)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b948e433fb00ecabf7f4fc79f755e6c4fadb4ac0","unresolved":false,"context_lines":[{"line_number":10,"context_line":"in Keystonemiddleware within auth_token middleware."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Co-Authored-By: David Charles Kennedy \u003cdavid.c.kennedy@hp.com\u003e"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Iad486f28455b63a5ce216595b9c184cf33d104ea"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"7aaa499b_ea0889db","line":13,"updated":"2015-04-14 11:26:43.000000000","message":"is their a bp for this new functionality?  A spec?","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"208fb75bf6cb6c59aa1a42cddb1c7241f1b54d26","unresolved":false,"context_lines":[{"line_number":10,"context_line":"in Keystonemiddleware within auth_token middleware."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Co-Authored-By: David Charles Kennedy \u003cdavid.c.kennedy@hp.com\u003e"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Iad486f28455b63a5ce216595b9c184cf33d104ea"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"7aaa499b_30edb7ef","line":13,"in_reply_to":"7aaa499b_ea0889db","updated":"2015-04-14 16:05:23.000000000","message":"Bob put together this spec: http://specs.openstack.org/openstack/keystone-specs/specs/keystonemiddleware/endpoint-enforcement-middleware\n\nI\u0027ll add that to the commit message.","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"45a6cc3a8c55da1d45895e21ec19eabde0d7f472","unresolved":false,"context_lines":[{"line_number":10,"context_line":"in Keystonemiddleware within auth_token middleware."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Co-Authored-By: David Charles Kennedy \u003cdavid.c.kennedy@hp.com\u003e"},{"line_number":13,"context_line":"Implements: http://specs.openstack.org/openstack/keystone-specs/specs/keystonemiddleware/endpoint-enforcement-middleware"},{"line_number":14,"context_line":"Change-Id: Iad486f28455b63a5ce216595b9c184cf33d104ea"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"dac4157f_c3935e4e","line":13,"updated":"2015-04-21 20:40:20.000000000","message":"you don\u0027t need the full url here, just \n\nImplements: endpoint-enforcement-middleware","commit_id":"ef9e0b2e08865780935bafa792e8c47a152be729"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"15bfe70456842d1a5d88f8ec744d3b2d02460584","unresolved":false,"context_lines":[{"line_number":10,"context_line":"in Keystonemiddleware within auth_token middleware."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Co-Authored-By: David Charles Kennedy \u003cdavid.c.kennedy@hp.com\u003e"},{"line_number":13,"context_line":"Implements: http://specs.openstack.org/openstack/keystone-specs/specs/keystonemiddleware/endpoint-enforcement-middleware"},{"line_number":14,"context_line":"Change-Id: Iad486f28455b63a5ce216595b9c184cf33d104ea"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"dac4157f_da4fafbb","line":13,"in_reply_to":"dac4157f_c3935e4e","updated":"2015-04-22 09:14:25.000000000","message":"OK, thanks for the hint.  Done.","commit_id":"ef9e0b2e08865780935bafa792e8c47a152be729"}],"keystonemiddleware/auth_token.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"a1ffc920d5bbaca13ea720b8d25c4e6c2375d1f6","unresolved":false,"context_lines":[{"line_number":353,"context_line":"                help\u003d\u0027(Optional) Indicate whether to enforce endpoint\u0027"},{"line_number":354,"context_line":"                \u0027 enforcement. If True, middleware will check endpont_id and\u0027"},{"line_number":355,"context_line":"                \u0027 service_id appear in service catalog. If True and there is\u0027"},{"line_number":356,"context_line":"                \u0027 no service catalog then an InvalidToken exception is raised.\u0027"},{"line_number":357,"context_line":"                \u0027 If True and endpoint_id and service_id are not found in\u0027"},{"line_number":358,"context_line":"                \u0027 service catalog then an InvalidToken exception is raised.\u0027),"},{"line_number":359,"context_line":"    cfg.StrOpt(\u0027endpoint_id\u0027,"}],"source_content_type":"text/x-python","patch_set":3,"id":"da86d52c_f110ae4f","line":356,"updated":"2015-02-06 10:28:28.000000000","message":"In the case there is no service catalog in the token AuthToken should be querying keystone for the SC. This case should only happen (currently) with an unscoped token.\n\nThe extra query to keystone for an SC *may* already happen, I need to look.","commit_id":"a573c0232de6a11ec00762db9b4e0e2cff09c6ae"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"2ad45457c37ea893d2e3269db793eabf330adac0","unresolved":false,"context_lines":[{"line_number":353,"context_line":"                help\u003d\u0027(Optional) Indicate whether to enforce endpoint\u0027"},{"line_number":354,"context_line":"                \u0027 enforcement. If True, middleware will check endpont_id and\u0027"},{"line_number":355,"context_line":"                \u0027 service_id appear in service catalog. If True and there is\u0027"},{"line_number":356,"context_line":"                \u0027 no service catalog then an InvalidToken exception is raised.\u0027"},{"line_number":357,"context_line":"                \u0027 If True and endpoint_id and service_id are not found in\u0027"},{"line_number":358,"context_line":"                \u0027 service catalog then an InvalidToken exception is raised.\u0027),"},{"line_number":359,"context_line":"    cfg.StrOpt(\u0027endpoint_id\u0027,"}],"source_content_type":"text/x-python","patch_set":3,"id":"da86d52c_ff4819b5","line":356,"in_reply_to":"da86d52c_f110ae4f","updated":"2015-02-09 23:30:52.000000000","message":"Currently if there is no service catalog, keystone middleware won\u0027t perform the query to keystone to get the SC. I\u0027ll aim to add this logic into the change for endpoint enforcement.","commit_id":"a573c0232de6a11ec00762db9b4e0e2cff09c6ae"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"a1ffc920d5bbaca13ea720b8d25c4e6c2375d1f6","unresolved":false,"context_lines":[{"line_number":818,"context_line":"                if self._delay_auth_decision:"},{"line_number":819,"context_line":"                    self._LOG.info("},{"line_number":820,"context_line":"                        _LI(\u0027Invalid user token - deferring reject \u0027"},{"line_number":821,"context_line":"                            \u0027downstream\u0027))"},{"line_number":822,"context_line":"                    self._add_headers(env, {\u0027X-Identity-Status\u0027: \u0027Invalid\u0027})"},{"line_number":823,"context_line":"                else:"},{"line_number":824,"context_line":"                    self._LOG.info("}],"source_content_type":"text/x-python","patch_set":3,"id":"da86d52c_b1a7160a","line":821,"updated":"2015-02-06 10:28:28.000000000","message":"delay_auth_decision It should clarify [docs] that with delay_auth_decision X-Identity-Status will be invalid, but the request will still go through as normal if the endpoint isn\u0027t in the catalog and the enforcement is turned on.","commit_id":"a573c0232de6a11ec00762db9b4e0e2cff09c6ae"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"2ad45457c37ea893d2e3269db793eabf330adac0","unresolved":false,"context_lines":[{"line_number":818,"context_line":"                if self._delay_auth_decision:"},{"line_number":819,"context_line":"                    self._LOG.info("},{"line_number":820,"context_line":"                        _LI(\u0027Invalid user token - deferring reject \u0027"},{"line_number":821,"context_line":"                            \u0027downstream\u0027))"},{"line_number":822,"context_line":"                    self._add_headers(env, {\u0027X-Identity-Status\u0027: \u0027Invalid\u0027})"},{"line_number":823,"context_line":"                else:"},{"line_number":824,"context_line":"                    self._LOG.info("}],"source_content_type":"text/x-python","patch_set":3,"id":"da86d52c_7f7fc966","line":821,"in_reply_to":"da86d52c_b1a7160a","updated":"2015-02-09 23:30:52.000000000","message":"Added an extra test to cover this use case.","commit_id":"a573c0232de6a11ec00762db9b4e0e2cff09c6ae"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"01b0ada4826d9715f35043e27303da4ffdc48459","unresolved":false,"context_lines":[{"line_number":348,"context_line":"                \u0027 only while migrating from a less secure algorithm to a more\u0027"},{"line_number":349,"context_line":"                \u0027 secure one. Once all the old tokens are expired this option\u0027"},{"line_number":350,"context_line":"                \u0027 should be set to a single value for better performance.\u0027),"},{"line_number":351,"context_line":"    cfg.BoolOpt(\u0027enforce_endpoint_in_authz\u0027,"},{"line_number":352,"context_line":"                default\u003dFalse,"},{"line_number":353,"context_line":"                help\u003d\u0027(Optional) Indicate whether to enforce endpoint\u0027"},{"line_number":354,"context_line":"                \u0027 enforcement. If True, middleware will check endpont_id and\u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_9339d6da","line":351,"updated":"2015-02-10 01:19:00.000000000","message":"enforce_endpoint_constraint?","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"caaa8575c3249aa7c54fb089a253b6912ef647b1","unresolved":false,"context_lines":[{"line_number":348,"context_line":"                \u0027 only while migrating from a less secure algorithm to a more\u0027"},{"line_number":349,"context_line":"                \u0027 secure one. Once all the old tokens are expired this option\u0027"},{"line_number":350,"context_line":"                \u0027 should be set to a single value for better performance.\u0027),"},{"line_number":351,"context_line":"    cfg.BoolOpt(\u0027enforce_endpoint_in_authz\u0027,"},{"line_number":352,"context_line":"                default\u003dFalse,"},{"line_number":353,"context_line":"                help\u003d\u0027(Optional) Indicate whether to enforce endpoint\u0027"},{"line_number":354,"context_line":"                \u0027 enforcement. If True, middleware will check endpont_id and\u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_637fd517","line":351,"in_reply_to":"da86d52c_9339d6da","updated":"2015-02-11 23:17:31.000000000","message":"Done","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"01b0ada4826d9715f35043e27303da4ffdc48459","unresolved":false,"context_lines":[{"line_number":365,"context_line":"               default\u003dNone,"},{"line_number":366,"context_line":"               help\u003d\u0027(Optional) Indicate the service_id of the current\u0027"},{"line_number":367,"context_line":"               \u0027service. If enforce_endpoint_in_authz is enabled then this\u0027"},{"line_number":368,"context_line":"               \u0027value must be specified.