage now supports the bootstrap command
+    on the CLI so that a keystone install can be
+    initialized without the need of the admin_token
+    filter in the paste-ini.
+security:
+  - The use of admin_token filter is insecure compared
+    to the use of a proper username/password. Historically
+    the admin_token filter has been left enabled in
+    Keystone after initialization due to the way CMS
+    systems work. Moving to an out-of-band initialization using
+    ``keystone-manage bootstrap`` will eliminate the security concerns around
+    a static shared string that conveys admin access to keystone
+    and therefore to the entire installation.
diff --git a/keystone-moon/releasenotes/notes/admin_token-a5678d712783c145.yaml b/keystone-moon/releasenotes/notes/admin_token-a5678d712783c145.yaml
new file mode 100644
index 00000000..8547c6d3
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/admin_token-a5678d712783c145.yaml
@@ -0,0 +1,14 @@
+---
+upgrade:
+  - >
+    [`bug 1473553 <https://bugs.launchpad.net/keystone/+bug/1473553>`_]
+    The `keystone-paste.ini` must be updated to put the ``admin_token_auth``
+    middleware before ``build_auth_context``. See the sample
+    `keystone-paste.ini` for the correct `pipeline` value. Having
+    ``admin_token_auth`` after ``build_auth_context`` is deprecated and will
+    not be supported in a future release.
+deprecations:
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    The ``admin_token_auth`` filter must now be placed before the
+    ``build_auth_context`` filter in `keystone-paste.ini`.
diff --git a/keystone-moon/releasenotes/notes/admin_token-c634ec12fc714255.yaml b/keystone-moon/releasenotes/notes/admin_token-c634ec12fc714255.yaml
new file mode 100644
index 00000000..69b70dbb
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/admin_token-c634ec12fc714255.yaml
@@ -0,0 +1,11 @@
+---
+security:
+  - The admin_token method of authentication was never intended to be
+    used for any purpose other than bootstrapping an install. However
+    many deployments had to leave the admin_token method enabled due
+    to restrictions on editing the paste file used to configure the
+    web pipelines.  To minimize the risk from this mechanism, the
+    `admin_token` configuration value now defaults to a python `None`
+    value.  In addition, if the value is set to `None`, either explicitly or
+    implicitly, the `admin_token` will not be enabled, and an attempt to
+    use it will lead to a failed authentication.
diff --git a/keystone-moon/releasenotes/notes/bp-domain-config-default-82e42d946ee7cb43.yaml b/keystone-moon/releasenotes/notes/bp-domain-config-default-82e42d946ee7cb43.yaml
new file mode 100644
index 00000000..a78f831f
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/bp-domain-config-default-82e42d946ee7cb43.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - >
+    [`blueprint domain-config-default <https://blueprints.launchpad.net/keystone/+spec/domain-config-default>`_]
+    The Identity API now supports retrieving the default values for the
+    configuration options that can be overriden via the domain specific
+    configuration API.
diff --git a/keystone-moon/releasenotes/notes/bp-url-safe-naming-ad90d6a659f5bf3c.yaml b/keystone-moon/releasenotes/notes/bp-url-safe-naming-ad90d6a659f5bf3c.yaml
new file mode 100644
index 00000000..1c81d866
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/bp-url-safe-naming-ad90d6a659f5bf3c.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - >
+    [`blueprint url-safe-naming <https://blueprints.launchpad.net/keystone/+spec/url-safe-naming>`_]
+    The names of projects and domains can optionally be ensured to be url safe,
+    to support the future ability to specify projects using hierarchical
+    naming.
diff --git a/keystone-moon/releasenotes/notes/bug-1490804-de58a9606edb31eb.yaml b/keystone-moon/releasenotes/notes/bug-1490804-de58a9606edb31eb.yaml
new file mode 100644
index 00000000..0d5c2034
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/bug-1490804-de58a9606edb31eb.yaml
@@ -0,0 +1,13 @@
+---
+features:
+  - >
+    [`bug 1490804 <https://bugs.launchpad.net/keystone/+bug/1490804>`_]
+    Audit IDs are included in the token revocation list.
