)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"ee8b3af4601e4db508c6fe9eee5a26eb7183a607","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"[1] https://github.com/openstack-dev/devstack/blob/master/lib/swift#L396"},{"line_number":28,"context_line":"[2] change I6072b4efb3a479a8e0cc2d9c11ffda5764b55e30"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Change-Id: Ic9402ef35ce3dd7c905d868a9eff7db5f3a4a40b"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"da86d52c_8b39fff3","line":29,"updated":"2015-02-12 23:09:58.000000000","message":"Would probably need to add a \"DocImpact\" tag here too since this impacts the doc\n\nCan you also link this change to a bug (https://bugs.launchpad.net/keystonemiddleware/+filebug) for tracking purposes.\n\nThis might be helpful for you in terms of formatting the commit msg: https://wiki.openstack.org/wiki/GitCommitMessages#Summary_of_Git_commit_message_structure","commit_id":"d8dd30f1b7e0f64f3601657d4f3d623ba5fc6b21"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"c3fb05f160cc9d3b1af5764a5727d6117334573d","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"[1] https://github.com/openstack-dev/devstack/blob/master/lib/swift#L396"},{"line_number":28,"context_line":"[2] change I6072b4efb3a479a8e0cc2d9c11ffda5764b55e30"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"Change-Id: Ic9402ef35ce3dd7c905d868a9eff7db5f3a4a40b"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"da86d52c_849a73c3","line":29,"in_reply_to":"da86d52c_8b39fff3","updated":"2015-02-16 15:08:34.000000000","message":"Done","commit_id":"d8dd30f1b7e0f64f3601657d4f3d623ba5fc6b21"}],"keystonemiddleware/auth_token.py":[{"author":{"_account_id":9101,"name":"wanghong","email":"reviewwanghong@126.com","username":"wanghong"},"change_message_id":"3ece16decbe1ef26ef5474ef81ec0a0d470cb5d7","unresolved":false,"context_lines":[{"line_number":813,"context_line":"                    self._LOG.info("},{"line_number":814,"context_line":"                        _LI(\u0027Invalid service token - deferring reject \u0027"},{"line_number":815,"context_line":"                            \u0027downstream\u0027))"},{"line_number":816,"context_line":"                    self._add_headers(env, {\u0027X-Identity-Status\u0027: \u0027Invalid\u0027})"},{"line_number":817,"context_line":"                else:"},{"line_number":818,"context_line":"                    self._LOG.info("},{"line_number":819,"context_line":"                        _LI(\u0027Invalid service token - rejecting request\u0027))"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_37524467","line":816,"updated":"2015-02-06 02:10:21.000000000","message":"I think we should add another header, because user_token and service_token both use X-Identity-Status header and they may be conflict.","commit_id":"9c4fb1a2c1bca6d0ac9282d2cd1268a4171a99b9"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"e9fb1009ef9ab58691e3877befaf7fcc9888017b","unresolved":false,"context_lines":[{"line_number":813,"context_line":"                    self._LOG.info("},{"line_number":814,"context_line":"                        _LI(\u0027Invalid service token - deferring reject \u0027"},{"line_number":815,"context_line":"                            \u0027downstream\u0027))"},{"line_number":816,"context_line":"                    self._add_headers(env, {\u0027X-Identity-Status\u0027: \u0027Invalid\u0027})"},{"line_number":817,"context_line":"                else:"},{"line_number":818,"context_line":"                    self._LOG.info("},{"line_number":819,"context_line":"                        _LI(\u0027Invalid service token - rejecting request\u0027))"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_ab7083a4","line":816,"in_reply_to":"da86d52c_37524467","updated":"2015-02-06 09:34:09.000000000","message":"I\u0027m not sure if you mean add another header here *in addition to* X-Identity-Status, or add a different header instead of X-Identity-Status.