\u0027),"},{"line_number":369,"context_line":"]"},{"line_number":370,"context_line":""},{"line_number":371,"context_line":"_AUTHTOKEN_GROUP \u003d \u0027keystone_authtoken\u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_8815214b","line":368,"updated":"2015-02-10 01:19:00.000000000","message":"endpoint_id and service_id here are mutually exclusive right? Otherwise, I don\u0027t see any reason to require a service_id.","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"caaa8575c3249aa7c54fb089a253b6912ef647b1","unresolved":false,"context_lines":[{"line_number":365,"context_line":"               default\u003dNone,"},{"line_number":366,"context_line":"               help\u003d\u0027(Optional) Indicate the service_id of the current\u0027"},{"line_number":367,"context_line":"               \u0027service. If enforce_endpoint_in_authz is enabled then this\u0027"},{"line_number":368,"context_line":"               \u0027value must be specified.\u0027),"},{"line_number":369,"context_line":"]"},{"line_number":370,"context_line":""},{"line_number":371,"context_line":"_AUTHTOKEN_GROUP \u003d \u0027keystone_authtoken\u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_d3a79cbb","line":368,"in_reply_to":"da86d52c_21ed2bb8","updated":"2015-02-11 23:17:31.000000000","message":"The boolean is more for readability and to have the ability to quickly turn off/on the feature.","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"caaa8575c3249aa7c54fb089a253b6912ef647b1","unresolved":false,"context_lines":[{"line_number":365,"context_line":"               default\u003dNone,"},{"line_number":366,"context_line":"               help\u003d\u0027(Optional) Indicate the service_id of the current\u0027"},{"line_number":367,"context_line":"               \u0027service. If enforce_endpoint_in_authz is enabled then this\u0027"},{"line_number":368,"context_line":"               \u0027value must be specified.\u0027),"},{"line_number":369,"context_line":"]"},{"line_number":370,"context_line":""},{"line_number":371,"context_line":"_AUTHTOKEN_GROUP \u003d \u0027keystone_authtoken\u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_287883c3","line":368,"in_reply_to":"da86d52c_8815214b","updated":"2015-02-11 23:17:31.000000000","message":"My original assumption was that we want to match both service_id and endpoint_id and therefore the two parameters are not mutually exclusive. Plus having the service_id avoids us having to traverse the complete catalog. However, it makes sense to have the option to enforce by just service_id. In other words, if service_id is defined and not endpoint_id then we match solely for service. I will make this change. In addition, if service_id is not defined but endpoint_id is then I will traverse the complete catalog looking for the target id.\n\nEven better would be to provide the option to support filters (e.g. enforce based on region id, interface, endpoint id, service id or a set of one or more of such constraints).","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"39d9eed7806728fb9a77d361b83b9c008da7fcde","unresolved":false,"context_lines":[{"line_number":365,"context_line":"               default\u003dNone,"},{"line_number":366,"context_line":"               help\u003d\u0027(Optional) Indicate the service_id of the current\u0027"},{"line_number":367,"context_line":"               \u0027service. If enforce_endpoint_in_authz is enabled then this\u0027"},{"line_number":368,"context_line":"               \u0027value must be specified.\u0027),"},{"line_number":369,"context_line":"]"},{"line_number":370,"context_line":""},{"line_number":371,"context_line":"_AUTHTOKEN_GROUP \u003d \u0027keystone_authtoken\u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_21ed2bb8","line":368,"in_reply_to":"da86d52c_8815214b","updated":"2015-02-10 04:41:36.000000000","message":"do we need all 3 of these? Why not just have enforce_endpoint_id and enforce_service_id, if these are not None then you should enforce. \n\nI don\u0027t see the reason to be able to turn on enforcement but not set any values.\n\nAlso you might just want to confirm that service_id is actually in the catalog - it was then it wasn\u0027t, then i think we added it again.... can\u0027t remember. Because it might be easier/sufficient to enable testing service_name or more likely service_type here.","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"01b0ada4826d9715f35043e27303da4ffdc48459","unresolved":false,"context_lines":[{"line_number":1000,"context_line":"            self._LOG.warn(_LW(\u0027Authorization failed for token\u0027))"},{"line_number":1001,"context_line":"            raise InvalidToken(_(\u0027Token authorization failed\u0027))"},{"line_number":1002,"context_line":""},{"line_number":1003,"context_line":"    def _enforce_endpoint(self, auth_ref):"},{"line_number":1004,"context_line":"        \"\"\"Optional endpoint enforcement check"},{"line_number":1005,"context_line":""},{"line_number":1006,"context_line":"        :param token: token id"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_f35cd21b","line":1003,"updated":"2015-02-10 01:19:00.000000000","message":"_enforce_endpoint_constraint?","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"caaa8575c3249aa7c54fb089a253b6912ef647b1","unresolved":false,"context_lines":[{"line_number":1000,"context_line":"            self._LOG.warn(_LW(\u0027Authorization failed for token\u0027))"},{"line_number":1001,"context_line":"            raise InvalidToken(_(\u0027Token authorization failed\u0027))"},{"line_number":1002,"context_line":""},{"line_number":1003,"context_line":"    def _enforce_endpoint(self, auth_ref):"},{"line_number":1004,"context_line":"        \"\"\"Optional endpoint enforcement check"},{"line_number":1005,"context_line":""},{"line_number":1006,"context_line":"        :param token: token id"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_630c35ed","line":1003,"in_reply_to":"da86d52c_f35cd21b","updated":"2015-02-11 23:17:31.000000000","message":"Done","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"01b0ada4826d9715f35043e27303da4ffdc48459","unresolved":false,"context_lines":[{"line_number":1010,"context_line":"        \"\"\""},{"line_number":1011,"context_line":"        # Check endpoint enforcement enabled"},{"line_number":1012,"context_line":"        if self._enforce_endpoint_in_authz is True:"},{"line_number":1013,"context_line":"            endpoint_found \u003d False"},{"line_number":1014,"context_line":""},{"line_number":1015,"context_line":"            if (self._include_service_catalog and"},{"line_number":1016,"context_line":"                    auth_ref.has_service_catalog()):"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_93ae36e6","line":1013,"updated":"2015-02-10 01:19:00.000000000","message":"do check it here, check it prior to calling this method","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"caaa8575c3249aa7c54fb089a253b6912ef647b1","unresolved":false,"context_lines":[{"line_number":1010,"context_line":"        \"\"\""},{"line_number":1011,"context_line":"        # Check endpoint enforcement enabled"},{"line_number":1012,"context_line":"        if self._enforce_endpoint_in_authz is True:"},{"line_number":1013,"context_line":"            endpoint_found \u003d False"},{"line_number":1014,"context_line":""},{"line_number":1015,"context_line":"            if (self._include_service_catalog and"},{"line_number":1016,"context_line":"                    auth_ref.has_service_catalog()):"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_036619bb","line":1013,"in_reply_to":"da86d52c_93ae36e6","updated":"2015-02-11 23:17:31.000000000","message":"Done","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"01b0ada4826d9715f35043e27303da4ffdc48459","unresolved":false,"context_lines":[{"line_number":1018,"context_line":"                endpoint_found \u003d self._find_endpoint(catalog)"},{"line_number":1019,"context_line":"            else:"},{"line_number":1020,"context_line":"                self._LOG.warn(_LW(\u0027Authorization failed for token because\u0027"},{"line_number":1021,"context_line":"                                   \u0027 no service catalog\u0027))"},{"line_number":1022,"context_line":""},{"line_number":1023,"context_line":"            if not endpoint_found:"},{"line_number":1024,"context_line":"                self._LOG.warn(_LW(\u0027Token authorization failed\u0027))"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_f38a1263","line":1021,"updated":"2015-02-10 01:19:00.000000000","message":"\u0027Unable to enforce endpoint constraint because service_catalog not found in token data\u0027","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"caaa8575c3249aa7c54fb089a253b6912ef647b1","unresolved":false,"context_lines":[{"line_number":1018,"context_line":"                endpoint_found \u003d self._find_endpoint(catalog)"},{"line_number":1019,"context_line":"            else:"},{"line_number":1020,"context_line":"                self._LOG.warn(_LW(\u0027Authorization failed for token because\u0027"},{"line_number":1021,"context_line":"                                   \u0027 no service catalog\u0027))"},{"line_number":1022,"context_line":""},{"line_number":1023,"context_line":"            if not endpoint_found:"},{"line_number":1024,"context_line":"                self._LOG.warn(_LW(\u0027Token authorization failed\u0027))"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_83112906","line":1021,"in_reply_to":"da86d52c_f38a1263","updated":"2015-02-11 23:17:31.000000000","message":"Done","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"39d9eed7806728fb9a77d361b83b9c008da7fcde","unresolved":false,"context_lines":[{"line_number":1035,"context_line":"                endpoints \u003d service[\u0027endpoints\u0027]"},{"line_number":1036,"context_line":"                for endpoint in endpoints:"},{"line_number":1037,"context_line":"                    if endpoint[\u0027id\u0027] \u003d\u003d self._endpoint_id:"},{"line_number":1038,"context_line":"                        return True"},{"line_number":1039,"context_line":"        return False"},{"line_number":1040,"context_line":""},{"line_number":1041,"context_line":"    def _build_user_headers(self, auth_ref, token_info):"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_6115639a","line":1038,"updated":"2015-02-10 04:41:36.000000000","message":"Agree with gyee from above having read this. endpoint_id will be unique and a member of only one service. You shouldn\u0027t need to specify both pieces.