)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"0d338b985e9e8f67e66565da7f99ed7ac4da02ca","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Implement trust support for images api v2 when uploading images"},{"line_number":10,"context_line":"with registry."},{"line_number":11,"context_line":"The algorighm is the following:"},{"line_number":12,"context_line":"1. If \u0027registry\u0027 is set as data_api backend create a trust"},{"line_number":13,"context_line":"2. Upload an image"},{"line_number":14,"context_line":"3. Try to update the image status to \u0027active\u0027 in registry"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":22,"id":"da6ed579_b93bc69b","line":11,"range":{"start_line":11,"start_character":4,"end_line":11,"end_character":13},"updated":"2016-01-13 14:47:30.000000000","message":"typo?","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"96ae3f9986def2306a1d3569b7ad211289617dcd","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Implement trust support for images api v2 when uploading images"},{"line_number":10,"context_line":"with registry."},{"line_number":11,"context_line":"The algorighm is the following:"},{"line_number":12,"context_line":"1. If \u0027registry\u0027 is set as data_api backend create a trust"},{"line_number":13,"context_line":"2. Upload an image"},{"line_number":14,"context_line":"3. Try to update the image status to \u0027active\u0027 in registry"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":22,"id":"da6ed579_7095333d","line":11,"range":{"start_line":11,"start_character":4,"end_line":11,"end_character":13},"in_reply_to":"da6ed579_b93bc69b","updated":"2016-01-14 09:37:10.000000000","message":"Yep, done.","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"}],"glance/api/v2/image_data.py":[{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"49759272f1b8ca144cc9c1af66ad9a591f53ee15","unresolved":false,"context_lines":[{"line_number":96,"context_line":"                    # if backend is registry"},{"line_number":97,"context_line":"                    cxt \u003d req.context"},{"line_number":98,"context_line":"                    try:"},{"line_number":99,"context_line":"                        LOG.debug(\"created trust\")"},{"line_number":100,"context_line":"                        cxt.trust_id \u003d trust_auth.create_trust("},{"line_number":101,"context_line":"                            cxt.auth_token, cxt.tenant)"},{"line_number":102,"context_line":"                    except Exception as e:"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa80f949_cc64c74a","line":99,"updated":"2015-11-05 11:06:56.000000000","message":"it should be \"creating trust\" instead of \"created trust\" or just move this line after create_trust call","commit_id":"232ec0e1f38bf09bf8fde377eb1c4e4fc9a2a679"},{"author":{"_account_id":9303,"name":"Abhishek Kekane","email":"akekane@redhat.com","username":"abhishekkekane"},"change_message_id":"49759272f1b8ca144cc9c1af66ad9a591f53ee15","unresolved":false,"context_lines":[{"line_number":108,"context_line":""},{"line_number":109,"context_line":"                # initialize a repo with new token"},{"line_number":110,"context_line":"                if hasattr(req.context, \u0027trust_id\u0027):"},{"line_number":111,"context_line":"                    LOG.debug(\"renew_token\")"},{"line_number":112,"context_line":"                    req.context.auth_token \u003d trust_auth.renew_token("},{"line_number":113,"context_line":"                        req.context.trust_id)"},{"line_number":114,"context_line":"                    image_repo \u003d self.gateway.get_repo(req.context)"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa80f949_0c4bafb1","line":111,"updated":"2015-11-05 11:06:56.000000000","message":"\"renewing token\" ????","commit_id":"232ec0e1f38bf09bf8fde377eb1c4e4fc9a2a679"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"ec771da4cfdc7619617aff69e6aa48ff5a5427c8","unresolved":false,"context_lines":[{"line_number":101,"context_line":"                    except Exception as e:"},{"line_number":102,"context_line":"                        LOG.exception(_LE(\"Unable to create trust: %s \""},{"line_number":103,"context_line":"                                          \"Use the existing user token.\"),"},{"line_number":104,"context_line":"                                      e.message)"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"                image_repo.save(image)"},{"line_number":107,"context_line":"                image.set_data(data, size)"}],"source_content_type":"text/x-python","patch_set":6,"id":"da85f559_ec54f0ff","line":104,"updated":"2015-11-11 09:03:32.000000000","message":"it should be encodeutils.exception_to_unicode(e) because in case of TypeError (if auth_uri is not set) there will be AttributeError.","commit_id":"320a4c84fa56dae1047479dc6f97a0bd76682ed5"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"70feadd282c5b7c30183600039611b5433e2c7db","unresolved":false,"context_lines":[{"line_number":101,"context_line":"                    except Exception as e:"},{"line_number":102,"context_line":"                        LOG.exception(_LE(\"Unable to create trust: %s \""},{"line_number":103,"context_line":"                                          \"Use the existing user token.\"),"},{"line_number":104,"context_line":"                                      e.message)"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"                image_repo.save(image)"},{"line_number":107,"context_line":"                image.set_data(data, size)"}],"source_content_type":"text/x-python","patch_set":6,"id":"da85f559_3a18dc1d","line":104,"in_reply_to":"da85f559_ec54f0ff","updated":"2015-11-11 14:52:45.000000000","message":"Done","commit_id":"320a4c84fa56dae1047479dc6f97a0bd76682ed5"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"ec771da4cfdc7619617aff69e6aa48ff5a5427c8","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                    LOG.exception(_LE(\"Unable to delete trust \""},{"line_number":124,"context_line":"                                      \"%(trust)s: %(msg)s\"),"},{"line_number":125,"context_line":"                                  {\"trust\": req.context.trust_id,"},{"line_number":126,"context_line":"                                   \"msg\": e.message})"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"            except (exception.ImageNotFound, exception.Conflict):"},{"line_number":129,"context_line":"                msg \u003d (_(\"Image %s could not be found after upload. \""}],"source_content_type":"text/x-python","patch_set":6,"id":"da85f559_4c441c49","line":126,"updated":"2015-11-11 09:03:32.000000000","message":"ditto","commit_id":"320a4c84fa56dae1047479dc6f97a0bd76682ed5"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"70feadd282c5b7c30183600039611b5433e2c7db","unresolved":false,"context_lines":[{"line_number":123,"context_line":"                    LOG.exception(_LE(\"Unable to delete trust \""},{"line_number":124,"context_line":"                                      \"%(trust)s: %(msg)s\"),"},{"line_number":125,"context_line":"                                  {\"trust\": req.context.trust_id,"},{"line_number":126,"context_line":"                                   \"msg\": e.message})"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"            except (exception.ImageNotFound, exception.Conflict):"},{"line_number":129,"context_line":"                msg \u003d (_(\"Image %s could not be found after upload. \""}],"source_content_type":"text/x-python","patch_set":6,"id":"da85f559_5a15a0e2","line":126,"in_reply_to":"da85f559_4c441c49","updated":"2015-11-11 14:52:45.000000000","message":"Done","commit_id":"320a4c84fa56dae1047479dc6f97a0bd76682ed5"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"d4a06ead0812bb82e781e6a1160ca4db2141b9f4","unresolved":false,"context_lines":[{"line_number":91,"context_line":"            image \u003d image_repo.get(image_id)"},{"line_number":92,"context_line":"            image.status \u003d \u0027saving\u0027"},{"line_number":93,"context_line":"            try:"},{"line_number":94,"context_line":"                if CONF.data_api \u003d\u003d \u0027glance.db.registry.api\u0027:"},{"line_number":95,"context_line":"                    # create a trust if backend is registry"},{"line_number":96,"context_line":"                    cxt \u003d req.context"},{"line_number":97,"context_line":"                    try:"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_43efa6b0","line":94,"updated":"2015-11-24 12:20:22.000000000","message":"this would seem to suggest you should put this in the plugin that does nothing by default.","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"58ecf793138b6798eb04d93c5d93293d55339e82","unresolved":false,"context_lines":[{"line_number":91,"context_line":"            image \u003d image_repo.get(image_id)"},{"line_number":92,"context_line":"            image.status \u003d \u0027saving\u0027"},{"line_number":93,"context_line":"            try:"},{"line_number":94,"context_line":"                if CONF.data_api \u003d\u003d \u0027glance.db.registry.api\u0027:"},{"line_number":95,"context_line":"                    # create a trust if backend is registry"},{"line_number":96,"context_line":"                    cxt \u003d req.context"},{"line_number":97,"context_line":"                    try:"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_294921d1","line":94,"in_reply_to":"9a8ffd7b_43efa6b0","updated":"2015-11-24 12:55:28.000000000","message":"It\u0027s done because new token is required only if we use registry server to communicate with DB (or CONF.data_api \u003d\u003d \u0027glance.db.registry.api\u0027), so trusts are not used by default.","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"f4705d8e8bda5805dd3b0715e7c3d41d39da0930","unresolved":false,"context_lines":[{"line_number":106,"context_line":"                image_repo.save(image)"},{"line_number":107,"context_line":"                image.set_data(data, size)"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"                if hasattr(req.context, \u0027trust_id\u0027):"},{"line_number":110,"context_line":"                    # request a new token before updating an image in database"},{"line_number":111,"context_line":"                    LOG.debug(\"Requesting the new token with trust %s\","},{"line_number":112,"context_line":"                              req.context.trust_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_186ca99b","line":109,"updated":"2015-11-24 12:03:38.000000000","message":"What if we *try* to update the image, catch the 401 and then create the trust?\n\nIn most of the cases, this will save us 1 token generation, since trusts are useful for cases when big images are uploaded. I\u0027d like to reduce the interaction with external services as much as possible... especially keystone.","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"ee9ee5cc246637b13a267b26d9358aa75e990006","unresolved":false,"context_lines":[{"line_number":106,"context_line":"                image_repo.save(image)"},{"line_number":107,"context_line":"                image.set_data(data, size)"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"                if hasattr(req.context, \u0027trust_id\u0027):"},{"line_number":110,"context_line":"                    # request a new token before updating an image in database"},{"line_number":111,"context_line":"                    LOG.debug(\"Requesting the new token with trust %s\","},{"line_number":112,"context_line":"                              req.context.trust_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_434b26b1","line":109,"in_reply_to":"9a8ffd7b_186ca99b","updated":"2015-11-24 12:16:24.000000000","message":"Unfortunately, we can\u0027t create a trust with expired user token. Because of this, we have to create the trust first and after that execute all operations. In this case we guarantee that trust-scoped token will be correctly received.","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"d4a06ead0812bb82e781e6a1160ca4db2141b9f4","unresolved":false,"context_lines":[{"line_number":106,"context_line":"                image_repo.save(image)"},{"line_number":107,"context_line":"                image.set_data(data, size)"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"                if hasattr(req.context, \u0027trust_id\u0027):"},{"line_number":110,"context_line":"                    # request a new token before updating an image in database"},{"line_number":111,"context_line":"                    LOG.debug(\"Requesting the new token with trust %s\","},{"line_number":112,"context_line":"                              req.context.trust_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_23adc288","line":109,"in_reply_to":"9a8ffd7b_186ca99b","updated":"2015-11-24 12:20:22.000000000","message":"because most likely then your token has expired and keystone won\u0027t let you use it to create a trust.