)]}'
{"etc/keystone.conf.sample":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"fcd1eab5a578dd03c3a8b463903fa8f7c24df3e9","unresolved":false,"context_lines":[{"line_number":151,"context_line":"#rpc_conn_pool_size\u003d30"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"# Qpid broker hostname. (string value)"},{"line_number":154,"context_line":"#qpid_hostname\u003dkeystone"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"# Qpid broker port. (integer value)"},{"line_number":157,"context_line":"#qpid_port\u003d5672"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"5a890539_17e8eee0","line":154,"updated":"2014-12-04 01:53:00.000000000","message":"I think we want these to be localhost... revert these changes and we\u0027ll have to figure out why this is getting replaced separately.","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"ce810f5e5ccea1577e6524d00f73dd3c13cbb272","unresolved":false,"context_lines":[{"line_number":151,"context_line":"#rpc_conn_pool_size\u003d30"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"# Qpid broker hostname. (string value)"},{"line_number":154,"context_line":"#qpid_hostname\u003dkeystone"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"# Qpid broker port. (integer value)"},{"line_number":157,"context_line":"#qpid_port\u003d5672"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"5a890539_456e3730","line":154,"in_reply_to":"5a890539_17e8eee0","updated":"2014-12-04 07:44:45.000000000","message":"Done","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"fcd1eab5a578dd03c3a8b463903fa8f7c24df3e9","unresolved":false,"context_lines":[{"line_number":212,"context_line":""},{"line_number":213,"context_line":"# The RabbitMQ broker address where a single node is used."},{"line_number":214,"context_line":"# (string value)"},{"line_number":215,"context_line":"#rabbit_host\u003dkeystone"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"# The RabbitMQ broker port where a single node is used."},{"line_number":218,"context_line":"# (integer value)"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"5a890539_57eef6ed","line":215,"updated":"2014-12-04 01:53:00.000000000","message":"revert","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"ce810f5e5ccea1577e6524d00f73dd3c13cbb272","unresolved":false,"context_lines":[{"line_number":212,"context_line":""},{"line_number":213,"context_line":"# The RabbitMQ broker address where a single node is used."},{"line_number":214,"context_line":"# (string value)"},{"line_number":215,"context_line":"#rabbit_host\u003dkeystone"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"# The RabbitMQ broker port where a single node is used."},{"line_number":218,"context_line":"# (integer value)"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"5a890539_85749ffe","line":215,"in_reply_to":"5a890539_57eef6ed","updated":"2014-12-04 07:44:45.000000000","message":"Done","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"ce810f5e5ccea1577e6524d00f73dd3c13cbb272","unresolved":false,"context_lines":[{"line_number":670,"context_line":"# Deprecated group/name - [DATABASE]/sql_max_pool_size"},{"line_number":671,"context_line":"#max_pool_size\u003d\u003cNone\u003e"},{"line_number":672,"context_line":""},{"line_number":673,"context_line":"# Maximum number of database connection retries during"},{"line_number":674,"context_line":"# startup. Set to -1 to specify an infinite retry count."},{"line_number":675,"context_line":"# (integer value)"},{"line_number":676,"context_line":"# Deprecated group/name - [DEFAULT]/sql_max_retries"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"5a890539_05cfcf29","line":673,"updated":"2014-12-04 07:44:45.000000000","message":"I\u0027ll revert this also because this is not related to my changes. And I\u0027m wondering that so many changes in this file","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"fcd1eab5a578dd03c3a8b463903fa8f7c24df3e9","unresolved":false,"context_lines":[{"line_number":871,"context_line":"#"},{"line_number":872,"context_line":""},{"line_number":873,"context_line":"# URL for connecting to the LDAP server. (string value)"},{"line_number":874,"context_line":"#url\u003dldap://keystone"},{"line_number":875,"context_line":""},{"line_number":876,"context_line":"# User BindDN to query the LDAP server. (string value)"},{"line_number":877,"context_line":"#user\u003d\u003cNone\u003e"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"5a890539_f7b442f2","line":874,"updated":"2014-12-04 01:53:00.000000000","message":"revert","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"ce810f5e5ccea1577e6524d00f73dd3c13cbb272","unresolved":false,"context_lines":[{"line_number":871,"context_line":"#"},{"line_number":872,"context_line":""},{"line_number":873,"context_line":"# URL for connecting to the LDAP server. (string value)"},{"line_number":874,"context_line":"#url\u003dldap://keystone"},{"line_number":875,"context_line":""},{"line_number":876,"context_line":"# User BindDN to query the LDAP server. (string value)"},{"line_number":877,"context_line":"#user\u003d\u003cNone\u003e"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"5a890539_a56fdb26","line":874,"in_reply_to":"5a890539_f7b442f2","updated":"2014-12-04 07:44:45.000000000","message":"Done","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"fcd1eab5a578dd03c3a8b463903fa8f7c24df3e9","unresolved":false,"context_lines":[{"line_number":1498,"context_line":""},{"line_number":1499,"context_line":"# SSL certificate subject (auto generated certificate)."},{"line_number":1500,"context_line":"# (string value)"},{"line_number":1501,"context_line":"#cert_subject\u003d/C\u003dUS/ST\u003dUnset/L\u003dUnset/O\u003dUnset/CN\u003dkeystone"},{"line_number":1502,"context_line":""},{"line_number":1503,"context_line":""},{"line_number":1504,"context_line":"[token]"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"5a890539_17cf0e80","line":1501,"updated":"2014-12-04 01:53:00.000000000","message":"revert","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"ce810f5e5ccea1577e6524d00f73dd3c13cbb272","unresolved":false,"context_lines":[{"line_number":1498,"context_line":""},{"line_number":1499,"context_line":"# SSL certificate subject (auto generated certificate)."},{"line_number":1500,"context_line":"# (string value)"},{"line_number":1501,"context_line":"#cert_subject\u003d/C\u003dUS/ST\u003dUnset/L\u003dUnset/O\u003dUnset/CN\u003dkeystone"},{"line_number":1502,"context_line":""},{"line_number":1503,"context_line":""},{"line_number":1504,"context_line":"[token]"}],"source_content_type":"application/octet-stream","patch_set":10,"id":"5a890539_c561473a","line":1501,"in_reply_to":"5a890539_17cf0e80","updated":"2014-12-04 07:44:45.000000000","message":"Done","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"}],"keystone/common/config.py":[{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"4e4591619b74160546e31e45aa12d9110c04271c","unresolved":false,"context_lines":[{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP Header that will be used to determine which \u0027"},{"line_number":146,"context_line":"                        \u0027the original request protocol scheme was, even if it \u0027"},{"line_number":147,"context_line":"                        \u0027was removed by an SSL terminator proxy.