)]}'
{"bin/glance":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"2c30f716de28fa9c21d457a1f7ecfccc6a3c9dea","unresolved":false,"context_lines":[{"line_number":789,"context_line":"                      help\u003d\"Authentication URL\")"},{"line_number":790,"context_line":"    parser.add_option(\u0027-S\u0027, \u0027--auth_strategy\u0027, dest\u003d\"auth_strategy\","},{"line_number":791,"context_line":"                      metavar\u003d\"STRATEGY\", default\u003dNone,"},{"line_number":792,"context_line":"                      help\u003d\"Authentication strategy (keystone or noauth)\")"},{"line_number":793,"context_line":"    parser.add_option(\u0027--limit\u0027, dest\u003d\"limit\", metavar\u003d\"LIMIT\", default\u003d10,"},{"line_number":794,"context_line":"                      type\u003d\"int\", help\u003d\"Page size to use while \""},{"line_number":795,"context_line":"                                       \"requesting image metadata\")"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"AAAAEH%2F%2F%2FXE%3D","line":792,"updated":"2012-01-24 01:35:45.000000000","message":"Are we sure we want to use None as the default? The default is \u0027noauth\u0027 in the dict() above here, but I\u0027m wondering if it would be better to have \u0027keystone\u0027 be the default?","commit_id":"27bdef70ceb0593a4004b6c2a8e60194a442c012"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"6b7d6256b18749b6edf66e76ab053c99f22f10d8","unresolved":false,"context_lines":[{"line_number":789,"context_line":"                      help\u003d\"Authentication URL\")"},{"line_number":790,"context_line":"    parser.add_option(\u0027-S\u0027, \u0027--auth_strategy\u0027, dest\u003d\"auth_strategy\","},{"line_number":791,"context_line":"                      metavar\u003d\"STRATEGY\", default\u003dNone,"},{"line_number":792,"context_line":"                      help\u003d\"Authentication strategy (keystone or noauth)\")"},{"line_number":793,"context_line":"    parser.add_option(\u0027--limit\u0027, dest\u003d\"limit\", metavar\u003d\"LIMIT\", default\u003d10,"},{"line_number":794,"context_line":"                      type\u003d\"int\", help\u003d\"Page size to use while \""},{"line_number":795,"context_line":"                                       \"requesting image metadata\")"}],"source_content_type":"application/octet-stream","patch_set":2,"id":"AAAAEH%2F%2F%2FFs%3D","line":792,"in_reply_to":"AAAAEH%2F%2F%2FXE%3D","updated":"2012-01-24 15:55:20.000000000","message":"Interesting thought, but here\u0027s where it might go slightly awry ...\n\nSo the default pipeline on the service-side effectively corresponds to noauth (i.e. paste_deploy.flavor \u003d keystone needs to be explicitly configured).\n\nNow suppose the default were to be keystone on the client-side, and the user specifies a perfectly good auth token via bin/glance --auth_token.\n\nThen the presence of an X-Auth-Token header in the the absence of a confirmed Identity-Status is interpreted by the insecure context middleware as a not-authorized condition, see:\n\nhttps://github.com/openstack/glance/blob/master/glance/common/context.py#L112\n\nI guess the logic here is that the mis-match between the auth config on the client- and service-sides is likely to have been a mistake. \n\nHowever this rejection is likely to be highly counter-intuitive to the client user, given that they know their auth token is good, yet it\u0027s being apparently rejected by the glance API service.