+security:
+  - >
+    [`bug 1490804 <https://bugs.launchpad.net/keystone/+bug/1490804>`_]
+    [`CVE-2015-7546 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7546>`_]
+    A bug is fixed where an attacker could avoid token revocation when the PKI
+    or PKIZ token provider is used. The complete remediation for this
+    vulnerability requires the corresponding fix in the keystonemiddleware
+    project.
diff --git a/keystone-moon/releasenotes/notes/bug-1519210-de76097c974f9c93.yaml b/keystone-moon/releasenotes/notes/bug-1519210-de76097c974f9c93.yaml
new file mode 100644
index 00000000..0b7192b1
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/bug-1519210-de76097c974f9c93.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - >
+    [`bug 1519210 <https://bugs.launchpad.net/keystone/+bug/1519210>`_]
+    A user may now opt-out of notifications by specifying a list of
+    event types using the `notification_opt_out` option in `keystone.conf`.
+    These events are never sent to a messaging service.
diff --git a/keystone-moon/releasenotes/notes/bug-1535878-change-get_project-permission-e460af1256a2c056.yaml b/keystone-moon/releasenotes/notes/bug-1535878-change-get_project-permission-e460af1256a2c056.yaml
new file mode 100644
index 00000000..68cb7e1d
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/bug-1535878-change-get_project-permission-e460af1256a2c056.yaml
@@ -0,0 +1,8 @@
+---
+fixes:
+  - >
+    [`bug 1535878 <https://bugs.launchpad.net/keystone/+bug/1535878>`_]
+    Originally, to perform GET /projects/{project_id}, the provided policy
+    files required a user to have at least project admin level of permission.
+    They have been updated to allow it to be performed by any user who has a
+    role on the project.
diff --git a/keystone-moon/releasenotes/notes/bug-1542417-d630b7886bb0b369.yaml b/keystone-moon/releasenotes/notes/bug-1542417-d630b7886bb0b369.yaml
new file mode 100644
index 00000000..bc6ec728
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/bug-1542417-d630b7886bb0b369.yaml
@@ -0,0 +1,21 @@
+---
+features:
+  - >
+    [`bug 1542417 <https://bugs.launchpad.net/keystone/+bug/1542417>`_]
+    Added support for a `user_description_attribute` mapping
+    to the LDAP driver configuration.
+upgrade:
+  - >
+    The LDAP driver now also maps the user description attribute after
+    user retrieval from LDAP.
+    If this is undesired behavior for your setup, please add `description`
+    to the `user_attribute_ignore` LDAP driver config setting.
+
+    The default mapping of the description attribute is set to `description`.
+    Please adjust the LDAP driver config setting `user_description_attribute`
+    if your LDAP uses a different attribute name (for instance to `displayName`
+    in case of an AD backed LDAP).
+
+    If your `user_additional_attribute_mapping` setting contains
+    `description:description` you can remove this mapping, since this is
+    now the default behavior.
diff --git a/keystone-moon/releasenotes/notes/bug_1526462-df9a3f3974d9040f.yaml b/keystone-moon/releasenotes/notes/bug_1526462-df9a3f3974d9040f.yaml
new file mode 100644
index 00000000..0befecd3
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/bug_1526462-df9a3f3974d9040f.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - >
+    [`bug 1526462 <https://bugs.launchpad.net/keystone/+bug/1526462>`_]
+    Support for posixGroups with OpenDirectory and UNIX when using
+    the LDAP identity driver.
diff --git a/keystone-moon/releasenotes/notes/catalog-caching-12f2532cfb71325a.yaml b/keystone-moon/releasenotes/notes/catalog-caching-12f2532cfb71325a.yaml
new file mode 100644
index 00000000..785fb3cf
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/catalog-caching-12f2532cfb71325a.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - >
+    [`bug 1489061 <https://bugs.launchpad.net/keystone/+bug/1489061>`_]
+    Caching has been added to catalog retrieval on a per user ID and project
+    ID basis. This affects both the v2 and v3 APIs. As a result this should
+    provide a performance benefit to fernet-based deployments.
diff --git a/keystone-moon/releasenotes/notes/catalog_project_id-519f5a70f9f7c4c6.yaml b/keystone-moon/releasenotes/notes/catalog_project_id-519f5a70f9f7c4c6.yaml
new file mode 100644
index 00000000..e0c381d9
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/catalog_project_id-519f5a70f9f7c4c6.yaml
@@ -0,0 +1,9 @@
+---
+deprecations:
+  - Use of ``$(tenant_id)s`` in the catalog endpoints is deprecated in favor
+    of ``$(project_id)s``.