\u0027)],"},{"line_number":148,"context_line":"    \u0027identity\u0027: ["},{"line_number":149,"context_line":"        cfg.StrOpt(\u0027default_domain_id\u0027, default\u003d\u0027default\u0027,"},{"line_number":150,"context_line":"                   help\u003d\u0027This references the domain to use for all \u0027"},{"line_number":151,"context_line":"                        \u0027Identity API v2 requests (which are not aware of \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a8c0949_3cce5a5b","line":148,"updated":"2014-10-31 13:15:33.000000000","message":"Is there a way we can take the whole URL from this? not just the protocol. \n\nIf my load balancer is at https://keystone.public/ and my internal sites are like http://int-keystone.int/XXX then i want the keystone.public URL to be the one returned by the version request - not just the scheme to change.","commit_id":"e29a1da8cd811048232a2cc2b754722327fd4cd3"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"ed55a8f9d0f88c4e07932ae0d5385c24065f42a1","unresolved":false,"context_lines":[{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP Header that will be used to determine which \u0027"},{"line_number":146,"context_line":"                        \u0027the original request protocol scheme was, even if it \u0027"},{"line_number":147,"context_line":"                        \u0027was removed by an SSL terminator proxy.\u0027)],"},{"line_number":148,"context_line":"    \u0027identity\u0027: ["},{"line_number":149,"context_line":"        cfg.StrOpt(\u0027default_domain_id\u0027, default\u003d\u0027default\u0027,"},{"line_number":150,"context_line":"                   help\u003d\u0027This references the domain to use for all \u0027"},{"line_number":151,"context_line":"                        \u0027Identity API v2 requests (which are not aware of \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a8c0949_8de4763c","line":148,"in_reply_to":"7a8c0949_1202653e","updated":"2014-10-31 14:34:46.000000000","message":"This problem occurs in our deployment. And I thought same problem presents in general deployment with load balancer. But in fact I haven\u0027t information about other private deployments.\nFor me - it\u0027s logical to build deployment with \u0027https\u0027 for public url and \u0027https\u0027 for private url.","commit_id":"e29a1da8cd811048232a2cc2b754722327fd4cd3"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"84026ba0bc8fa26a19183d3c13a5d664162ed8a3","unresolved":false,"context_lines":[{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP Header that will be used to determine which \u0027"},{"line_number":146,"context_line":"                        \u0027the original request protocol scheme was, even if it \u0027"},{"line_number":147,"context_line":"                        \u0027was removed by an SSL terminator proxy.\u0027)],"},{"line_number":148,"context_line":"    \u0027identity\u0027: ["},{"line_number":149,"context_line":"        cfg.StrOpt(\u0027default_domain_id\u0027, default\u003d\u0027default\u0027,"},{"line_number":150,"context_line":"                   help\u003d\u0027This references the domain to use for all \u0027"},{"line_number":151,"context_line":"                        \u0027Identity API v2 requests (which are not aware of \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a8c0949_6f7e62b0","line":148,"in_reply_to":"7a8c0949_3cce5a5b","updated":"2014-10-31 13:54:25.000000000","message":"why I should to public url with https if I go to internal URL?\nload balancer changes only scheme of request and doesn\u0027t change host.\nso host_url variable of request.evironment dictionary set to right hostname for the response.","commit_id":"e29a1da8cd811048232a2cc2b754722327fd4cd3"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"68ce48688035d41ee598364f63d485e2612312dc","unresolved":false,"context_lines":[{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP Header that will be used to determine which \u0027"},{"line_number":146,"context_line":"                        \u0027the original request protocol scheme was, even if it \u0027"},{"line_number":147,"context_line":"                        \u0027was removed by an SSL terminator proxy.\u0027)],"},{"line_number":148,"context_line":"    \u0027identity\u0027: ["},{"line_number":149,"context_line":"        cfg.StrOpt(\u0027default_domain_id\u0027, default\u003d\u0027default\u0027,"},{"line_number":150,"context_line":"                   help\u003d\u0027This references the domain to use for all \u0027"},{"line_number":151,"context_line":"                        \u0027Identity API v2 requests (which are not aware of \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a8c0949_1202653e","line":148,"in_reply_to":"7a8c0949_6f7e62b0","updated":"2014-10-31 14:23:04.000000000","message":"is that in general or in your deployment?","commit_id":"e29a1da8cd811048232a2cc2b754722327fd4cd3"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"7642fe08ed8e06b1320e21887f59094d3ce2fcae","unresolved":false,"context_lines":[{"line_number":142,"context_line":"                         \u0027maximum length.\u0027),"},{"line_number":143,"context_line":"        cfg.StrOpt(\u0027secure_proxy_ssl_header\u0027,"},{"line_number":144,"context_line":"                   default\u003d\u0027HTTP_X_FORWARDED_PROTO\u0027,"},{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP Header that will be used to determine which \u0027"},{"line_number":146,"context_line":"                        \u0027the original request protocol scheme was, even if it \u0027"},{"line_number":147,"context_line":"                        \u0027was removed by an SSL terminator proxy.\u0027)],"},{"line_number":148,"context_line":"    \u0027identity\u0027: ["}],"source_content_type":"text/x-python","patch_set":6,"id":"5a890539_3538a6d2","line":145,"updated":"2014-11-24 17:26:44.000000000","message":"Suggest: \"The HTTP header used to determine the scheme for the original request, even if it was removed by an SSL terminating proxy.\"","commit_id":"4c27cb39d5af6087cc700d5dca50718e77cb8fd3"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"fec6d5a62367f7b5a138a99b3e0eee494cb71e6a","unresolved":false,"context_lines":[{"line_number":142,"context_line":"                         \u0027maximum length.\u0027),"},{"line_number":143,"context_line":"        cfg.StrOpt(\u0027secure_proxy_ssl_header\u0027,"},{"line_number":144,"context_line":"                   default\u003d\u0027HTTP_X_FORWARDED_PROTO\u0027,"},{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP Header that will be used to determine which \u0027"},{"line_number":146,"context_line":"                        \u0027the original request protocol scheme was, even if it \u0027"},{"line_number":147,"context_line":"                        \u0027was removed by an SSL terminator proxy.\u0027)],"},{"line_number":148,"context_line":"    \u0027identity\u0027: ["}],"source_content_type":"text/x-python","patch_set":6,"id":"5a890539_6317d445","line":145,"in_reply_to":"5a890539_3538a6d2","updated":"2014-11-24 18:28:11.000000000","message":"Done","commit_id":"4c27cb39d5af6087cc700d5dca50718e77cb8fd3"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"222447545a1e2ea5d1b79e94b6860587e0159be2","unresolved":false,"context_lines":[{"line_number":141,"context_line":"                         \u0027passwords are automatically truncated to the \u0027"},{"line_number":142,"context_line":"                         \u0027maximum length.