\n\nSo if we were to change the client-side default to keystone, I think we\u0027d need to also change the logic in ContextMiddleWare.process_request() to be tolerant of unexpected tokens (or go even further and change service-side default pipeline also).","commit_id":"27bdef70ceb0593a4004b6c2a8e60194a442c012"}],"doc/source/authentication.rst":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"2c30f716de28fa9c21d457a1f7ecfccc6a3c9dea","unresolved":false,"context_lines":[{"line_number":84,"context_line":"  OS_AUTH_URL\u003d\u003cTHIS SHOULD POINT TO KEYSTONE\u003e"},{"line_number":85,"context_line":"  OS_AUTH_STRATEGY\u003dkeystone"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Alternatively, these credentials may be specified using the following "},{"line_number":88,"context_line":"switches to the ``bin/glance`` command:"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  -I USER, --username\u003dUSER"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAEH%2F%2F%2FW4%3D","line":87,"updated":"2012-01-24 01:35:45.000000000","message":"femto-nit: trailing whitespace","commit_id":"27bdef70ceb0593a4004b6c2a8e60194a442c012"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"2c30f716de28fa9c21d457a1f7ecfccc6a3c9dea","unresolved":false,"context_lines":[{"line_number":106,"context_line":"                        Authentication token to use to identify the client to"},{"line_number":107,"context_line":"                        the glance server"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"In general the command line switch takes precedence over the corresponding"},{"line_number":110,"context_line":"OS_AUTH_* environment variable, if both are set."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAEH%2F%2F%2FW0%3D","line":109,"updated":"2012-01-24 01:35:45.000000000","message":"I would remove \"In general\" here...","commit_id":"27bdef70ceb0593a4004b6c2a8e60194a442c012"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"a9fcf4c322a49a674aa18fa4dc3885fed37d72e6","unresolved":false,"context_lines":[{"line_number":84,"context_line":"  OS_AUTH_URL\u003d\u003cTHIS SHOULD POINT TO KEYSTONE\u003e"},{"line_number":85,"context_line":"  OS_AUTH_STRATEGY\u003dkeystone"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Alternatively, these credentials may be specified using the following "},{"line_number":88,"context_line":"switches to the ``bin/glance`` command:"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"  -I USER, --username\u003dUSER"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAEH%2F%2F%2B%2BA%3D","line":87,"updated":"2012-01-24 16:56:51.000000000","message":"Can we remove the whitespace at the end of this line?","commit_id":"7d5cf91f0d2375053edc7e0f09372d86d1dd9209"}],"glance/common/auth.py":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"2c30f716de28fa9c21d457a1f7ecfccc6a3c9dea","unresolved":false,"context_lines":[{"line_number":144,"context_line":"            try:"},{"line_number":145,"context_line":"                self.management_url \u003d resp[\u0027x-server-management-url\u0027]"},{"line_number":146,"context_line":"            except KeyError:"},{"line_number":147,"context_line":"                self.management_url \u003d resp[\u0027x-glance\u0027]"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"        if resp.status in (200, 204):"},{"line_number":150,"context_line":"            try:"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAEH%2F%2F%2FWw%3D","line":147,"updated":"2012-01-24 01:35:45.000000000","message":"This should not be x-glance. This should really be X-Image-Management-Url...","commit_id":"27bdef70ceb0593a4004b6c2a8e60194a442c012"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"6b7d6256b18749b6edf66e76ab053c99f22f10d8","unresolved":false,"context_lines":[{"line_number":144,"context_line":"            try:"},{"line_number":145,"context_line":"                self.management_url \u003d resp[\u0027x-server-management-url\u0027]"},{"line_number":146,"context_line":"            except KeyError:"},{"line_number":147,"context_line":"                self.management_url \u003d resp[\u0027x-glance\u0027]"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"        if resp.status in (200, 204):"},{"line_number":150,"context_line":"            try:"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAEH%2F%2F%2FFA%3D","line":147,"in_reply_to":"AAAAEH%2F%2F%2FWw%3D","updated":"2012-01-24 15:55:20.000000000","message":"That change was motivated by noticing X-Glance is the service header mapping used by keystone with default config.