\n\nAlso from a style point of view, this feels like it could be a generator and use endpoint in catalog_endpoints(catalog)","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"caaa8575c3249aa7c54fb089a253b6912ef647b1","unresolved":false,"context_lines":[{"line_number":1035,"context_line":"                endpoints \u003d service[\u0027endpoints\u0027]"},{"line_number":1036,"context_line":"                for endpoint in endpoints:"},{"line_number":1037,"context_line":"                    if endpoint[\u0027id\u0027] \u003d\u003d self._endpoint_id:"},{"line_number":1038,"context_line":"                        return True"},{"line_number":1039,"context_line":"        return False"},{"line_number":1040,"context_line":""},{"line_number":1041,"context_line":"    def _build_user_headers(self, auth_ref, token_info):"}],"source_content_type":"text/x-python","patch_set":4,"id":"da86d52c_22906dec","line":1038,"in_reply_to":"da86d52c_6115639a","updated":"2015-02-11 23:17:31.000000000","message":"See discussion above.","commit_id":"30f7e525aa0870f91adb69cd69433a70584f6d90"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c545ec1c6224ac838a0fdb83dacb310bb0ef22b4","unresolved":false,"context_lines":[{"line_number":356,"context_line":"                \u0027 no service catalog then an InvalidToken exception is raised.\u0027"},{"line_number":357,"context_line":"                \u0027 If True and endpoint_id and service_id are not found in\u0027"},{"line_number":358,"context_line":"                \u0027 service catalog then an InvalidToken exception is raised.\u0027),"},{"line_number":359,"context_line":"    cfg.StrOpt(\u0027endpoint_id\u0027,"},{"line_number":360,"context_line":"               default\u003dNone,"},{"line_number":361,"context_line":"               help\u003d\u0027(Optional) Indicate the endpoint_id of the current\u0027"},{"line_number":362,"context_line":"               \u0027service. If enforce_endpoint_constraint is enabled then this\u0027"}],"source_content_type":"text/x-python","patch_set":5,"id":"da86d52c_e162ce3c","line":359,"updated":"2015-02-12 02:33:18.000000000","message":"Would there be a case where a list for endpoint_id/service_id be useful?","commit_id":"5edb93cb6d115c21d8bdcb49cce807609f7f7734"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"2ad968c416fbc836d9f8051525d5616c570aa180","unresolved":false,"context_lines":[{"line_number":356,"context_line":"                \u0027 no service catalog then an InvalidToken exception is raised.\u0027"},{"line_number":357,"context_line":"                \u0027 If True and endpoint_id and service_id are not found in\u0027"},{"line_number":358,"context_line":"                \u0027 service catalog then an InvalidToken exception is raised.\u0027),"},{"line_number":359,"context_line":"    cfg.StrOpt(\u0027endpoint_id\u0027,"},{"line_number":360,"context_line":"               default\u003dNone,"},{"line_number":361,"context_line":"               help\u003d\u0027(Optional) Indicate the endpoint_id of the current\u0027"},{"line_number":362,"context_line":"               \u0027service. If enforce_endpoint_constraint is enabled then this\u0027"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba7be1f8_b6db4a1a","line":359,"in_reply_to":"da86d52c_e162ce3c","updated":"2015-02-20 23:01:14.000000000","message":"Certainly I could see a use case for access being granted for services in a given region or interface type, perhaps. Regarding a list of endpoint/service ids, I\u0027m not sold on the requirement. Do you have an example use case?","commit_id":"5edb93cb6d115c21d8bdcb49cce807609f7f7734"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c545ec1c6224ac838a0fdb83dacb310bb0ef22b4","unresolved":false,"context_lines":[{"line_number":1168,"context_line":"        \"\"\"Optional endpoint enforcement check"},{"line_number":1169,"context_line":""},{"line_number":1170,"context_line":"        :param token: token id"},{"line_number":1171,"context_line":"        :param env: wsgi environment"},{"line_number":1172,"context_line":"        :raises InvalidToken: if token is rejected"},{"line_number":1173,"context_line":""},{"line_number":1174,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":5,"id":"da86d52c_e12d6eff","line":1171,"updated":"2015-02-12 02:33:18.000000000","message":"Doc param doesn\u0027t match the method argument","commit_id":"5edb93cb6d115c21d8bdcb49cce807609f7f7734"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"2ad968c416fbc836d9f8051525d5616c570aa180","unresolved":false,"context_lines":[{"line_number":1168,"context_line":"        \"\"\"Optional endpoint enforcement check"},{"line_number":1169,"context_line":""},{"line_number":1170,"context_line":"        :param token: token id"},{"line_number":1171,"context_line":"        :param env: wsgi environment"},{"line_number":1172,"context_line":"        :raises InvalidToken: if token is rejected"},{"line_number":1173,"context_line":""},{"line_number":1174,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":5,"id":"da86d52c_824a2bab","line":1171,"in_reply_to":"da86d52c_e12d6eff","updated":"2015-02-20 23:01:14.000000000","message":"Done","commit_id":"5edb93cb6d115c21d8bdcb49cce807609f7f7734"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c545ec1c6224ac838a0fdb83dacb310bb0ef22b4","unresolved":false,"context_lines":[{"line_number":1197,"context_line":"        enforce_endpoint \u003d self._endpoint_id is not None"},{"line_number":1198,"context_line":"        for service in catalog:"},{"line_number":1199,"context_line":"            # Find matching service"},{"line_number":1200,"context_line":"            if enforce_service and service[\u0027id\u0027] \u003d\u003d self._service_id:"},{"line_number":1201,"context_line":"                if self._endpoint_id is None:"},{"line_number":1202,"context_line":"                    return True"},{"line_number":1203,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"da86d52c_2143066d","line":1200,"updated":"2015-02-12 02:33:18.000000000","message":"This logic only works with V3 service catalog,  V2 doesn\u0027t have service id\n\nhttp://docs.openstack.org/api/openstack-identity-service/2.0/content/Request_Response_Types-d1e459.html","commit_id":"5edb93cb6d115c21d8bdcb49cce807609f7f7734"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"2ad968c416fbc836d9f8051525d5616c570aa180","unresolved":false,"context_lines":[{"line_number":1197,"context_line":"        enforce_endpoint \u003d self._endpoint_id is not None"},{"line_number":1198,"context_line":"        for service in catalog:"},{"line_number":1199,"context_line":"            # Find matching service"},{"line_number":1200,"context_line":"            if enforce_service and service[\u0027id\u0027] \u003d\u003d self._service_id:"},{"line_number":1201,"context_line":"                if self._endpoint_id is None:"},{"line_number":1202,"context_line":"                    return True"},{"line_number":1203,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"ba7be1f8_36cbdaa6","line":1200,"in_reply_to":"da86d52c_2143066d","updated":"2015-02-20 23:01:14.000000000","message":"V3 is our focus and I\u0027ve updated the logic to validate service[\u0027id\u0027] exists.","commit_id":"5edb93cb6d115c21d8bdcb49cce807609f7f7734"}],"keystonemiddleware/auth_token/__init__.py":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9b115cf98863afe9301cca76e6216f8ce47317ff","unresolved":false,"context_lines":[{"line_number":350,"context_line":"                \u0027 should be set to a single value for better performance.\u0027),"},{"line_number":351,"context_line":"    cfg.BoolOpt(\u0027enforce_endpoint_constraint\u0027,"},{"line_number":352,"context_line":"                default\u003dFalse,"},{"line_number":353,"context_line":"                help\u003d\u0027(Optional) Indicate whether to enforce endpoint\u0027"},{"line_number":354,"context_line":"                \u0027 enforcement. If True, middleware will check service_id\u0027"},{"line_number":355,"context_line":"                \u0027 and/or endpoint_id appear in service catalog. If True\u0027"},{"line_number":356,"context_line":"                \u0027 and there is no service catalog then an InvalidToken\u0027"}],"source_content_type":"text/x-python","patch_set":6,"id":"ba7be1f8_b8005302","line":353,"updated":"2015-02-24 07:14:08.000000000","message":"Indicate whether to enforce endpoint constraint.","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"37d5358d926cdfc76b86647fa2848f7d31509826","unresolved":false,"context_lines":[{"line_number":350,"context_line":"                \u0027 should be set to a single value for better performance.