\n\nIf we do not set X-Identity-Status \u003d Invalid here then a request with a valid user token but invalid service token will result in X-Identity-Status \u003d Confirmed. That results in a different outcome when keystone *is* the auth middleware: currently that request is rejected outright, but if it is forwarded with X-Identity-Status \u003d Confirmed then (in the case of swift keystoneauth at least) the request may be allowed.\n\nSo, if the intention is for a keystone auth system (combination of authtoken and keystoneauth middleware) to reject any request with an invalid service token, then we must set \u0027X-Identity-Status\u0027: \u0027Invalid\u0027 (or require every downstream keystone auth to be modified to check a new header for service token validity and reject accordingly).\n\nIf it is ok to change the contract so that a request with an invalid service token (that *is* intended for a keystone auth system) may still be allowed if the valid user identity is sufficient, then I agree that we could use an alternative here such as \u0027X-Service-Identity-Status\u0027.\n\n\nThoughts?","commit_id":"9c4fb1a2c1bca6d0ac9282d2cd1268a4171a99b9"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"f168ea8c78d4e31b498f4e32426b590c12b74047","unresolved":false,"context_lines":[{"line_number":813,"context_line":"                    self._LOG.info("},{"line_number":814,"context_line":"                        _LI(\u0027Invalid service token - deferring reject \u0027"},{"line_number":815,"context_line":"                            \u0027downstream\u0027))"},{"line_number":816,"context_line":"                    self._add_headers(env, {\u0027X-Identity-Status\u0027: \u0027Invalid\u0027})"},{"line_number":817,"context_line":"                else:"},{"line_number":818,"context_line":"                    self._LOG.info("},{"line_number":819,"context_line":"                        _LI(\u0027Invalid service token - rejecting request\u0027))"}],"source_content_type":"text/x-python","patch_set":1,"id":"da86d52c_71375eff","line":816,"in_reply_to":"da86d52c_ab7083a4","updated":"2015-02-06 14:48:18.000000000","message":"\u003e If it is ok to change the contract...\n\nChecking the original spec, there is no mention of this level of detail, so we need to look at the comments at the top of this file. Looking at that contract, it looks to me that X-Service-Identity-Status is symmetrical with the other headers.\n\nIn addition, looking at how services handle X-Identity-Status, it appears to be used to identity whether this the user is anonymous or not. X-Auth-Token tells us *who* (the user_id) is making the request. If the X-Service-Token happens to be invalid, the id of the person making the request is not invalidated -- the request is *not* anonymous. Hence, I don\u0027t think it\u0027s right to set X-Identity-Status to Invalid, but instead, set X-Service-Identity to Invalid.","commit_id":"9c4fb1a2c1bca6d0ac9282d2cd1268a4171a99b9"},{"author":{"_account_id":9101,"name":"wanghong","email":"reviewwanghong@126.com","username":"wanghong"},"change_message_id":"d2f2aeb507decb48cc48aa67db0844e841c0397e","unresolved":false,"context_lines":[{"line_number":838,"context_line":""},{"line_number":839,"context_line":"        Both user and service token headers are generated."},{"line_number":840,"context_line":"        \"\"\""},{"line_number":841,"context_line":"        auth_headers \u003d [\u0027X-Service-Catalog\u0027,"},{"line_number":842,"context_line":"                        \u0027X-Identity-Status\u0027,"},{"line_number":843,"context_line":"                        \u0027X-Roles\u0027,"},{"line_number":844,"context_line":"                        \u0027X-Service-Roles\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"da86d52c_f7a88322","line":841,"updated":"2015-02-07 01:57:16.000000000","message":"I think we\u0027d better add \u0027X-Service-Identity-Status\u0027 here too.","commit_id":"cdd8711c82c12fc82dbd928b7e83794273b420fd"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"36ef5c49606a6cdba8e82198ffd406b1fb847e2c","unresolved":false,"context_lines":[{"line_number":838,"context_line":""},{"line_number":839,"context_line":"        Both user and service token headers are generated."