+features:
+  - Keystone supports ``$(project_id)s`` in the catalog. It works the same as
+    ``$(tenant_id)s``. Use of ``$(tenant_id)s`` is deprecated and catalog
+    endpoints should be updated to use ``$(project_id)s``.
+
diff --git a/keystone-moon/releasenotes/notes/deprecate-endpoint-policy-cfg-option-d018acab72a398a0.yaml b/keystone-moon/releasenotes/notes/deprecate-endpoint-policy-cfg-option-d018acab72a398a0.yaml
new file mode 100644
index 00000000..ce372ede
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/deprecate-endpoint-policy-cfg-option-d018acab72a398a0.yaml
@@ -0,0 +1,6 @@
+---
+deprecations:
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    Deprecate the ``enabled`` option from ``[endpoint_policy]``, it will be
+    removed in the 'O' release, and the extension will always be enabled.
diff --git a/keystone-moon/releasenotes/notes/deprecate-memcache-token-persistence-eac88c80147ea241.yaml b/keystone-moon/releasenotes/notes/deprecate-memcache-token-persistence-eac88c80147ea241.yaml
new file mode 100644
index 00000000..7b9c8e08
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/deprecate-memcache-token-persistence-eac88c80147ea241.yaml
@@ -0,0 +1,7 @@
+---
+deprecations:
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    The token memcache and memcache_pool persistence
+    backends have been deprecated in favor of using
+    Fernet tokens (which require no persistence).
diff --git a/keystone-moon/releasenotes/notes/deprecate-v2-apis-894284c17be881d2.yaml b/keystone-moon/releasenotes/notes/deprecate-v2-apis-894284c17be881d2.yaml
new file mode 100644
index 00000000..59680274
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/deprecate-v2-apis-894284c17be881d2.yaml
@@ -0,0 +1,8 @@
+---
+deprecations:
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    Deprecated all v2.0 APIs. The keystone team recommends using v3 APIs instead.
+    Most v2.0 APIs will be removed in the 'Q' release. However, the authentication
+    APIs and EC2 APIs are indefinitely deprecated and will not be removed in
+    the 'Q' release.
diff --git a/keystone-moon/releasenotes/notes/deprecated-as-of-mitaka-8534e43fa40c1d09.yaml b/keystone-moon/releasenotes/notes/deprecated-as-of-mitaka-8534e43fa40c1d09.yaml
new file mode 100644
index 00000000..31c7ff85
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/deprecated-as-of-mitaka-8534e43fa40c1d09.yaml
@@ -0,0 +1,26 @@
+---
+deprecations:
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    As of the Mitaka release, the PKI and PKIz token formats have been
+    deprecated. They will be removed in the 'O' release. Due to this change,
+    the `hash_algorithm` option in the `[token]` section of the
+    configuration file has also been deprecated. Also due to this change, the
+    ``keystone-manage pki_setup`` command has been deprecated as well.
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    As of the Mitaka release, write support for the LDAP driver of the Identity
+    backend has been deprecated. This includes the following operations: create user,
+    create group, delete user, delete group, update user, update group,
+    add user to group, and remove user from group. These operations will be
+    removed in the 'O' release.
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    As of the Mitaka release, the auth plugin `keystone.auth.plugins.saml2.Saml2`
+    has been deprecated. It is recommended to use `keystone.auth.plugins.mapped.Mapped`
+    instead. The ``saml2`` plugin will be removed in the 'O' release.
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    As of the Mitaka release, the simple_cert_extension is deprecated since it
+    is only used in support of the PKI and PKIz token formats.  It will be
+    removed in the 'O' release.
diff --git a/keystone-moon/releasenotes/notes/enable-filter-idp-d0135f4615178cfc.yaml b/keystone-moon/releasenotes/notes/enable-filter-idp-d0135f4615178cfc.yaml
new file mode 100644
index 00000000..f4c1bbe7
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/enable-filter-idp-d0135f4615178cfc.yaml
@@ -0,0 +1,10 @@
+---
+features:
+  - >
+    [`bug 1525317 <https://bugs.launchpad.net/keystone/+bug/1525317>`_]
+    Enable filtering of identity providers based on `id`, and `enabled`
+    attributes.
+  - >
+    [`bug 1555830 <https://bugs.launchpad.net/keystone/+bug/1555830>`_]
+    Enable filtering of service providers based on `id`, and `enabled`
+    attributes.
