Added CORS support to Keystone

This adds the CORS support middleware to Keystone, allowing a deployer
to optionally configure rules under which a javascript client may
break the single-origin policy and access the API directly. Included
are Keystone's auth headers, so that anyone activating this
middleware does not have to explicitly enable them.

OpenStack CrossProject Spec:
   http://specs.openstack.org/openstack/openstack-specs/specs/cors-support.html
Oslo_Middleware Docs:
   http://docs.openstack.org/developer/oslo.middleware/cors.html
OpenStack Cloud Admin Guide:
   http://docs.openstack.org/admin-guide-cloud/cross_project_cors.html

Change-Id: If58ad7d952ace9211f0ed8beff8552c216262382

keystone/server/wsgi.py

@@ -16,6 +16,7 @@ import logging
 
 from oslo_config import cfg
 import oslo_i18n
+import oslo_middleware.cors as cors
 
 
 # NOTE(dstanek): i18n.enable_lazy() must be called before
@@ -27,12 +28,24 @@ oslo_i18n.enable_lazy()
 
 from keystone.common import environment
 from keystone import config
+import keystone.middleware.core as middleware_core
 from keystone.server import common
 from keystone import service as keystone_service
 
 
 CONF = cfg.CONF
 
+KEYSTONE_HEADERS = [
+    middleware_core.AUTH_TOKEN_HEADER,
+    middleware_core.SUBJECT_TOKEN_HEADER,
+    'X-Project-Id',
+    'X-Project-Name',
+    'X-Project-Domain-Id',
+    'X-Project-Domain-Name',
+    'X-Domain-Id',
+    'X-Domain-Name'
+]
+
 
 def initialize_application(name):
     common.configure()
@@ -49,6 +62,15 @@ def initialize_application(name):
 
     _unused, application = common.setup_backends(
         startup_application_fn=loadapp)
+
+    # Create a CORS wrapper, and attach keystone-specific defaults that must be
+    # included in all CORS responses
+    application = cors.CORS(application, CONF)
+    application.set_latent(
+        allow_headers=KEYSTONE_HEADERS,
+        allow_methods=['GET', 'PUT', 'POST', 'DELETE', 'PATCH'],
+        expose_headers=KEYSTONE_HEADERS
+    )
     return application