},{"line_number":840,"context_line":"        \"\"\""},{"line_number":841,"context_line":"        auth_headers \u003d [\u0027X-Service-Catalog\u0027,"},{"line_number":842,"context_line":"                        \u0027X-Identity-Status\u0027,"},{"line_number":843,"context_line":"                        \u0027X-Roles\u0027,"},{"line_number":844,"context_line":"                        \u0027X-Service-Roles\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"da86d52c_26a9067c","line":841,"in_reply_to":"da86d52c_f7a88322","updated":"2015-02-07 15:42:22.000000000","message":"Done","commit_id":"cdd8711c82c12fc82dbd928b7e83794273b420fd"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d34f7c35fd3d80db5675ddf8554d83d13f06e35c","unresolved":false,"context_lines":[{"line_number":74,"context_line":"    The underlying service will only see a value of \u0027Invalid\u0027 if the Middleware"},{"line_number":75,"context_line":"    is configured to run in \u0027delay_auth_decision\u0027 mode. As with all such"},{"line_number":76,"context_line":"    headers, HTTP_X_SERVICE_IDENTITY_STATUS will only exist in the"},{"line_number":77,"context_line":"    environment is a service token is presented. This is different than"},{"line_number":78,"context_line":"    HTTP_X_IDENTITY_STATUS which is always set even if no user token is"},{"line_number":79,"context_line":"    presented. This allows the underlying service to determine if a"},{"line_number":80,"context_line":"    denial should use 401 or 403."}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_16480b5b","line":77,"updated":"2015-02-12 00:47:08.000000000","message":"typo: \"environment is a\" to \"environment where a\"?","commit_id":"dceaa55f45b85eaa375c974d0f872c003bea5325"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"7542346c08ea8db469c91cf465da874cebdd4d27","unresolved":false,"context_lines":[{"line_number":74,"context_line":"    The underlying service will only see a value of \u0027Invalid\u0027 if the Middleware"},{"line_number":75,"context_line":"    is configured to run in \u0027delay_auth_decision\u0027 mode. As with all such"},{"line_number":76,"context_line":"    headers, HTTP_X_SERVICE_IDENTITY_STATUS will only exist in the"},{"line_number":77,"context_line":"    environment is a service token is presented. This is different than"},{"line_number":78,"context_line":"    HTTP_X_IDENTITY_STATUS which is always set even if no user token is"},{"line_number":79,"context_line":"    presented. This allows the underlying service to determine if a"},{"line_number":80,"context_line":"    denial should use 401 or 403."}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_eb035c3f","line":77,"in_reply_to":"da86d52c_16480b5b","updated":"2015-02-12 22:43:49.000000000","message":"Done","commit_id":"dceaa55f45b85eaa375c974d0f872c003bea5325"}],"keystonemiddleware/auth_token/__init__.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a7216365ee64cb62dd90ccefd34b935894e0a741","unresolved":false,"context_lines":[{"line_number":77,"context_line":"    environment if a service token is presented. This is different than"},{"line_number":78,"context_line":"    HTTP_X_IDENTITY_STATUS which is always set even if no user token is"},{"line_number":79,"context_line":"    presented. This allows the underlying service to determine if a"},{"line_number":80,"context_line":"    denial should use 401 or 403."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"HTTP_X_DOMAIN_ID, HTTP_X_SERVICE_DOMAIN_ID"},{"line_number":83,"context_line":"    Identity service managed unique identifier, string. Only present if"}],"source_content_type":"text/x-python","patch_set":10,"id":"9a80dd14_7462283f","line":80,"updated":"2015-03-08 17:17:37.000000000","message":"According to the HTTP 1.1 spec a 401 shouldn\u0027t be returned unless the client can re-request with a suitable Authorization header field, and since auth_token doesn\u0027t use the Authorization header field, it\u0027s not appropriate to return a 401. Services should be responding with 403.","commit_id":"c682b07a4f7ce8d66dbee9976582edf0bc3ff2c6"}]}