\ No newline at end of file
diff --git a/keystone-moon/releasenotes/notes/enable-inherit-on-default-54ac435230261a6a.yaml b/keystone-moon/releasenotes/notes/enable-inherit-on-default-54ac435230261a6a.yaml
new file mode 100644
index 00000000..8346285a
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/enable-inherit-on-default-54ac435230261a6a.yaml
@@ -0,0 +1,10 @@
+---
+upgrade:
+  - >
+    The default setting for the `os_inherit` configuration option is
+    changed to True. If it is required to continue with this portion
+    of the API disabled, then override the default setting by explicitly
+    specifying the os_inherit option as False.
+deprecations:
+  - The `os_inherit` configuration option is disabled. In the future, this
+    option will be removed and this portion of the API will be always enabled.
diff --git a/keystone-moon/releasenotes/notes/endpoints-from-endpoint_group-project-association-7271fba600322fb6.yaml b/keystone-moon/releasenotes/notes/endpoints-from-endpoint_group-project-association-7271fba600322fb6.yaml
new file mode 100644
index 00000000..d94db3ba
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/endpoints-from-endpoint_group-project-association-7271fba600322fb6.yaml
@@ -0,0 +1,7 @@
+---
+fixes:
+  - >
+    [`bug 1516469 <https://bugs.launchpad.net/keystone/+bug/1516469>`_]
+    Endpoints filtered by endpoint_group project association will be
+    included in the service catalog when a project scoped token is issued and
+    ``endpoint_filter.sql`` is used for the catalog driver.
diff --git a/keystone-moon/releasenotes/notes/extensions-to-core-a0d270d216d47276.yaml b/keystone-moon/releasenotes/notes/extensions-to-core-a0d270d216d47276.yaml
new file mode 100644
index 00000000..ced7d5a7
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/extensions-to-core-a0d270d216d47276.yaml
@@ -0,0 +1,25 @@
+---
+upgrade:
+  - >
+    The `keystone-paste.ini` file must be updated to remove extension
+    filters, and their use in ``[pipeline:api_v3]``.
+    Remove the following filters: ``[filter:oauth1_extension]``,
+    ``[filter:federation_extension]``, ``[filter:endpoint_filter_extension]``,
+    and ``[filter:revoke_extension]``. See the sample `keystone-paste.ini
+    <https://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone-paste.ini>`_
+    file for guidance.
+  - >
+    The `keystone-paste.ini` file must be updated to remove extension filters,
+    and their use in ``[pipeline:public_api]`` and ``[pipeline:admin_api]`` pipelines.
+    Remove the following filters: ``[filter:user_crud_extension]``,
+    ``[filter:crud_extension]``. See the sample `keystone-paste.ini
+    <https://git.openstack.org/cgit/openstack/keystone/tree/etc/keystone-paste.ini>`_
+    file for guidance.
+other:
+  - >
+    [`blueprint move-extensions <https://blueprints.launchpad.net/keystone/+spec/move-extensions>`_]
+    If any extension migrations are run, for example: ``keystone-manage db_sync
+    --extension endpoint_policy`` an error will be returned. This is working as
+    designed. To run these migrations simply run: ``keystone-manage db_sync``.
+    The complete list of affected extensions are: ``oauth1``, ``federation``,
+    ``endpoint_filter``, ``endpoint_policy``, and ``revoke``.
diff --git a/keystone-moon/releasenotes/notes/federation-group-ids-mapping-6c56120d65a5cb22.yaml b/keystone-moon/releasenotes/notes/federation-group-ids-mapping-6c56120d65a5cb22.yaml
new file mode 100644
index 00000000..04d45dae
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/federation-group-ids-mapping-6c56120d65a5cb22.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - >
+   [`blueprint federation-group-ids-mapped-without-domain-reference <https://blueprints.launchpad.net/keystone/+spec/federation-group-ids-mapped-without-domain-reference>`_]
+   Enhanced the federation mapping engine to allow for group IDs to be
+   referenced without a domain ID.
diff --git a/keystone-moon/releasenotes/notes/httpd-keystone-d51b7335559b09c8.yaml b/keystone-moon/releasenotes/notes/httpd-keystone-d51b7335559b09c8.yaml
new file mode 100644
index 00000000..86bb378e
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/httpd-keystone-d51b7335559b09c8.yaml
@@ -0,0 +1,7 @@
+---
+deprecations:
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    The file ``httpd/keystone.py`` has been deprecated in favor of
+    ``keystone-wsgi-admin`` and ``keystone-wsgi-public`` and may be
+    removed in the 'O' release.
