)]}'
{"openstack_auth/backend.py":[{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"7dc1ad043a610cdfa630b09c92139bad0745ea58","unresolved":false,"context_lines":[{"line_number":161,"context_line":"        # a domain"},{"line_number":162,"context_line":"        domains \u003d []"},{"line_number":163,"context_line":"        if not domain_auth_ref and unscoped_auth_ref.is_federated:"},{"line_number":164,"context_line":"            domains \u003d plugin.list_domains(session,"},{"line_number":165,"context_line":"                                          unscoped_auth,"},{"line_number":166,"context_line":"                                          unscoped_auth_ref)"},{"line_number":167,"context_line":"            domains \u003d [domain for domain in domains if domain.enabled]"}],"source_content_type":"text/x-python","patch_set":2,"id":"da6895a0_d26a211a","line":164,"updated":"2016-10-21 20:18:51.000000000","message":"this call concerns me as the default policy in keystone [1] will block this for all users other than admin users. And it\u0027s restricted to cloud_admin in the v3 policy file sample [2].\n\n[1] https://github.com/openstack/keystone/blob/master/etc/policy.json#L32\n\n[2] https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json#L32","commit_id":"eeda3d73b657b7b9893d64284db66d0e758f8929"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"18862f88e0c0347e1f54a066fcda3eb19d67f06a","unresolved":false,"context_lines":[{"line_number":161,"context_line":"        # a domain"},{"line_number":162,"context_line":"        domains \u003d []"},{"line_number":163,"context_line":"        if not domain_auth_ref and unscoped_auth_ref.is_federated:"},{"line_number":164,"context_line":"            domains \u003d plugin.list_domains(session,"},{"line_number":165,"context_line":"                                          unscoped_auth,"},{"line_number":166,"context_line":"                                          unscoped_auth_ref)"},{"line_number":167,"context_line":"            domains \u003d [domain for domain in domains if domain.enabled]"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba5da102_0e2878e1","line":164,"in_reply_to":"da6895a0_d26a211a","updated":"2016-11-02 11:32:14.000000000","message":"You\u0027re right that normal users are unable to list domains. Federated users, however, have a special API call just for this purpose: http://developer.openstack.org/api-ref/identity/v3-ext/?expanded\u003dlist-domains-a-federated-user-can-access-detail#list-projects-a-federated-user-can-access\n\nI\u0027ll modify the list_domains method so that it never attempts to list domains for unfederated users.","commit_id":"eeda3d73b657b7b9893d64284db66d0e758f8929"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"cc5f61718967a279bd1b7735acf330662802d0f9","unresolved":false,"context_lines":[{"line_number":224,"context_line":"            if domain_auth_ref:"},{"line_number":225,"context_line":"                scoped_auth \u003d domain_auth"},{"line_number":226,"context_line":"                scoped_auth_ref \u003d domain_auth_ref"},{"line_number":227,"context_line":"            elif domains:"},{"line_number":228,"context_line":"                for domain in domains:"},{"line_number":229,"context_line":"                    dom_kw \u003d {\u0027domain_name\u0027: domain.name}"},{"line_number":230,"context_line":"                    scoped_auth \u003d utils.get_token_auth_plugin(auth_url,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3a71b18c_359a6315","line":227,"range":{"start_line":227,"start_character":12,"end_line":227,"end_character":25},"updated":"2016-12-01 20:20:13.000000000","message":"could use a comment here indicating that it\u0027ll only end up here in the federation case","commit_id":"00e1629943a8d33cfa9fa6f3f864d65f38a4760d"}],"openstack_auth/plugin/base.py":[{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"7dc1ad043a610cdfa630b09c92139bad0745ea58","unresolved":false,"context_lines":[{"line_number":101,"context_line":"            if self.keystone_version \u003e\u003d 3:"},{"line_number":102,"context_line":"                client \u003d v3_client.Client(session\u003dsession, auth\u003dauth_plugin)"},{"line_number":103,"context_line":"                if auth_ref.is_federated:"},{"line_number":104,"context_line":"                    return client.federation.domains.list()"},{"line_number":105,"context_line":"                else:"},{"line_number":106,"context_line":"                    return client.domains.list(user\u003dauth_ref.user_id)"},{"line_number":107,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"da6895a0_6de8947d","line":104,"updated":"2016-10-21 20:18:51.000000000","message":"I\u0027m not easily able to figure out what the default access for this call