\n\nwhat\u0027s with the hasattrs? why don\u0027t you just add the field to the context?","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"4cd7b9dba4bc089921313f4424be058d37d3fed3","unresolved":false,"context_lines":[{"line_number":106,"context_line":"                image_repo.save(image)"},{"line_number":107,"context_line":"                image.set_data(data, size)"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"                if hasattr(req.context, \u0027trust_id\u0027):"},{"line_number":110,"context_line":"                    # request a new token before updating an image in database"},{"line_number":111,"context_line":"                    LOG.debug(\"Requesting the new token with trust %s\","},{"line_number":112,"context_line":"                              req.context.trust_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_de87e910","line":109,"in_reply_to":"9a8ffd7b_23adc288","updated":"2015-11-24 12:25:10.000000000","message":"Wait, I was referring to the `renew_token` call not the trust creation. Trust\u0027s creation happens in L98 and that\u0027s fine. My question is:\n\nIf we already have a trust, why are we renewing the token if we don\u0027t know whether it\u0027s expired already? Can\u0027t we try to call the registry API and catch the 401 error to renew the token?","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"58ecf793138b6798eb04d93c5d93293d55339e82","unresolved":false,"context_lines":[{"line_number":106,"context_line":"                image_repo.save(image)"},{"line_number":107,"context_line":"                image.set_data(data, size)"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"                if hasattr(req.context, \u0027trust_id\u0027):"},{"line_number":110,"context_line":"                    # request a new token before updating an image in database"},{"line_number":111,"context_line":"                    LOG.debug(\"Requesting the new token with trust %s\","},{"line_number":112,"context_line":"                              req.context.trust_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_09945d35","line":109,"in_reply_to":"9a8ffd7b_de87e910","updated":"2015-11-24 12:55:28.000000000","message":"Yes, we renew token every time after image upload. It was considered as easier solution, because it guarantees only on request for keystone. In other case we have to validate user token (1 request) and renew it if it\u0027s expired (2 request).\n\nAlso we can wrap it with try-catch and handle 401 errors. If it happens we renew the token and try again. I\u0027m okay with this solution too. It doesn\u0027t work with v1 api because of spaghetti-code there, but here I believe it\u0027s fine :)","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2fa5a15cebfe20b2839a4c3c5ad06bee4252afd5","unresolved":false,"context_lines":[{"line_number":98,"context_line":"                        cxt.trust_id \u003d trust_auth.create_trust("},{"line_number":99,"context_line":"                            cxt.auth_token, cxt.tenant)"},{"line_number":100,"context_line":"                        LOG.debug(\"Trust %s has been created.\", cxt.trust_id)"},{"line_number":101,"context_line":"                    except Exception as e:"},{"line_number":102,"context_line":"                        LOG.exception(_LE(\"Unable to create trust: %s \""},{"line_number":103,"context_line":"                                          \"Use the existing user token.\"),"},{"line_number":104,"context_line":"                                      encodeutils.exception_to_unicode(e))"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_cfebebda","line":101,"updated":"2015-11-27 20:50:59.000000000","message":"same as below, why can\u0027t you create it?","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2fa5a15cebfe20b2839a4c3c5ad06bee4252afd5","unresolved":false,"context_lines":[{"line_number":124,"context_line":"                    # delete trust if it has been created before"},{"line_number":125,"context_line":"                    if hasattr(req.context, \u0027trust_id\u0027):"},{"line_number":126,"context_line":"                        trust_auth.delete_trust(req.context.trust_id)"},{"line_number":127,"context_line":"                except Exception as e:"},{"line_number":128,"context_line":"                    LOG.exception(_LE(\"Unable to delete trust \""},{"line_number":129,"context_line":"                                      \"%(trust)s: %(msg)s\"),"},{"line_number":130,"context_line":"                                  {\"trust\": req.context.trust_id,"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_aff0e7c9","line":127,"updated":"2015-11-27 20:50:59.000000000","message":"this is a bit generic, why can\u0027t you delete it, it\u0027s either 401 for unauthorized or 404 can\u0027t find trust to delete. maybe use \"Exception\" as a last defense","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"75f8fc361dfaa82067241dea6b42a3db89b39f98","unresolved":false,"context_lines":[{"line_number":128,"context_line":"                    LOG.exception(_LE(\"Unable to delete trust \""},{"line_number":129,"context_line":"                                      \"%(trust)s: %(msg)s\"),"},{"line_number":130,"context_line":"                                  {\"trust\": req.context.trust_id,"},{"line_number":131,"context_line":"                                   \"msg\": encodeutils.exception_to_unicode(e)})"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"            except (exception.ImageNotFound, exception.Conflict):"},{"line_number":134,"context_line":"                msg \u003d (_(\"Image %s could not be found after upload. \""}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_1db82029","line":131,"updated":"2015-11-30 12:18:02.000000000","message":"This exception message describes the reason why we can\u0027t delete the trust. I think it\u0027s enough.","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"59f68d4274ff6bd50d338b33135d9be6b2c074ab","unresolved":false,"context_lines":[{"line_number":93,"context_line":"            image \u003d image_repo.get(image_id)"},{"line_number":94,"context_line":"            image.status \u003d \u0027saving\u0027"},{"line_number":95,"context_line":"            try:"},{"line_number":96,"context_line":"                if CONF.data_api \u003d\u003d \u0027glance.db.registry.api\u0027:"},{"line_number":97,"context_line":"                    # create a trust if backend is registry"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"                    try:"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_8aac9a8d","line":96,"updated":"2015-12-01 06:13:15.000000000","message":"opinion: maybe consider using private methods here, upload() seems to already be a complex function that you\u0027ve added complexity to, it\u0027s just getting hard to read.","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"59f68d4274ff6bd50d338b33135d9be6b2c074ab","unresolved":false,"context_lines":[{"line_number":111,"context_line":""},{"line_number":112,"context_line":"                try:"},{"line_number":113,"context_line":"                    image_repo.save(image, from_state\u003d\u0027saving\u0027)"},{"line_number":114,"context_line":"                except exception.NotAuthenticated as e:"},{"line_number":115,"context_line":"                    if auth_plugin is not None:"},{"line_number":116,"context_line":"                        # request a new token to update an image in database"},{"line_number":117,"context_line":"                        LOG.debug(\"Requesting the new token with trust %s\","}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_cac9425c","line":114,"updated":"2015-12-01 06:13:15.000000000","message":"you don\u0027t need to do any of this if CONF.data_api is not \u0027glance.db.registry.api\u0027","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"b1e6853fd7dbba2386c6ce0210745462465ec865","unresolved":false,"context_lines":[{"line_number":111,"context_line":""},{"line_number":112,"context_line":"                try:"},{"line_number":113,"context_line":"                    image_repo.save(image, from_state\u003d\u0027saving\u0027)"},{"line_number":114,"context_line":"                except exception.NotAuthenticated as e:"},{"line_number":115,"context_line":"                    if auth_plugin is not None:"},{"line_number":116,"context_line":"                        # request a new token to update an image in database"},{"line_number":117,"context_line":"                        LOG.debug(\"Requesting the new token with trust %s\","}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_35513d63","line":114,"in_reply_to":"9a8ffd7b_cac9425c","updated":"2015-12-01 12:49:10.000000000","message":"Yes. And taht\u0027s why we check that auth_plugin is not None (which means it was previously created), and reraise the exception in other case.","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"88c035d3649293ad8beadee570e00498cde83a34","unresolved":false,"context_lines":[{"line_number":97,"context_line":"                    # create a trust if backend is registry"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"                    try:"},{"line_number":100,"context_line":"                        auth_plugin \u003d trust_auth.create_client_for_trust("},{"line_number":101,"context_line":"                            cxt.auth_token, cxt.tenant, cxt.roles)"},{"line_number":102,"context_line":"                        LOG.debug(\"Trust %s has been created.\","},{"line_number":103,"context_line":"                                  trust_auth.get_trust_id(auth_plugin))"}],"source_content_type":"text/x-python","patch_set":14,"id":"9a8ffd7b_f6c6e39a","line":100,"updated":"2015-12-03 06:05:38.000000000","message":"this isn\u0027t an auth_plugin, it\u0027s a keystoneclient.","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"33a4700a0b1c6780ae38ca3940b973ba4f1ed886","unresolved":false,"context_lines":[{"line_number":97,"context_line":"                    # create a trust if backend is registry"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"                    try:"},{"line_number":100,"context_line":"                        auth_plugin \u003d trust_auth.create_client_for_trust("},{"line_number":101,"context_line":"                            cxt.auth_token, cxt.tenant, cxt.roles)"},{"line_number":102,"context_line":"                        LOG.debug(\"Trust %s has been created.\","},{"line_number":103,"context_line":"                                  trust_auth.get_trust_id(auth_plugin))"}],"source_content_type":"text/x-python","patch_set":14,"id":"7a740942_7f20304a","line":100,"in_reply_to":"9a8ffd7b_f6c6e39a","updated":"2015-12-03 18:19:26.000000000","message":"Done","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"88c035d3649293ad8beadee570e00498cde83a34","unresolved":false,"context_lines":[{"line_number":115,"context_line":"                    if auth_plugin is not None:"},{"line_number":116,"context_line":"                        # request a new token to update an image in database"},{"line_number":117,"context_line":"                        LOG.debug(\"Requesting the new token with trust %s\","},{"line_number":118,"context_line":"                                  trust_auth.get_trust_id(auth_plugin))"},{"line_number":119,"context_line":"                        cxt.auth_token \u003d trust_auth.renew_token("},{"line_number":120,"context_line":"                            auth_plugin)"},{"line_number":121,"context_line":"                        image_repo \u003d self.gateway.get_repo(req.context)"}],"source_content_type":"text/x-python","patch_set":14,"id":"9a8ffd7b_362d4b46","line":118,"updated":"2015-12-03 06:05:38.000000000","message":"i feel like you shouldn\u0027t have to keep doing get_trust_id here. maybe return both?","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"33a4700a0b1c6780ae38ca3940b973ba4f1ed886","unresolved":false,"context_lines":[{"line_number":115,"context_line":"                    if auth_plugin is not None:"},{"line_number":116,"context_line":"                        # request a new token to update an image in database"},{"line_number":117,"context_line":"                        LOG.debug(\"Requesting the new token with trust %s\","},{"line_number":118,"context_line":"                                  trust_auth.get_trust_id(auth_plugin))"},{"line_number":119,"context_line":"                        cxt.auth_token \u003d trust_auth.renew_token("},{"line_number":120,"context_line":"                            auth_plugin)"},{"line_number":121,"context_line":"                        image_repo \u003d self.gateway.get_repo(req.context)"}],"source_content_type":"text/x-python","patch_set":14,"id":"7a740942_9f1ddc11","line":118,"in_reply_to":"9a8ffd7b_362d4b46","updated":"2015-12-03 18:19:26.000000000","message":"Done","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"44e45b4646c1cf32b6d01d0db7499c40a3cce345","unresolved":false,"context_lines":[{"line_number":106,"context_line":"                                                              cxt.tenant,"},{"line_number":107,"context_line":"                                                              roles)"},{"line_number":108,"context_line":"                    except Exception as e:"},{"line_number":109,"context_line":"                        LOG.exception(_LE(\"Unable to create trust: %s \""},{"line_number":110,"context_line":"                                          \"Use the existing user token.\"),"},{"line_number":111,"context_line":"                                      encodeutils.exception_to_unicode(e))"},{"line_number":112,"context_line":""}],"source_content_type":"text/x-python","patch_set":21,"id":"da6ed579_4587860f","line":109,"updated":"2016-01-12 12:38:02.000000000","message":"If I understand correctly we log ERROR level message each time we cannot create trust. Including environments which are configured to use Identity API v2. This is not acceptable behavior.","commit_id":"29b81378e117d248908b63ba30d5c924a5bae23a"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"dcb0d3602fa2ff2e30dd144baea8deac8a0f260b","unresolved":false,"context_lines":[{"line_number":106,"context_line":"                                                              cxt.tenant,"},{"line_number":107,"context_line":"                                                              roles)"},{"line_number":108,"context_line":"                    except Exception as e:"},{"line_number":109,"context_line":"                        LOG.exception(_LE(\"Unable to create trust: %s \""},{"line_number":110,"context_line":"                                          \"Use the existing user token.