diff --git a/keystone-moon/releasenotes/notes/impl-templated-catalog-1d8f6333726b34f8.yaml b/keystone-moon/releasenotes/notes/impl-templated-catalog-1d8f6333726b34f8.yaml
new file mode 100644
index 00000000..3afd9159
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/impl-templated-catalog-1d8f6333726b34f8.yaml
@@ -0,0 +1,9 @@
+---
+other:
+  - >
+    [`bug 1367113 <https://bugs.launchpad.net/keystone/+bug/1367113>`_]
+    The "get entity" and "list entities" functionality for the KVS catalog
+    backend has been reimplemented to use the data from the catalog template.
+    Previously this would only act on temporary data that was created at
+    runtime. The create, update and delete entity functionality now raises
+    an exception.
diff --git a/keystone-moon/releasenotes/notes/implied-roles-026f401adc0f7fb6.yaml b/keystone-moon/releasenotes/notes/implied-roles-026f401adc0f7fb6.yaml
new file mode 100644
index 00000000..065fd541
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/implied-roles-026f401adc0f7fb6.yaml
@@ -0,0 +1,12 @@
+---
+features:
+  - >
+   [`blueprint implied-roles <https://blueprints.launchpad.net/keystone/+spec/implied-roles>`_]
+   Keystone now supports creating implied roles. Role inference rules can now
+   be added to indicate when the assignment of one role implies the assignment
+   of another. The rules are of the form `prior_role` implies
+   `implied_role`. At token generation time, user/group assignments of roles
+   that have implied roles will be expanded to also include such roles in the
+   token. The expansion of implied roles is controlled by the
+   `prohibited_implied_role` option in the `[assignment]`
+   section of `keystone.conf`.
diff --git a/keystone-moon/releasenotes/notes/insecure_reponse-2a168230709bc8e7.yaml b/keystone-moon/releasenotes/notes/insecure_reponse-2a168230709bc8e7.yaml
new file mode 100644
index 00000000..ba11ab2a
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/insecure_reponse-2a168230709bc8e7.yaml
@@ -0,0 +1,7 @@
+---
+upgrade:
+  - A new config option, `insecure_debug`, is added to control whether debug
+    information is returned to clients. This used to be controlled by the
+    `debug` option. If you'd like to return extra information to clients
+    set the value to ``true``. This extra information may help an attacker.
+
diff --git a/keystone-moon/releasenotes/notes/is-admin-24b34238c83b3a82.yaml b/keystone-moon/releasenotes/notes/is-admin-24b34238c83b3a82.yaml
new file mode 100644
index 00000000..a0c2b3bb
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/is-admin-24b34238c83b3a82.yaml
@@ -0,0 +1,14 @@
+---
+features:
+  - >
+    [`bug 96869 <https://bugs.launchpad.net/keystone/+bug/968696>`_]
+    A pair of configuration options have been added to the ``[resource]``
+    section to specify a special ``admin`` project:
+    ``admin_project_domain_name`` and ``admin_project_name``.  If these are
+    defined, any scoped token issued for that project will have an additional
+    identifier ``is_admin_project`` added to the token. This identifier can then
+    be checked by the policy rules in the policy files of the services when
+    evaluating access control policy for an API. Keystone does not yet
+    support the ability for a project acting as a domain to be the
+    admin project.  That will be added once the rest of the code for
+    projects acting as domains is merged.
diff --git a/keystone-moon/releasenotes/notes/ldap-conn-pool-enabled-90df94652f1ded53.yaml b/keystone-moon/releasenotes/notes/ldap-conn-pool-enabled-90df94652f1ded53.yaml
new file mode 100644
index 00000000..c26eeb3f
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/ldap-conn-pool-enabled-90df94652f1ded53.yaml
@@ -0,0 +1,8 @@
+---
+upgrade:
+  - >
+    The configuration options for LDAP connection pooling, `[ldap] use_pool`
+    and `[ldap] use_auth_pool`, are now both enabled by default. Only
+    deployments using LDAP drivers are affected. Additional configuration
+    options are available in the `[ldap]` section to tune connection pool size,
+    etc.
diff --git a/keystone-moon/releasenotes/notes/ldap-emulation-91c4d535eb9c3d10.yaml b/keystone-moon/releasenotes/notes/ldap-emulation-91c4d535eb9c3d10.yaml
new file mode 100644
index 00000000..1d097ae3
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/ldap-emulation-91c4d535eb9c3d10.yaml
@@ -0,0 +1,8 @@
+---
+features:
+  - >
+    [`bug 1515302 <https://bugs.launchpad.net/keystone/+bug/1515302>`_]
+    Two new configuration options have been added to the `[ldap]` section.