\u0027),"},{"line_number":351,"context_line":"    cfg.BoolOpt(\u0027enforce_endpoint_constraint\u0027,"},{"line_number":352,"context_line":"                default\u003dFalse,"},{"line_number":353,"context_line":"                help\u003d\u0027(Optional) Indicate whether to enforce endpoint\u0027"},{"line_number":354,"context_line":"                \u0027 enforcement. If True, middleware will check service_id\u0027"},{"line_number":355,"context_line":"                \u0027 and/or endpoint_id appear in service catalog. If True\u0027"},{"line_number":356,"context_line":"                \u0027 and there is no service catalog then an InvalidToken\u0027"}],"source_content_type":"text/x-python","patch_set":6,"id":"ba7be1f8_b623adbb","line":353,"in_reply_to":"ba7be1f8_b8005302","updated":"2015-03-12 23:19:44.000000000","message":"Done","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"b1ab7a9227e60afc6049bb65a030753f2d99cf42","unresolved":false,"context_lines":[{"line_number":884,"context_line":""},{"line_number":885,"context_line":"        # endpoint enforcement"},{"line_number":886,"context_line":"        self._endpoint_id \u003d self._conf_get(\u0027endpoint_id\u0027)"},{"line_number":887,"context_line":"        self._service_id \u003d self._conf_get(\u0027service_id\u0027)"},{"line_number":888,"context_line":"        self._enforce_endpoint_constraint \u003d self._conf_get("},{"line_number":889,"context_line":"            \u0027enforce_endpoint_constraint\u0027)"},{"line_number":890,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"9a80dd14_0673c1b1","line":887,"updated":"2015-03-06 05:36:25.000000000","message":"nit: \n\nself._enforce_endpoint_id\nself._enforce_service_id","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"37d5358d926cdfc76b86647fa2848f7d31509826","unresolved":false,"context_lines":[{"line_number":884,"context_line":""},{"line_number":885,"context_line":"        # endpoint enforcement"},{"line_number":886,"context_line":"        self._endpoint_id \u003d self._conf_get(\u0027endpoint_id\u0027)"},{"line_number":887,"context_line":"        self._service_id \u003d self._conf_get(\u0027service_id\u0027)"},{"line_number":888,"context_line":"        self._enforce_endpoint_constraint \u003d self._conf_get("},{"line_number":889,"context_line":"            \u0027enforce_endpoint_constraint\u0027)"},{"line_number":890,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"9a80dd14_04fef56a","line":887,"in_reply_to":"9a80dd14_0673c1b1","updated":"2015-03-12 23:19:44.000000000","message":"Done","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"b1ab7a9227e60afc6049bb65a030753f2d99cf42","unresolved":false,"context_lines":[{"line_number":954,"context_line":"                    auth_token\u003duser_token)"},{"line_number":955,"context_line":""},{"line_number":956,"context_line":"                if self._enforce_endpoint_constraint is True:"},{"line_number":957,"context_line":"                    self._enforce_endpoint_constraints(user_auth_ref)"},{"line_number":958,"context_line":""},{"line_number":959,"context_line":"                env[\u0027keystone.token_info\u0027] \u003d user_token_info"},{"line_number":960,"context_line":"                user_headers \u003d self._build_user_headers(user_auth_ref,"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a80dd14_922b6c93","line":957,"updated":"2015-03-06 05:36:25.000000000","message":"very small nit: check the config value within the function, it means you can always call it and it just exits early if not defined.","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"37d5358d926cdfc76b86647fa2848f7d31509826","unresolved":false,"context_lines":[{"line_number":954,"context_line":"                    auth_token\u003duser_token)"},{"line_number":955,"context_line":""},{"line_number":956,"context_line":"                if self._enforce_endpoint_constraint is True:"},{"line_number":957,"context_line":"                    self._enforce_endpoint_constraints(user_auth_ref)"},{"line_number":958,"context_line":""},{"line_number":959,"context_line":"                env[\u0027keystone.token_info\u0027] \u003d user_token_info"},{"line_number":960,"context_line":"                user_headers \u003d self._build_user_headers(user_auth_ref,"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a80dd14_24a2194b","line":957,"in_reply_to":"9a80dd14_922b6c93","updated":"2015-03-12 23:19:44.000000000","message":"I agree with you and that\u0027s what I originally had but I was asked to perform the check outside the function and like you said it\u0027s a small nit so I kept quiet and made the change in order to keep the original reviewer happy ;) So hopefully you are happy that we thought the same :-)","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9b115cf98863afe9301cca76e6216f8ce47317ff","unresolved":false,"context_lines":[{"line_number":1164,"context_line":"        filter_success \u003d False"},{"line_number":1165,"context_line":""},{"line_number":1166,"context_line":"        if (self._include_service_catalog and"},{"line_number":1167,"context_line":"                auth_ref.has_service_catalog()):"},{"line_number":1168,"context_line":"            catalog \u003d auth_ref.service_catalog.get_data()"},{"line_number":1169,"context_line":"            filter_success \u003d self._filter_catalog(catalog)"},{"line_number":1170,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":6,"id":"ba7be1f8_185cff24","line":1167,"updated":"2015-02-24 07:14:08.000000000","message":"Just need to check for auth_ref.has_service_catalog(). If deployer meant to enforce endpoint constraint and service catalog is absent, we should error out.","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"37d5358d926cdfc76b86647fa2848f7d31509826","unresolved":false,"context_lines":[{"line_number":1164,"context_line":"        filter_success \u003d False"},{"line_number":1165,"context_line":""},{"line_number":1166,"context_line":"        if (self._include_service_catalog and"},{"line_number":1167,"context_line":"                auth_ref.has_service_catalog()):"},{"line_number":1168,"context_line":"            catalog \u003d auth_ref.service_catalog.get_data()"},{"line_number":1169,"context_line":"            filter_success \u003d self._filter_catalog(catalog)"},{"line_number":1170,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":6,"id":"ba7be1f8_d133cbf3","line":1167,"in_reply_to":"ba7be1f8_185cff24","updated":"2015-03-12 23:19:44.000000000","message":"Done - good idea Jamie. Thanks.","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"b1ab7a9227e60afc6049bb65a030753f2d99cf42","unresolved":false,"context_lines":[{"line_number":1164,"context_line":"        filter_success \u003d False"},{"line_number":1165,"context_line":""},{"line_number":1166,"context_line":"        if (self._include_service_catalog and"},{"line_number":1167,"context_line":"                auth_ref.has_service_catalog()):"},{"line_number":1168,"context_line":"            catalog \u003d auth_ref.service_catalog.get_data()"},{"line_number":1169,"context_line":"            filter_success \u003d self._filter_catalog(catalog)"},{"line_number":1170,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a80dd14_a62755b5","line":1167,"in_reply_to":"ba7be1f8_185cff24","updated":"2015-03-06 05:36:25.000000000","message":"you could have that as a ConfigurationError on __init__.\n\nif (self._service_id or self._endpoint_id) and not self._include_service_catalog: \n    raise exc.ConfigurationError(\u0027huh?\u0027)","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9b115cf98863afe9301cca76e6216f8ce47317ff","unresolved":false,"context_lines":[{"line_number":1168,"context_line":"            catalog \u003d auth_ref.service_catalog.get_data()"},{"line_number":1169,"context_line":"            filter_success \u003d self._filter_catalog(catalog)"},{"line_number":1170,"context_line":"        else:"},{"line_number":1171,"context_line":"            self._LOG.warn(_LW(\u0027Unable to enforce endpoint constraint because\u0027"},{"line_number":1172,"context_line":"                               \u0027 service_catalog not found in token data\u0027))"},{"line_number":1173,"context_line":""},{"line_number":1174,"context_line":"        if not filter_success:"}],"source_content_type":"text/x-python","patch_set":6,"id":"ba7be1f8_b875b399","line":1171,"updated":"2015-02-24 07:14:08.000000000","message":"we should raise an exception here","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"b1ab7a9227e60afc6049bb65a030753f2d99cf42","unresolved":false,"context_lines":[{"line_number":1168,"context_line":"            catalog \u003d auth_ref.service_catalog.get_data()"},{"line_number":1169,"context_line":"            filter_success \u003d self._filter_catalog(catalog)"},{"line_number":1170,"context_line":"        else:"},{"line_number":1171,"context_line":"            self._LOG.warn(_LW(\u0027Unable to enforce endpoint constraint because\u0027"},{"line_number":1172,"context_line":"                               \u0027 service_catalog not found in token data\u0027))"},{"line_number":1173,"context_line":""},{"line_number":1174,"context_line":"        if not filter_success:"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a80dd14_66355dd9","line":1171,"in_reply_to":"ba7be1f8_b875b399","updated":"2015-03-06 05:36:25.000000000","message":"+1 enforcing endpoint id and no catalog is a failure.","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"37d5358d926cdfc76b86647fa2848f7d31509826","unresolved":false,"context_lines":[{"line_number":1168,"context_line":"            catalog \u003d auth_ref.service_catalog.get_data()"},{"line_number":1169,"context_line":"            filter_success \u003d self._filter_catalog(catalog)"},{"line_number":1170,"context_line":"        else:"},{"line_number":1171,"context_line":"            self._LOG.warn(_LW(\u0027Unable to enforce endpoint constraint because\u0027"},{"line_number":1172,"context_line":"                               \u0027 service_catalog not found in token data\u0027))"},{"line_number":1173,"context_line":""},{"line_number":1174,"context_line":"        if not filter_success:"}],"source_content_type":"text/x-python","patch_set":6,"id":"ba7be1f8_f12e0f8b","line":1171,"in_reply_to":"ba7be1f8_b875b399","updated":"2015-03-12 23:19:44.000000000","message":"Done","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9b115cf98863afe9301cca76e6216f8ce47317ff","unresolved":false,"context_lines":[{"line_number":1171,"context_line":"            self._LOG.warn(_LW(\u0027Unable to enforce endpoint constraint because\u0027"},{"line_number":1172,"context_line":"                               \u0027 service_catalog not found in token data\u0027))"},{"line_number":1173,"context_line":""},{"line_number":1174,"context_line":"        if not filter_success:"},{"line_number":1175,"context_line":"            self._LOG.warn(_LW(\u0027Token authorization failed\u0027))"},{"line_number":1176,"context_line":"            raise InvalidToken(_(\u0027Token authorization failed because\u0027"},{"line_number":1177,"context_line":"                                 \u0027 endpoint not found