)]}'
{"lib/keystone":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7e0b1c31162d269580078c4106b6912cc1911498","unresolved":false,"context_lines":[{"line_number":135,"context_line":"KEYSTONE_AUTH_URI_V3\u003d$KEYSTONE_AUTH_URI/v3"},{"line_number":136,"context_line":"KEYSTONE_SERVICE_URI_V3\u003d$KEYSTONE_SERVICE_URI/v3"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"# Security compliance"},{"line_number":139,"context_line":"KEYSTONE_SECURITY_COMPLIANCE_ENABLED\u003d${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-False}"},{"line_number":140,"context_line":"KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS\u003d${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}"},{"line_number":141,"context_line":"KEYSTONE_LOCKOUT_DURATION\u003d${KEYSTONE_DURATION:-5}"}],"source_content_type":"application/x-shellscript","patch_set":4,"id":"5a8bc5a2_05d46445","line":138,"range":{"start_line":138,"start_character":2,"end_line":138,"end_character":21},"updated":"2016-09-28 03:44:43.000000000","message":"can i ask for the password regex setting too?","commit_id":"f8f0f8a4f8e038ab6b0aa5606a406bcbe009cbc2"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"872c4cf01a8a9df2f95ff4e571706a2f4e51529c","unresolved":false,"context_lines":[{"line_number":135,"context_line":"KEYSTONE_AUTH_URI_V3\u003d$KEYSTONE_AUTH_URI/v3"},{"line_number":136,"context_line":"KEYSTONE_SERVICE_URI_V3\u003d$KEYSTONE_SERVICE_URI/v3"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"# Security compliance"},{"line_number":139,"context_line":"KEYSTONE_SECURITY_COMPLIANCE_ENABLED\u003d${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-False}"},{"line_number":140,"context_line":"KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS\u003d${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}"},{"line_number":141,"context_line":"KEYSTONE_LOCKOUT_DURATION\u003d${KEYSTONE_DURATION:-5}"}],"source_content_type":"application/x-shellscript","patch_set":4,"id":"5a8bc5a2_4d35a0f5","line":138,"range":{"start_line":138,"start_character":2,"end_line":138,"end_character":21},"in_reply_to":"5a8bc5a2_05d46445","updated":"2016-09-28 11:25:45.000000000","message":"breaks both devstack and tempest :(\n\n(limiting this on keystone side, limits the options devs have to chose the password in their deployments)","commit_id":"f8f0f8a4f8e038ab6b0aa5606a406bcbe009cbc2"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"26d63887eea1843c005e41c52fad533804d80f25","unresolved":false,"context_lines":[{"line_number":135,"context_line":"KEYSTONE_AUTH_URI_V3\u003d$KEYSTONE_AUTH_URI/v3"},{"line_number":136,"context_line":"KEYSTONE_SERVICE_URI_V3\u003d$KEYSTONE_SERVICE_URI/v3"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"# Security compliance"},{"line_number":139,"context_line":"KEYSTONE_SECURITY_COMPLIANCE_ENABLED\u003d${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-False}"},{"line_number":140,"context_line":"KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS\u003d${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}"},{"line_number":141,"context_line":"KEYSTONE_LOCKOUT_DURATION\u003d${KEYSTONE_DURATION:-5}"}],"source_content_type":"application/x-shellscript","patch_set":4,"id":"3a98d1f4_255ed445","line":138,"range":{"start_line":138,"start_character":2,"end_line":138,"end_character":21},"in_reply_to":"5a8bc5a2_4d35a0f5","updated":"2016-09-28 13:27:02.000000000","message":"ah damn... shame","commit_id":"f8f0f8a4f8e038ab6b0aa5606a406bcbe009cbc2"},{"author":{"_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"},"change_message_id":"8c92571b91f7aad7bedc1b445d55fb5dd97b97a8","unresolved":false,"context_lines":[{"line_number":138,"context_line":"# Security compliance"},{"line_number":139,"context_line":"KEYSTONE_SECURITY_COMPLIANCE_ENABLED\u003d${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-False}"},{"line_number":140,"context_line":"KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS\u003d${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}"},{"line_number":141,"context_line":"KEYSTONE_LOCKOUT_DURATION\u003d${KEYSTONE_DURATION:-5}"},{"line_number":142,"context_line":"KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT\u003d${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""}],"source_content_type":"application/x-shellscript","patch_set":4,"id":"3a98d1f4_4fe36433","line":141,"updated":"2016-09-30 