\u0027),"},{"line_number":143,"context_line":"        cfg.StrOpt(\u0027secure_proxy_ssl_header\u0027,"},{"line_number":144,"context_line":"                   default\u003d\u0027HTTP_X_FORWARDED_PROTO\u0027,"},{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":146,"context_line":"                        \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":147,"context_line":"                        \u0027terminating proxy.\u0027)],"}],"source_content_type":"text/x-python","patch_set":7,"id":"5a890539_ac1d2464","line":144,"updated":"2014-11-24 23:40:18.000000000","message":"The config option should default to None and the server code should be changed so that if the config option is None then it won\u0027t check any headers. Since headers can be sent by the client the server shouldn\u0027t trust it by default.","commit_id":"095959fb6fb236935fb192267819550031fe264d"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"9b826325d9530453bccef78b75ab291badb1f36f","unresolved":false,"context_lines":[{"line_number":141,"context_line":"                         \u0027passwords are automatically truncated to the \u0027"},{"line_number":142,"context_line":"                         \u0027maximum length.\u0027),"},{"line_number":143,"context_line":"        cfg.StrOpt(\u0027secure_proxy_ssl_header\u0027,"},{"line_number":144,"context_line":"                   default\u003d\u0027HTTP_X_FORWARDED_PROTO\u0027,"},{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":146,"context_line":"                        \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":147,"context_line":"                        \u0027terminating proxy.\u0027)],"}],"source_content_type":"text/x-python","patch_set":7,"id":"5a890539_98a8a121","line":144,"in_reply_to":"5a890539_ac1d2464","updated":"2014-11-25 05:27:20.000000000","message":"Done","commit_id":"095959fb6fb236935fb192267819550031fe264d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df8c6cd045766b9abbf467832b1216440459aa4c","unresolved":false,"context_lines":[{"line_number":141,"context_line":"                         \u0027passwords are automatically truncated to the \u0027"},{"line_number":142,"context_line":"                         \u0027maximum length.\u0027),"},{"line_number":143,"context_line":"        cfg.StrOpt(\u0027secure_proxy_ssl_header\u0027,"},{"line_number":144,"context_line":"                   default\u003dNone,"},{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":146,"context_line":"                        \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":147,"context_line":"                        \u0027terminating proxy.\u0027)],"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_67b909ec","line":144,"updated":"2014-12-01 01:13:12.000000000","message":"can remove this since it\u0027s the default. Somebody recently went through and removed these so let\u0027s not add a new one.","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"85c5300343365a71c88f31cf4a509ce599dd4a5c","unresolved":false,"context_lines":[{"line_number":141,"context_line":"                         \u0027passwords are automatically truncated to the \u0027"},{"line_number":142,"context_line":"                         \u0027maximum length.\u0027),"},{"line_number":143,"context_line":"        cfg.StrOpt(\u0027secure_proxy_ssl_header\u0027,"},{"line_number":144,"context_line":"                   default\u003dNone,"},{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":146,"context_line":"                        \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":147,"context_line":"                        \u0027terminating proxy.\u0027)],"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_dd0e0e8c","line":144,"in_reply_to":"5a890539_67b909ec","updated":"2014-12-01 08:58:24.000000000","message":"Done","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df8c6cd045766b9abbf467832b1216440459aa4c","unresolved":false,"context_lines":[{"line_number":144,"context_line":"                   default\u003dNone,"},{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":146,"context_line":"                        \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":147,"context_line":"                        \u0027terminating proxy.\u0027)],"},{"line_number":148,"context_line":"    \u0027identity\u0027: ["},{"line_number":149,"context_line":"        cfg.StrOpt(\u0027default_domain_id\u0027, default\u003d\u0027default\u0027,"},{"line_number":150,"context_line":"                   help\u003d\u0027This references the domain to use for all \u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_47c24d54","line":147,"updated":"2014-12-01 01:13:12.000000000","message":"It would be useful to have an example of a typical value, \"HTTP_X_FORWARDED_PROTO\"","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"85c5300343365a71c88f31cf4a509ce599dd4a5c","unresolved":false,"context_lines":[{"line_number":144,"context_line":"                   default\u003dNone,"},{"line_number":145,"context_line":"                   help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":146,"context_line":"                        \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":147,"context_line":"                        \u0027terminating proxy.\u0027)],"},{"line_number":148,"context_line":"    \u0027identity\u0027: ["},{"line_number":149,"context_line":"        cfg.StrOpt(\u0027default_domain_id\u0027, default\u003d\u0027default\u0027,"},{"line_number":150,"context_line":"                   help\u003d\u0027This references the domain to use for all \u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_fd24aa0f","line":147,"in_reply_to":"5a890539_47c24d54","updated":"2014-12-01 08:58:24.000000000","message":"Done","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"fcd1eab5a578dd03c3a8b463903fa8f7c24df3e9","unresolved":false,"context_lines":[{"line_number":144,"context_line":"                   help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":145,"context_line":"                        \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":146,"context_line":"                        \u0027terminating proxy. Typical value is \u0027"},{"line_number":147,"context_line":"                        \u0027\"HTTP_X_FORWARDED_PROTO\".\u0027)],"},{"line_number":148,"context_line":"    \u0027identity\u0027: ["},{"line_number":149,"context_line":"        cfg.StrOpt(\u0027default_domain_id\u0027, default\u003d\u0027default\u0027,"},{"line_number":150,"context_line":"                   help\u003d\u0027This references the domain to use for all \u0027"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a890539_7764d2b2","line":147,"updated":"2014-12-04 01:53:00.000000000","message":"(nit) could leave the , at the end of the list since then it\u0027s easier to change the code.","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"ce810f5e5ccea1577e6524d00f73dd3c13cbb272","unresolved":false,"context_lines":[{"line_number":144,"context_line":"                   help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":145,"context_line":"                        \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":146,"context_line":"                        \u0027terminating proxy. Typical value is \u0027"},{"line_number":147,"context_line":"                        \u0027\"HTTP_X_FORWARDED_PROTO\".