)]}'
{"keystonemiddleware/auth_token/__init__.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e08f92b87770480cf2a4e1e029b2d9cd25f3f721","unresolved":false,"context_lines":[{"line_number":368,"context_line":"            self.log.debug(\u0027Authenticating service token\u0027)"},{"line_number":369,"context_line":"            try:"},{"line_number":370,"context_line":"                _, serv_auth_ref \u003d self._do_fetch_token(request.service_token)"},{"line_number":371,"context_line":"                self._validate_token(serv_auth_ref)"},{"line_number":372,"context_line":"                self._confirm_token_bind(serv_auth_ref, request)"},{"line_number":373,"context_line":"            except ksm_exceptions.InvalidToken:"},{"line_number":374,"context_line":"                self.log.info(_LI(\u0027Invalid service token\u0027))"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a74a57a_7056a42a","side":"PARENT","line":371,"updated":"2016-11-23 21:28:32.000000000","message":"This is where we would have to validate that the service token response as the proper role, right?","commit_id":"89b55705db35a0e91e5f296745892697a3b966ff"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"d4e7d31a852294da84933038a08f108cea93cc2c","unresolved":false,"context_lines":[{"line_number":368,"context_line":"            self.log.debug(\u0027Authenticating service token\u0027)"},{"line_number":369,"context_line":"            try:"},{"line_number":370,"context_line":"                _, serv_auth_ref \u003d self._do_fetch_token(request.service_token)"},{"line_number":371,"context_line":"                self._validate_token(serv_auth_ref)"},{"line_number":372,"context_line":"                self._confirm_token_bind(serv_auth_ref, request)"},{"line_number":373,"context_line":"            except ksm_exceptions.InvalidToken:"},{"line_number":374,"context_line":"                self.log.info(_LI(\u0027Invalid service token\u0027))"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a71b18c_6415ba47","side":"PARENT","line":371,"in_reply_to":"5a74a57a_7056a42a","updated":"2016-12-04 23:15:10.000000000","message":"yea, i think so - and i\u0027m not really sure how to do it here because there\u0027s no oslo.context or anything at this point.","commit_id":"89b55705db35a0e91e5f296745892697a3b966ff"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"8e8d9e61fb626d65ccc213a1bf90187dbf9af800","unresolved":false,"context_lines":[{"line_number":393,"context_line":"        :raises exc.InvalidToken: if token is rejected"},{"line_number":394,"context_line":"        \"\"\""},{"line_number":395,"context_line":"        # guess at 8 hours if we allow expired, might want infinite"},{"line_number":396,"context_line":"        # negative provides beyond expiry rather than minimum required window"},{"line_number":397,"context_line":"        window \u003d -8 * 60 * 60 if allow_expired else 0"},{"line_number":398,"context_line":""},{"line_number":399,"context_line":"        # 0 seconds of validity means it is invalid right now"}],"source_content_type":"text/x-python","patch_set":1,"id":"fa6399be_da96a893","line":396,"updated":"2016-10-12 00:19:06.000000000","message":"??","commit_id":"f90c1d0cb658e2a7b6f19b5880e46def8ef1a984"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"d4e7d31a852294da84933038a08f108cea93cc2c","unresolved":false,"context_lines":[{"line_number":393,"context_line":"        :raises exc.InvalidToken: if token is rejected"},{"line_number":394,"context_line":"        \"\"\""},{"line_number":395,"context_line":"        # guess at 8 hours if we allow expired, might want infinite"},{"line_number":396,"context_line":"        # negative provides beyond expiry rather than minimum required window"},{"line_number":397,"context_line":"        window \u003d -8 * 60 * 60 if allow_expired else 0"},{"line_number":398,"context_line":""},{"line_number":399,"context_line":"        # 0 seconds of validity means it is invalid right now"}],"source_content_type":"text/x-python","patch_set":1,"id":"3a71b18c_a40b5229","line":396,"in_reply_to":"fa6399be_da96a893","updated":"2016-12-04 23:15:10.000000000","message":"I don\u0027t think this applies any more. We\u0027re doing this on the server side. This was an early POC that i hadn\u0027t updated since i needed the ksc changes to come through