18:39:58.000000000","message":"Should the default here be KEYSTONE_LOCKOUT_DURATION?","commit_id":"f8f0f8a4f8e038ab6b0aa5606a406bcbe009cbc2"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7e0b1c31162d269580078c4106b6912cc1911498","unresolved":false,"context_lines":[{"line_number":138,"context_line":"# Security compliance"},{"line_number":139,"context_line":"KEYSTONE_SECURITY_COMPLIANCE_ENABLED\u003d${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-False}"},{"line_number":140,"context_line":"KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS\u003d${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}"},{"line_number":141,"context_line":"KEYSTONE_LOCKOUT_DURATION\u003d${KEYSTONE_DURATION:-5}"},{"line_number":142,"context_line":"KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT\u003d${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""}],"source_content_type":"application/x-shellscript","patch_set":4,"id":"5a8bc5a2_65dc4875","line":141,"range":{"start_line":141,"start_character":0,"end_line":141,"end_character":25},"updated":"2016-09-28 03:44:43.000000000","message":"set this as low as possible, it\u0027ll be neat to see if we can actually do a functional test for this","commit_id":"f8f0f8a4f8e038ab6b0aa5606a406bcbe009cbc2"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"dad64075655beb3052a15c0ed443fea09f59dd16","unresolved":false,"context_lines":[{"line_number":138,"context_line":"# Security compliance"},{"line_number":139,"context_line":"KEYSTONE_SECURITY_COMPLIANCE_ENABLED\u003d${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-False}"},{"line_number":140,"context_line":"KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS\u003d${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}"},{"line_number":141,"context_line":"KEYSTONE_LOCKOUT_DURATION\u003d${KEYSTONE_DURATION:-5}"},{"line_number":142,"context_line":"KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT\u003d${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""}],"source_content_type":"application/x-shellscript","patch_set":4,"id":"3a98d1f4_4ac0b22a","line":141,"in_reply_to":"3a98d1f4_4fe36433","updated":"2016-09-30 19:09:59.000000000","message":"you are correct, Dean","commit_id":"f8f0f8a4f8e038ab6b0aa5606a406bcbe009cbc2"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"872c4cf01a8a9df2f95ff4e571706a2f4e51529c","unresolved":false,"context_lines":[{"line_number":138,"context_line":"# Security compliance"},{"line_number":139,"context_line":"KEYSTONE_SECURITY_COMPLIANCE_ENABLED\u003d${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-False}"},{"line_number":140,"context_line":"KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS\u003d${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}"},{"line_number":141,"context_line":"KEYSTONE_LOCKOUT_DURATION\u003d${KEYSTONE_DURATION:-5}"},{"line_number":142,"context_line":"KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT\u003d${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""}],"source_content_type":"application/x-shellscript","patch_set":4,"id":"5a8bc5a2_8024cfaf","line":141,"range":{"start_line":141,"start_character":0,"end_line":141,"end_character":25},"in_reply_to":"5a8bc5a2_65dc4875","updated":"2016-09-28 11:25:45.000000000","message":"maybe 3 seconds?","commit_id":"f8f0f8a4f8e038ab6b0aa5606a406bcbe009cbc2"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"26d63887eea1843c005e41c52fad533804d80f25","unresolved":false,"context_lines":[{"line_number":138,"context_line":"# Security compliance"},{"line_number":139,"context_line":"KEYSTONE_SECURITY_COMPLIANCE_ENABLED\u003d${KEYSTONE_SECURITY_COMPLIANCE_ENABLED:-False}"},{"line_number":140,"context_line":"KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS\u003d${KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS:-2}"},{"line_number":141,"context_line":"KEYSTONE_LOCKOUT_DURATION\u003d${KEYSTONE_DURATION:-5}"},{"line_number":142,"context_line":"KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT\u003d${KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT:-2}"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""}],"source_content_type":"application/x-shellscript","patch_set":4,"id":"3a98d1f4_05171852","line":141,"range":{"start_line":141,"start_character":0,"end_line":141,"end_character":25},"in_reply_to":"5a8bc5a2_8024cfaf","updated":"2016-09-28 