for values:\u0027"}],"source_content_type":"text/x-python","patch_set":6,"id":"ba7be1f8_38b0e342","line":1174,"updated":"2015-02-24 07:14:08.000000000","message":"No need for filter_success, just raise the exception directly in _filter_catalog().","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"37d5358d926cdfc76b86647fa2848f7d31509826","unresolved":false,"context_lines":[{"line_number":1171,"context_line":"            self._LOG.warn(_LW(\u0027Unable to enforce endpoint constraint because\u0027"},{"line_number":1172,"context_line":"                               \u0027 service_catalog not found in token data\u0027))"},{"line_number":1173,"context_line":""},{"line_number":1174,"context_line":"        if not filter_success:"},{"line_number":1175,"context_line":"            self._LOG.warn(_LW(\u0027Token authorization failed\u0027))"},{"line_number":1176,"context_line":"            raise InvalidToken(_(\u0027Token authorization failed because\u0027"},{"line_number":1177,"context_line":"                                 \u0027 endpoint not found for values:\u0027"}],"source_content_type":"text/x-python","patch_set":6,"id":"ba7be1f8_f15c4f1b","line":1174,"in_reply_to":"ba7be1f8_38b0e342","updated":"2015-03-12 23:19:44.000000000","message":"Done","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"b1ab7a9227e60afc6049bb65a030753f2d99cf42","unresolved":false,"context_lines":[{"line_number":1197,"context_line":"                for endpoint in endpoints:"},{"line_number":1198,"context_line":"                    if (\u0027id\u0027 in endpoint and"},{"line_number":1199,"context_line":"                            endpoint[\u0027id\u0027] \u003d\u003d self._endpoint_id):"},{"line_number":1200,"context_line":"                        return True"},{"line_number":1201,"context_line":"        return False"},{"line_number":1202,"context_line":""},{"line_number":1203,"context_line":"    def _build_user_headers(self, auth_ref, token_info):"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a80dd14_8647b14a","line":1200,"updated":"2015-03-06 05:36:25.000000000","message":"What if people add service and endpoint? you say service takes priority but what if it finds the endpoint_id and not the service_id?\n\nI don\u0027t know the answer here i just want to know what the edge cases do.","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"37d5358d926cdfc76b86647fa2848f7d31509826","unresolved":false,"context_lines":[{"line_number":1197,"context_line":"                for endpoint in endpoints:"},{"line_number":1198,"context_line":"                    if (\u0027id\u0027 in endpoint and"},{"line_number":1199,"context_line":"                            endpoint[\u0027id\u0027] \u003d\u003d self._endpoint_id):"},{"line_number":1200,"context_line":"                        return True"},{"line_number":1201,"context_line":"        return False"},{"line_number":1202,"context_line":""},{"line_number":1203,"context_line":"    def _build_user_headers(self, auth_ref, token_info):"}],"source_content_type":"text/x-python","patch_set":6,"id":"9a80dd14_60529368","line":1200,"in_reply_to":"9a80dd14_8647b14a","updated":"2015-03-12 23:19:44.000000000","message":"Done. I\u0027ve added logic to catch the case whereby we are enforcing endpoint and service but we only match endpoint. In addition, the use case whereby the wrong service id is defined for the target endpoint is not supported. For instance we do not support defining a swift service id and a nova endpoint. To me this doesn\u0027t make sense.","commit_id":"06660521f1d7214ecb0cba8d02d93f637226e8cb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b948e433fb00ecabf7f4fc79f755e6c4fadb4ac0","unresolved":false,"context_lines":[{"line_number":564,"context_line":"        self._enforce_endpoint_constraint \u003d self._conf_get("},{"line_number":565,"context_line":"            \u0027enforce_endpoint_constraint\u0027)"},{"line_number":566,"context_line":""},{"line_number":567,"context_line":"        if ((self._enforce_service_id or self._enforce_endpoint_id) and"},{"line_number":568,"context_line":"                not self._include_service_catalog):"},{"line_number":569,"context_line":"            raise ConfigurationError("},{"line_number":570,"context_line":"                _(\u0027unable to enforce endpoint constraints without service\u0027"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aaa499b_474f76bd","line":567,"updated":"2015-04-14 11:26:43.000000000","message":"shouldn\u0027t we check that  _enforce_endpoint_constraint is True as well here?","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"208fb75bf6cb6c59aa1a42cddb1c7241f1b54d26","unresolved":false,"context_lines":[{"line_number":564,"context_line":"        self._enforce_endpoint_constraint \u003d self._conf_get("},{"line_number":565,"context_line":"            \u0027enforce_endpoint_constraint\u0027)"},{"line_number":566,"context_line":""},{"line_number":567,"context_line":"        if ((self._enforce_service_id or self._enforce_endpoint_id) and"},{"line_number":568,"context_line":"                not self._include_service_catalog):"},{"line_number":569,"context_line":"            raise ConfigurationError("},{"line_number":570,"context_line":"                _(\u0027unable to enforce endpoint constraints without service\u0027"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aaa499b_50c5e339","line":567,"in_reply_to":"7aaa499b_474f76bd","updated":"2015-04-14 16:05:23.000000000","message":"Not quite sure what to do here.  I agree it would seem to make sense, but the spec indicates that  _enforce_endpoint_constraint is deemed false if either of these two properties are unset yet it\u0027s pointless to set them unless you intend to filter.  I shall think about a more elegant way of doing this as the way it is just looks like a trap.","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"0072af1e2677163a3e3f320d389257fde7393e98","unresolved":false,"context_lines":[{"line_number":564,"context_line":"        self._enforce_endpoint_constraint \u003d self._conf_get("},{"line_number":565,"context_line":"            \u0027enforce_endpoint_constraint\u0027)"},{"line_number":566,"context_line":""},{"line_number":567,"context_line":"        if ((self._enforce_service_id or self._enforce_endpoint_id) and"},{"line_number":568,"context_line":"                not self._include_service_catalog):"},{"line_number":569,"context_line":"            raise ConfigurationError("},{"line_number":570,"context_line":"                _(\u0027unable to enforce endpoint constraints without service\u0027"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aaa499b_9c32530f","line":567,"in_reply_to":"7aaa499b_50c5e339","updated":"2015-04-15 06:37:21.000000000","message":"Can\u0027t we just get rid of enforce_endpoint_constraint? It seems to be like a global on/off switch that can be dropped in favour of testing the enforce_endpoint_id or endpoint_service_id constraints where appropriate.\n\nie. \n\nself._enforce_endpoint_constraint \u003d self._enforce_endpoint_id or self._enforce_service_id\n\nbut you shouldn\u0027t need to actually save that, just use the OR","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"100c55a9ab79bbcfb6ed42f42d61ab2b210ef258","unresolved":false,"context_lines":[{"line_number":564,"context_line":"        self._enforce_endpoint_constraint \u003d self._conf_get("},{"line_number":565,"context_line":"            \u0027enforce_endpoint_constraint\u0027)"},{"line_number":566,"context_line":""},{"line_number":567,"context_line":"        if ((self._enforce_service_id or self._enforce_endpoint_id) and"},{"line_number":568,"context_line":"                not self._include_service_catalog):"},{"line_number":569,"context_line":"            raise ConfigurationError("},{"line_number":570,"context_line":"                _(\u0027unable to enforce endpoint constraints without service\u0027"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aaa499b_f2c05b7e","line":567,"in_reply_to":"7aaa499b_9c32530f","updated":"2015-04-15 10:27:55.000000000","message":"I agree, that was one of the options I was mulling over when responding to Henry.  I was thinking that the additional BIG switch added clarity so that enforcement was less likely to be switched on by accident - but then that way lies ever bigger switches and ultimately madness.  I\u0027ll make the change you suggest, Jamie.","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b948e433fb00ecabf7f4fc79f755e6c4fadb4ac0","unresolved":false,"context_lines":[{"line_number":566,"context_line":""},{"line_number":567,"context_line":"        if ((self._enforce_service_id or self._enforce_endpoint_id) and"},{"line_number":568,"context_line":"                not self._include_service_catalog):"},{"line_number":569,"context_line":"            raise ConfigurationError("},{"line_number":570,"context_line":"                _(\u0027unable to enforce endpoint constraints without service\u0027"},{"line_number":571,"context_line":"                  \u0027catalog. Include service catalog or disable enforcing\u0027"},{"line_number":572,"context_line":"                  \u0027endpoint constraints.\u0027))"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aaa499b_479416e1","line":569,"updated":"2015-04-14 11:26:43.000000000","message":"how does this tally with the help text on the config saying that an Invalid Token will be thrown....would that ever happen if you catch it here (and catching it early is good!)","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"208fb75bf6cb6c59aa1a42cddb1c7241f1b54d26","unresolved":false,"context_lines":[{"line_number":566,"context_line":""},{"line_number":567,"context_line":"        if ((self._enforce_service_id or self._enforce_endpoint_id) and"},{"line_number":568,"context_line":"                not self._include_service_catalog):"},{"line_number":569,"context_line":"            raise ConfigurationError("},{"line_number":570,"context_line":"                _(\u0027unable to enforce endpoint constraints without service\u0027"},{"line_number":571,"context_line":"                  \u0027catalog. Include service catalog or disable enforcing\u0027"},{"line_number":572,"context_line":"                  \u0027endpoint constraints.