first.","commit_id":"f90c1d0cb658e2a7b6f19b5880e46def8ef1a984"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"f69c0d82b624c1edcb1dadee328066c64e4efeea","unresolved":false,"context_lines":[{"line_number":318,"context_line":"    def __init__(self,"},{"line_number":319,"context_line":"                 app,"},{"line_number":320,"context_line":"                 log\u003d_LOG,"},{"line_number":321,"context_line":"                 enforce_token_bind\u003d_BIND_MODE.PERMISSIVE,"},{"line_number":322,"context_line":"                 service_token_policy\u003dNone):"},{"line_number":323,"context_line":"        self.log \u003d log"},{"line_number":324,"context_line":"        self._app \u003d app"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a71b18c_d449a6b8","line":321,"updated":"2016-12-06 02:49:24.000000000","message":"both of these appear to always be passed, in which case they don\u0027t really need to be kwargs. And since the values that are passed come from conf, wouldn\u0027t it be better to define the defaults as conf defaults rather than as kwarg defaults?","commit_id":"37a0fae9b91069ef70757dba513aea3bd7b37407"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"a0f2b80a455f1e1475babac49323ca416b3e57fd","unresolved":false,"context_lines":[{"line_number":318,"context_line":"    def __init__(self,"},{"line_number":319,"context_line":"                 app,"},{"line_number":320,"context_line":"                 log\u003d_LOG,"},{"line_number":321,"context_line":"                 enforce_token_bind\u003d_BIND_MODE.PERMISSIVE,"},{"line_number":322,"context_line":"                 service_token_policy\u003dNone):"},{"line_number":323,"context_line":"        self.log \u003d log"},{"line_number":324,"context_line":"        self._app \u003d app"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a6eadb0_4bb91be9","line":321,"in_reply_to":"3a71b18c_d449a6b8","updated":"2016-12-14 22:10:52.000000000","message":"This class is also subclassed from keystone server where we need to pass these values from a different CONF location. The base class here purposefully doesn\u0027t deal with CONF directly for this reason.","commit_id":"37a0fae9b91069ef70757dba513aea3bd7b37407"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"f69c0d82b624c1edcb1dadee328066c64e4efeea","unresolved":false,"context_lines":[{"line_number":319,"context_line":"                 app,"},{"line_number":320,"context_line":"                 log\u003d_LOG,"},{"line_number":321,"context_line":"                 enforce_token_bind\u003d_BIND_MODE.PERMISSIVE,"},{"line_number":322,"context_line":"                 service_token_policy\u003dNone):"},{"line_number":323,"context_line":"        self.log \u003d log"},{"line_number":324,"context_line":"        self._app \u003d app"},{"line_number":325,"context_line":"        self._enforce_token_bind \u003d enforce_token_bind"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a71b18c_0f7b0b8d","line":322,"range":{"start_line":322,"start_character":38,"end_line":322,"end_character":42},"updated":"2016-12-06 02:49:24.000000000","message":"this is a different default than where the conf setting is defined, which is confusing.","commit_id":"37a0fae9b91069ef70757dba513aea3bd7b37407"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"f69c0d82b624c1edcb1dadee328066c64e4efeea","unresolved":false,"context_lines":[{"line_number":365,"context_line":"                request.service_token_valid \u003d False"},{"line_number":366,"context_line":"            else:"},{"line_number":367,"context_line":"                for role in self._service_token_policy:"},{"line_number":368,"context_line":"                    if role not in serv_auth_ref.role_names:"},{"line_number":369,"context_line":"                        request.service_token_valid \u003d False"},{"line_number":370,"context_line":"                        break"},{"line_number":371,"context_line":"                else:"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a71b18c_6f7e3f1a","line":368,"updated":"2016-12-06 02:49:24.000000000","message":"I assumed that service_token_policy was a list so that you could define multiple roles that were all service roles (thought I\u0027m still not sure if that would ever be used... do we have a reason in mind, or is this just future proofing?). But this is treating it as if you have to have EVERY role in service_token_policy to be a service, rather than ANY role in service_token_policy. Is that