\u0027)],"},{"line_number":148,"context_line":"    \u0027identity\u0027: ["},{"line_number":149,"context_line":"        cfg.StrOpt(\u0027default_domain_id\u0027, default\u003d\u0027default\u0027,"},{"line_number":150,"context_line":"                   help\u003d\u0027This references the domain to use for all \u0027"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a890539_65fed339","line":147,"in_reply_to":"5a890539_7764d2b2","updated":"2014-12-04 07:44:45.000000000","message":"Done. formatted like sections below","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"fbaede0cf23a1e44b2c8791d772ca06ae388752d","unresolved":false,"context_lines":[{"line_number":145,"context_line":"                         \u0027passwords are automatically truncated to the \u0027"},{"line_number":146,"context_line":"                         \u0027maximum length.\u0027),"},{"line_number":147,"context_line":"        cfg.StrOpt(\u0027secure_proxy_ssl_header\u0027,"},{"line_number":148,"context_line":"                   default\u003dNone,"},{"line_number":149,"context_line":"                   help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":150,"context_line":"                        \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":151,"context_line":"                        \u0027terminating proxy.\u0027)],"}],"source_content_type":"text/x-python","patch_set":12,"id":"3a961159_b02434b3","line":148,"updated":"2014-12-28 17:59:21.000000000","message":"why was this line added back?","commit_id":"61beb3641a936b98b7e2eb418c2d42ea9e957699"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"d59b335c819e543a38c715b0a1a9e1290b32fd11","unresolved":false,"context_lines":[{"line_number":145,"context_line":"                         \u0027passwords are automatically truncated to the \u0027"},{"line_number":146,"context_line":"                         \u0027maximum length.\u0027),"},{"line_number":147,"context_line":"        cfg.StrOpt(\u0027secure_proxy_ssl_header\u0027,"},{"line_number":148,"context_line":"                   default\u003dNone,"},{"line_number":149,"context_line":"                   help\u003d\u0027The HTTP header used to determine the scheme for the \u0027"},{"line_number":150,"context_line":"                        \u0027original request, even if it was removed by an SSL \u0027"},{"line_number":151,"context_line":"                        \u0027terminating proxy.\u0027)],"}],"source_content_type":"text/x-python","patch_set":12,"id":"3a961159_70600cd0","line":148,"in_reply_to":"3a961159_b02434b3","updated":"2014-12-28 18:11:48.000000000","message":"thanks for point me to this. automatic merge was very strange and incorrect.","commit_id":"61beb3641a936b98b7e2eb418c2d42ea9e957699"}],"keystone/common/wsgi.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"222447545a1e2ea5d1b79e94b6860587e0159be2","unresolved":false,"context_lines":[{"line_number":196,"context_line":"        context[\u0027query_string\u0027] \u003d dict(six.iteritems(req.params))"},{"line_number":197,"context_line":"        context[\u0027headers\u0027] \u003d dict(six.iteritems(req.headers))"},{"line_number":198,"context_line":"        context[\u0027path\u0027] \u003d req.environ[\u0027PATH_INFO\u0027]"},{"line_number":199,"context_line":"        scheme \u003d req.environ.get(CONF[\u0027secure_proxy_ssl_header\u0027])"},{"line_number":200,"context_line":"        if scheme:"},{"line_number":201,"context_line":"            req.environ[\u0027wsgi.url_scheme\u0027] \u003d scheme"},{"line_number":202,"context_line":"        context[\u0027host_url\u0027] \u003d req.host_url"}],"source_content_type":"text/x-python","patch_set":7,"id":"5a890539_4c45a041","line":199,"updated":"2014-11-24 23:40:18.000000000","message":"use CONF.secure_proxy_ssl_header for consistency.","commit_id":"095959fb6fb236935fb192267819550031fe264d"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"9b826325d9530453bccef78b75ab291badb1f36f","unresolved":false,"context_lines":[{"line_number":196,"context_line":"        context[\u0027query_string\u0027] \u003d dict(six.iteritems(req.params))"},{"line_number":197,"context_line":"        context[\u0027headers\u0027] \u003d dict(six.iteritems(req.headers))"},{"line_number":198,"context_line":"        context[\u0027path\u0027] \u003d req.environ[\u0027PATH_INFO\u0027]"},{"line_number":199,"context_line":"        scheme \u003d req.environ.get(CONF[\u0027secure_proxy_ssl_header\u0027])"},{"line_number":200,"context_line":"        if scheme:"},{"line_number":201,"context_line":"            req.environ[\u0027wsgi.url_scheme\u0027] \u003d scheme"},{"line_number":202,"context_line":"        context[\u0027host_url\u0027] \u003d req.host_url"}],"source_content_type":"text/x-python","patch_set":7,"id":"5a890539_186cb107","line":199,"in_reply_to":"5a890539_4c45a041","updated":"2014-11-25 05:27:20.000000000","message":"Done","commit_id":"095959fb6fb236935fb192267819550031fe264d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"222447545a1e2ea5d1b79e94b6860587e0159be2","unresolved":false,"context_lines":[{"line_number":198,"context_line":"        context[\u0027path\u0027] \u003d req.environ[\u0027PATH_INFO\u0027]"},{"line_number":199,"context_line":"        scheme \u003d req.environ.get(CONF[\u0027secure_proxy_ssl_header\u0027])"},{"line_number":200,"context_line":"        if scheme:"},{"line_number":201,"context_line":"            req.environ[\u0027wsgi.url_scheme\u0027] \u003d scheme"},{"line_number":202,"context_line":"        context[\u0027host_url\u0027] \u003d req.host_url"},{"line_number":203,"context_line":"        params \u003d req.environ.get(PARAMS_ENV, {})"},{"line_number":204,"context_line":"        # authentication and authorization attributes are set as environment"}],"source_content_type":"text/x-python","patch_set":7,"id":"5a890539_8cef881d","line":201,"updated":"2014-11-24 23:40:18.000000000","message":"It would be nice to have a comment that explains what this does and why it works.","commit_id":"095959fb6fb236935fb192267819550031fe264d"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"9b826325d9530453bccef78b75ab291badb1f36f","unresolved":false,"context_lines":[{"line_number":198,"context_line":"        context[\u0027path\u0027] \u003d req.environ[\u0027PATH_INFO\u0027]"},{"line_number":199,"context_line":"        scheme \u003d req.environ.get(CONF[\u0027secure_proxy_ssl_header\u0027])"},{"line_number":200,"context_line":"        if scheme:"},{"line_number":201,"context_line":"            req.environ[\u0027wsgi.url_scheme\u0027] \u003d scheme"},{"line_number":202,"context_line":"        context[\u0027host_url\u0027] \u003d req.host_url"},{"line_number":203,"context_line":"        params \u003d req.environ.get(PARAMS_ENV, {})"},{"line_number":204,"context_line":"        # authentication and authorization attributes are set as environment"}],"source_content_type":"text/x-python","patch_set":7,"id":"5a890539_db4f8369","line":201,"in_reply_to":"5a890539_8cef881d","updated":"2014-11-25 