is, so not sure if it would typically be problematic for non-admin users as well.","commit_id":"eeda3d73b657b7b9893d64284db66d0e758f8929"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"18862f88e0c0347e1f54a066fcda3eb19d67f06a","unresolved":false,"context_lines":[{"line_number":101,"context_line":"            if self.keystone_version \u003e\u003d 3:"},{"line_number":102,"context_line":"                client \u003d v3_client.Client(session\u003dsession, auth\u003dauth_plugin)"},{"line_number":103,"context_line":"                if auth_ref.is_federated:"},{"line_number":104,"context_line":"                    return client.federation.domains.list()"},{"line_number":105,"context_line":"                else:"},{"line_number":106,"context_line":"                    return client.domains.list(user\u003dauth_ref.user_id)"},{"line_number":107,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"ba5da102_4e4c30c8","line":104,"in_reply_to":"da6895a0_6de8947d","updated":"2016-11-02 11:32:14.000000000","message":"This should be fine, it\u0027s built into the federation API: http://developer.openstack.org/api-ref/identity/v3-ext/?expanded\u003dlist-domains-a-federated-user-can-access-detail#list-projects-a-federated-user-can-access","commit_id":"eeda3d73b657b7b9893d64284db66d0e758f8929"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"7dc1ad043a610cdfa630b09c92139bad0745ea58","unresolved":false,"context_lines":[{"line_number":103,"context_line":"                if auth_ref.is_federated:"},{"line_number":104,"context_line":"                    return client.federation.domains.list()"},{"line_number":105,"context_line":"                else:"},{"line_number":106,"context_line":"                    return client.domains.list(user\u003dauth_ref.user_id)"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"            else:"},{"line_number":109,"context_line":"                msg \u003d _(\u0027Unable to retrieve authorized domains.\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"da6895a0_92ed098e","line":106,"updated":"2016-10-21 20:18:51.000000000","message":"this call will almost always fail, unless you are cloud_admin in v3 policy file or admin in default keystone policy file, so raising an exception based on this will likely break all logins that aren\u0027t federated.\n\nI think we\u0027ll want separate try/except blocks for the federated vs non-federated case.","commit_id":"eeda3d73b657b7b9893d64284db66d0e758f8929"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"18862f88e0c0347e1f54a066fcda3eb19d67f06a","unresolved":false,"context_lines":[{"line_number":103,"context_line":"                if auth_ref.is_federated:"},{"line_number":104,"context_line":"                    return client.federation.domains.list()"},{"line_number":105,"context_line":"                else:"},{"line_number":106,"context_line":"                    return client.domains.list(user\u003dauth_ref.user_id)"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"            else:"},{"line_number":109,"context_line":"                msg \u003d _(\u0027Unable to retrieve authorized domains.\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba5da102_ae66ac4e","line":106,"in_reply_to":"da6895a0_92ed098e","updated":"2016-11-02 11:32:14.000000000","message":"You\u0027re right, I think this should just be replaced by an exception.","commit_id":"eeda3d73b657b7b9893d64284db66d0e758f8929"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"bb64ac501932faaa22c193e36f25b334073929bb","unresolved":false,"context_lines":[{"line_number":55,"context_line":"        \"\"\"The Identity API version as specified in the settings file.\"\"\""},{"line_number":56,"context_line":"        return utils.get_keystone_version()"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"    def list_projects(self, session, auth_plugin, auth_ref\u003dNone):"},{"line_number":59,"context_line":"        \"\"\"List the projects that are accessible to this plugin."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"        Query the keystone server for all projects that this authentication"}],"source_content_type":"text/x-python","patch_set":4,"id":"3a71b18c_b5d833f1","line":58,"updated":"2016-12-01 20:19:44.000000000","message":"there is a general purpose (not federation specific) way to do this at client.auth.projects()\n\nthough this method will work and support older versions of the keystone api.","commit_id":"00e1629943a8d33cfa9fa6f3f864d65f38a4760d"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"bb64ac501932faaa22c193e36f25b334073929bb","unresolved":false,"context_lines":[{"line_number":100,"context_line":"        try:"},{"line_number":101,"context_line":"            if self.keystone_version \u003e\u003d 3 and auth_ref.is_federated:"},{"line_number":102,"context_line":"                client \u003d v3_client.Client(session\u003dsession, auth\u003dauth_plugin)"},{"line_number":103,"context_line":"                return client.federation.domains.list()"},{"line_number":104,"context_line":"            else:"},{"line_number":105,"context_line":"                msg \u003d _(\u0027Unable to retrieve authorized domains.