really what you intended? If so, why?","commit_id":"37a0fae9b91069ef70757dba513aea3bd7b37407"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"a0f2b80a455f1e1475babac49323ca416b3e57fd","unresolved":false,"context_lines":[{"line_number":365,"context_line":"                request.service_token_valid \u003d False"},{"line_number":366,"context_line":"            else:"},{"line_number":367,"context_line":"                for role in self._service_token_policy:"},{"line_number":368,"context_line":"                    if role not in serv_auth_ref.role_names:"},{"line_number":369,"context_line":"                        request.service_token_valid \u003d False"},{"line_number":370,"context_line":"                        break"},{"line_number":371,"context_line":"                else:"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a6eadb0_2c6002a5","line":368,"in_reply_to":"3a71b18c_6f7e3f1a","updated":"2016-12-14 22:10:52.000000000","message":"There was no particular reason to do a list here, it seemed like it would be useful in future, but you\u0027re right i don\u0027t know if checking ALL roles are available is better that ANY role is available. \n\nI don\u0027t know what the correct choice here would be.","commit_id":"37a0fae9b91069ef70757dba513aea3bd7b37407"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"f69c0d82b624c1edcb1dadee328066c64e4efeea","unresolved":false,"context_lines":[{"line_number":533,"context_line":"        super(AuthProtocol, self).__init__("},{"line_number":534,"context_line":"            app,"},{"line_number":535,"context_line":"            log\u003dlog,"},{"line_number":536,"context_line":"            enforce_token_bind\u003dself._conf.get(\u0027enforce_token_bind\u0027),"},{"line_number":537,"context_line":"            service_token_policy\u003dself._conf.get(\u0027service_token_policy\u0027))"},{"line_number":538,"context_line":""},{"line_number":539,"context_line":"        # delay_auth_decision means we still allow unauthenticated requests"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a71b18c_ef96cfee","line":536,"updated":"2016-12-06 02:49:24.000000000","message":"we could alternatively pass _conf to the parent class and let it read these, rather than read and pass them.","commit_id":"37a0fae9b91069ef70757dba513aea3bd7b37407"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"67d25117cb7975e5b62e4334b76027e62354681e","unresolved":false,"context_lines":[{"line_number":558,"context_line":"        if not token_roles_required:"},{"line_number":559,"context_line":"            log.warning(_LW(\u0027AuthToken middleware is set with \u0027"},{"line_number":560,"context_line":"                            \u0027keystone_authtoken.service_token_roles_required \u0027"},{"line_number":561,"context_line":"                            \u0027is set to False. This is backwards compatible \u0027"},{"line_number":562,"context_line":"                            \u0027but deprecated behaviour. Please test and set \u0027"},{"line_number":563,"context_line":"                            \u0027this to True.\u0027))"},{"line_number":564,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"1a6eadb0_1ba61653","line":561,"range":{"start_line":561,"start_character":29,"end_line":561,"end_character":31},"updated":"2016-12-15 01:01:54.000000000","message":"remove this","commit_id":"f073b807c6591642e63dd508ef15b008659039b3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"67d25117cb7975e5b62e4334b76027e62354681e","unresolved":false,"context_lines":[{"line_number":559,"context_line":"            log.warning(_LW(\u0027AuthToken middleware is set with \u0027"},{"line_number":560,"context_line":"                            \u0027keystone_authtoken.service_token_roles_required \u0027"},{"line_number":561,"context_line":"                            \u0027is set to False. This is backwards compatible \u0027"},{"line_number":562,"context_line":"                            \u0027but deprecated behaviour. Please test and set \u0027"},{"line_number":563,"context_line":"                            \u0027this to True.\u0027))"},{"line_number":564,"context_line":""},{"line_number":565,"context_line":"        super(AuthProtocol, self).__init__("}],"source_content_type":"text/x-python","patch_set":5,"id":"1a6eadb0_7b6b8af1","line":562,"range":{"start_line":562,"start_character":62,"end_line":562,"end_character":66},"updated":"2016-12-15 01:01:54.000000000","message":"test what?","commit_id":"f073b807c6591642e63dd508ef15b008659039b3"}],"keystonemiddleware/auth_token/_identity.