13:27:02.000000000","message":"thought this was minutes, it\u0027s seconds, this is fine.","commit_id":"f8f0f8a4f8e038ab6b0aa5606a406bcbe009cbc2"},{"author":{"_account_id":4656,"name":"Sean M. Collins","email":"sean@coreitpro.com","username":"scollins"},"change_message_id":"a08e9c0821036bf88a8734fc3c55d57dbff5544a","unresolved":false,"context_lines":[{"line_number":349,"context_line":"    if [[ \"$KEYSTONE_SECURITY_COMPLIANCE_ENABLED\" \u003d True ]]; then"},{"line_number":350,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS"},{"line_number":351,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION"},{"line_number":352,"context_line":"        iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT"},{"line_number":353,"context_line":"    fi"},{"line_number":354,"context_line":"}"},{"line_number":355,"context_line":""}],"source_content_type":"application/x-shellscript","patch_set":12,"id":"7a77a97e_7f30fc9e","line":352,"updated":"2016-11-16 16:16:53.000000000","message":"For lockout_duration and unique_last_password_count - how come we are setting values that are different from the defaults that keystone ships?\n\nI would prefer we use the defaults for these settings.","commit_id":"e856043cb2976962fd589530e2608fd771b40e6c"},{"author":{"_account_id":4656,"name":"Sean M. Collins","email":"sean@coreitpro.com","username":"scollins"},"change_message_id":"d2344b8c02deb4925250471b23ba43ce39729d4c","unresolved":false,"context_lines":[{"line_number":349,"context_line":"    if [[ \"$KEYSTONE_SECURITY_COMPLIANCE_ENABLED\" \u003d True ]]; then"},{"line_number":350,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS"},{"line_number":351,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION"},{"line_number":352,"context_line":"        iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT"},{"line_number":353,"context_line":"    fi"},{"line_number":354,"context_line":"}"},{"line_number":355,"context_line":""}],"source_content_type":"application/x-shellscript","patch_set":12,"id":"5a74a57a_687ec7e5","line":352,"in_reply_to":"5a74a57a_3e5ee845","updated":"2016-11-23 15:40:00.000000000","message":"I understand *why* \nlockout_failure_attempts is getting set to something - since there is no default value.\n\nMy confusion is why other settings within this feature have defaults, (like lockout_duration and unique_last_password_count) - why are we not leaving those set to their defaults?","commit_id":"e856043cb2976962fd589530e2608fd771b40e6c"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"ed3e9530c4aa6e60498eb211e7e85a1cf6381b50","unresolved":false,"context_lines":[{"line_number":349,"context_line":"    if [[ \"$KEYSTONE_SECURITY_COMPLIANCE_ENABLED\" \u003d True ]]; then"},{"line_number":350,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS"},{"line_number":351,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION"},{"line_number":352,"context_line":"        iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT"},{"line_number":353,"context_line":"    fi"},{"line_number":354,"context_line":"}"},{"line_number":355,"context_line":""}],"source_content_type":"application/x-shellscript","patch_set":12,"id":"7a77a97e_c9788cfb","line":352,"in_reply_to":"7a77a97e_29290038","updated":"2016-11-22 18:10:37.000000000","message":"0 was just an example, 1 or 0 being the default value means the settings are *disabled*.\n\nthis change is to actually *enable* them, this is done by changing the value from 0/1 to something else.","commit_id":"e856043cb2976962fd589530e2608fd771b40e6c"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"e2c33884c783b2d80ec33b8cd49bd06765f31c01","unresolved":false,"context_lines":[{"line_number":349,"context_line":"    if [[ \"$KEYSTONE_SECURITY_COMPLIANCE_ENABLED\" \u003d True ]]; then"},{"line_number":350,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS"},{"line_number":351,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION"},{"line_number":352,"context_line":"        iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT"},{"line_number":353,"context_line":"    