\u0027)"},{"line_number":106,"context_line":"                raise exceptions.KeystoneAuthException(msg)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3a71b18c_d5776f00","line":103,"range":{"start_line":103,"start_character":0,"end_line":103,"end_character":16},"updated":"2016-12-01 20:19:44.000000000","message":"there is a general purpose (not federation specific) way to do this at client.auth.domains()","commit_id":"00e1629943a8d33cfa9fa6f3f864d65f38a4760d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"cc5f61718967a279bd1b7735acf330662802d0f9","unresolved":false,"context_lines":[{"line_number":100,"context_line":"        try:"},{"line_number":101,"context_line":"            if self.keystone_version \u003e\u003d 3 and auth_ref.is_federated:"},{"line_number":102,"context_line":"                client \u003d v3_client.Client(session\u003dsession, auth\u003dauth_plugin)"},{"line_number":103,"context_line":"                return client.federation.domains.list()"},{"line_number":104,"context_line":"            else:"},{"line_number":105,"context_line":"                msg \u003d _(\u0027Unable to retrieve authorized domains.\u0027)"},{"line_number":106,"context_line":"                raise exceptions.KeystoneAuthException(msg)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3a71b18c_958977cd","line":103,"range":{"start_line":103,"start_character":0,"end_line":103,"end_character":16},"in_reply_to":"3a71b18c_d5776f00","updated":"2016-12-01 20:20:13.000000000","message":"++","commit_id":"00e1629943a8d33cfa9fa6f3f864d65f38a4760d"},{"author":{"_account_id":5623,"name":"David Lyle","email":"dklyle0@gmail.com","username":"david-lyle"},"change_message_id":"1dbd949a412801c710fdddec59ecbc0ada36ec9f","unresolved":false,"context_lines":[{"line_number":230,"context_line":"                pass"},{"line_number":231,"context_line":"            else:"},{"line_number":232,"context_line":"                if len(domains) \u003e 1:"},{"line_number":233,"context_line":"                    LOG.warning(\"More than one valid domain found for user %s,\""},{"line_number":234,"context_line":"                                \" scoping to %s\" %"},{"line_number":235,"context_line":"                                (unscoped_auth_ref.user_id, domain_name))"},{"line_number":236,"context_line":"                break"}],"source_content_type":"text/x-python","patch_set":6,"id":"3a461143_feba9fbf","line":233,"updated":"2017-01-25 18:22:22.000000000","message":"this seems info level at best","commit_id":"1268b3301d17d83904a544de73684991ab772322"},{"author":{"_account_id":12826,"name":"Rob Cresswell","display_name":"robcresswell","email":"robert.cresswell@outlook.com","username":"rob-cresswell"},"change_message_id":"bc7dbc202c7ba81b44bf05ce31ce9fb0ddd192b8","unresolved":false,"context_lines":[{"line_number":227,"context_line":"                domain_auth_ref \u003d domain_auth.get_access(session)"},{"line_number":228,"context_line":"            except (keystone_exceptions.ClientException,"},{"line_number":229,"context_line":"                    keystone_exceptions.AuthorizationFailure):"},{"line_number":230,"context_line":"                pass"},{"line_number":231,"context_line":"            else:"},{"line_number":232,"context_line":"                if len(domains) \u003e 1:"},{"line_number":233,"context_line":"                    LOG.info(\"More than one valid domain found for user %s,\""}],"source_content_type":"text/x-python","patch_set":7,"id":"3a461143_3cc05d7b","line":230,"updated":"2017-01-27 09:35:28.000000000","message":"Whats the reason for having no log or comment here? Seems a little mystical to me. It would be nice to log, or at least comment explaining why we don\u0027t need to.