+    `user_enabled_emulation_use_group_config` and
+    `project_enabled_emulation_use_group_config`, which allow deployers to
+    choose if they want to override the default group LDAP schema option.
diff --git a/keystone-moon/releasenotes/notes/list_limit-ldap-support-5d31d51466fc49a6.yaml b/keystone-moon/releasenotes/notes/list_limit-ldap-support-5d31d51466fc49a6.yaml
new file mode 100644
index 00000000..4e5f5458
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/list_limit-ldap-support-5d31d51466fc49a6.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - >
+    [`bug 1501698 <https://bugs.launchpad.net/keystone/+bug/1501698>`_]
+    Support parameter `list_limit` when LDAP is used as
+    identity backend.
diff --git a/keystone-moon/releasenotes/notes/list_role_assignment_names-33aedc1e521230b6.yaml b/keystone-moon/releasenotes/notes/list_role_assignment_names-33aedc1e521230b6.yaml
new file mode 100644
index 00000000..267ece71
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/list_role_assignment_names-33aedc1e521230b6.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - >
+    [`bug 1479569 <https://bugs.launchpad.net/keystone/+bug/1479569>`_]
+    Names have been added to list role assignments
+    (GET /role_assignments?include_names=True), rather than returning
+    just the internal IDs of the objects the names are also returned.
diff --git a/keystone-moon/releasenotes/notes/migration_squash-f655329ddad7fc2a.yaml b/keystone-moon/releasenotes/notes/migration_squash-f655329ddad7fc2a.yaml
new file mode 100644
index 00000000..c7d9d412
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/migration_squash-f655329ddad7fc2a.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - >
+    [`bug 1541092 <https://bugs.launchpad.net/keystone/+bug/1541092>`_]
+    Only database upgrades from Kilo and newer are supported.
diff --git a/keystone-moon/releasenotes/notes/no-default-domain-2161ada44bf7a3f7.yaml b/keystone-moon/releasenotes/notes/no-default-domain-2161ada44bf7a3f7.yaml
new file mode 100644
index 00000000..a449ad67
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/no-default-domain-2161ada44bf7a3f7.yaml
@@ -0,0 +1,7 @@
+---
+other:
+  - >
+    ``keystone-manage db_sync`` will no longer create the Default domain. This
+    domain is used as the domain for any users created using the legacy v2.0
+    API. A default domain is created by ``keystone-manage bootstrap`` and when
+    a user or project is created using the legacy v2.0 API.
diff --git a/keystone-moon/releasenotes/notes/notify-on-user-group-membership-8c0136ee0484e255.yaml b/keystone-moon/releasenotes/notes/notify-on-user-group-membership-8c0136ee0484e255.yaml
new file mode 100644
index 00000000..d80ab826
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/notify-on-user-group-membership-8c0136ee0484e255.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - Support has now been added to send notification events
+    on user/group membership. When a user is added or removed
+    from a group a notification will be sent including the
+    identifiers of both the user and the group.
diff --git a/keystone-moon/releasenotes/notes/oslo.cache-a9ce47bfa8809efa.yaml b/keystone-moon/releasenotes/notes/oslo.cache-a9ce47bfa8809efa.yaml
new file mode 100644
index 00000000..dc989154
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/oslo.cache-a9ce47bfa8809efa.yaml
@@ -0,0 +1,17 @@
+---
+upgrade:
+  - >
+    Keystone now uses oslo.cache. Update the `[cache]` section of
+    `keystone.conf` to point to oslo.cache backends:
+    ``oslo_cache.memcache_pool`` or ``oslo_cache.mongo``. Refer to the
+    sample configuration file for examples. See `oslo.cache
+    <http://docs.openstack.org/developer/oslo.cache>`_ for additional
+    documentation.