05:27:20.000000000","message":"Done","commit_id":"095959fb6fb236935fb192267819550031fe264d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df8c6cd045766b9abbf467832b1216440459aa4c","unresolved":false,"context_lines":[{"line_number":196,"context_line":"        context[\u0027query_string\u0027] \u003d dict(six.iteritems(req.params))"},{"line_number":197,"context_line":"        context[\u0027headers\u0027] \u003d dict(six.iteritems(req.headers))"},{"line_number":198,"context_line":"        context[\u0027path\u0027] \u003d req.environ[\u0027PATH_INFO\u0027]"},{"line_number":199,"context_line":"        scheme \u003d req.environ.get(CONF.secure_proxy_ssl_header)"},{"line_number":200,"context_line":"        if scheme:"},{"line_number":201,"context_line":"            # NOTE(andrey-mp): Header that contains the protocol used before"},{"line_number":202,"context_line":"            # the proxy removed the ssh thing (\u0027https\u0027 usually). So if"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_a7b3f108","line":199,"updated":"2014-12-01 01:13:12.000000000","message":"this should only be done if CONF.secure_proxy_ssl_header is not None.","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"85c5300343365a71c88f31cf4a509ce599dd4a5c","unresolved":false,"context_lines":[{"line_number":196,"context_line":"        context[\u0027query_string\u0027] \u003d dict(six.iteritems(req.params))"},{"line_number":197,"context_line":"        context[\u0027headers\u0027] \u003d dict(six.iteritems(req.headers))"},{"line_number":198,"context_line":"        context[\u0027path\u0027] \u003d req.environ[\u0027PATH_INFO\u0027]"},{"line_number":199,"context_line":"        scheme \u003d req.environ.get(CONF.secure_proxy_ssl_header)"},{"line_number":200,"context_line":"        if scheme:"},{"line_number":201,"context_line":"            # NOTE(andrey-mp): Header that contains the protocol used before"},{"line_number":202,"context_line":"            # the proxy removed the ssh thing (\u0027https\u0027 usually). So if"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_3d763207","line":199,"in_reply_to":"5a890539_a7b3f108","updated":"2014-12-01 08:58:24.000000000","message":"Done","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df8c6cd045766b9abbf467832b1216440459aa4c","unresolved":false,"context_lines":[{"line_number":199,"context_line":"        scheme \u003d req.environ.get(CONF.secure_proxy_ssl_header)"},{"line_number":200,"context_line":"        if scheme:"},{"line_number":201,"context_line":"            # NOTE(andrey-mp): Header that contains the protocol used before"},{"line_number":202,"context_line":"            # the proxy removed the ssh thing (\u0027https\u0027 usually). So if"},{"line_number":203,"context_line":"            # if the webob.Request instance is modified in order to use this"},{"line_number":204,"context_line":"            # schema instead of the one defined by API, the call to"},{"line_number":205,"context_line":"            # webob.Request.relative_url() will return a URL with the correct"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_e7cc198d","line":202,"updated":"2014-12-01 01:13:12.000000000","message":"I don\u0027t know what \"ssh thing\" is? Was this meants to be \"SSL/TLS\"?","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"85c5300343365a71c88f31cf4a509ce599dd4a5c","unresolved":false,"context_lines":[{"line_number":199,"context_line":"        scheme \u003d req.environ.get(CONF.secure_proxy_ssl_header)"},{"line_number":200,"context_line":"        if scheme:"},{"line_number":201,"context_line":"            # NOTE(andrey-mp): Header that contains the protocol used before"},{"line_number":202,"context_line":"            # the proxy removed the ssh thing (\u0027https\u0027 usually). So if"},{"line_number":203,"context_line":"            # if the webob.Request instance is modified in order to use this"},{"line_number":204,"context_line":"            # schema instead of the one defined by API, the call to"},{"line_number":205,"context_line":"            # webob.Request.relative_url() will return a URL with the correct"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_b3fb3247","line":202,"in_reply_to":"5a890539_e7cc198d","updated":"2014-12-01 08:58:24.000000000","message":"It means protocol - \u0027https\u0027 (or any other if it can be).","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df8c6cd045766b9abbf467832b1216440459aa4c","unresolved":false,"context_lines":[{"line_number":201,"context_line":"            # NOTE(andrey-mp): Header that contains the protocol used before"},{"line_number":202,"context_line":"            # the proxy removed the ssh thing (\u0027https\u0027 usually). So if"},{"line_number":203,"context_line":"            # if the webob.Request instance is modified in order to use this"},{"line_number":204,"context_line":"            # schema instead of the one defined by API, the call to"},{"line_number":205,"context_line":"            # webob.Request.relative_url() will return a URL with the correct"},{"line_number":206,"context_line":"            # schema."},{"line_number":207,"context_line":"            req.environ[\u0027wsgi.url_scheme\u0027] \u003d scheme"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_c7b63df9","line":204,"updated":"2014-12-01 01:13:12.000000000","message":"change \"schema\" to \"scheme\"","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"85c5300343365a71c88f31cf4a509ce599dd4a5c","unresolved":false,"context_lines":[{"line_number":201,"context_line":"            # NOTE(andrey-mp): Header that contains the protocol used before"},{"line_number":202,"context_line":"            # the proxy removed the ssh thing (\u0027https\u0027 usually). So if"},{"line_number":203,"context_line":"            # if the webob.Request instance is modified in order to use this"},{"line_number":204,"context_line":"            # schema instead of the one defined by API, the call to"},{"line_number":205,"context_line":"            # webob.Request.relative_url() will return a URL with the correct"},{"line_number":206,"context_line":"            # schema."},{"line_number":207,"context_line":"            req.environ[\u0027wsgi.url_scheme\u0027] \u003d scheme"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_dd852ed0","line":204,"in_reply_to":"5a890539_c7b63df9","updated":"2014-12-01 08:58:24.000000000","message":"Done","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"fcd1eab5a578dd03c3a8b463903fa8f7c24df3e9","unresolved":false,"context_lines":[{"line_number":199,"context_line":"        scheme \u003d (None if not CONF.secure_proxy_ssl_header"},{"line_number":200,"context_line":"                  else req.environ.get(CONF.secure_proxy_ssl_header))"},{"line_number":201,"context_line":"        if scheme:"},{"line_number":202,"context_line":"            # NOTE(andrey-mp): Header that contains the protocol used before"},{"line_number":203,"context_line":"            # the proxy removed the ssh thing (\u0027https\u0027 usually). So if"},{"line_number":204,"context_line":"            # if the webob.Request instance is modified in order to use this"},{"line_number":205,"context_line":"            # scheme instead of the one defined by API, the call to"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a890539_f7e7e2e0","line":202,"updated":"2014-12-04 01:53:00.000000000","message":"change \"Header