\u0027))"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aaa499b_70d7bfbf","line":569,"in_reply_to":"7aaa499b_479416e1","updated":"2015-04-14 16:05:23.000000000","message":"I think that you may be misunderstanding this (or I may be).  It looks to me like this set of conditionals is only intended to validate the config.  The message here should read something like \u0027this configuration is invalid: unable to enforce endpoint constraints without inclusion of service catalog. Include service catalog or disable enforcing endpoint constraints.\u0027","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"0072af1e2677163a3e3f320d389257fde7393e98","unresolved":false,"context_lines":[{"line_number":634,"context_line":"                    body\u003duser_token_info,"},{"line_number":635,"context_line":"                    auth_token\u003duser_token)"},{"line_number":636,"context_line":""},{"line_number":637,"context_line":"                if self._enforce_endpoint_constraint is True:"},{"line_number":638,"context_line":"                    self._enforce_endpoint_constraints(user_auth_ref)"},{"line_number":639,"context_line":""},{"line_number":640,"context_line":"                env[\u0027keystone.token_info\u0027] \u003d user_token_info"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aaa499b_1c2763cb","line":637,"updated":"2015-04-15 06:37:21.000000000","message":"if self._enforce_service_id or self._enforce_endpoint_id:\n\n\nalso i\u0027d prefer if this check was in the _enforce_endpoint_constraint function\n\non a side note this is a validation function and should go in _validate_token which should take an auth_ref - not the raw body/env. need to look into why that is.","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"0072af1e2677163a3e3f320d389257fde7393e98","unresolved":false,"context_lines":[{"line_number":849,"context_line":""},{"line_number":850,"context_line":"        \"\"\""},{"line_number":851,"context_line":"        if (auth_ref.has_service_catalog()):"},{"line_number":852,"context_line":"            catalog \u003d auth_ref.service_catalog.get_data()"},{"line_number":853,"context_line":"            self._filter_catalog(catalog)"},{"line_number":854,"context_line":"        else:"},{"line_number":855,"context_line":"            self._LOG.warn(_LW(\u0027Unable to enforce endpoint constraint because\u0027"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aaa499b_9727ccb5","line":852,"updated":"2015-04-15 06:37:21.000000000","message":"get_data gives you the raw catalog - why are you using that? I don\u0027t see anything that does different code for v2 or v3? does it work with both formats? I would expect you want to work with get_endpoints()","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"0072af1e2677163a3e3f320d389257fde7393e98","unresolved":false,"context_lines":[{"line_number":856,"context_line":"                               \u0027 service_catalog not found in token data\u0027))"},{"line_number":857,"context_line":"            raise InvalidToken(_(\u0027Token authorization failed because\u0027"},{"line_number":858,"context_line":"                                 \u0027 enforce_endpoint_constraint is enabled\u0027"},{"line_number":859,"context_line":"                                 \u0027 but no service catalog found.\u0027))"},{"line_number":860,"context_line":""},{"line_number":861,"context_line":"    def _filter_catalog(self, catalog):"},{"line_number":862,"context_line":"        \"\"\"Check catalog for matching service and/or endpoint.\"\"\""}],"source_content_type":"text/x-python","patch_set":11,"id":"7aaa499b_5c13ab66","line":859,"updated":"2015-04-15 06:37:21.000000000","message":"nit: you can collapse this into one function: \n\nif not auth_ref.has_service_catalog(): \n    warn\n    raise \n\n# do stuff","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"0072af1e2677163a3e3f320d389257fde7393e98","unresolved":false,"context_lines":[{"line_number":882,"context_line":"                        if enforce_service and not service_matched:"},{"line_number":883,"context_line":"                            endpoint_matched \u003d True"},{"line_number":884,"context_line":"                        else:"},{"line_number":885,"context_line":"                            return"},{"line_number":886,"context_line":""},{"line_number":887,"context_line":"        # Otherwise no desired match in catalog and so"},{"line_number":888,"context_line":"        # enforcement fails"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aaa499b_57cb84a5","line":885,"updated":"2015-04-15 06:37:21.000000000","message":"i feel like this is overly complicated and you can get rid of some booleans. shouldn\u0027t it just be\n\nfor service in services: \n    if enforce_service_id and service[\u0027id\u0027] !\u003d enforce_service_id:\n        continue\n\n    if enforce_endpoint_id:\n        ids \u003d endpoint[\u0027id\u0027] for endpoint in service[\u0027endpoints\u0027]\n        return enforce_endpoint_id in ids\n\n    return True\n\nreturn False\n\n\nand you could find places for most of the warning messages in there","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"100c55a9ab79bbcfb6ed42f42d61ab2b210ef258","unresolved":false,"context_lines":[{"line_number":882,"context_line":"                        if enforce_service and not service_matched:"},{"line_number":883,"context_line":"                            endpoint_matched \u003d True"},{"line_number":884,"context_line":"                        else:"},{"line_number":885,"context_line":"                            return"},{"line_number":886,"context_line":""},{"line_number":887,"context_line":"        # Otherwise no desired match in catalog and so"},{"line_number":888,"context_line":"        # enforcement fails"}],"source_content_type":"text/x-python","patch_set":11,"id":"7aaa499b_c3fd8f3b","line":885,"in_reply_to":"7aaa499b_57cb84a5","updated":"2015-04-15 10:27:55.000000000","message":"I\u0027d like to simplify this.  However, what Bob\u0027s done here has a broader scope than what you suggest.  We can enforce service_id inclusiveor endpoint_id.  What you suggest validates a service correctly but doesn\u0027t allow the totality of failures to be diagnosed.  The possibility that both the service and the endpoint could be found in the catalog but not together cannot be diagnosed from your logic without flags being set.  If we\u0027re agreed that the reasons for failure need to be contained in the InvalidToken raised below then we\u0027ll need flags. \n\nLooking at this though I\u0027m actually concerned that if the service id is found, then the endpoint is found in another service we\u0027d get a false positive as the service_matched flag would have been set already  and the condition at 882 would be satisfied.  It looks like a bug in the making.\n\nI\u0027m approaching the view that we shouldn\u0027t bother with detail in the InvalidToken message; that we should fail fast - if the service and endpoint are configured and we find the service but not the endpoint then fail.  That would assume that the catalog should contain only one service per service_id.\n\nAnother point here is that if the endpoint_id and service_id are being enforced and they are found in the catalog but not together, then isn\u0027t that always a mis-configuration of the middleware?  Should be not make it very clear in the log what\u0027s happening or maybe even validate the two values somewhere above, around 567?","commit_id":"1c8bdef2ed3c383b7559b03ef62620c03d39ddee"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"f019586e2711095f78783bd22d77c7f5a266a4d5","unresolved":false,"context_lines":[{"line_number":558,"context_line":"            # all services within the catalog will be searched for the"},{"line_number":559,"context_line":"            # endpoint id - rather than just those with the configured"},{"line_number":560,"context_line":"            # service id"},{"line_number":561,"context_line":"            self._LOG.warning("},{"line_number":562,"context_line":"                _LW(\u0027Configuring enforce_endpoint_id without \u0027"},{"line_number":563,"context_line":"                    \u0027enforce_service_id can slow performance\u0027)"},{"line_number":564,"context_line":"            )"}],"source_content_type":"text/x-python","patch_set":12,"id":"5aa745d1_e6b5af7e","line":561,"updated":"2015-04-16 00:02:08.000000000","message":"probably an INFO","commit_id":"781c11748fa9edca3941d4ea7a9e3c8e16e6c0d7"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"efc6811a654d40d6c74f1637a824e86b087cc1ed","unresolved":false,"context_lines":[{"line_number":558,"context_line":"            # all services within the catalog will be searched for the"},{"line_number":559,"context_line":"            # endpoint id - rather than just those with the configured"},{"line_number":560,"context_line":"            # service id"},{"line_number":561,"context_line":"            self._LOG.warning("},{"line_number":562,"context_line":"                _LW(\u0027Configuring enforce_endpoint_id without \u0027"},{"line_number":563,"context_line":"                    \u0027enforce_service_id can slow performance\u0027)"},{"line_number":564,"context_line":"            )"}],"source_content_type":"text/x-python","patch_set":12,"id":"5aa745d1_0d7306b3","line":561,"in_reply_to":"5aa745d1_e6b5af7e","updated":"2015-04-16 12:00:01.000000000","message":"Done.","commit_id":"781c11748fa9edca3941d4ea7a9e3c8e16e6c0d7"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"f019586e2711095f78783bd22d77c7f5a266a4d5","unresolved":false,"context_lines":[{"line_number":854,"context_line":"                raise InvalidToken(_(\u0027Token authorization failed because\u0027"},{"line_number":855,"context_line":"                                     \u0027 enforce_endpoint_constraint is enabled\u0027"},{"line_number":856,"context_line":"                                     \u0027 but no service catalog found.\u0027))"},{"line_number":857,"context_line":""},{"line_number":858,"context_line":"            catalog \u003d auth_ref.service_catalog.get_data()"},{"line_number":859,"context_line":"            self._filter_catalog(catalog)"},{"line_number":860,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"5aa745d1_2937e8b1","line":857,"updated":"2015-04-16 00:02:08.000000000","message":"nit: you can remove the nesting here by writing these as quick exists.