\n\nIn order for X-Image-Management-Url to be used instead, looks like the follow change to keystone config is needed ...\n\netc/keystone.conf:\n service-header-mappings \u003d {\n     \u0027nova\u0027 : \u0027X-Server-Management-Url\u0027,\n+    \u0027glance\u0027 : \u0027X-Image-Management-Url\u0027,\n     \u0027swift\u0027 : \u0027X-Storage-Url\u0027,\n     \u0027cdn\u0027 : \u0027X-CDN-Management-Url\u0027}\n\nSo the X-Glance fallback was intended to address the \"out of the box\" keystone case.\n\nIn the latest patch set, I\u0027ve added X-Image-Management-Url to the headers tried (first that, then X-Server-Management-Url, before finally falling back to X-Glance).\n\nAlso I\u0027ve extended the keystone functional test support to ensure that the URL returned by keystone via the X-*-Url header contains the appropriate dynamically allocated port for the glance API service.","commit_id":"27bdef70ceb0593a4004b6c2a8e60194a442c012"}],"glance/tests/functional/test_private_images.py":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"2c30f716de28fa9c21d457a1f7ecfccc6a3c9dea","unresolved":false,"context_lines":[{"line_number":865,"context_line":"        cmd \u003d (\"bin/glance --port\u003d%d  --auth_url\u003dhttp://localhost:%d/v1.0 \""},{"line_number":866,"context_line":"               \"--auth_strategy\u003d%s --username\u003d%s --password\u003d%s \""},{"line_number":867,"context_line":"               \" add name\u003dMyImage\" % substitutions)"},{"line_number":868,"context_line":"        self._do_test_glance_cli(cmd)"},{"line_number":869,"context_line":""},{"line_number":870,"context_line":"    @skip_if_disabled"},{"line_number":871,"context_line":"    def test_glance_cli_keystone_strategy_environment(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAEH%2F%2F%2FWo%3D","line":868,"updated":"2012-01-24 01:35:45.000000000","message":"Can we verify here that the X-Image-Meta-Owner has been set to the correct user ID?","commit_id":"27bdef70ceb0593a4004b6c2a8e60194a442c012"},{"author":{"_account_id":2284,"name":"Eoghan Glynn","email":"eglynn@redhat.com","username":"eglynn"},"change_message_id":"6b7d6256b18749b6edf66e76ab053c99f22f10d8","unresolved":false,"context_lines":[{"line_number":865,"context_line":"        cmd \u003d (\"bin/glance --port\u003d%d  --auth_url\u003dhttp://localhost:%d/v1.0 \""},{"line_number":866,"context_line":"               \"--auth_strategy\u003d%s --username\u003d%s --password\u003d%s \""},{"line_number":867,"context_line":"               \" add name\u003dMyImage\" % substitutions)"},{"line_number":868,"context_line":"        self._do_test_glance_cli(cmd)"},{"line_number":869,"context_line":""},{"line_number":870,"context_line":"    @skip_if_disabled"},{"line_number":871,"context_line":"    def test_glance_cli_keystone_strategy_environment(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAEH%2F%2F%2FGU%3D","line":868,"in_reply_to":"AAAAEH%2F%2F%2FWo%3D","updated":"2012-01-24 15:55:20.000000000","message":"I think this is covered by the assertion in the _do_test_glance_cli() helper method:\n\n        self.assertEqual(response[\u0027x-image-meta-owner\u0027],\n                         keystone_utils.pattieblack_id)","commit_id":"27bdef70ceb0593a4004b6c2a8e60194a442c012"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"2c30f716de28fa9c21d457a1f7ecfccc6a3c9dea","unresolved":false,"context_lines":[{"line_number":878,"context_line":"        os.environ[\u0027OS_AUTH_USER\u0027] \u003d \u0027pattieblack\u0027"},{"line_number":879,"context_line":"        os.environ[\u0027OS_AUTH_KEY\u0027] \u003d \u0027secrete\u0027"},{"line_number":880,"context_line":"        cmd \u003d \"bin/glance --port\u003d%d add name\u003dMyImage\" % self.api_port"},{"line_number":881,"context_line":"        self._do_test_glance_cli(cmd)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAEH%2F%2F%2FWk%3D","line":881,"updated":"2012-01-24 01:35:45.000000000","message":"Can we verify here that the X-Image-Meta-Owner has been set to the correct user ID?","commit_id":"27bdef70ceb0593a4004b6c2a8e60194a442c012"}]}