\"),"},{"line_number":111,"context_line":"                                      encodeutils.exception_to_unicode(e))"},{"line_number":112,"context_line":""}],"source_content_type":"text/x-python","patch_set":21,"id":"da6ed579_642ba383","line":109,"in_reply_to":"da6ed579_4587860f","updated":"2016-01-12 14:54:58.000000000","message":"I\u0027ll change that to info.","commit_id":"29b81378e117d248908b63ba30d5c924a5bae23a"},{"author":{"_account_id":5202,"name":"Erno Kuvaja","email":"jokke@usr.fi","username":"jokke"},"change_message_id":"44e45b4646c1cf32b6d01d0db7499c40a3cce345","unresolved":false,"context_lines":[{"line_number":129,"context_line":"                    if refresher is not None:"},{"line_number":130,"context_line":"                        refresher.release_resources()"},{"line_number":131,"context_line":"                except Exception as e:"},{"line_number":132,"context_line":"                    LOG.exception(_LE(\"Unable to delete trust \""},{"line_number":133,"context_line":"                                      \"%(trust)s: %(msg)s\"),"},{"line_number":134,"context_line":"                                  {\"trust\": refresher.trust_id,"},{"line_number":135,"context_line":"                                   \"msg\": encodeutils.exception_to_unicode(e)})"}],"source_content_type":"text/x-python","patch_set":21,"id":"da6ed579_057aee24","line":132,"updated":"2016-01-12 12:38:02.000000000","message":"DITTO","commit_id":"29b81378e117d248908b63ba30d5c924a5bae23a"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"dcb0d3602fa2ff2e30dd144baea8deac8a0f260b","unresolved":false,"context_lines":[{"line_number":129,"context_line":"                    if refresher is not None:"},{"line_number":130,"context_line":"                        refresher.release_resources()"},{"line_number":131,"context_line":"                except Exception as e:"},{"line_number":132,"context_line":"                    LOG.exception(_LE(\"Unable to delete trust \""},{"line_number":133,"context_line":"                                      \"%(trust)s: %(msg)s\"),"},{"line_number":134,"context_line":"                                  {\"trust\": refresher.trust_id,"},{"line_number":135,"context_line":"                                   \"msg\": encodeutils.exception_to_unicode(e)})"}],"source_content_type":"text/x-python","patch_set":21,"id":"da6ed579_046e67c9","line":132,"in_reply_to":"da6ed579_057aee24","updated":"2016-01-12 14:54:58.000000000","message":"I\u0027ll change that to info.","commit_id":"29b81378e117d248908b63ba30d5c924a5bae23a"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"0d338b985e9e8f67e66565da7f99ed7ac4da02ca","unresolved":false,"context_lines":[{"line_number":95,"context_line":"                    # create a trust if backend is registry"},{"line_number":96,"context_line":"                    try:"},{"line_number":97,"context_line":"                        # request user pluging for current token"},{"line_number":98,"context_line":"                        user_plugin \u003d req.environ.get(\u0027keystone.token_auth\u0027)"},{"line_number":99,"context_line":"                        roles \u003d []"},{"line_number":100,"context_line":"                        # use roles from request environment because they"},{"line_number":101,"context_line":"                        # are not transformed to lower-case unlike cxt.roles"}],"source_content_type":"text/x-python","patch_set":22,"id":"da6ed579_563cd9e1","line":98,"range":{"start_line":98,"start_character":42,"end_line":98,"end_character":49},"updated":"2016-01-13 14:47:30.000000000","message":"Currently it\u0027s possible to upload an image if you don\u0027t have keystone (any auth) in your pipeline, ie glance-api.conf contains:\n\n[paste_deploy]\nflavor \u003d\n\nDoes this code assume keystone is in the pipeline? (ie will uploads without auth break if I apply this patch?)","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"96ae3f9986def2306a1d3569b7ad211289617dcd","unresolved":false,"context_lines":[{"line_number":95,"context_line":"                    # create a trust if backend is registry"},{"line_number":96,"context_line":"                    try:"},{"line_number":97,"context_line":"                        # request user pluging for current token"},{"line_number":98,"context_line":"                        user_plugin \u003d req.environ.get(\u0027keystone.token_auth\u0027)"},{"line_number":99,"context_line":"                        roles \u003d []"},{"line_number":100,"context_line":"                        # use roles from request environment because they"},{"line_number":101,"context_line":"                        # are not transformed to lower-case unlike cxt.roles"}],"source_content_type":"text/x-python","patch_set":22,"id":"da6ed579_f0512337","line":98,"range":{"start_line":98,"start_character":42,"end_line":98,"end_character":49},"in_reply_to":"da6ed579_563cd9e1","updated":"2016-01-14 09:37:10.000000000","message":"Yep, we assumed that. In this case you\u0027ll get an exception and catch it at line 108. After that glance proceed with saving and updating. Additionally, we will catch Unauthorized if and only if refresher has been initialized correctly (see lines 119,129).\nSo the common approach is: if something happened with trust then return to the old approach (without trusts).","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"315d1d48fe8d07b92cf048347cdd4096cdd6b02c","unresolved":false,"context_lines":[{"line_number":95,"context_line":"                    # create a trust if backend is registry"},{"line_number":96,"context_line":"                    try:"},{"line_number":97,"context_line":"                        # request user pluging for current token"},{"line_number":98,"context_line":"                        user_plugin \u003d req.environ.get(\u0027keystone.token_auth\u0027)"},{"line_number":99,"context_line":"                        roles \u003d []"},{"line_number":100,"context_line":"                        # use roles from request environment because they"},{"line_number":101,"context_line":"                        # are not transformed to lower-case unlike cxt.roles"}],"source_content_type":"text/x-python","patch_set":22,"id":"da6ed579_bbf848c4","line":98,"range":{"start_line":98,"start_character":42,"end_line":98,"end_character":49},"in_reply_to":"da6ed579_f0512337","updated":"2016-01-14 18:26:52.000000000","message":"Ok, thanks.","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"0d338b985e9e8f67e66565da7f99ed7ac4da02ca","unresolved":false,"context_lines":[{"line_number":120,"context_line":"                        # request a new token to update an image in database"},{"line_number":121,"context_line":"                        cxt.auth_token \u003d refresher.refresh_token()"},{"line_number":122,"context_line":"                        image_repo \u003d self.gateway.get_repo(req.context)"},{"line_number":123,"context_line":"                        image_repo.save(image, from_state\u003d\u0027saving\u0027)"},{"line_number":124,"context_line":"                    else:"},{"line_number":125,"context_line":"                        raise e"},{"line_number":126,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"da6ed579_d9a0faa1","line":123,"updated":"2016-01-13 14:47:30.000000000","message":"We retry once. Are there any cases where retrying more than once might make sense? (Possibly not)","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"96ae3f9986def2306a1d3569b7ad211289617dcd","unresolved":false,"context_lines":[{"line_number":120,"context_line":"                        # request a new token to update an image in database"},{"line_number":121,"context_line":"                        cxt.auth_token \u003d refresher.refresh_token()"},{"line_number":122,"context_line":"                        image_repo \u003d self.gateway.get_repo(req.context)"},{"line_number":123,"context_line":"                        image_repo.save(image, from_state\u003d\u0027saving\u0027)"},{"line_number":124,"context_line":"                    else:"},{"line_number":125,"context_line":"                        raise e"},{"line_number":126,"context_line":""}],"source_content_type":"text/x-python","patch_set":22,"id":"da6ed579_d39d09bd","line":123,"in_reply_to":"da6ed579_d9a0faa1","updated":"2016-01-14 09:37:10.000000000","message":"I cannot find such cases. If token is expired then we need to re-authenticate again and re-execute the operation. If we have got Unauthorized again then something has to be wrong with configuration. So it would be useless to re-execute the query again.","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"}],"glance/common/trust_auth.py":[{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"d4a06ead0812bb82e781e6a1160ca4db2141b9f4","unresolved":false,"context_lines":[{"line_number":68,"context_line":"    trustee_id \u003d _get_admin_client("},{"line_number":69,"context_line":"        project_name\u003dsettings[\u0027project_name\u0027]).user_id"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    roles \u003d [t[\u0027name\u0027] for t in client.auth_ref[\u0027roles\u0027]]"},{"line_number":72,"context_line":"    trust \u003d client.trusts.create(trustor_user\u003dclient.user_id,"},{"line_number":73,"context_line":"                                 trustee_user\u003dtrustee_id,"},{"line_number":74,"context_line":"                                 impersonation\u003dTrue,"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_fe518d0f","line":71,"updated":"2015-11-24 12:20:22.000000000","message":"i\u0027m delegating everything?","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"58ecf793138b6798eb04d93c5d93293d55339e82","unresolved":false,"context_lines":[{"line_number":68,"context_line":"    trustee_id \u003d _get_admin_client("},{"line_number":69,"context_line":"        project_name\u003dsettings[\u0027project_name\u0027]).user_id"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    roles \u003d [t[\u0027name\u0027] for t in client.auth_ref[\u0027roles\u0027]]"},{"line_number":72,"context_line":"    trust \u003d client.trusts.create(trustor_user\u003dclient.user_id,"},{"line_number":73,"context_line":"                                 trustee_user\u003dtrustee_id,"},{"line_number":74,"context_line":"                                 impersonation\u003dTrue,"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_696de931","line":71,"in_reply_to":"9a8ffd7b_fe518d0f","updated":"2015-11-24 12:55:28.000000000","message":"yes, I think it\u0027s okay","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"58ecf793138b6798eb04d93c5d93293d55339e82","unresolved":false,"context_lines":[{"line_number":74,"context_line":"                                 impersonation\u003dTrue,"},{"line_number":75,"context_line":"                                 role_names\u003droles,"},{"line_number":76,"context_line":"                                 project\u003dtenant_id,"},{"line_number":77,"context_line":"                                 allow_redelegation\u003dTrue)"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"    return trust.id"},{"line_number":80,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_0431a4a2","line":77,"updated":"2015-11-24 12:55:28.000000000","message":"Btw, we can remove \u0027allow_redelegation\u0027","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"f4705d8e8bda5805dd3b0715e7c3d41d39da0930","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    return trust.id"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"def delete_trust(trust_id):"},{"line_number":83,"context_line":"    keystone_client \u003d _get_admin_client(trust_id\u003dtrust_id)"},{"line_number":84,"context_line":"    keystone_client.trusts.delete(trust_id)"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_63966a96","line":82,"updated":"2015-11-24 12:03:38.000000000","message":"could you document all these functions? (at the very least the public ones)","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"ee9ee5cc246637b13a267b26d9358aa75e990006","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    return trust.id"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"def delete_trust(trust_id):"},{"line_number":83,"context_line":"    keystone_client \u003d _get_admin_client(trust_id\u003dtrust_id)"},{"line_number":84,"context_line":"    keystone_client.trusts.delete(trust_id)"},{"line_number":85,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_03cc3e34","line":82,"in_reply_to":"9a8ffd7b_63966a96","updated":"2015-11-24 12:16:24.000000000","message":"Ok, will do.","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"f4705d8e8bda5805dd3b0715e7c3d41d39da0930","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"def _get_keystone_settings():"},{"line_number":92,"context_line":"    importutils.import_module(\u0027keystonemiddleware.auth_token\u0027)"},{"line_number":93,"context_line":"    return {"},{"line_number":94,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":95,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_381dedbd","line":92,"updated":"2015-11-24 12:03:38.000000000","message":"Why do we need this import line? and why do we need it inside this