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"f69c0d82b624c1edcb1dadee328066c64e4efeea","unresolved":false,"context_lines":[{"line_number":206,"context_line":"        :param retry: flag that forces the middleware to retry"},{"line_number":207,"context_line":"                      user authentication when an indeterminate"},{"line_number":208,"context_line":"                      response is received. Optional."},{"line_number":209,"context_line":"        :param allow_expired: Allow retreving an expired token."},{"line_number":210,"context_line":"        :returns: access info received from identity server on success"},{"line_number":211,"context_line":"        :rtype: :py:class:`keystoneauth1.access.AccessInfo`"},{"line_number":212,"context_line":"        :raises exc.InvalidToken: if token is rejected"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a71b18c_2f6b67f2","line":209,"range":{"start_line":209,"start_character":36,"end_line":209,"end_character":45},"updated":"2016-12-06 02:49:24.000000000","message":"spelling","commit_id":"37a0fae9b91069ef70757dba513aea3bd7b37407"}],"keystonemiddleware/auth_token/_opts.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"f69c0d82b624c1edcb1dadee328066c64e4efeea","unresolved":false,"context_lines":[{"line_number":182,"context_line":"                \u0027 secure one. Once all the old tokens are expired this option\u0027"},{"line_number":183,"context_line":"                \u0027 should be set to a single value for better performance.\u0027),"},{"line_number":184,"context_line":"    cfg.ListOpt(\u0027service_token_policy\u0027, default\u003d[\u0027service\u0027],"},{"line_number":185,"context_line":"                help\u003d\u0027A policy check to apply for service tokens. Service\u0027"},{"line_number":186,"context_line":"                \u0027 tokens are allowed to request that an expired token can be\u0027"},{"line_number":187,"context_line":"                \u0027 used and so this check should tightly control that only\u0027"},{"line_number":188,"context_line":"                \u0027 actual services should be sending this token.\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"3a71b18c_2f1e075f","line":185,"range":{"start_line":185,"start_character":24,"end_line":185,"end_character":36},"updated":"2016-12-06 02:49:24.000000000","message":"but this isn\u0027t used as a policy check. It\u0027s a list of roles in conf, and nothing to do with policy.json. The name and comment should reflect that for clarity.","commit_id":"37a0fae9b91069ef70757dba513aea3bd7b37407"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"a0f2b80a455f1e1475babac49323ca416b3e57fd","unresolved":false,"context_lines":[{"line_number":182,"context_line":"                \u0027 secure one. Once all the old tokens are expired this option\u0027"},{"line_number":183,"context_line":"                \u0027 should be set to a single value for better performance.\u0027),"},{"line_number":184,"context_line":"    cfg.ListOpt(\u0027service_token_policy\u0027, default\u003d[\u0027service\u0027],"},{"line_number":185,"context_line":"                help\u003d\u0027A policy check to apply for service tokens. Service\u0027"},{"line_number":186,"context_line":"                \u0027 tokens are allowed to request that an expired token can be\u0027"},{"line_number":187,"context_line":"                \u0027 used and so this check should tightly control that only\u0027"},{"line_number":188,"context_line":"                \u0027 actual services should be sending this token.\u0027),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1a6eadb0_acfb32c0","line":185,"range":{"start_line":185,"start_character":24,"end_line":185,"end_character":36},"in_reply_to":"3a71b18c_2f1e075f","updated":"2016-12-14 22:10:52.000000000","message":"Yea, i\u0027ve gone back and forwards on this. Ideally this would be a oslo.policy check but there\u0027s dependency issues and questions about does this get loaded from a policy.json file or is it ok to have it be a rule in a config file. I guess i need to rename this.","commit_id":"37a0fae9b91069ef70757dba513aea3bd7b37407"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a0c9fa7f376dfd6bc80fa83774c6620623f8d7a3","unresolved":false,"context_lines":[{"line_number":189,"context_line":"                \u0027 Roles here are applied as an ANY check so any role in this\u0027"},{"line_number":190,"context_line":"                \u0027 list must be present. For backwards compatibility reasons\u0027"},{"line_number":191,"context_line":"                \u0027 this currently only affects the allow_expired check.