that\" to \"wsgi.url_scheme\" since it\u0027s confusing to use \"Header\" to refer to a key in the request environment.","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"fcd1eab5a578dd03c3a8b463903fa8f7c24df3e9","unresolved":false,"context_lines":[{"line_number":200,"context_line":"                  else req.environ.get(CONF.secure_proxy_ssl_header))"},{"line_number":201,"context_line":"        if scheme:"},{"line_number":202,"context_line":"            # NOTE(andrey-mp): Header that contains the protocol used before"},{"line_number":203,"context_line":"            # the proxy removed the ssh thing (\u0027https\u0027 usually). So if"},{"line_number":204,"context_line":"            # if the webob.Request instance is modified in order to use this"},{"line_number":205,"context_line":"            # scheme instead of the one defined by API, the call to"},{"line_number":206,"context_line":"            # webob.Request.relative_url() will return a URL with the correct"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a890539_177d4e1c","line":203,"updated":"2014-12-04 01:53:00.000000000","message":"Reword this since I have no idea what ssh is doing here... change \"ssh thing\" to \"scheme\"?","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"ce810f5e5ccea1577e6524d00f73dd3c13cbb272","unresolved":false,"context_lines":[{"line_number":200,"context_line":"                  else req.environ.get(CONF.secure_proxy_ssl_header))"},{"line_number":201,"context_line":"        if scheme:"},{"line_number":202,"context_line":"            # NOTE(andrey-mp): Header that contains the protocol used before"},{"line_number":203,"context_line":"            # the proxy removed the ssh thing (\u0027https\u0027 usually). So if"},{"line_number":204,"context_line":"            # if the webob.Request instance is modified in order to use this"},{"line_number":205,"context_line":"            # scheme instead of the one defined by API, the call to"},{"line_number":206,"context_line":"            # webob.Request.relative_url() will return a URL with the correct"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a890539_600fa12e","line":203,"in_reply_to":"5a890539_177d4e1c","updated":"2014-12-04 07:44:45.000000000","message":"Done. (I taken this phrase from original bug for Heat)","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"fcd1eab5a578dd03c3a8b463903fa8f7c24df3e9","unresolved":false,"context_lines":[{"line_number":204,"context_line":"            # if the webob.Request instance is modified in order to use this"},{"line_number":205,"context_line":"            # scheme instead of the one defined by API, the call to"},{"line_number":206,"context_line":"            # webob.Request.relative_url() will return a URL with the correct"},{"line_number":207,"context_line":"            # schema."},{"line_number":208,"context_line":"            req.environ[\u0027wsgi.url_scheme\u0027] \u003d scheme"},{"line_number":209,"context_line":"        context[\u0027host_url\u0027] \u003d req.host_url"},{"line_number":210,"context_line":"        params \u003d req.environ.get(PARAMS_ENV, {})"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a890539_37cdea5d","line":207,"updated":"2014-12-04 01:53:00.000000000","message":"change \"schema\" to \"scheme\"","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"ce810f5e5ccea1577e6524d00f73dd3c13cbb272","unresolved":false,"context_lines":[{"line_number":204,"context_line":"            # if the webob.Request instance is modified in order to use this"},{"line_number":205,"context_line":"            # scheme instead of the one defined by API, the call to"},{"line_number":206,"context_line":"            # webob.Request.relative_url() will return a URL with the correct"},{"line_number":207,"context_line":"            # schema."},{"line_number":208,"context_line":"            req.environ[\u0027wsgi.url_scheme\u0027] \u003d scheme"},{"line_number":209,"context_line":"        context[\u0027host_url\u0027] \u003d req.host_url"},{"line_number":210,"context_line":"        params \u003d req.environ.get(PARAMS_ENV, {})"}],"source_content_type":"text/x-python","patch_set":10,"id":"5a890539_c5bdc769","line":207,"in_reply_to":"5a890539_37cdea5d","updated":"2014-12-04 07:44:45.000000000","message":"Done","commit_id":"1a10f84e9549e0946ad11dd334c0be3128e1432e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"da47b55e8a1c7f43a28b5a383b379f6a1fb04a7c","unresolved":false,"context_lines":[{"line_number":371,"context_line":"            # should set it relative to the url that the user used to get here"},{"line_number":372,"context_line":"            # so as not to mess with version discovery. This is not perfect."},{"line_number":373,"context_line":"            # host_url omits the path prefix, but there isn\u0027t another good"},{"line_number":374,"context_line":"            # solution that will work for all urls."},{"line_number":375,"context_line":"            url \u003d context[\u0027host_url\u0027]"},{"line_number":376,"context_line":""},{"line_number":377,"context_line":"        return url.rstrip(\u0027/\u0027)"}],"source_content_type":"text/x-python","patch_set":17,"id":"3a961159_11048313","line":374,"updated":"2015-01-07 19:31:53.000000000","message":"you may need to update the real url here as well","commit_id":"28affbab38c7258f6cef8bcd6b5bace21ba40dc5"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"f9f2bdf82b1efd5789fd77172df0a6be3cb08c8a","unresolved":false,"context_lines":[{"line_number":371,"context_line":"            # should set it relative to the url that the user used to get here"},{"line_number":372,"context_line":"            # so as not to mess with version discovery. This is not perfect."},{"line_number":373,"context_line":"            # host_url omits the path prefix, but there isn\u0027t another good"},{"line_number":374,"context_line":"            # solution that will work for all urls."},{"line_number":375,"context_line":"            url \u003d context[\u0027host_url\u0027]"},{"line_number":376,"context_line":""},{"line_number":377,"context_line":"        return url.rstrip(\u0027/\u0027)"}],"source_content_type":"text/x-python","patch_set":17,"id":"3a961159_b448fd5c","line":374,"in_reply_to":"3a961159_11048313","updated":"2015-01-07 20:12:36.000000000","message":"did you see previous comments? I described how it works.","commit_id":"28affbab38c7258f6cef8bcd6b5bace21ba40dc5"}],"keystone/tests/test_versions.py":[{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"480e5430f905efd91fd33ea4ca79cea71a7c74d1","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"7a8c0949_1a918599","line":917,"updated":"2014-11-03 18:18:34.000000000","message":"What will happen to the host name in case of SSL termination porxy?\n\nSSL terminates at :   https://hosta:35357\nKeystone runs at  : http://hostb:35357\n\nKeystone is going to get protocol as https, how about the host name? Link is going to return keystone host name, but you want  proxy\u0027s hostname.\n\nAm I missing something?","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"d0d0ecf1f12108652fc486c39754dc874cc63b62","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_3128e8e1","line":917,"in_reply_to":"5a890539_1d179152","updated":"2014-11-13 20:09:47.000000000","message":"Yes. That is the standard practice. If we are using haproxy or any load balancer they need to populate these headers and keystone should prioritize those headers.