fi"},{"line_number":354,"context_line":"}"},{"line_number":355,"context_line":""}],"source_content_type":"application/x-shellscript","patch_set":12,"id":"7a77a97e_f87d021d","line":352,"in_reply_to":"7a77a97e_7f30fc9e","updated":"2016-11-16 16:55:20.000000000","message":"keystone defaults have these settings disabled (set to 0, for example), this is how we \"enable\" them (by setting a valid value).","commit_id":"e856043cb2976962fd589530e2608fd771b40e6c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"aa4a42d20c2cf884d8728ceb55695c562cbc6df4","unresolved":false,"context_lines":[{"line_number":349,"context_line":"    if [[ \"$KEYSTONE_SECURITY_COMPLIANCE_ENABLED\" \u003d True ]]; then"},{"line_number":350,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS"},{"line_number":351,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION"},{"line_number":352,"context_line":"        iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT"},{"line_number":353,"context_line":"    fi"},{"line_number":354,"context_line":"}"},{"line_number":355,"context_line":""}],"source_content_type":"application/x-shellscript","patch_set":12,"id":"5a74a57a_3e5ee845","line":352,"in_reply_to":"7a77a97e_c9788cfb","updated":"2016-11-23 03:48:44.000000000","message":"Sean, by design the PCI options are not enabled by default, if we had done that we would be breaking all sorts of people on upgrade (they\u0027d randomly have passwords expire and such)","commit_id":"e856043cb2976962fd589530e2608fd771b40e6c"},{"author":{"_account_id":4656,"name":"Sean M. Collins","email":"sean@coreitpro.com","username":"scollins"},"change_message_id":"d5597bd0983961949961545828289b47a425f30e","unresolved":false,"context_lines":[{"line_number":349,"context_line":"    if [[ \"$KEYSTONE_SECURITY_COMPLIANCE_ENABLED\" \u003d True ]]; then"},{"line_number":350,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS"},{"line_number":351,"context_line":"        iniset $KEYSTONE_CONF security_compliance lockout_duration $KEYSTONE_LOCKOUT_DURATION"},{"line_number":352,"context_line":"        iniset $KEYSTONE_CONF security_compliance unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT"},{"line_number":353,"context_line":"    fi"},{"line_number":354,"context_line":"}"},{"line_number":355,"context_line":""}],"source_content_type":"application/x-shellscript","patch_set":12,"id":"7a77a97e_29290038","line":352,"in_reply_to":"7a77a97e_f87d021d","updated":"2016-11-22 18:05:26.000000000","message":"lockout_duration appears to have a default value that is non zero:\n\nhttps://github.com/openstack/keystone/blob/03ba1324c28e4319f76f0a45ed09e0fd994184bf/keystone/conf/security_compliance.py#L45\n\nunique_last_password_count has a non-zero default\n\nhttps://github.com/openstack/keystone/blob/03ba1324c28e4319f76f0a45ed09e0fd994184bf/keystone/conf/security_compliance.py#L89\n\n\nSo again, why are we not using these defaults?","commit_id":"e856043cb2976962fd589530e2608fd771b40e6c"}],"lib/tempest":[{"author":{"_account_id":970,"name":"Dean Troyer","email":"dtroyer@gmail.com","username":"dtroyer"},"change_message_id":"8c92571b91f7aad7bedc1b445d55fb5dd97b97a8","unresolved":false,"context_lines":[{"line_number":265,"context_line":"    iniset $TEMPEST_CONFIG identity uri_v3 \"$KEYSTONE_SERVICE_URI_V3\""},{"line_number":266,"context_line":"    iniset $TEMPEST_CONFIG identity user_lockout_failure_attempts $KEYSTONE_LOCKOUT_FAILURE_ATTEMPTS"},{"line_number":267,"context_line":"    iniset $TEMPEST_CONFIG identity user_lockout_duration $KEYSTONE_LOCKOUT_DURATION"},{"line_number":268,"context_line":"    iniset $TEMPEST_CONFIG identity user_unique_last_password_count $KEYSTONE_UNIQUE_LAST_PASSWORD_COUNT"},{"line_number":269,"context_line":"    # Use domain scoped tokens for admin v3 tests, v3 dynamic credentials of v3 account generation"},{"line_number":270,"context_line":"    iniset $TEMPEST_CONFIG identity admin_domain_scope True"},{"line_number":271,"context_line":"    if [[ \"$TEMPEST_HAS_ADMIN\" \u003d\u003d \"True\" ]]; then"}],"source_content_type":"application/x-shellscript","patch_set":4,"id":"3a98d1f4_4f68c487","line":268,"updated":"2016-09-30 18:39:58.000000000","message":"Am assuming Tempest doesn\u0027t care if these are set when KEYSTONE_SECURITY_COMPLIANCE_ENABLED\u003dFalse?","commit_id":"f8f0f8a4f8e038ab6b0aa5606a406bcbe009cbc2"}]}