\u0027),"},{"line_number":192,"context_line":"    cfg.BoolOpt(\u0027service_token_roles_required\u0027, default\u003dFalse,"},{"line_number":193,"context_line":"                help\u003d\u0027For backwards compatibility reasons we must let valid\u0027"},{"line_number":194,"context_line":"                \u0027 service tokens pass that don\\\u0027t pass the service_token_roles\u0027"},{"line_number":195,"context_line":"                \u0027 check as valid. Setting this true will become the default\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"1a6eadb0_ae7f79a9","line":192,"updated":"2016-12-15 17:57:53.000000000","message":"So this is really the security bit that we\u0027ll need to fix later on. As a deployer, I need to make sure my services, and only my service accounts, have the role defined in service_token_roles.\n\nThis is backwards incompatible because before we allowed *any* token to validate a user token? Or is this backward incompatible because we only want services to be able to use allow_expired?","commit_id":"4c6282ff70e22710ebf0c806d3ce8cc388e6510a"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"4fc5945fbb1a70ca13b95b6ce4118874149658e2","unresolved":false,"context_lines":[{"line_number":189,"context_line":"                \u0027 Roles here are applied as an ANY check so any role in this\u0027"},{"line_number":190,"context_line":"                \u0027 list must be present. For backwards compatibility reasons\u0027"},{"line_number":191,"context_line":"                \u0027 this currently only affects the allow_expired check.\u0027),"},{"line_number":192,"context_line":"    cfg.BoolOpt(\u0027service_token_roles_required\u0027, default\u003dFalse,"},{"line_number":193,"context_line":"                help\u003d\u0027For backwards compatibility reasons we must let valid\u0027"},{"line_number":194,"context_line":"                \u0027 service tokens pass that don\\\u0027t pass the service_token_roles\u0027"},{"line_number":195,"context_line":"                \u0027 check as valid. Setting this true will become the default\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"1a6eadb0_6b538917","line":192,"in_reply_to":"1a6eadb0_ae7f79a9","updated":"2016-12-15 21:58:10.000000000","message":"It\u0027s backwards incompatible because previously any valid token was allowed. \n\nFor the allowed_expired check we will always test the service_token_roles. Because this is new functionality it can\u0027t be backwards incompatible.","commit_id":"4c6282ff70e22710ebf0c806d3ce8cc388e6510a"}],"keystonemiddleware/tests/unit/auth_token/test_auth_token_middleware.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a0c9fa7f376dfd6bc80fa83774c6620623f8d7a3","unresolved":false,"context_lines":[{"line_number":1582,"context_line":""},{"line_number":1583,"context_line":"        resp \u003d self.call_middleware(headers\u003d{\u0027X-Service-Catalog\u0027: \u0027[]\u0027,"},{"line_number":1584,"context_line":"                                             \u0027X-Auth-Token\u0027: token,"},{"line_number":1585,"context_line":"                                             \u0027X-Service-Token\u0027: token})"},{"line_number":1586,"context_line":""},{"line_number":1587,"context_line":"        self.assertEqual(FakeApp.SUCCESS, resp.body)"},{"line_number":1588,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"1a6eadb0_82ae11e4","side":"PARENT","line":1585,"updated":"2016-12-15 17:57:53.000000000","message":"Ah - so this is essentially what deployments will have to do in order to enforce this.","commit_id":"29a879c0ed5d1af5dca0cf6fd0394487f97b1670"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a0c9fa7f376dfd6bc80fa83774c6620623f8d7a3","unresolved":false,"context_lines":[{"line_number":1372,"context_line":"                                    expected_status\u003d401)"},{"line_number":1373,"context_line":""},{"line_number":1374,"context_line":"        self.assertEqual(\u0027Invalid\u0027,"},{"line_number":1375,"context_line":"                         