+deprecations:
+  - >
+    [`blueprint deprecated-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/deprecated-as-of-mitaka>`_]
+    ``keystone.common.cache.backends.memcache_pool``,
+    ``keystone.common.cache.backends.mongo``, and
+    ``keystone.common.cache.backends.noop`` are deprecated in favor of
+    oslo.cache backends. The keystone backends will be removed in the 'O'
+    release.
diff --git a/keystone-moon/releasenotes/notes/projects_as_domains-3ea8a58b4c2965e1.yaml b/keystone-moon/releasenotes/notes/projects_as_domains-3ea8a58b4c2965e1.yaml
new file mode 100644
index 00000000..7845df9a
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/projects_as_domains-3ea8a58b4c2965e1.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - Domains are now represented as top level projects with the attribute
+    `is_domain` set to true. Such projects will appear as parents for any
+    previous top level projects. Projects acting as domains can be created,
+    read, updated, and deleted via either the project API or the domain API
+    (V3 only).
diff --git a/keystone-moon/releasenotes/notes/remove-trust-auth-support-from-v2-de316c9ba46d556d.yaml b/keystone-moon/releasenotes/notes/remove-trust-auth-support-from-v2-de316c9ba46d556d.yaml
new file mode 100644
index 00000000..0c591dcc
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/remove-trust-auth-support-from-v2-de316c9ba46d556d.yaml
@@ -0,0 +1,4 @@
+---
+other:
+  - The ability to validate a trust-scoped token against the v2.0 API has been
+    removed, in favor of using the version 3 of the API.
diff --git a/keystone-moon/releasenotes/notes/removed-as-of-mitaka-9ff14f87d0b98e7e.yaml b/keystone-moon/releasenotes/notes/removed-as-of-mitaka-9ff14f87d0b98e7e.yaml
new file mode 100644
index 00000000..b0964c95
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/removed-as-of-mitaka-9ff14f87d0b98e7e.yaml
@@ -0,0 +1,44 @@
+---
+other:
+  - >
+    [`blueprint removed-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/removed-as-of-mitaka>`_]
+    Removed ``extras`` from token responses. These fields should not be
+    necessary and a well-defined API makes this field redundant. This was
+    deprecated in the Kilo release.
+  - >
+    [`blueprint removed-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/removed-as-of-mitaka>`_]
+    Removed ``RequestBodySizeLimiter`` from keystone middleware. The keystone
+    team suggests using ``oslo_middleware.sizelimit.RequestBodySizeLimiter``
+    instead. This was deprecated in the Kilo release.
+  - >
+    [`blueprint removed-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/removed-as-of-mitaka>`_]
+    Notifications with event_type ``identity.created.role_assignment`` and
+    ``identity.deleted.role_assignment`` have been removed. The keystone team
+    suggests listening for ``identity.role_assignment.created`` and
+    ``identity.role_assignment.deleted`` instead. This was deprecated in the
+    Kilo release.
+  - >
+    [`blueprint removed-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/removed-as-of-mitaka>`_]
+    Removed ``check_role_for_trust`` from the trust controller, ensure policy
+    files do not refer to this target. This was deprecated in the Kilo
+    release.
+  - >
+    [`blueprint removed-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/removed-as-of-mitaka>`_]
+    Removed Catalog KVS backend (``keystone.catalog.backends.sql.Catalog``).
+    This was deprecated in the Icehouse release.
+  - >
+    [`blueprint removed-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/removed-as-of-mitaka>`_]
+    The LDAP backend for Assignment has been removed. This was deprecated in
+    the Kilo release.
+  - >
+    [`blueprint removed-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/removed-as-of-mitaka>`_]
+    The LDAP backend for Resource has been removed. This was deprecated in
+    the Kilo release.
+  - >
+    [`blueprint removed-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/removed-as-of-mitaka>`_]
+    The LDAP backend for Role has been removed. This was deprecated in the
+    Kilo release.
+  - >
+    [`blueprint removed-as-of-mitaka <https://blueprints.launchpad.net/keystone/+spec/removed-as-of-mitaka>`_]
+    Removed Revoke KVS backend (``keystone.revoke.backends.kvs.Revoke``).