\n\nif not (self.enforce_service_id or self.enforce_endpoint_id): \n    return \n\nif not auth_ref.has_service_catalog():\n    raise \n\ndo stuff","commit_id":"781c11748fa9edca3941d4ea7a9e3c8e16e6c0d7"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"efc6811a654d40d6c74f1637a824e86b087cc1ed","unresolved":false,"context_lines":[{"line_number":854,"context_line":"                raise InvalidToken(_(\u0027Token authorization failed because\u0027"},{"line_number":855,"context_line":"                                     \u0027 enforce_endpoint_constraint is enabled\u0027"},{"line_number":856,"context_line":"                                     \u0027 but no service catalog found.\u0027))"},{"line_number":857,"context_line":""},{"line_number":858,"context_line":"            catalog \u003d auth_ref.service_catalog.get_data()"},{"line_number":859,"context_line":"            self._filter_catalog(catalog)"},{"line_number":860,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"5aa745d1_cd3e3eb8","line":857,"in_reply_to":"5aa745d1_2937e8b1","updated":"2015-04-16 12:00:01.000000000","message":"Personally I prefer nesting to multiple exit points from a method.  But I recognise the pattern.  Done.","commit_id":"781c11748fa9edca3941d4ea7a9e3c8e16e6c0d7"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"f019586e2711095f78783bd22d77c7f5a266a4d5","unresolved":false,"context_lines":[{"line_number":862,"context_line":"        \"\"\"Check catalog for matching service and/or endpoint.\"\"\""},{"line_number":863,"context_line":""},{"line_number":864,"context_line":"        enforce_service \u003d self._enforce_service_id is not None"},{"line_number":865,"context_line":"        enforce_endpoint \u003d self._enforce_endpoint_id is not None"},{"line_number":866,"context_line":""},{"line_number":867,"context_line":"        for service in catalog:"},{"line_number":868,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"5aa745d1_29824853","line":865,"updated":"2015-04-16 00:02:08.000000000","message":"these are reduncant, you can use self._enforce_service_id as a bool in the exact same way.","commit_id":"781c11748fa9edca3941d4ea7a9e3c8e16e6c0d7"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"efc6811a654d40d6c74f1637a824e86b087cc1ed","unresolved":false,"context_lines":[{"line_number":862,"context_line":"        \"\"\"Check catalog for matching service and/or endpoint.\"\"\""},{"line_number":863,"context_line":""},{"line_number":864,"context_line":"        enforce_service \u003d self._enforce_service_id is not None"},{"line_number":865,"context_line":"        enforce_endpoint \u003d self._enforce_endpoint_id is not None"},{"line_number":866,"context_line":""},{"line_number":867,"context_line":"        for service in catalog:"},{"line_number":868,"context_line":""}],"source_content_type":"text/x-python","patch_set":12,"id":"5aa745d1_ad62d2d6","line":865,"in_reply_to":"5aa745d1_29824853","updated":"2015-04-16 12:00:01.000000000","message":"I forgot that.  Now they\u0027re only being used the once it\u0027s better to do that.  Done.","commit_id":"781c11748fa9edca3941d4ea7a9e3c8e16e6c0d7"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"f019586e2711095f78783bd22d77c7f5a266a4d5","unresolved":false,"context_lines":[{"line_number":868,"context_line":""},{"line_number":869,"context_line":"            if ((not enforce_service) or"},{"line_number":870,"context_line":"                    all([\u0027id\u0027 in service,"},{"line_number":871,"context_line":"                         service[\u0027id\u0027] \u003d\u003d self._enforce_service_id])):"},{"line_number":872,"context_line":"                if not enforce_endpoint:"},{"line_number":873,"context_line":"                    return"},{"line_number":874,"context_line":"                # Find matching endpoint"}],"source_content_type":"text/x-python","patch_set":12,"id":"5aa745d1_29e9281b","line":871,"updated":"2015-04-16 00:02:08.000000000","message":"can be replaced with a service.get(\u0027id\u0027)","commit_id":"781c11748fa9edca3941d4ea7a9e3c8e16e6c0d7"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"efc6811a654d40d6c74f1637a824e86b087cc1ed","unresolved":false,"context_lines":[{"line_number":868,"context_line":""},{"line_number":869,"context_line":"            if ((not enforce_service) or"},{"line_number":870,"context_line":"                    all([\u0027id\u0027 in service,"},{"line_number":871,"context_line":"                         service[\u0027id\u0027] \u003d\u003d self._enforce_service_id])):"},{"line_number":872,"context_line":"                if not enforce_endpoint:"},{"line_number":873,"context_line":"                    return"},{"line_number":874,"context_line":"                # Find matching endpoint"}],"source_content_type":"text/x-python","patch_set":12,"id":"5aa745d1_cdacfeef","line":871,"in_reply_to":"5aa745d1_29e9281b","updated":"2015-04-16 12:00:01.000000000","message":"I don\u0027t think it can for the next patch set.  I\u0027m handling both v2 and v3 so the type is not available.  Let me know what you think.","commit_id":"781c11748fa9edca3941d4ea7a9e3c8e16e6c0d7"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"f019586e2711095f78783bd22d77c7f5a266a4d5","unresolved":false,"context_lines":[{"line_number":876,"context_line":"                    endpoints \u003d service[\u0027endpoints\u0027]"},{"line_number":877,"context_line":"                    for endpoint in endpoints:"},{"line_number":878,"context_line":"                        if (\u0027id\u0027 in endpoint and endpoint[\u0027id\u0027] \u003d\u003d"},{"line_number":879,"context_line":"                                self._enforce_endpoint_id):"},{"line_number":880,"context_line":"                            return"},{"line_number":881,"context_line":""},{"line_number":882,"context_line":"        # Otherwise no desired match in catalog and so"}],"source_content_type":"text/x-python","patch_set":12,"id":"5aa745d1_09d54c42","line":879,"updated":"2015-04-16 00:02:08.000000000","message":"endpoint.get(\u0027id\u0027)","commit_id":"781c11748fa9edca3941d4ea7a9e3c8e16e6c0d7"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"efc6811a654d40d6c74f1637a824e86b087cc1ed","unresolved":false,"context_lines":[{"line_number":876,"context_line":"                    endpoints \u003d service[\u0027endpoints\u0027]"},{"line_number":877,"context_line":"                    for endpoint in endpoints:"},{"line_number":878,"context_line":"                        if (\u0027id\u0027 in endpoint and endpoint[\u0027id\u0027] \u003d\u003d"},{"line_number":879,"context_line":"                                self._enforce_endpoint_id):"},{"line_number":880,"context_line":"                            return"},{"line_number":881,"context_line":""},{"line_number":882,"context_line":"        # Otherwise no desired match in catalog and so"}],"source_content_type":"text/x-python","patch_set":12,"id":"5aa745d1_4d87ce61","line":879,"in_reply_to":"5aa745d1_09d54c42","updated":"2015-04-16 12:00:01.000000000","message":"As per above.","commit_id":"781c11748fa9edca3941d4ea7a9e3c8e16e6c0d7"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"e449c4182d3aef25c8cad11c90759770c64096f9","unresolved":false,"context_lines":[{"line_number":861,"context_line":""},{"line_number":862,"context_line":"        self._filter_catalog(auth_ref)"},{"line_number":863,"context_line":""},{"line_number":864,"context_line":"    def _filter_catalog(self, auth_ref):"},{"line_number":865,"context_line":"        \"\"\"Check catalog for matching service and/or endpoint.\"\"\""},{"line_number":866,"context_line":""},{"line_number":867,"context_line":"        enforce_for_v2_catalog \u003d auth_ref[\u0027version\u0027] \u003d\u003d \u0027v2.0\u0027"}],"source_content_type":"text/x-python","patch_set":13,"id":"3ab451fb_10e9f41a","line":864,"updated":"2015-04-16 22:16:34.000000000","message":"nit: unless you\u0027re unit testing this function specifically you may as well collapse them together.","commit_id":"8ef8f5508a2b6140c15c97afae633d5faca4fbcc"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"a3f3bdce0fd7d2f6f7dc7eca1bffcbe0b739f809","unresolved":false,"context_lines":[{"line_number":861,"context_line":""},{"line_number":862,"context_line":"        self._filter_catalog(auth_ref)"},{"line_number":863,"context_line":""},{"line_number":864,"context_line":"    def _filter_catalog(self, auth_ref):"},{"line_number":865,"context_line":"        \"\"\"Check catalog for matching service and/or endpoint.\"\"\""},{"line_number":866,"context_line":""},{"line_number":867,"context_line":"        enforce_for_v2_catalog \u003d auth_ref[\u0027version\u0027] \u003d\u003d \u0027v2.0\u0027"}],"source_content_type":"text/x-python","patch_set":13,"id":"3ab451fb_17579c03","line":864,"in_reply_to":"3ab451fb_10e9f41a","updated":"2015-04-17 09:20:45.000000000","message":"Agreed.  I think it was split out because it used to do a whole lot of work putting together a message for the exception (I deleted that because it was only thrown away in the handling anyway).\n\nDone.","commit_id":"8ef8f5508a2b6140c15c97afae633d5faca4fbcc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"09feb7342b06e045de28eb2045144ed09e54a7c0","unresolved":false,"context_lines":[{"line_number":864,"context_line":"    def _filter_catalog(self, auth_ref):"},{"line_number":865,"context_line":"        \"\"\"Check catalog for matching service and/or endpoint.\"\"\""},{"line_number":866,"context_line":""},{"line_number":867,"context_line":"        enforce_for_v2_catalog \u003d auth_ref[\u0027version\u0027] \u003d\u003d \u0027v2.0\u0027"},{"line_number":868,"context_line":""},{"line_number":869,"context_line":"        for service in auth_ref.service_catalog.get_data():"},{"line_number":870,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"5aa745d1_cd2f50a0","line":867,"updated":"2015-04-16 16:38:07.000000000","message":"may want to consider using version-independent catalog object here\n\nhttps://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/service_catalog.py\n\nmake the code more robust","commit_id":"8ef8f5508a2b6140c15c97afae633d5faca4fbcc"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"a3f3bdce0fd7d2f6f7dc7eca1bffcbe0b739f809","unresolved":false,"context_lines":[{"line_number":864,"context_line":"    def _filter_catalog(self, auth_ref):"},{"line_number":865,"context_line":"        \"\"\"Check catalog for matching service and/or endpoint.