resp.request.headers[\u0027X-Service-Identity-Status\u0027])"},{"line_number":1376,"context_line":""},{"line_number":1377,"context_line":""},{"line_number":1378,"context_line":"class V2CertDownloadMiddlewareTest(BaseAuthTokenMiddlewareTest,"}],"source_content_type":"text/x-python","patch_set":9,"id":"1a6eadb0_8267f1e7","line":1375,"updated":"2016-12-15 17:57:53.000000000","message":"Nice tests.","commit_id":"4c6282ff70e22710ebf0c806d3ce8cc388e6510a"}],"releasenotes/notes/allow-expired-5ddbabcffc5678af.yaml":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"67d25117cb7975e5b62e4334b76027e62354681e","unresolved":false,"context_lines":[{"line_number":6,"context_line":"features:"},{"line_number":7,"context_line":"  - AuthToken middleware will now allow fetching an expired token when a valid"},{"line_number":8,"context_line":"    service token is present. This service token must contain any one of the"},{"line_number":9,"context_line":"    roles specified in `service_token_roles`."},{"line_number":10,"context_line":"  - Service tokens are compared against a list of possible service_token_roles"},{"line_number":11,"context_line":"    for validity. This will ensure that only services are submitting tokens as"},{"line_number":12,"context_line":"    an `X-Service-Token`. For backwards compatibility this currently only"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"1a6eadb0_dbdadee7","line":9,"range":{"start_line":9,"start_character":20,"end_line":9,"end_character":44},"updated":"2016-12-15 01:01:54.000000000","message":"in the configuration option ``service_token_roles``.\n\ni like double backticks for options and values since they render more prominently (rather than single backticks which are just italics)","commit_id":"f073b807c6591642e63dd508ef15b008659039b3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"67d25117cb7975e5b62e4334b76027e62354681e","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  - AuthToken middleware will now allow fetching an expired token when a valid"},{"line_number":8,"context_line":"    service token is present. This service token must contain any one of the"},{"line_number":9,"context_line":"    roles specified in `service_token_roles`."},{"line_number":10,"context_line":"  - Service tokens are compared against a list of possible service_token_roles"},{"line_number":11,"context_line":"    for validity. This will ensure that only services are submitting tokens as"},{"line_number":12,"context_line":"    an `X-Service-Token`. For backwards compatibility this currently only"},{"line_number":13,"context_line":"    produces a warning unless you enable `service_token_roles_required` which"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"1a6eadb0_fbe31aa2","line":10,"range":{"start_line":10,"start_character":59,"end_line":10,"end_character":78},"updated":"2016-12-15 01:01:54.000000000","message":"``service_token_roles``","commit_id":"f073b807c6591642e63dd508ef15b008659039b3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"67d25117cb7975e5b62e4334b76027e62354681e","unresolved":false,"context_lines":[{"line_number":10,"context_line":"  - Service tokens are compared against a list of possible service_token_roles"},{"line_number":11,"context_line":"    for validity. This will ensure that only services are submitting tokens as"},{"line_number":12,"context_line":"    an `X-Service-Token`. For backwards compatibility this currently only"},{"line_number":13,"context_line":"    produces a warning unless you enable `service_token_roles_required` which"},{"line_number":14,"context_line":"    will become the default in future releases."},{"line_number":15,"context_line":"upgrade:"},{"line_number":16,"context_line":"  - You should set the `service_token_roles` to a list of roles that your"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"1a6eadb0_9beb0678","line":13,"range":{"start_line":13,"start_character":41,"end_line":13,"end_character":71},"updated":"2016-12-15 01:01:54.000000000","message":"the configuration option ````service_token_roles_required``","commit_id":"f073b807c6591642e63dd508ef15b008659039b3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"67d25117cb7975e5b62e4334b76027e62354681e","unresolved":false,"context_lines":[{"line_number":14,"context_line":"    will become the default in future releases."