function?","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"ee9ee5cc246637b13a267b26d9358aa75e990006","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"def _get_keystone_settings():"},{"line_number":92,"context_line":"    importutils.import_module(\u0027keystonemiddleware.auth_token\u0027)"},{"line_number":93,"context_line":"    return {"},{"line_number":94,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":95,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_8374aecf","line":92,"in_reply_to":"9a8ffd7b_381dedbd","updated":"2015-11-24 12:16:24.000000000","message":"Oh, it has landed from Mike\u0027s previous patch during the merge. I\u0027ll ask him.","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"d4a06ead0812bb82e781e6a1160ca4db2141b9f4","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"def _get_keystone_settings():"},{"line_number":92,"context_line":"    importutils.import_module(\u0027keystonemiddleware.auth_token\u0027)"},{"line_number":93,"context_line":"    return {"},{"line_number":94,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":95,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_636d0a32","line":92,"in_reply_to":"9a8ffd7b_381dedbd","updated":"2015-11-24 12:20:22.000000000","message":"These should be considered off limits to applications. What happens here if we use something other than user/pass authentication?","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"58ecf793138b6798eb04d93c5d93293d55339e82","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"def _get_keystone_settings():"},{"line_number":92,"context_line":"    importutils.import_module(\u0027keystonemiddleware.auth_token\u0027)"},{"line_number":93,"context_line":"    return {"},{"line_number":94,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":95,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_2455c8c5","line":92,"in_reply_to":"9a8ffd7b_636d0a32","updated":"2015-11-24 12:55:28.000000000","message":"If we use something other than user/pass authentication, then glance won\u0027t be able to create trust and there will be a Debug log message about that. That\u0027s all. I mean in that case glance falls back to current workflow with original user token.\n\nI use this string for early patches, I think now we can remove it.","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"d4a06ead0812bb82e781e6a1160ca4db2141b9f4","unresolved":false,"context_lines":[{"line_number":101,"context_line":"            \u0027cert\u0027: CONF.keystone_authtoken.certfile,"},{"line_number":102,"context_line":"            \u0027key\u0027: CONF.keystone_authtoken.keyfile,"},{"line_number":103,"context_line":"        },"},{"line_number":104,"context_line":"        \u0027region_name\u0027: \u0027RegionOne\u0027"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    }"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_e35fba73","line":104,"updated":"2015-11-24 12:20:22.000000000","message":"hardcode region?","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"58ecf793138b6798eb04d93c5d93293d55339e82","unresolved":false,"context_lines":[{"line_number":101,"context_line":"            \u0027cert\u0027: CONF.keystone_authtoken.certfile,"},{"line_number":102,"context_line":"            \u0027key\u0027: CONF.keystone_authtoken.keyfile,"},{"line_number":103,"context_line":"        },"},{"line_number":104,"context_line":"        \u0027region_name\u0027: \u0027RegionOne\u0027"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    }"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a8ffd7b_04520414","line":104,"in_reply_to":"9a8ffd7b_e35fba73","updated":"2015-11-24 12:55:28.000000000","message":"Glance doesn\u0027t support multi-region :( Is it okay if we don\u0027t pass region_name to keystoneclient?","commit_id":"47e6592a3e15db68cf945bdc018cd737eac6c5a3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2fa5a15cebfe20b2839a4c3c5ad06bee4252afd5","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        \u0027ssl\u0027: settings[\u0027ssl\u0027]"},{"line_number":30,"context_line":"    }"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"    client \u003d ks_client.Client(**kwargs)"},{"line_number":33,"context_line":"    client.management_url \u003d settings[\u0027auth_url\u0027]"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"    return client"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_4f5a9bf3","line":32,"updated":"2015-11-27 20:50:59.000000000","message":"you probably want to create a session and plugin as seen here: http://docs.openstack.org/developer/keystoneauth/using-sessions.html#sessions-for-users and get a client instance from those two","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"75f8fc361dfaa82067241dea6b42a3db89b39f98","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        \u0027ssl\u0027: settings[\u0027ssl\u0027]"},{"line_number":30,"context_line":"    }"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"    client \u003d ks_client.Client(**kwargs)"},{"line_number":33,"context_line":"    client.management_url \u003d settings[\u0027auth_url\u0027]"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"    return client"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_a210d559","line":32,"in_reply_to":"9a8ffd7b_4f5a9bf3","updated":"2015-11-30 12:18:02.000000000","message":"I\u0027ve rewritten 90% of code, but Done :D","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2fa5a15cebfe20b2839a4c3c5ad06bee4252afd5","unresolved":false,"context_lines":[{"line_number":38,"context_line":"def _get_admin_client(trust_id\u003dNone, project_name\u003dNone):"},{"line_number":39,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    kwargs \u003d {"},{"line_number":42,"context_line":"        \u0027project_name\u0027: project_name,"},{"line_number":43,"context_line":"        \u0027trust_id\u0027: trust_id,"},{"line_number":44,"context_line":"        \u0027username\u0027: settings[\u0027username\u0027],"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_8f0ba3d5","line":41,"updated":"2015-11-27 20:50:59.000000000","message":"the way this is setup now, you would not be able to authenticate with v3 APIs, you need domain information as well if you insist on only using names of user and project","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"75f8fc361dfaa82067241dea6b42a3db89b39f98","unresolved":false,"context_lines":[{"line_number":38,"context_line":"def _get_admin_client(trust_id\u003dNone, project_name\u003dNone):"},{"line_number":39,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    kwargs \u003d {"},{"line_number":42,"context_line":"        \u0027project_name\u0027: project_name,"},{"line_number":43,"context_line":"        \u0027trust_id\u0027: trust_id,"},{"line_number":44,"context_line":"        \u0027username\u0027: settings[\u0027username\u0027],"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_39c74165","line":41,"in_reply_to":"9a8ffd7b_8f0ba3d5","updated":"2015-11-30 12:18:02.000000000","message":"Done","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2fa5a15cebfe20b2839a4c3c5ad06bee4252afd5","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        \u0027username\u0027: settings[\u0027username\u0027],"},{"line_number":45,"context_line":"        \u0027password\u0027: settings[\u0027password\u0027],"},{"line_number":46,"context_line":"        \u0027auth_url\u0027: settings[\u0027auth_url\u0027],"},{"line_number":47,"context_line":"        \u0027ssl\u0027: settings[\u0027ssl\u0027]"},{"line_number":48,"context_line":"    }"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    client \u003d ks_client.Client(**kwargs)"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_af0227b2","line":47,"updated":"2015-11-27 20:50:59.000000000","message":"you\u0027re setting `ssl` to be a dict here, and then passing that to Client()? is that right?","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"75f8fc361dfaa82067241dea6b42a3db89b39f98","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        \u0027username\u0027: settings[\u0027username\u0027],"},{"line_number":45,"context_line":"        \u0027password\u0027: settings[\u0027password\u0027],"},{"line_number":46,"context_line":"        \u0027auth_url\u0027: settings[\u0027auth_url\u0027],"},{"line_number":47,"context_line":"        \u0027ssl\u0027: settings[\u0027ssl\u0027]"},{"line_number":48,"context_line":"    }"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    client \u003d ks_client.Client(**kwargs)"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_4bacaf8b","line":47,"in_reply_to":"9a8ffd7b_af0227b2","updated":"2015-11-30 12:18:02.000000000","message":"Not right :) Done.","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2fa5a15cebfe20b2839a4c3c5ad06bee4252afd5","unresolved":false,"context_lines":[{"line_number":57,"context_line":"    return client"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"def create_trust(token, tenant_id):"},{"line_number":61,"context_line":"    \"\"\"Create a trust for a service user."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"    :param token: valid user token"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_6fd3df60","line":60,"updated":"2015-11-27 20:50:59.000000000","message":"nit, change tenant to project","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"75f8fc361dfaa82067241dea6b42a3db89b39f98","unresolved":false,"context_lines":[{"line_number":57,"context_line":"    return client"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"def create_trust(token, tenant_id):"},{"line_number":61,"context_line":"    \"\"\"Create a trust for a service user."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"    :param token: valid user token"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_8ba617ac","line":60,"in_reply_to":"9a8ffd7b_6fd3df60","updated":"2015-11-30 12:18:02.000000000","message":"Done","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"81407836f5fd92fa8d7689648a307edf0896c460","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    return _get_admin_client(trust_id\u003dtrust_id).auth_token"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"def _get_keystone_settings():"},{"line_number":101,"context_line":"    return {"},{"line_number":102,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":103,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_475197d7","line":100,"updated":"2015-11-25 18:06:57.000000000","message":"\u003cbikeshed\u003e\n\nI wonder if we should be accessing the keystone middleware\u0027s settings in this way?\n\nI wonder if the keystone folks would have any bright ideas on an alternative way to do this?\n\nSomething like a function in keystonemiddleware:\n\nEg. keystonemiddleware.get_me_a_trust(trustor, ...)\n\nAlthough that\u0027s not strictly a middleware\u0027s job either.\n\nMaybe a wsgi pipeline like:\n\ntrust_decision authtoken context glance\n\nwhere trust-decision could decide (based on the token\u0027s expiration or something else) whether to indicate to authtoken that it (authtoken) should output a trust in addition to its usual stuff. Context could consume that, so that you\u0027d end up with glance accessing:\n\ncontext.trust (in the same way as context.auth_token currently).\n\n\u003c/bikeshed\u003e","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"257fa06f99156d205a2ced9dbac424b29268da54","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    return _get_admin_client(trust_id\u003dtrust_id).auth_token"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"def _get_keystone_settings():"},{"line_number":101,"context_line":"    return {"},{"line_number":102,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":103,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_47a9977a","line":100,"in_reply_to":"9a8ffd7b_475197d7","updated":"2015-11-25 18:10:28.000000000","message":"Heat seem to do a lot of stuff with trusts. It might be worth having a quick look at what they do.","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"73398149af5a7f4579400c01c0a42022641c664d","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    return _get_admin_client(trust_id\u003dtrust_id).auth_token"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"def _get_keystone_settings():"},{"line_number":101,"context_line":"    return {"},{"line_number":102,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":103,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_573917f1","line":100,"in_reply_to":"9a8ffd7b_47a9977a","updated":"2015-11-26 13:32:24.000000000","message":"We were discussing it on the summit. Our idea is that we need trusts in rare cases, and creating them every time is resource consuming and absolutely unnecessary. So for performance sake we decided to create them in the code and don\u0027t take it out on middleware level. \n\nhttps://etherpad.openstack.org/p/mitaka-glance-trusts\n\n--What\u0027s the impact of this from a performance perspective if we use trusts for every request?