\n\nSorry for my lack of knowledge here, had a scan through the patch discussion and couldn\u0027t see anything related.","commit_id":"ca3166707b2b8d121d4bf75dcea32ddfd3a442f1"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"62dfe210a664716eb9d167b4ffdd09479a4d1e8a","unresolved":false,"context_lines":[{"line_number":227,"context_line":"                domain_auth_ref \u003d domain_auth.get_access(session)"},{"line_number":228,"context_line":"            except (keystone_exceptions.ClientException,"},{"line_number":229,"context_line":"                    keystone_exceptions.AuthorizationFailure):"},{"line_number":230,"context_line":"                pass"},{"line_number":231,"context_line":"            else:"},{"line_number":232,"context_line":"                if len(domains) \u003e 1:"},{"line_number":233,"context_line":"                    LOG.info(\"More than one valid domain found for user %s,\""}],"source_content_type":"text/x-python","patch_set":7,"id":"3a461143_927db570","line":230,"in_reply_to":"3a461143_3cc05d7b","updated":"2017-01-27 11:33:16.000000000","message":"This is more or less copypasted from the project scoping method, see line 184. The reasoning for it is if it\u0027s not possible to scope to a given domain in the list, we ignore it and try the next one in the next loop iteration.\n\nI could perhaps add a comment to both these methods in a followup patch?","commit_id":"ca3166707b2b8d121d4bf75dcea32ddfd3a442f1"},{"author":{"_account_id":12826,"name":"Rob Cresswell","display_name":"robcresswell","email":"robert.cresswell@outlook.com","username":"rob-cresswell"},"change_message_id":"a86371094fdcd3a7e5ee555677cca8a64a213186","unresolved":false,"context_lines":[{"line_number":227,"context_line":"                domain_auth_ref \u003d domain_auth.get_access(session)"},{"line_number":228,"context_line":"            except (keystone_exceptions.ClientException,"},{"line_number":229,"context_line":"                    keystone_exceptions.AuthorizationFailure):"},{"line_number":230,"context_line":"                pass"},{"line_number":231,"context_line":"            else:"},{"line_number":232,"context_line":"                if len(domains) \u003e 1:"},{"line_number":233,"context_line":"                    LOG.info(\"More than one valid domain found for user %s,\""}],"source_content_type":"text/x-python","patch_set":7,"id":"3a461143_204664bf","line":230,"in_reply_to":"3a461143_927db570","updated":"2017-01-27 15:20:14.000000000","message":"Ah, understood. If you wouldn\u0027t mind following it up with a comment, or an info log, that\u0027d be great. Just something to help follow the code if I come back to it in a years time.","commit_id":"ca3166707b2b8d121d4bf75dcea32ddfd3a442f1"}],"openstack_auth/utils.py":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"195e7f620bfb421cc88afb3b877fb159010c094a","unresolved":false,"context_lines":[{"line_number":380,"context_line":"            auth_plugin \u003d get_token_auth_plugin(auth_url, kwargs[\u0027token\u0027])"},{"line_number":381,"context_line":"        client \u003d get_keystone_client().Client(session\u003dsess, auth\u003dauth_plugin)"},{"line_number":382,"context_line":"        try:"},{"line_number":383,"context_line":"            return client.auth.domains()"},{"line_number":384,"context_line":""},{"line_number":385,"context_line":"        except (keystone_exceptions.ClientException,"},{"line_number":386,"context_line":"                keystone_exceptions.AuthorizationFailure):"}],"source_content_type":"text/x-python","patch_set":5,"id":"1a6eadb0_4b4a9784","line":383,"range":{"start_line":383,"start_character":19,"end_line":383,"end_character":40},"updated":"2016-12-20 21:19:25.000000000","message":"One thing I\u0027m noticing is that this only returns domains that the user has a role in, and that doesn\u0027t necessarily include the user-domain that the user was created in. The full domain list should probably include that domain but I\u0027m not sure at what level it should be added to the list - here, in ksa, in the context selection, in the view, or elsewhere? Or am I thinking about this wrong?","commit_id":"c035774bc1a80a0cadd6e42aebc2fc0483d38dbc"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f24c14ddb39eed77539c8c821000572cc3283f1e","unresolved":false,"context_lines":[{"line_number":380,"context_line":"            auth_plugin \u003d get_token_auth_plugin(auth_url, kwargs[\u0027token\u0027])"},{"line_number":381,"context_line":"        client \u003d get_keystone_client().Client(session\u003dsess, auth\u003dauth_plugin)"},{"line_number":382,"context_line":"        try:"},{"line_number":383,"context_line":"            return client.auth.domains()"},{"line_number":384,"context_line":""},{"line_number":385,"context_line":"        except (keystone_exceptions.ClientException,"},{"line_number":386,"context_line":"                keystone_exceptions.AuthorizationFailure):"}],"source_content_type":"text/x-python","patch_set":5,"id":"da4df55a_0bbbb173","line":383,"range":{"start_line":383,"start_character":19,"end_line":383,"end_character":40},"in_reply_to":"1a6eadb0_4b4a9784","updated":"2016-12-21 22:35:33.000000000","message":"Morgan helped clear this up for me. The domain that owns the user (which is what the drop-down currently displays) and the domains the user can scope to are completely orthogonal entities.","commit_id":"c035774bc1a80a0cadd6e42aebc2fc0483d38dbc"}]}