},{"line_number":15,"context_line":"upgrade:"},{"line_number":16,"context_line":"  - You should set the `service_token_roles` to a list of roles that your"},{"line_number":17,"context_line":"    services may have. The likely list is \u0027service\u0027 or \u0027admin\u0027. Any"},{"line_number":18,"context_line":"    `service_token_roles` may apply to accept the service token. You should"},{"line_number":19,"context_line":"    ensure that your service users have one of these roles so that interservice"},{"line_number":20,"context_line":"    communication continues to work correclty. When this is verified set the"}],"source_content_type":"text/x-yaml","patch_set":5,"id":"1a6eadb0_7b9d4a09","line":17,"range":{"start_line":17,"start_character":42,"end_line":17,"end_character":62},"updated":"2016-12-15 01:01:54.000000000","message":"use double backticks for service and admin","commit_id":"f073b807c6591642e63dd508ef15b008659039b3"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"00eec6d609e1a6d0eab07e9aa5ca168728944613","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    services may have. The likely list is ``service`` or ``admin``. Any"},{"line_number":19,"context_line":"    ``service_token_roles`` may apply to accept the service token. You should"},{"line_number":20,"context_line":"    ensure that your service users have one of these roles so that interservice"},{"line_number":21,"context_line":"    communication continues to work correclty. When this is verified set the"},{"line_number":22,"context_line":"    ``service_token_roles_required`` flag to `True` to enforce the behaviour."},{"line_number":23,"context_line":"    This will become the default setting in future releases."},{"line_number":24,"context_line":"deprecations:"}],"source_content_type":"text/x-yaml","patch_set":7,"id":"1a6eadb0_fa37744a","line":21,"range":{"start_line":21,"start_character":36,"end_line":21,"end_character":45},"updated":"2016-12-15 14:57:56.000000000","message":"spelling","commit_id":"b4e0dd8b944a4f8be4b7bc84a42f336d1f025daa"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"00eec6d609e1a6d0eab07e9aa5ca168728944613","unresolved":false,"context_lines":[{"line_number":24,"context_line":"deprecations:"},{"line_number":25,"context_line":"  - For backwards compatibility the ``service_token_roles_required`` option in"},{"line_number":26,"context_line":"    ``[keystone_authtoken]`` is added with the default as `False` and the `False`"},{"line_number":27,"context_line":"    settings is immediately deprecated. This will allow the current behaviour"},{"line_number":28,"context_line":"    that service tokens are validated but not checked for roles to continue but"},{"line_number":29,"context_line":"    should be set to `True` and will become the default in future releases."}],"source_content_type":"text/x-yaml","patch_set":7,"id":"1a6eadb0_7a1b64ca","line":27,"range":{"start_line":27,"start_character":4,"end_line":27,"end_character":12},"updated":"2016-12-15 14:57:56.000000000","message":"\"settings\" should be singular \"setting\"","commit_id":"b4e0dd8b944a4f8be4b7bc84a42f336d1f025daa"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"00eec6d609e1a6d0eab07e9aa5ca168728944613","unresolved":false,"context_lines":[{"line_number":26,"context_line":"    ``[keystone_authtoken]`` is added with the default as `False` and the `False`"},{"line_number":27,"context_line":"    settings is immediately deprecated. This will allow the current behaviour"},{"line_number":28,"context_line":"    that service tokens are validated but not checked for roles to continue but"},{"line_number":29,"context_line":"    should be set to `True` and will become the default in future releases."}],"source_content_type":"text/x-yaml","patch_set":7,"id":"1a6eadb0_bacdfc32","line":29,"range":{"start_line":29,"start_character":28,"end_line":29,"end_character":31},"updated":"2016-12-15 14:57:56.000000000","message":"s/and/which/","commit_id":"b4e0dd8b944a4f8be4b7bc84a42f336d1f025daa"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"80a3d3dd52bb9553eb95e14a58e78b275052b556","unresolved":false,"context_lines":[{"line_number":10,"context_line":"  - Service tokens are compared against a list of possible roles for validity."},{"line_number":11,"context_line":"    This will ensure that only services are submitting tokens as an"},{"line_number":12,"context_line":"    ``X-Service-Token``."