\n\nAlso in this case, why are we even adding non ssl endpoints in service catalog. Endpoint should match what the customer sees.\n\nAlso links should be derived from the endpoints defined in the table \n\n(ie)   public_urls for identity should be https://hosta:35357 in endpoint table\nand the link should use this protocol and name","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"15cd75d08f004b006102e8f8bfa5134b4dba12a2","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_a27b51bc","line":917,"in_reply_to":"5a890539_2244c119","updated":"2014-11-17 18:49:31.000000000","message":"yes. It uses https(publicURL) in \u0027/users\u0027 query.\nbut I fight for another issue :)\n\nI want to leave unconfigured public_endpoint/admin_endpoint in config and see correct urls returned by keystone server. And I want to see correct and corresponding urls when using internal or public endpoint for request.\n\nMy issue relates to server logic. But flow of \u0027user-list\u0027(and other cli commands) relates to client logic.","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"83f350de33fa59277226c463d250ac5fd16ea715","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_54bab46e","line":917,"in_reply_to":"5a890539_3128e8e1","updated":"2014-11-14 07:38:40.000000000","message":"we have https for public and http for internal links.\n\nkeystone isn\u0027t able to form urls in response from catalog. have it knowledge what link should be used?","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"457af3887007c5dea368fd129c35033db781bf3a","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_bf968c92","line":917,"in_reply_to":"5a890539_3e5d5e22","updated":"2014-11-12 17:46:50.000000000","message":"Yes. for HAProxy case it will work since most probably  it will be running in the same host. It won\u0027t work for external  hardware load balancer  which is most likely a dedicated appliance","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"a48adc2dfa46f20cf2b15b7c7808b5eb9da013ed","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_a5435bad","line":917,"in_reply_to":"5a890539_45b2b74c","updated":"2014-11-17 19:13:09.000000000","message":"I care only about links. Because they formed by keystone.\n\nAnd issue that I faced was with new cinder client.\nIt makes request to publicURL without path.\nIt takes response with versions and it takes URL from it. And this URL has \u0027http\u0027 and public name.\nAnd next call to \u0027http\u0027 + publicName + \u0027/tokens\u0027 fails.\n\nAll cinder commands work in this way.\ncinder version is \u00271.1.1\u0027","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"d2d18f35ab29c0aa3e02b6368a20ffeeda5f2149","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_78711f0b","line":917,"in_reply_to":"5a890539_4dbdb0b6","updated":"2014-11-17 17:22:58.000000000","message":"In that case,  keystone uses public url. What will happen for internal client? The internal clients are now going to use https? Is that what  you ant.","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"6240759fcfdc771b8e0cc69110a43bc120b60d4c","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_b63e6ad8","line":917,"in_reply_to":"5a890539_54bab46e","updated":"2014-11-14 17:10:03.000000000","message":"In that case, better option is to use  X-Forwarded-Proto.   But still you will be having problem. \n\nAssume  some   external client calls token , he will get a catalog which will have endpoints with http.\n\nAs an example try   keystone user-list  using public endpoint. The following will happen\n\n--  Gets token via HTTPS\n---  Token catalog has http endpoint for identity\n---- User list will go via http","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"88c0ac6cbcb61331c55cd1670e5f8917b82cdf2d","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_3e5d5e22","line":917,"in_reply_to":"5a890539_7472ac7d","updated":"2014-11-11 19:35:55.000000000","message":"we use HAProxy","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"3993872303d3ce81bc75b6abda959223e3d886d4","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_8f9e7e61","line":917,"in_reply_to":"5a890539_78711f0b","updated":"2014-11-17 18:08:02.000000000","message":"i\u0027m sorry but i don\u0027t understand last phrase.","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"02f78ebb2533ea94d282b9f58b4a55bb7fff41b4","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_2244c119","line":917,"in_reply_to":"5a890539_8f9e7e61","updated":"2014-11-17 18:24:51.000000000","message":"Sorry typo.\n\nSince keystone is using public url from catalog and the public url has https endpoint, what will happen if you do keystone user-list from internal.\n\n(i.e)  OS_AUTH_URL points to http endpoint of  keystone \nkeystone  user-list  \n\nI believe this will be using https. Is that what you want?","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"a7fc925983086be8e13d939a6eedecbb655c2718","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_dc3747e1","line":917,"in_reply_to":"5a890539_9bd5e0e6","updated":"2014-11-18 13:27:52.000000000","message":"I\u0027ve checked it -\ncinder, glance, ceilometer and heat don\u0027t work.\nnova, keystone, swift work.\n\nI\u0027ve downloaded all clients through \u0027pip install\u0027","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"65838a667db55027fcb5b45a28dc7f27f0bb4ae1","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_45b2b74c","line":917,"in_reply_to":"5a890539_a27b51bc","updated":"2014-11-17 18:56:38.000000000","message":"There are 2 places you can see keystone url\n\n1) Catalog\n2) Links\n\nYou can fix  links by using  X_Forwarded-*, but you can\u0027t do anything about catalog.  Most of the clients (keystone client) rely on catalog and not link\n\nIf your intention is for internal clients to use http and external to use https, then it is not going to happen.","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"85a9910a455857a3795e354c42f02193b019ce16","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_9bd5e0e6","line":917,"in_reply_to":"5a890539_a5435bad","updated":"2014-11-17 20:35:17.000000000","message":"Did you check other clients? All the clients does the same. They use version discovery to find out keystone url. This is added as part of keystone v3 support for all the clients","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"b24523bca8ff9ba0b20eee90b96dea5e70dc9406","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_4dbdb0b6","line":917,"in_reply_to":"5a890539_b63e6ad8","updated":"2014-11-14 17:56:44.000000000","message":"so in that case I implemented using of X-Forwarded-Proto ...\n\nchecked this -\n\u0027keystone user-list\u0027(using public endpoint) returns token catalog with https in public url and http in internal. and next call uses https.\n\nbut \u0027keystone discover\u0027 returns \u0027http://Public.Url\" ...","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"c550611f1fcf63c22787f56fa9239e5c6f9ca6bb","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_1d179152","line":917,"in_reply_to":"5a890539_bf968c92","updated":"2014-11-13 12:59:59.000000000","message":"from https://bugs.launchpad.net/heat/+bug/1235555 where same problem resolved - \n\nResearching in order to understand this bug I found that there is another header that could be handy: X-Forwarded-Proto, which contains the protocol used before the proxy removed the ssh thing (in this case is \u0027https\u0027).