\n\n--There seems to be a performance impact, which makes it not recommended for every request.","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"39ad0b43955f7beee14a6a2740e32f46f034f07d","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"def _get_keystone_settings():"},{"line_number":101,"context_line":"    return {"},{"line_number":102,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":103,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"},{"line_number":104,"context_line":"        \u0027password\u0027: CONF.keystone_authtoken.password,"},{"line_number":105,"context_line":"        \u0027project_name\u0027: CONF.keystone_authtoken.project_name,"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_bb50b75f","line":102,"updated":"2015-11-25 12:07:06.000000000","message":"mmh, I\u0027m a bit concerned about the hard-coded version here. I assume there\u0027s no better way to do this, is there?","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"75f8fc361dfaa82067241dea6b42a3db89b39f98","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"def _get_keystone_settings():"},{"line_number":101,"context_line":"    return {"},{"line_number":102,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":103,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"},{"line_number":104,"context_line":"        \u0027password\u0027: CONF.keystone_authtoken.password,"},{"line_number":105,"context_line":"        \u0027project_name\u0027: CONF.keystone_authtoken.project_name,"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_eb9a4361","line":102,"in_reply_to":"9a8ffd7b_2fc957ac","updated":"2015-11-30 12:18:02.000000000","message":"Unfortunately, if I remove it, then exception occurs and trust cannot be created :( http://paste.openstack.org/show/480349/","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"ebe8517ad025ba47241b6bb4d127d655967654db","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"def _get_keystone_settings():"},{"line_number":101,"context_line":"    return {"},{"line_number":102,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":103,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"},{"line_number":104,"context_line":"        \u0027password\u0027: CONF.keystone_authtoken.password,"},{"line_number":105,"context_line":"        \u0027project_name\u0027: CONF.keystone_authtoken.project_name,"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_e898a51d","line":102,"in_reply_to":"9a8ffd7b_bb50b75f","updated":"2015-11-25 15:43:57.000000000","message":"Yes, I read about keystone api version discovering and it seems that we can remove \u0027/v3\u0027 hardcoding.","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2fa5a15cebfe20b2839a4c3c5ad06bee4252afd5","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"def _get_keystone_settings():"},{"line_number":101,"context_line":"    return {"},{"line_number":102,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":103,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"},{"line_number":104,"context_line":"        \u0027password\u0027: CONF.keystone_authtoken.password,"},{"line_number":105,"context_line":"        \u0027project_name\u0027: CONF.keystone_authtoken.project_name,"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a8ffd7b_2fc957ac","line":102,"in_reply_to":"9a8ffd7b_e898a51d","updated":"2015-11-27 20:50:59.000000000","message":"yeah, remove /v3","commit_id":"b2f56bfd175c6ee25b9ae3fc8c782ff04f266e50"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"59f68d4274ff6bd50d338b33135d9be6b2c074ab","unresolved":false,"context_lines":[{"line_number":20,"context_line":"CONF \u003d cfg.CONF"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"def _get_client(token, project_id):"},{"line_number":24,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    client_auth \u003d v3.Token("}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_4d2b2c34","line":23,"updated":"2015-12-01 06:13:15.000000000","message":"maybe call this: \n\n  _get_trustor_session/client\n\nadd a doc string about how you determine stuff here, is the token based on an authenticated user?","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"b1e6853fd7dbba2386c6ce0210745462465ec865","unresolved":false,"context_lines":[{"line_number":20,"context_line":"CONF \u003d cfg.CONF"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"def _get_client(token, project_id):"},{"line_number":24,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    client_auth \u003d v3.Token("}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_9536e9b2","line":23,"in_reply_to":"9a8ffd7b_4d2b2c34","updated":"2015-12-01 12:49:10.000000000","message":"Done","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"59f68d4274ff6bd50d338b33135d9be6b2c074ab","unresolved":false,"context_lines":[{"line_number":30,"context_line":"    )"},{"line_number":31,"context_line":"    ssl \u003d settings[\u0027ssl\u0027]"},{"line_number":32,"context_line":"    client_sess \u003d session.Session(auth\u003dclient_auth)"},{"line_number":33,"context_line":"    return ks_client.Client(session\u003dclient_sess, **ssl), client_sess"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"def _get_admin_client(trust_id\u003dNone, project_name\u003dNone):"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_2de108ff","line":33,"updated":"2015-12-01 06:13:15.000000000","message":"suggest just returning the session here, and create the client instance later, tuples are nasty when undocumented, i thought this was an error at first","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"b1e6853fd7dbba2386c6ce0210745462465ec865","unresolved":false,"context_lines":[{"line_number":30,"context_line":"    )"},{"line_number":31,"context_line":"    ssl \u003d settings[\u0027ssl\u0027]"},{"line_number":32,"context_line":"    client_sess \u003d session.Session(auth\u003dclient_auth)"},{"line_number":33,"context_line":"    return ks_client.Client(session\u003dclient_sess, **ssl), client_sess"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"def _get_admin_client(trust_id\u003dNone, project_name\u003dNone):"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_75458515","line":33,"in_reply_to":"9a8ffd7b_2de108ff","updated":"2015-12-01 12:49:10.000000000","message":"Done","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"59f68d4274ff6bd50d338b33135d9be6b2c074ab","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    return ks_client.Client(session\u003dclient_sess, **ssl), client_sess"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"def _get_admin_client(trust_id\u003dNone, project_name\u003dNone):"},{"line_number":37,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    admin_auth \u003d v3.Password("}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_6da5d0b3","line":36,"updated":"2015-12-01 06:13:15.000000000","message":"suggest calling this:\n\n  _get_trustee_client/session\n\nadd a docstring about how this is determined, through the settings in authtoken_middleware, and it\u0027s normally a service user?","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"b1e6853fd7dbba2386c6ce0210745462465ec865","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    return ks_client.Client(session\u003dclient_sess, **ssl), client_sess"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"def _get_admin_client(trust_id\u003dNone, project_name\u003dNone):"},{"line_number":37,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    admin_auth \u003d v3.Password("}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_154bd92c","line":36,"in_reply_to":"9a8ffd7b_6da5d0b3","updated":"2015-12-01 12:49:10.000000000","message":"Done","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"59f68d4274ff6bd50d338b33135d9be6b2c074ab","unresolved":false,"context_lines":[{"line_number":37,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    admin_auth \u003d v3.Password("},{"line_number":40,"context_line":"        project_name\u003dproject_name,"},{"line_number":41,"context_line":"        trust_id\u003dtrust_id,"},{"line_number":42,"context_line":"        username\u003dsettings[\u0027username\u0027],"},{"line_number":43,"context_line":"        password\u003dsettings[\u0027password\u0027],"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_0ae74aad","line":40,"updated":"2015-12-01 06:13:15.000000000","message":"you either specify a project to scope to, or a trust, in this case, you want a trust, so remove the project_name","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"b1e6853fd7dbba2386c6ce0210745462465ec865","unresolved":false,"context_lines":[{"line_number":37,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    admin_auth \u003d v3.Password("},{"line_number":40,"context_line":"        project_name\u003dproject_name,"},{"line_number":41,"context_line":"        trust_id\u003dtrust_id,"},{"line_number":42,"context_line":"        username\u003dsettings[\u0027username\u0027],"},{"line_number":43,"context_line":"        password\u003dsettings[\u0027password\u0027],"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_35485d2d","line":40,"in_reply_to":"9a8ffd7b_0ae74aad","updated":"2015-12-01 12:49:10.000000000","message":"Done","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"59f68d4274ff6bd50d338b33135d9be6b2c074ab","unresolved":false,"context_lines":[{"line_number":43,"context_line":"        password\u003dsettings[\u0027password\u0027],"},{"line_number":44,"context_line":"        auth_url\u003dsettings[\u0027auth_url\u0027],"},{"line_number":45,"context_line":"        user_domain_id\u003dsettings[\u0027user_domain_id\u0027],"},{"line_number":46,"context_line":"        project_domain_id\u003dsettings[\u0027project_domain_id\u0027],"},{"line_number":47,"context_line":"        user_domain_name\u003dsettings[\u0027user_domain_name\u0027],"},{"line_number":48,"context_line":"        project_domain_name\u003dsettings[\u0027project_domain_name\u0027],"},{"line_number":49,"context_line":"    )"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_ca01423b","line":46,"updated":"2015-12-01 06:13:15.000000000","message":"remove the project-domain-* bits since they are not necessary when creating a trust based session","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"b1e6853fd7dbba2386c6ce0210745462465ec865","unresolved":false,"context_lines":[{"line_number":43,"context_line":"        password\u003dsettings[\u0027password\u0027],"},{"line_number":44,"context_line":"        auth_url\u003dsettings[\u0027auth_url\u0027],"},{"line_number":45,"context_line":"        user_domain_id\u003dsettings[\u0027user_domain_id\u0027],"},{"line_number":46,"context_line":"        project_domain_id\u003dsettings[\u0027project_domain_id\u0027],"},{"line_number":47,"context_line":"        user_domain_name\u003dsettings[\u0027user_domain_name\u0027],"},{"line_number":48,"context_line":"        project_domain_name\u003dsettings[\u0027project_domain_name\u0027],"},{"line_number":49,"context_line":"    )"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_35a05d90","line":46,"in_reply_to":"9a8ffd7b_ca01423b","updated":"2015-12-01 12:49:10.000000000","message":"Done for trustee session. But I left them for service user session.","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"59f68d4274ff6bd50d338b33135d9be6b2c074ab","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        auth_url\u003dsettings[\u0027auth_url\u0027],"},{"line_number":45,"context_line":"        user_domain_id\u003dsettings[\u0027user_domain_id\u0027],"},{"line_number":46,"context_line":"        project_domain_id\u003dsettings[\u0027project_domain_id\u0027],"},{"line_number":47,"context_line":"        user_domain_name\u003dsettings[\u0027user_domain_name\u0027],"},{"line_number":48,"context_line":"        project_domain_name\u003dsettings[\u0027project_domain_name\u0027],"},{"line_number":49,"context_line":"    )"},{"line_number":50,"context_line":"    ssl \u003d settings[\u0027ssl\u0027]"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_aaf87e4a","line":47,"updated":"2015-12-01 06:13:15.000000000","message":"nit: use either user_domain_name or user_domain_id, no need for both.","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"b1e6853fd7dbba2386c6ce0210745462465ec865","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        auth_url\u003dsettings[\u0027auth_url\u0027],"},{"line_number":45,"context_line":"        user_domain_id\u003dsettings[\u0027user_domain_id\u0027],"},{"line_number":46,"context_line":"        project_domain_id\u003dsettings[\u0027project_domain_id\u0027],"},{"line_number":47,"context_line":"        user_domain_name\u003dsettings[\u0027user_domain_name\u0027],"},{"line_number":48,"context_line":"        project_domain_name\u003dsettings[\u0027project_domain_name\u0027],"},{"line_number":49,"context_line":"    )"},{"line_number":50,"context_line":"    ssl \u003d settings[\u0027ssl\u0027]"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_75afc594","line":47,"in_reply_to":"9a8ffd7b_aaf87e4a","updated":"2015-12-01 12:49:10.000000000","message":"I think it\u0027s better to leave both, because in other case we limit users with one choice. I mean if we leave user_domain_name, but in config it\u0027s specify only user_domain_id trust may not work after that.","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"59f68d4274ff6bd50d338b33135d9be6b2c074ab","unresolved":false,"context_lines":[{"line_number":56,"context_line":"    \"\"\"Create a keystone client with a trust for the service user."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"    :param token: valid user token"},{"line_number":59,"context_line":"    :param project_id: id of project the user belongs to"},{"line_number":60,"context_line":"    \"\"\""},{"line_number":61,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":62,"context_line":"    client, sess \u003d _get_client(token, project_id)"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_4a78f2f8","line":59,"updated":"2015-12-01 06:13:15.000000000","message":"suggested rewording: ID of the project the user has a role on","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"b1e6853fd7dbba2386c6ce0210745462465ec865","unresolved":false,"context_lines":[{"line_number":56,"context_line":"    \"\"\"Create a keystone client with a trust for the service user."