+    This was deprecated in the Juno release.
diff --git a/keystone-moon/releasenotes/notes/request_context-e143ba9c446a5952.yaml b/keystone-moon/releasenotes/notes/request_context-e143ba9c446a5952.yaml
new file mode 100644
index 00000000..b00153db
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/request_context-e143ba9c446a5952.yaml
@@ -0,0 +1,7 @@
+---
+features:
+  - >
+    [`bug 1500222 <https://bugs.launchpad.net/keystone/+bug/1500222>`_]
+    Added information such as: user ID, project ID, and domain ID to log
+    entries. As a side effect of this change, both the user's domain ID and
+    project's domain ID are now included in the auth context.
diff --git a/keystone-moon/releasenotes/notes/revert-v2-token-issued-for-non-default-domain-25ea5337f158ef13.yaml b/keystone-moon/releasenotes/notes/revert-v2-token-issued-for-non-default-domain-25ea5337f158ef13.yaml
new file mode 100644
index 00000000..cc28c7f3
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/revert-v2-token-issued-for-non-default-domain-25ea5337f158ef13.yaml
@@ -0,0 +1,12 @@
+fixes:
+  - >
+    [`bug 1527759 <https://bugs.launchpad.net/keystone/+bug/1527759>`_]
+    Reverted the change that eliminates the ability to get
+    a V2 token with a user or project that is not in the
+    default domain. This change broke real-world deployments
+    that utilized the ability to authenticate via V2 API
+    with a user not in the default domain or with a
+    project not in the default domain. The deployer
+    is being convinced to update code to properly handle
+    V3 auth but the fix broke expected and tested
+    behavior.
diff --git a/keystone-moon/releasenotes/notes/s3-aws-v4-c6cb75ce8d2289d4.yaml b/keystone-moon/releasenotes/notes/s3-aws-v4-c6cb75ce8d2289d4.yaml
new file mode 100644
index 00000000..85fcd6d8
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/s3-aws-v4-c6cb75ce8d2289d4.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - >
+    [`bug 1473042 <https://bugs.launchpad.net/keystone/+bug/1473042>`_]
+    Keystone's S3 compatibility support can now authenticate using AWS
+    Signature Version 4.
diff --git a/keystone-moon/releasenotes/notes/totp-40d93231714c6a20.yaml b/keystone-moon/releasenotes/notes/totp-40d93231714c6a20.yaml
new file mode 100644
index 00000000..fcfdb049
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/totp-40d93231714c6a20.yaml
@@ -0,0 +1,9 @@
+---
+features:
+  - >
+   [`blueprint totp-auth <https://blueprints.launchpad.net/keystone/+spec/totp-auth>`_]
+   Keystone now supports authenticating via Time-based One-time Password (TOTP).
+   To enable this feature, add the ``totp`` auth plugin to the `methods`
+   option in the `[auth]` section of `keystone.conf`. More information
+   about using TOTP can be found in `keystone's developer documentation
+   <http://docs.openstack.org/developer/keystone/auth-totp.html>`_.
diff --git a/keystone-moon/releasenotes/notes/v3-endpoints-in-v2-list-b0439816938713d6.yaml b/keystone-moon/releasenotes/notes/v3-endpoints-in-v2-list-b0439816938713d6.yaml
new file mode 100644
index 00000000..ae184605
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/v3-endpoints-in-v2-list-b0439816938713d6.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - >
+    [`bug 1480270 <https://bugs.launchpad.net/keystone/+bug/1480270>`_]
+    Endpoints created when using v3 of the keystone REST API will now be
+    included when listing endpoints via the v2.0 API.
diff --git a/keystone-moon/releasenotes/notes/v9FederationDriver-cbebcf5f97e1eae2.yaml b/keystone-moon/releasenotes/notes/v9FederationDriver-cbebcf5f97e1eae2.yaml
new file mode 100644
index 00000000..7db04c81
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/v9FederationDriver-cbebcf5f97e1eae2.yaml
@@ -0,0 +1,5 @@
+---
+deprecations:
+  - The V8 Federation driver interface is deprecated in favor of the V9
+    Federation driver interface. Support for the V8 Federation driver
+    interface is planned to be removed in the 'O' release of OpenStack.
diff --git a/keystone-moon/releasenotes/notes/x509-auth-df0a229780b8e3ff.yaml b/keystone-moon/releasenotes/notes/x509-auth-df0a229780b8e3ff.yaml
new file mode 100644
index 00000000..421acd6d
--- /dev/null
+++ b/keystone-moon/releasenotes/notes/x509-auth-df0a229780b8e3ff.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - >
+   [`blueprint x509-ssl-client-cert-authn <https://blueprints.launchpad.net/keystone/+spec/x509-ssl-client-cert-authn>`_]
+   Keystone now supports tokenless client SSL x.509 certificate authentication
+   and authorization.