\"\"\""},{"line_number":866,"context_line":""},{"line_number":867,"context_line":"        enforce_for_v2_catalog \u003d auth_ref[\u0027version\u0027] \u003d\u003d \u0027v2.0\u0027"},{"line_number":868,"context_line":""},{"line_number":869,"context_line":"        for service in auth_ref.service_catalog.get_data():"},{"line_number":870,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"3ab451fb_97e72c40","line":867,"in_reply_to":"3ab451fb_1037b4b1","updated":"2015-04-17 09:20:45.000000000","message":"Fair enough.  Thanks for the hint.  Done.","commit_id":"8ef8f5508a2b6140c15c97afae633d5faca4fbcc"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"a3f3bdce0fd7d2f6f7dc7eca1bffcbe0b739f809","unresolved":false,"context_lines":[{"line_number":864,"context_line":"    def _filter_catalog(self, auth_ref):"},{"line_number":865,"context_line":"        \"\"\"Check catalog for matching service and/or endpoint.\"\"\""},{"line_number":866,"context_line":""},{"line_number":867,"context_line":"        enforce_for_v2_catalog \u003d auth_ref[\u0027version\u0027] \u003d\u003d \u0027v2.0\u0027"},{"line_number":868,"context_line":""},{"line_number":869,"context_line":"        for service in auth_ref.service_catalog.get_data():"},{"line_number":870,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"3ab451fb_778dc07a","line":867,"in_reply_to":"5aa745d1_cd2f50a0","updated":"2015-04-17 09:20:45.000000000","message":"I did want to and I did.  It would have been my strong preference to use that.  However, the service_catalog.get_endpoints() method omits the \u0027service_id\u0027 in favour of only \u0027type\u0027.  As we are filtering by service_id we cannot use it here.  If it was code from the middleware then I would explore adding the service_id to the data returned but it\u0027s not.","commit_id":"8ef8f5508a2b6140c15c97afae633d5faca4fbcc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"e449c4182d3aef25c8cad11c90759770c64096f9","unresolved":false,"context_lines":[{"line_number":864,"context_line":"    def _filter_catalog(self, auth_ref):"},{"line_number":865,"context_line":"        \"\"\"Check catalog for matching service and/or endpoint.\"\"\""},{"line_number":866,"context_line":""},{"line_number":867,"context_line":"        enforce_for_v2_catalog \u003d auth_ref[\u0027version\u0027] \u003d\u003d \u0027v2.0\u0027"},{"line_number":868,"context_line":""},{"line_number":869,"context_line":"        for service in auth_ref.service_catalog.get_data():"},{"line_number":870,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"3ab451fb_1037b4b1","line":867,"in_reply_to":"5aa745d1_cd2f50a0","updated":"2015-04-16 22:16:34.000000000","message":"use auth_ref.version - same thing result but we\u0027re trying to move away from the [] syntax.\n\nwhat makes v2 special here? reading the code it seems that we enforce endpoint id checks on even if the service_id doesn\u0027t match?","commit_id":"8ef8f5508a2b6140c15c97afae633d5faca4fbcc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"e449c4182d3aef25c8cad11c90759770c64096f9","unresolved":false,"context_lines":[{"line_number":871,"context_line":"            if ((not self._enforce_service_id)"},{"line_number":872,"context_line":"                    or enforce_for_v2_catalog"},{"line_number":873,"context_line":"                    or service[\u0027id\u0027] \u003d\u003d self._enforce_service_id):"},{"line_number":874,"context_line":"                if not (self._enforce_endpoint_id or enforce_for_v2_catalog):"},{"line_number":875,"context_line":"                    return"},{"line_number":876,"context_line":"                # Find matching endpoint"},{"line_number":877,"context_line":"                elif service[\u0027endpoints\u0027]:"}],"source_content_type":"text/x-python","patch_set":13,"id":"3ab451fb_30ee30ed","line":874,"updated":"2015-04-16 22:16:34.000000000","message":"this reads if we have are evaluating a v3 token then we should always test endpoint_ids - even if _enforce_endpoint_id is None?","commit_id":"8ef8f5508a2b6140c15c97afae633d5faca4fbcc"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"a3f3bdce0fd7d2f6f7dc7eca1bffcbe0b739f809","unresolved":false,"context_lines":[{"line_number":871,"context_line":"            if ((not self._enforce_service_id)"},{"line_number":872,"context_line":"                    or enforce_for_v2_catalog"},{"line_number":873,"context_line":"                    or service[\u0027id\u0027] \u003d\u003d self._enforce_service_id):"},{"line_number":874,"context_line":"                if not (self._enforce_endpoint_id or enforce_for_v2_catalog):"},{"line_number":875,"context_line":"                    return"},{"line_number":876,"context_line":"                # Find matching endpoint"},{"line_number":877,"context_line":"                elif service[\u0027endpoints\u0027]:"}],"source_content_type":"text/x-python","patch_set":13,"id":"3ab451fb_f75e7075","line":874,"in_reply_to":"3ab451fb_30ee30ed","updated":"2015-04-17 09:20:45.000000000","message":"I don\u0027t think so.  An alternative way of making this condition would be \n\nif (not self._enforce_endpoint_id) and (not enforce_for_v2_catalog):\n\nIf the token is V2 then all we can enforce is the endpoint_id so we skip the service bit.  If the token is V3 then we can only get here if the service_id matches or is not enforced.  not (or) will mean that we bail only if we are neither enforcing endpoint_id nor are we evaluating a v2 token.","commit_id":"8ef8f5508a2b6140c15c97afae633d5faca4fbcc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"e449c4182d3aef25c8cad11c90759770c64096f9","unresolved":false,"context_lines":[{"line_number":878,"context_line":"                    endpoints \u003d service[\u0027endpoints\u0027]"},{"line_number":879,"context_line":"                    for endpoint in endpoints:"},{"line_number":880,"context_line":"                        if (\u0027id\u0027 in endpoint and endpoint[\u0027id\u0027] \u003d\u003d"},{"line_number":881,"context_line":"                                self._enforce_endpoint_id):"},{"line_number":882,"context_line":"                            return"},{"line_number":883,"context_line":""},{"line_number":884,"context_line":"        # Otherwise no desired match in catalog and so"}],"source_content_type":"text/x-python","patch_set":13,"id":"3ab451fb_3052b0de","line":881,"updated":"2015-04-16 22:16:34.000000000","message":"nit: endpoint.get() means you won\u0027t have to do the in check","commit_id":"8ef8f5508a2b6140c15c97afae633d5faca4fbcc"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"a3f3bdce0fd7d2f6f7dc7eca1bffcbe0b739f809","unresolved":false,"context_lines":[{"line_number":878,"context_line":"                    endpoints \u003d service[\u0027endpoints\u0027]"},{"line_number":879,"context_line":"                    for endpoint in endpoints:"},{"line_number":880,"context_line":"                        if (\u0027id\u0027 in endpoint and endpoint[\u0027id\u0027] \u003d\u003d"},{"line_number":881,"context_line":"                                self._enforce_endpoint_id):"},{"line_number":882,"context_line":"                            return"},{"line_number":883,"context_line":""},{"line_number":884,"context_line":"        # Otherwise no desired match in catalog and so"}],"source_content_type":"text/x-python","patch_set":13,"id":"3ab451fb_1741dc0b","line":881,"in_reply_to":"3ab451fb_3052b0de","updated":"2015-04-17 09:20:45.000000000","message":"OK.  Thanks for the hint.  Done.","commit_id":"8ef8f5508a2b6140c15c97afae633d5faca4fbcc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"b22cfde5fbbac0484db3907db5d32eac68f014c8","unresolved":false,"context_lines":[{"line_number":866,"context_line":"            if ((not self._enforce_service_id)"},{"line_number":867,"context_line":"                    or enforce_for_v2_catalog"},{"line_number":868,"context_line":"                    or service[\u0027id\u0027] \u003d\u003d self._enforce_service_id):"},{"line_number":869,"context_line":"                if not (self._enforce_endpoint_id or enforce_for_v2_catalog):"},{"line_number":870,"context_line":"                    return"},{"line_number":871,"context_line":"                # Find matching endpoint"},{"line_number":872,"context_line":"                elif service[\u0027endpoints\u0027]:"}],"source_content_type":"text/x-python","patch_set":15,"id":"dac4157f_c3d7de21","line":869,"updated":"2015-04-21 20:39:08.000000000","message":"what\u0027s the point of the or here? \n\nif i have a v2 token and no enforce_endpoint_id i\u0027m going to loop through the services, find nothing and then raise an error. \n\nIs that the expected behaviour for v2 tokens and enforce_service_id only?","commit_id":"ef9e0b2e08865780935bafa792e8c47a152be729"},{"author":{"_account_id":9276,"name":"David Charles Kennedy","email":"david.c.kennedy@hpe.com","username":"darfed"},"change_message_id":"15bfe70456842d1a5d88f8ec744d3b2d02460584","unresolved":false,"context_lines":[{"line_number":866,"context_line":"            if ((not self._enforce_service_id)"},{"line_number":867,"context_line":"                    or enforce_for_v2_catalog"},{"line_number":868,"context_line":"                    or service[\u0027id\u0027] \u003d\u003d self._enforce_service_id):"},{"line_number":869,"context_line":"                if not (self._enforce_endpoint_id or enforce_for_v2_catalog):"},{"line_number":870,"context_line":"                    return"},{"line_number":871,"context_line":"                # Find matching endpoint"},{"line_number":872,"context_line":"                elif service[\u0027endpoints\u0027]:"}],"source_content_type":"text/x-python","patch_set":15,"id":"dac4157f_1a79a7c8","line":869,"in_reply_to":"dac4157f_c3d7de21","updated":"2015-04-22 09:14:25.000000000","message":"Yes.  Not great I agree.  I\u0027ve moved the check on endpoint_id and whether version is v2 to before the looping so that if it\u0027s v2 and there is no endpoint specified we don\u0027t bother looking at the catalog.  Thanks for picking up on this.","commit_id":"ef9e0b2e08865780935bafa792e8c47a152be729"}]}