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"    :param token: valid user token"},{"line_number":59,"context_line":"    :param project_id: id of project the user belongs to"},{"line_number":60,"context_line":"    \"\"\""},{"line_number":61,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":62,"context_line":"    client, sess \u003d _get_client(token, project_id)"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_95b589d1","line":59,"in_reply_to":"9a8ffd7b_4a78f2f8","updated":"2015-12-01 12:49:10.000000000","message":"Done","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"59f68d4274ff6bd50d338b33135d9be6b2c074ab","unresolved":false,"context_lines":[{"line_number":73,"context_line":"                                 role_names\u003droles,"},{"line_number":74,"context_line":"                                 project\u003dproject_id)"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"    return _get_admin_client(trust_id\u003dtrust.id)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"def get_trust_id(keystone_client):"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_2db4a8cf","line":76,"updated":"2015-12-01 06:13:15.000000000","message":"i think for this last step, you probaby want to create a 3rd private function so you don\u0027t overload the arguments being passed into v3.Password, and only specify what you need\n\nin this last case you only want to authenticate with trustee name/password, trust ID and auth_url","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"b1e6853fd7dbba2386c6ce0210745462465ec865","unresolved":false,"context_lines":[{"line_number":73,"context_line":"                                 role_names\u003droles,"},{"line_number":74,"context_line":"                                 project\u003dproject_id)"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"    return _get_admin_client(trust_id\u003dtrust.id)"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"def get_trust_id(keystone_client):"}],"source_content_type":"text/x-python","patch_set":13,"id":"9a8ffd7b_15caf94f","line":76,"in_reply_to":"9a8ffd7b_2db4a8cf","updated":"2015-12-01 12:49:10.000000000","message":"Done","commit_id":"31dc08df5ccaed805cebeb7fbeae8a04328de988"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4265f231eb1c1022d3c02e06bdf75a40ccd9eb0a","unresolved":false,"context_lines":[{"line_number":12,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":13,"context_line":"#    under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystoneclient.auth.identity import v3"},{"line_number":16,"context_line":"from keystoneclient import session"},{"line_number":17,"context_line":"from keystoneclient.v3 import client as ks_client"},{"line_number":18,"context_line":"from oslo_config import cfg"}],"source_content_type":"text/x-python","patch_set":14,"id":"9a8ffd7b_49ecfcba","line":15,"updated":"2015-12-03 01:17:56.000000000","message":"from keystoneauth1.identity import v3","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"33a4700a0b1c6780ae38ca3940b973ba4f1ed886","unresolved":false,"context_lines":[{"line_number":12,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":13,"context_line":"#    under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystoneclient.auth.identity import v3"},{"line_number":16,"context_line":"from keystoneclient import session"},{"line_number":17,"context_line":"from keystoneclient.v3 import client as ks_client"},{"line_number":18,"context_line":"from oslo_config import cfg"}],"source_content_type":"text/x-python","patch_set":14,"id":"7a740942_7fc4b091","line":15,"in_reply_to":"9a8ffd7b_49ecfcba","updated":"2015-12-03 18:19:26.000000000","message":"Done","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4265f231eb1c1022d3c02e06bdf75a40ccd9eb0a","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystoneclient.auth.identity import v3"},{"line_number":16,"context_line":"from keystoneclient import session"},{"line_number":17,"context_line":"from keystoneclient.v3 import client as ks_client"},{"line_number":18,"context_line":"from oslo_config import cfg"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"9a8ffd7b_89f6648d","line":16,"updated":"2015-12-03 01:17:56.000000000","message":"from keystoneauth1 import session","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"33a4700a0b1c6780ae38ca3940b973ba4f1ed886","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    under the License."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"from keystoneclient.auth.identity import v3"},{"line_number":16,"context_line":"from keystoneclient import session"},{"line_number":17,"context_line":"from keystoneclient.v3 import client as ks_client"},{"line_number":18,"context_line":"from oslo_config import cfg"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"7a740942_dfce04b4","line":16,"in_reply_to":"9a8ffd7b_89f6648d","updated":"2015-12-03 18:19:26.000000000","message":"Done","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"88c035d3649293ad8beadee570e00498cde83a34","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"    # get trustor id"},{"line_number":83,"context_line":"    trustor_sess \u003d _get_trustor_session(token, project_id)"},{"line_number":84,"context_line":"    trustor_client \u003d ks_client.Client(session\u003dtrustor_sess, **ssl)"},{"line_number":85,"context_line":"    trustor_id \u003d trustor_client.session.get_user_id()"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    # get service user id"}],"source_content_type":"text/x-python","patch_set":14,"id":"9a8ffd7b_023ec68a","line":84,"updated":"2015-12-03 06:05:38.000000000","message":"ssl here is ignored on the client because they are expected to be passed to the session. I would recommend instead of doing get_trustor_session do at the top\n\nsess \u003d Session(**settings[\u0027ssl\u0027])\n\nthen later\n\ntrustor_client \u003d ks_client.Client(session\u003dsess, auth\u003dget_trustor_auth()) \n\nservice_user_client \u003d ks_client.Client(session\u003dsess, auth\u003dget_service_user_auth())","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"33a4700a0b1c6780ae38ca3940b973ba4f1ed886","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"    # get trustor id"},{"line_number":83,"context_line":"    trustor_sess \u003d _get_trustor_session(token, project_id)"},{"line_number":84,"context_line":"    trustor_client \u003d ks_client.Client(session\u003dtrustor_sess, **ssl)"},{"line_number":85,"context_line":"    trustor_id \u003d trustor_client.session.get_user_id()"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    # get service user id"}],"source_content_type":"text/x-python","patch_set":14,"id":"7a740942_5fe4543a","line":84,"in_reply_to":"9a8ffd7b_023ec68a","updated":"2015-12-03 18:19:26.000000000","message":"Are you sure about that? if I try what you recommend I get an error http://paste.openstack.org/show/480809/","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"88c035d3649293ad8beadee570e00498cde83a34","unresolved":false,"context_lines":[{"line_number":140,"context_line":"            \u0027insecure\u0027: CONF.keystone_authtoken.insecure,"},{"line_number":141,"context_line":"            \u0027cert\u0027: CONF.keystone_authtoken.certfile,"},{"line_number":142,"context_line":"            \u0027key\u0027: CONF.keystone_authtoken.keyfile,"},{"line_number":143,"context_line":"        }"},{"line_number":144,"context_line":"    }"}],"source_content_type":"text/x-python","patch_set":14,"id":"9a8ffd7b_4764e020","line":143,"updated":"2015-12-03 06:05:38.000000000","message":"I know this has been mentioned and dismissed, but this only works if auth_token is configured with the password plugin. This is true in devstack but i don\u0027t even know for puppet/ansible.\n\nI don\u0027t like to recommend this because it\u0027s supposed to be private but you *could* do\n\nauth \u003d loading.load_auth_from_conf(CONF, \u0027keystone_authtoken\u0027)\nsess \u003d loading.load_session_from_conf(CONF, \u0027keystone_authtoken\u0027)\n\njust do me a favour and comment that this is bad and you should be using your own configured user to at least limit people copying you.","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"161632cacc7ed53e2aa60c78064e7286222e9557","unresolved":false,"context_lines":[{"line_number":140,"context_line":"            \u0027insecure\u0027: CONF.keystone_authtoken.insecure,"},{"line_number":141,"context_line":"            \u0027cert\u0027: CONF.keystone_authtoken.certfile,"},{"line_number":142,"context_line":"            \u0027key\u0027: CONF.keystone_authtoken.keyfile,"},{"line_number":143,"context_line":"        }"},{"line_number":144,"context_line":"    }"}],"source_content_type":"text/x-python","patch_set":14,"id":"7a740942_5ae4623a","line":143,"in_reply_to":"9a8ffd7b_4764e020","updated":"2015-12-03 18:37:45.000000000","message":"@Jamie\n\nI agree that re-cycling the keystone middleware params here is a bit unclean, they probably should be opaque to glance.\n\nIt seems like it would be useful if the keystone middleware could provide a trust to the service in addition to a token (in some cases). Is there any reasonable way that could be done?\n\nI had a comment on patch set 11, around line 100 which may or may not be sane, or maybe something callable?","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"33a4700a0b1c6780ae38ca3940b973ba4f1ed886","unresolved":false,"context_lines":[{"line_number":140,"context_line":"            \u0027insecure\u0027: CONF.keystone_authtoken.insecure,"},{"line_number":141,"context_line":"            \u0027cert\u0027: CONF.keystone_authtoken.certfile,"},{"line_number":142,"context_line":"            \u0027key\u0027: CONF.keystone_authtoken.keyfile,"},{"line_number":143,"context_line":"        }"},{"line_number":144,"context_line":"    }"}],"source_content_type":"text/x-python","patch_set":14,"id":"7a740942_1fd56c42","line":143,"in_reply_to":"9a8ffd7b_4764e020","updated":"2015-12-03 18:19:26.000000000","message":"Done","commit_id":"42e60c9b76a117725e9b91f47226169f51980f2c"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"df3627df213efa67d5e776b43ea7e14291949a1c","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        project_id\u003dproject_id,"},{"line_number":31,"context_line":"        auth_url\u003dsettings[\u0027auth_url\u0027],"},{"line_number":32,"context_line":"    )"},{"line_number":33,"context_line":"    return session.Session(auth\u003dclient_auth)"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"def _get_service_user_session():"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_f9d8a4f1","line":33,"updated":"2015-12-04 06:33:56.000000000","message":"This is being called with the token from context and the project_id from context. You are therefore rescoping a token to exactly the same thing. You want to use token.TokenEndpoint here to reuse a token. \n\nAlternatively if this is running on the API service then auth_token middleware already passed down a plugin in ENV[\u0027keystone.token_auth\u0027] [1] that you can use immediately to work on behalf of a user.\n\n[1] https://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/auth_token/__init__.py#L171-L174","commit_id":"f4a32b7eed6096996f028dcf2d43e63572dc64a0"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"50761045a2694f6a4c58977bde2bc4879b93549e","unresolved":false,"context_lines":[{"line_number":30,"context_line":"        project_id\u003dproject_id,"},{"line_number":31,"context_line":"        auth_url\u003dsettings[\u0027auth_url\u0027],"},{"line_number":32,"context_line":"    )"},{"line_number":33,"context_line":"    return session.Session(auth\u003dclient_auth)"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"def _get_service_user_session():"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_43dfafd5","line":33,"in_reply_to":"7a740942_f9d8a4f1","updated":"2015-12-09 12:30:30.000000000","message":"Thanks for clarification.\nDone, keystone.token_auth was used to create session.","commit_id":"f4a32b7eed6096996f028dcf2d43e63572dc64a0"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"9fe2b7f4e6525c3b9c3cb51c2c8ac2f51bcc523b","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    # get service user id"},{"line_number":88,"context_line":"    service_user_sess \u003d _get_service_user_session()"},{"line_number":89,"context_line":"    service_user_client \u003d ks_client.Client(session\u003dservice_user_sess, **ssl)"},{"line_number":90,"context_line":"    trustee_id \u003d service_user_client.session.get_user_id()"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    # create a trust for service user"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_d55252dd","line":89,"updated":"2015-12-04 01:44:50.000000000","message":"I\u0027m sure they get ignored yes. It\u0027s just the options here have changed slightly from Client() to Session() to more closely resemble what requests does. In hindsight maybe i just should have left it but i was expecting people to want to use the loading.session_from_conf_options(CONF, \u0027group\u0027) syntax and so would never have to deal with this manually.