},{"line_number":13,"context_line":"    For backwards compatibility, if ``service_token_roles`` is not set, a warning"},{"line_number":14,"context_line":"    will be emitted. To enforce the check properly, set"},{"line_number":15,"context_line":"    ``service_token_roles_required`` to ``True``. It currently defaults to"},{"line_number":16,"context_line":"    ``False``"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"1a6eadb0_5f9cd55c","line":13,"range":{"start_line":13,"start_character":38,"end_line":13,"end_character":57},"updated":"2016-12-15 16:04:56.000000000","message":"should be ``service_token_roles_required``. You don\u0027t actually have to set ``service_token_roles``, since that has a default.","commit_id":"bd2ec1c85af360f988b6a8d2dc2329c43544d237"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"80a3d3dd52bb9553eb95e14a58e78b275052b556","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    behaviour. This will become the default setting in future releases."},{"line_number":24,"context_line":"deprecations:"},{"line_number":25,"context_line":"  - For backwards compatibility the ``service_token_roles_required`` option in"},{"line_number":26,"context_line":"    ``[keystone_authtoken]`` was added. The option defaults to ``False`` and is"},{"line_number":27,"context_line":"    and has been immediately deprecated. This will allow the current behaviour"},{"line_number":28,"context_line":"    that service tokens are validated but not checked for roles to continue."},{"line_number":29,"context_line":"    The option should be set to ``True`` as soon as possible. The option will"},{"line_number":30,"context_line":"    default to ``True`` in a future release."}],"source_content_type":"text/x-yaml","patch_set":8,"id":"1a6eadb0_1f197dd7","line":27,"range":{"start_line":26,"start_character":73,"end_line":27,"end_character":16},"updated":"2016-12-15 16:04:56.000000000","message":"either \"and is\" or \"and has been\", but not both","commit_id":"bd2ec1c85af360f988b6a8d2dc2329c43544d237"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a0c9fa7f376dfd6bc80fa83774c6620623f8d7a3","unresolved":false,"context_lines":[{"line_number":13,"context_line":"    For backwards compatibility, if ``service_token_roles_required`` is not set,"},{"line_number":14,"context_line":"    a warning will be emitted. To enforce the check properly, set"},{"line_number":15,"context_line":"    ``service_token_roles_required`` to ``True``. It currently defaults to"},{"line_number":16,"context_line":"    ``False``"},{"line_number":17,"context_line":"upgrade:"},{"line_number":18,"context_line":"  - Set the ``service_token_roles`` to a list of roles that services may have."},{"line_number":19,"context_line":"    The likely list is ``service`` or ``admin``. Any ``service_token_roles`` may"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"1a6eadb0_4244f919","line":16,"updated":"2016-12-15 17:57:53.000000000","message":"We will need to reach out to folks  to see how long it would take to make this default to True without breaking a bunch of people.\n\nDo we have any pulse on when that would be, or is there an action item to hit up the mailing list?","commit_id":"4c6282ff70e22710ebf0c806d3ce8cc388e6510a"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"4fc5945fbb1a70ca13b95b6ce4118874149658e2","unresolved":false,"context_lines":[{"line_number":13,"context_line":"    For backwards compatibility, if ``service_token_roles_required`` is not set,"},{"line_number":14,"context_line":"    a warning will be emitted. To enforce the check properly, set"},{"line_number":15,"context_line":"    ``service_token_roles_required`` to ``True``. It currently defaults to"},{"line_number":16,"context_line":"    ``False``"},{"line_number":17,"context_line":"upgrade:"},{"line_number":18,"context_line":"  - Set the ``service_token_roles`` to a list of roles that services may have."},{"line_number":19,"context_line":"    The likely list is ``service`` or ``admin``. Any ``service_token_roles`` may"}],"source_content_type":"text/x-yaml","patch_set":9,"id":"1a6eadb0_eb707974","line":16,"in_reply_to":"1a6eadb0_4244f919","updated":"2016-12-15 21:58:10.000000000","message":"Not really, I think it\u0027s an easy and acceptable change to make we just need to get people to understand it. I think the warnings are pretty strong.","commit_id":"4c6282ff70e22710ebf0c806d3ce8cc388e6510a"}]}