\n\nYou can see the conversion here[1] which you can either emulate, call Session().load_from_options(**settings[\u0027ssl\u0027]) (you\u0027ll need to import the loading.session file, this isn\u0027t public at the loading module), or just use the loading.session_from_conf_options directly\n\n\n[1] https://github.com/openstack/keystoneauth/blob/8761ab4323e835c3d605af9957b97580fc982ead/keystoneauth1/loading/session.py#L70-L83","commit_id":"f4a32b7eed6096996f028dcf2d43e63572dc64a0"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"50761045a2694f6a4c58977bde2bc4879b93549e","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    # get service user id"},{"line_number":88,"context_line":"    service_user_sess \u003d _get_service_user_session()"},{"line_number":89,"context_line":"    service_user_client \u003d ks_client.Client(session\u003dservice_user_sess, **ssl)"},{"line_number":90,"context_line":"    trustee_id \u003d service_user_client.session.get_user_id()"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    # create a trust for service user"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_11bd6e02","line":89,"in_reply_to":"7a740942_d55252dd","updated":"2015-12-09 12:30:30.000000000","message":"I tried both proposals.\n1) Session().load_from_options(auth\u003dplugin, **settings[\u0027ssl\u0027]) works correctly\nbut it requires ssl parameters to be specified.\n2) loading.session_from_conf_options(CONF, \u0027group\u0027) does not work because it requires \u0027timeout\u0027 option to be specified[1]. Unfortunately, there is no timeout config option in keystone_authtoken group. I guess we should use \u0027http_connect_timeout\u0027 option instead of this value but it seems that there is some messy with config names and timeout was not registered.\nI would like to use 2nd approach (cause we don\u0027t need to keep in mind ssl configs anymore) but it does not work so it would be perfect to hear your opinion on this.\n[1] https://github.com/openstack/keystoneauth/blob/8761ab4323e835c3d605af9957b97580fc982ead/keystoneauth1/loading/session.py#L239","commit_id":"f4a32b7eed6096996f028dcf2d43e63572dc64a0"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"341807ddbab68382580298a44ba001d7e87b3541","unresolved":false,"context_lines":[{"line_number":129,"context_line":"    # this is a bad solution because this only works if auth_token is"},{"line_number":130,"context_line":"    # configured with the password plugin and it forces you to use your own"},{"line_number":131,"context_line":"    # configured user."},{"line_number":132,"context_line":"    # TODO(mfedosin): rewrite this with keystoneauth1 loading module"},{"line_number":133,"context_line":"    return {"},{"line_number":134,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":135,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_b0c52d8f","line":132,"updated":"2015-12-04 17:34:59.000000000","message":"@Mike\n\nQuick query to make sure I\u0027m understanding correctly:\n\nWhen we switch to keystoneauth1 we won\u0027t need to access CONF.keystone_authtoken.xxx directly anymore?","commit_id":"f4a32b7eed6096996f028dcf2d43e63572dc64a0"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"50761045a2694f6a4c58977bde2bc4879b93549e","unresolved":false,"context_lines":[{"line_number":129,"context_line":"    # this is a bad solution because this only works if auth_token is"},{"line_number":130,"context_line":"    # configured with the password plugin and it forces you to use your own"},{"line_number":131,"context_line":"    # configured user."},{"line_number":132,"context_line":"    # TODO(mfedosin): rewrite this with keystoneauth1 loading module"},{"line_number":133,"context_line":"    return {"},{"line_number":134,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":135,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_71cab270","line":132,"in_reply_to":"7a740942_120c0c40","updated":"2015-12-09 12:30:30.000000000","message":"Ok, I have done this for project-scoped client with password authentication.\nBut I stuck at trust-scoped client. It is not good idea to register trust_id in configuration options or change auth_method so I tried this:\ntrustee_auth \u003d conf.load_from_conf_options(CONF,\n                                               IDENTITY_CONFIG_GROUP,\n                                               trust_id\u003dtrust_id)\nand it also does not work because token is scoped to project and trust.\nSo it seems that we need to use configs for trust-scoped token.\nIt would be perfect to hear opinion on this from Keystone guys.","commit_id":"f4a32b7eed6096996f028dcf2d43e63572dc64a0"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"5842baeee96029ef33286b9b65d8c18f23486cc7","unresolved":false,"context_lines":[{"line_number":129,"context_line":"    # this is a bad solution because this only works if auth_token is"},{"line_number":130,"context_line":"    # configured with the password plugin and it forces you to use your own"},{"line_number":131,"context_line":"    # configured user."},{"line_number":132,"context_line":"    # TODO(mfedosin): rewrite this with keystoneauth1 loading module"},{"line_number":133,"context_line":"    return {"},{"line_number":134,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":135,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_120c0c40","line":132,"in_reply_to":"7a740942_87651cb6","updated":"2015-12-07 13:19:23.000000000","message":"@Mike,\n\nOk, thanks! That sounds great!\n\n@Jamie\n\nIs there any example code you know of which uses keystoneauth1? It would be helpful for Mike to have example usage he could refer to.","commit_id":"f4a32b7eed6096996f028dcf2d43e63572dc64a0"},{"author":{"_account_id":11391,"name":"Mikhail Fedosin","email":"mfedosin@redhat.com","username":"fedosinme"},"change_message_id":"ca46b658257c83023aab5f364933b45e4870d1a7","unresolved":false,"context_lines":[{"line_number":129,"context_line":"    # this is a bad solution because this only works if auth_token is"},{"line_number":130,"context_line":"    # configured with the password plugin and it forces you to use your own"},{"line_number":131,"context_line":"    # configured user."},{"line_number":132,"context_line":"    # TODO(mfedosin): rewrite this with keystoneauth1 loading module"},{"line_number":133,"context_line":"    return {"},{"line_number":134,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":135,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"}],"source_content_type":"text/x-python","patch_set":15,"id":"7a740942_87651cb6","line":132,"in_reply_to":"7a740942_b0c52d8f","updated":"2015-12-07 12:49:51.000000000","message":"I suppose you are right, sir. I understand it similarly. \n\nUnfortunately this feature is not well documented and I have to take some time to realize how it works out from the code...","commit_id":"f4a32b7eed6096996f028dcf2d43e63572dc64a0"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"34ece5a984b587a096b0b9b5b6d8be12aa18f63f","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    Return a session for service user as a trustee."},{"line_number":44,"context_line":"    \"\"\""},{"line_number":45,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":46,"context_line":"    trustee_auth \u003d v3.Password("},{"line_number":47,"context_line":"        trust_id\u003dtrust_id,"},{"line_number":48,"context_line":"        username\u003dsettings[\u0027username\u0027],"},{"line_number":49,"context_line":"        password\u003dsettings[\u0027password\u0027],"}],"source_content_type":"text/x-python","patch_set":17,"id":"5a710552_03f4de83","line":46,"updated":"2015-12-16 08:38:34.000000000","message":"instead of v3.Password, can you use v3.Token? I think trusts only work with token based auth... (i didn\u0027t know this).\n\nSource: https://elmiko.github.io/2014/06/10/keystone-trust-delegation.html\n\nSo the only arguments into v3.Token should be: trust_id and token_id.\n\nYou can get the token_id from the trustee_session on line 73.","commit_id":"b857387c438f01b0d356333b4dd1a4dd34725345"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0bb04d6e18105c12db59d62c20efbc85573d65e2","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    Return a session for service user as a trustee."},{"line_number":44,"context_line":"    \"\"\""},{"line_number":45,"context_line":"    settings \u003d _get_keystone_settings()"},{"line_number":46,"context_line":"    trustee_auth \u003d v3.Password("},{"line_number":47,"context_line":"        trust_id\u003dtrust_id,"},{"line_number":48,"context_line":"        username\u003dsettings[\u0027username\u0027],"},{"line_number":49,"context_line":"        password\u003dsettings[\u0027password\u0027],"}],"source_content_type":"text/x-python","patch_set":17,"id":"3a7e1126_34582232","line":46,"in_reply_to":"5a710552_03f4de83","updated":"2015-12-18 09:36:11.000000000","message":"Thanks for recommendation! Now we don\u0027t username, password and domain info to be specified.","commit_id":"b857387c438f01b0d356333b4dd1a4dd34725345"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"fd5ad162b5c35db6a792100380ab89580338cf18","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    # configured with the password plugin and it forces you to use your own"},{"line_number":114,"context_line":"    # configured user."},{"line_number":115,"context_line":"    return {"},{"line_number":116,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":117,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"},{"line_number":118,"context_line":"        \u0027password\u0027: CONF.keystone_authtoken.password,"},{"line_number":119,"context_line":"        \u0027user_domain_id\u0027: CONF.keystone_authtoken.user_domain_id,"}],"source_content_type":"text/x-python","patch_set":17,"id":"7a740942_f5372a4b","line":116,"updated":"2015-12-10 12:34:44.000000000","message":"please do not use settings from keystone_authtoken. This are private keystonemiddleware options. http://lists.openstack.org/pipermail/openstack-dev/2015-July/070557.html","commit_id":"b857387c438f01b0d356333b4dd1a4dd34725345"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"34ece5a984b587a096b0b9b5b6d8be12aa18f63f","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    # configured with the password plugin and it forces you to use your own"},{"line_number":114,"context_line":"    # configured user."},{"line_number":115,"context_line":"    return {"},{"line_number":116,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":117,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"},{"line_number":118,"context_line":"        \u0027password\u0027: CONF.keystone_authtoken.password,"},{"line_number":119,"context_line":"        \u0027user_domain_id\u0027: CONF.keystone_authtoken.user_domain_id,"}],"source_content_type":"text/x-python","patch_set":17,"id":"5a710552_1803ed10","line":116,"updated":"2015-12-16 08:38:34.000000000","message":"you could do some basic checking on the value of auth_uri before slapping on v3. Check if it already ends in v3 for instance..","commit_id":"b857387c438f01b0d356333b4dd1a4dd34725345"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"0bb04d6e18105c12db59d62c20efbc85573d65e2","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    # configured with the password plugin and it forces you to use your own"},{"line_number":114,"context_line":"    # configured user."},{"line_number":115,"context_line":"    return {"},{"line_number":116,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":117,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"},{"line_number":118,"context_line":"        \u0027password\u0027: CONF.keystone_authtoken.password,"},{"line_number":119,"context_line":"        \u0027user_domain_id\u0027: CONF.keystone_authtoken.user_domain_id,"}],"source_content_type":"text/x-python","patch_set":17,"id":"3a7e1126_143e46b8","line":116,"in_reply_to":"5a710552_1803ed10","updated":"2015-12-18 09:36:11.000000000","message":"Done","commit_id":"b857387c438f01b0d356333b4dd1a4dd34725345"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"34ece5a984b587a096b0b9b5b6d8be12aa18f63f","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    # configured with the password plugin and it forces you to use your own"},{"line_number":114,"context_line":"    # configured user."},{"line_number":115,"context_line":"    return {"},{"line_number":116,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":117,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"},{"line_number":118,"context_line":"        \u0027password\u0027: CONF.keystone_authtoken.password,"},{"line_number":119,"context_line":"        \u0027user_domain_id\u0027: CONF.keystone_authtoken.user_domain_id,"}],"source_content_type":"text/x-python","patch_set":17,"id":"5a710552_4315063e","line":116,"in_reply_to":"7a740942_f5372a4b","updated":"2015-12-16 08:38:34.000000000","message":"@boris, the comments make it clear they are doing this at their own risk :)","commit_id":"b857387c438f01b0d356333b4dd1a4dd34725345"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"da6a342ec21763ee219bdec221d7ce61e9af632c","unresolved":false,"context_lines":[{"line_number":113,"context_line":"    # configured with the password plugin and it forces you to use your own"},{"line_number":114,"context_line":"    # configured user."},{"line_number":115,"context_line":"    return {"},{"line_number":116,"context_line":"        \u0027auth_url\u0027: CONF.keystone_authtoken.auth_uri + \u0027/v3\u0027,"},{"line_number":117,"context_line":"        \u0027username\u0027: CONF.keystone_authtoken.username,"},{"line_number":118,"context_line":"        \u0027password\u0027: CONF.keystone_authtoken.password,"},{"line_number":119,"context_line":"        \u0027user_domain_id\u0027: CONF.keystone_authtoken.user_domain_id,"}],"source_content_type":"text/x-python","patch_set":17,"id":"7a740942_44e972b6","line":116,"in_reply_to":"7a740942_f5372a4b","updated":"2015-12-11 11:10:36.000000000","message":"I tried to use it but when I tested it Keystone complains that there are multiples scopes (trust and project from configuration file).\nI would appreciate any help or consultation from Keystone guys on this.","commit_id":"b857387c438f01b0d356333b4dd1a4dd34725345"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"020bd93ae0ee8c9844221c35dfbcc693780d11d0","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        # step 2: create trust to ensure that we can always update token"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"        # trustor \u003d user who made the request"},{"line_number":49,"context_line":"        trustor_client \u003d self._load_client(user_plugin, self.ssl_settings)"},{"line_number":50,"context_line":"        trustor_id \u003d trustor_client.session.get_user_id()"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"        # get service user(trustee) client that impersonates main user"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a7e1126_860e6239","line":49,"updated":"2015-12-19 06:54:12.000000000","message":"this is the only part that concerns me, since uer_plugin is grabbed from:\n\n  user_plugin \u003d req.environ.get(\u0027keystone.token_auth\u0027)\n\ni just don\u0027t recall what gets passed in that field atm, but a plugin seems unlikely.","commit_id":"dcdc8592c026180a699fb28e06b3a73820af4721"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"2a08524b132dfafbd9674acded791e9d2e31dde0","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        # step 2: create trust to ensure that we can always update token"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"        # trustor \u003d user who made the request"},{"line_number":49,"context_line":"        trustor_client \u003d self._load_client(user_plugin, self.ssl_settings)"},{"line_number":50,"context_line":"        trustor_id \u003d trustor_client.session.get_user_id()"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"        # get service user(trustee) client that impersonates main user"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a7e1126_48e4eedf","line":49,"in_reply_to":"3a7e1126_860e6239","updated":"2015-12-21 08:19:56.000000000","message":"You can find the description here:\nhttps://github.com/openstack/keystonemiddleware/blob/1047cececf68c3c22add66b6a8a1c499a667c036/keystonemiddleware/auth_token/__init__.py#L171\nThe idea came from Jamie Lennox comment to one of previous patches.","commit_id":"dcdc8592c026180a699fb28e06b3a73820af4721"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"0d338b985e9e8f67e66565da7f99ed7ac4da02ca","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"        # step 1: Prepare parameters required to connect to keystone"},{"line_number":35,"context_line":"        self.auth_url \u003d CONF.keystone_authtoken.auth_uri"},{"line_number":36,"context_line":"        if not self.auth_url.endswith(\u0027/v3\u0027):"},{"line_number":37,"context_line":"            self.auth_url +\u003d \u0027/v3\u0027"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"        self.ssl_settings \u003d {"}],"source_content_type":"text/x-python","patch_set":22,"id":"da6ed579_2dcc7969","line":36,"range":{"start_line":36,"start_character":39,"end_line":36,"end_character":42},"updated":"2016-01-13 14:47:30.000000000","message":"Why do we need to add /v3 here?\n\nMy understanding is that keystone\u0027s unversioned endpoint could redirect to v2 or v3 as needed:\n\n\n $ curl http://10.0.0.100:5000\n {\"versions\": {\"values\": [{\"status\": \"stable\", \"updated\": \"2015-09- 15T00:00:00Z\", \"media-types\": [{\"base\": \"application/json\", \"type\":   \"application/vnd.openstack.identity-v3+json\"}], \"id\": \"v3.5\", \"links\":  [{\"href\": \"http://10.0.0.100:35357/v3/\", \"rel\": \"self\"}]}, {\"status\":  \"stable\", \"updated\": \"2014-04-17T00:00:00Z\", \"media-types\": [{\"base\":  \"application/json\", \"type\": \"application/vnd.openstack.identity- v2.0+json\"}], \"id\": \"v2.0\", \"links\": [{\"href\":  \"http://10.0.0.100:35357/v2.0/\", \"rel\": \"self\"}, {\"href\":  \"http://docs.openstack.org/\", \"type\": \"text/html\", \"rel\":  \"describedby\"}]}]}}\n\n\nDoes v3.Token (line 103 below) not work if you give it an unversioned endpoint?","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"96ae3f9986def2306a1d3569b7ad211289617dcd","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"        # step 1: Prepare parameters required to connect to keystone"},{"line_number":35,"context_line":"        self.auth_url \u003d CONF.keystone_authtoken.auth_uri"},{"line_number":36,"context_line":"        if not self.auth_url.endswith(\u0027/v3\u0027):"},{"line_number":37,"context_line":"            self.auth_url +\u003d \u0027/v3\u0027"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"        self.ssl_settings \u003d {"}],"source_content_type":"text/x-python","patch_set":22,"id":"da6ed579_73f8dd7b","line":36,"range":{"start_line":36,"start_character":39,"end_line":36,"end_character":42},"in_reply_to":"da6ed579_2dcc7969","updated":"2016-01-14 09:37:10.000000000","message":"I have tried that approach.\nv3 is required otherwise we will get something like this:\nhttp://paste.openstack.org/show/483853/\nSo the plugin does not work with unversioned endpoint.","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"0d338b985e9e8f67e66565da7f99ed7ac4da02ca","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        trustor_client \u003d self._load_client(user_plugin, self.ssl_settings)"},{"line_number":50,"context_line":"        trustor_id \u003d trustor_client.session.get_user_id()"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"        # get service user(trustee) client that impersonates main user"},{"line_number":53,"context_line":"        service_user_auth \u003d conf.load_from_conf_options(CONF,"},{"line_number":54,"context_line":"                                                        \u0027keystone_authtoken\u0027)"},{"line_number":55,"context_line":"        # save service user client because we need new service token"}],"source_content_type":"text/x-python","patch_set":22,"id":"da6ed579_5048662d","line":52,"range":{"start_line":52,"start_character":14,"end_line":52,"end_character":26},"updated":"2016-01-13 14:47:30.000000000","message":"It may only be me, but I find the name \u0027service user\u0027 a little confusing here. There is a concept of \u0027service tokens\u0027 and we may introduce a \u0027service user\u0027 which is used to generate \u0027service tokens\u0027.\n\nWhat about \u0027trust/trustee user\u0027?","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"96ae3f9986def2306a1d3569b7ad211289617dcd","unresolved":false,"context_lines":[{"line_number":49,"context_line":"        trustor_client \u003d self._load_client(user_plugin, self.ssl_settings)"},{"line_number":50,"context_line":"        trustor_id \u003d trustor_client.session.get_user_id()"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"        # get service user(trustee) client that impersonates main user"},{"line_number":53,"context_line":"        service_user_auth \u003d conf.load_from_conf_options(CONF,"},{"line_number":54,"context_line":"                                                        \u0027keystone_authtoken\u0027)"},{"line_number":55,"context_line":"        # save service user client because we need new service token"}],"source_content_type":"text/x-python","patch_set":22,"id":"da6ed579_73dd3d6e","line":52,"range":{"start_line":52,"start_character":14,"end_line":52,"end_character":26},"in_reply_to":"da6ed579_5048662d","updated":"2016-01-14 09:37:10.000000000","message":"It makes sense, I\u0027ll rename it.","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"0d338b985e9e8f67e66565da7f99ed7ac4da02ca","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"        # get service user(trustee) client that impersonates main user"},{"line_number":53,"context_line":"        service_user_auth \u003d conf.load_from_conf_options(CONF,"},{"line_number":54,"context_line":"                                                        \u0027keystone_authtoken\u0027)"},{"line_number":55,"context_line":"        # save service user client because we need new service token"},{"line_number":56,"context_line":"        # to refresh trust-scoped client later"},{"line_number":57,"context_line":"        self.service_user_client \u003d self._load_client(service_user_auth,"}],"source_content_type":"text/x-python","patch_set":22,"id":"da6ed579_e2c0a8e2","line":54,"range":{"start_line":54,"start_character":57,"end_line":54,"end_character":75},"updated":"2016-01-13 14:47:30.000000000","message":"\u003cbikeshed\u003e Part of me doesn\u0027t like using config parameters that should -- in an ideal world -- only be used by the middleware.\n\nI guess if it becomes problematic we could introduce new glance specific parameters. \u003c/bikeshed\u003e","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"96ae3f9986def2306a1d3569b7ad211289617dcd","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"        # get service user(trustee) client that impersonates main user"},{"line_number":53,"context_line":"        service_user_auth \u003d conf.load_from_conf_options(CONF,"},{"line_number":54,"context_line":"                                                        \u0027keystone_authtoken\u0027)"},{"line_number":55,"context_line":"        # save service user client because we need new service token"},{"line_number":56,"context_line":"        # to refresh trust-scoped client later"},{"line_number":57,"context_line":"        self.service_user_client \u003d self._load_client(service_user_auth,"}],"source_content_type":"text/x-python","patch_set":22,"id":"da6ed579_d3918948","line":54,"range":{"start_line":54,"start_character":57,"end_line":54,"end_character":75},"in_reply_to":"da6ed579_e2c0a8e2","updated":"2016-01-14 09:37:10.000000000","message":"Yep, we discussed this a lot with Keystone guys already. That\u0027s why we used keystoneauth1 to not rely on keystone_authtoken parameters. And I agree with your last suggestion: we can introduce new parameters once it becomes problematic. Also I think that we will start to use service tokens at the moment when there will be some troubles with that config group.","commit_id":"a6935afa920f17c30436a5d0fafc8de00600809e"}],"glance/tests/unit/v2/test_image_data_resource.py":[{"author":{"_account_id":6159,"name":"Flavio Percoco Premoli","display_name":"flaper87","email":"flavio.percoco@flyrlabs.com","username":"flaper87"},"change_message_id":"693f9dadc43c22d1d9b38bacd8776f811dbc39bc","unresolved":false,"context_lines":[{"line_number":391,"context_line":"        \"\"\"Test upload with registry if trust was not successfully created\"\"\""},{"line_number":392,"context_line":"        # initialize trust environment"},{"line_number":393,"context_line":"        self.config(data_api\u003d\u0027glance.db.registry.api\u0027)"},{"line_number":394,"context_line":"        mock_refresher().side_effect \u003d Exception()"},{"line_number":395,"context_line":"        # request an image upload"},{"line_number":396,"context_line":"        request \u003d unit_test_utils.get_fake_request()"},{"line_number":397,"context_line":"        image \u003d FakeImage(\u0027abcd\u0027)"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a7e1126_d26ad6b2","line":394,"range":{"start_line":394,"start_character":22,"end_line":394,"end_character":24},"updated":"2015-12-20 16:21:37.000000000","message":"nit: This shouldn\u0027t be needed","commit_id":"dcdc8592c026180a699fb28e06b3a73820af4721"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"2642367e856f9a464dc3e8ea95b6766faa461378","unresolved":false,"context_lines":[{"line_number":391,"context_line":"        \"\"\"Test upload with registry if trust was not successfully created\"\"\""},{"line_number":392,"context_line":"        # initialize trust environment"},{"line_number":393,"context_line":"        self.config(data_api\u003d\u0027glance.db.registry.api\u0027)"},{"line_number":394,"context_line":"        mock_refresher().side_effect \u003d Exception()"},{"line_number":395,"context_line":"        # request an image upload"},{"line_number":396,"context_line":"        request \u003d unit_test_utils.get_fake_request()"},{"line_number":397,"context_line":"        image \u003d FakeImage(\u0027abcd\u0027)"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a7e1126_c888dec7","line":394,"range":{"start_line":394,"start_character":22,"end_line":394,"end_character":24},"in_reply_to":"3a7e1126_c8d0def8","updated":"2015-12-21 08:27:11.000000000","message":"Tried it but mock_refresher generated an exception when I tried to check call count at str 404.","commit_id":"dcdc8592c026180a699fb28e06b3a73820af4721"},{"author":{"_account_id":14676,"name":"Kairat Kushaev","email":"kkushaev@mirantis.com","username":"kairat_kushaev"},"change_message_id":"2a08524b132dfafbd9674acded791e9d2e31dde0","unresolved":false,"context_lines":[{"line_number":391,"context_line":"        \"\"\"Test upload with registry if trust was not successfully created\"\"\""},{"line_number":392,"context_line":"        # initialize trust environment"},{"line_number":393,"context_line":"        self.config(data_api\u003d\u0027glance.db.registry.api\u0027)"},{"line_number":394,"context_line":"        mock_refresher().side_effect \u003d Exception()"},{"line_number":395,"context_line":"        # request an image upload"},{"line_number":396,"context_line":"        request \u003d unit_test_utils.get_fake_request()"},{"line_number":397,"context_line":"        image \u003d FakeImage(\u0027abcd\u0027)"}],"source_content_type":"text/x-python","patch_set":18,"id":"3a7e1126_c8d0def8","line":394,"range":{"start_line":394,"start_character":22,"end_line":394,"end_character":24},"in_reply_to":"3a7e1126_d26ad6b2","updated":"2015-12-21 08:19:56.000000000","message":"Will do, thanks.","commit_id":"dcdc8592c026180a699fb28e06b3a73820af4721"}]}