\nSo if the webob.Request instance is modified in order to use this schema instead of the one defined by Heat API, the call to webob.Request.relative_url() will return a URL with the correct schema.\nI think that the X-Forwarded-For won\u0027t be needed, because webob uses the env(HTTP_HOST) to create a URL in webob.Request.relative_url(), and that environment variable is the same that comes in X-Forwarded-For.\nThis modification could be done in heat.api.openstack.v1.util.make_url() or a new middleware could be added in order to alter the request. Any though about the best place to implement the change?","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"8a10642ea4241f7ec1388a2384c229bb12bf05f5","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_7472ac7d","line":917,"in_reply_to":"5a890539_c6b664dc","updated":"2014-11-11 17:49:42.000000000","message":"I think you are going for the specific case where SSL is terminated in the node itself by some service ( say stunnel). If SSL is terminated by external hardware LB, then host is going to be different.","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"dda3d9b10672e113b59b01bb8a81af2a16372050","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"7a8c0949_daa37d9c","line":917,"in_reply_to":"7a8c0949_1a918599","updated":"2014-11-03 19:18:33.000000000","message":"Host will be \u0027hosta\u0027. It\u0027s in the \u0027requests\u0027 library. Code has \u0027HOST\u0027 http header with \u0027hosta\u0027 value and \u0027requests\u0027 library will concatenate it with \u0027wsgi.scheme\u0027 value.","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"14cbe406a47451a4baa1eb33d9a7fcd12c94a9e4","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a890539_c6b664dc","line":917,"in_reply_to":"7a8c0949_67047ec0","updated":"2014-11-11 08:30:44.000000000","message":"becasue of scheme.\nhost is not changing by SSL termination. scheme is changing.\nso if we have https://hosta from teh client then we have http://hosta in keystone. and client receives http://hosta in the list of protocols","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"882d92f630766c707da37416d142520b6b003e61","unresolved":false,"context_lines":[{"line_number":914,"context_line":"        client \u003d self.client(self.public_app)"},{"line_number":915,"context_line":"        host_name \u003d \u0027host-%d\u0027 % random.randint(10, 30)"},{"line_number":916,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":917,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":918,"context_line":"        resp \u003d client.get(host)"},{"line_number":919,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":920,"context_line":"        data \u003d jsonutils.loads(resp.body)"}],"source_content_type":"text/x-python","patch_set":5,"id":"7a8c0949_67047ec0","line":917,"in_reply_to":"7a8c0949_daa37d9c","updated":"2014-11-06 22:29:04.000000000","message":"May be I don\u0027t understand. If SSL is terminated at \"hosta\" then there will a new session from hosta to hostb. So far all practical purpose   \"hosta\" is a client to keystone server running at \"hostb\".\n\nThis interaction is same as   any client calling keystone. So what will the value of wsgi.scheme in the following cases\n\nClient A running at   host with name \"ClientA\"\n\nDirect call\nClientA  \u003e  hostb:35357\n\nSSL terminated call\n\nClientA  \u003e  hosta:35357  ( ssl is terminated here) \n                   hosta   -\u003e hosta:35357","commit_id":"aa09248e8a132474cf813ca1a4b6bca922f5bc5e"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"7642fe08ed8e06b1320e21887f59094d3ce2fcae","unresolved":false,"context_lines":[{"line_number":927,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":928,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":929,"context_line":"        resp \u003d client.get(host)"},{"line_number":930,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":931,"context_line":"        data \u003d jsonutils.loads(resp.body)"},{"line_number":932,"context_line":"        expected \u003d self._get_expected(host)"},{"line_number":933,"context_line":"        self.assertEqual(data, expected)"}],"source_content_type":"text/x-python","patch_set":6,"id":"5a890539_d5792283","line":930,"updated":"2014-11-24 17:26:44.000000000","message":"Fix the order of the arguments. It should be (expected, observed).","commit_id":"4c27cb39d5af6087cc700d5dca50718e77cb8fd3"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"fec6d5a62367f7b5a138a99b3e0eee494cb71e6a","unresolved":false,"context_lines":[{"line_number":927,"context_line":"        host_port \u003d random.randint(10000, 30000)"},{"line_number":928,"context_line":"        host \u003d \u0027http://%s:%s/\u0027 % (host_name, host_port)"},{"line_number":929,"context_line":"        resp \u003d client.get(host)"},{"line_number":930,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":931,"context_line":"        data \u003d jsonutils.loads(resp.body)"},{"line_number":932,"context_line":"        expected \u003d self._get_expected(host)"},{"line_number":933,"context_line":"        self.assertEqual(data, expected)"}],"source_content_type":"text/x-python","patch_set":6,"id":"5a890539_a32c5c9a","line":930,"in_reply_to":"5a890539_d5792283","updated":"2014-11-24 18:28:11.000000000","message":"Done","commit_id":"4c27cb39d5af6087cc700d5dca50718e77cb8fd3"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"7642fe08ed8e06b1320e21887f59094d3ce2fcae","unresolved":false,"context_lines":[{"line_number":930,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":931,"context_line":"        data \u003d jsonutils.loads(resp.body)"},{"line_number":932,"context_line":"        expected \u003d self._get_expected(host)"},{"line_number":933,"context_line":"        self.assertEqual(data, expected)"},{"line_number":934,"context_line":""},{"line_number":935,"context_line":"    def test_versions_with_header(self):"},{"line_number":936,"context_line":"        client \u003d self.client(self.public_app)"}],"source_content_type":"text/x-python","patch_set":6,"id":"5a890539_f5a7fe08","line":933,"updated":"2014-11-24 17:26:44.000000000","message":"Fix the order of the arguments. It should be (expected, observed).","commit_id":"4c27cb39d5af6087cc700d5dca50718e77cb8fd3"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"fec6d5a62367f7b5a138a99b3e0eee494cb71e6a","unresolved":false,"context_lines":[{"line_number":930,"context_line":"        self.assertEqual(resp.status_int, 300)"},{"line_number":931,"context_line":"        data \u003d jsonutils.loads(resp.body)"},{"line_number":932,"context_line":"        expected \u003d self._get_expected(host)"},{"line_number":933,"context_line":"        self.assertEqual(data, expected)"},{"line_number":934,"context_line":""},{"line_number":935,"context_line":"    def test_versions_with_header(self):"},{"line_number":936,"context_line":"        client \u003d self.client(self.public_app)"}],"source_content_type":"text/x-python","patch_set":6,"id":"5a890539_c31de863","line":933,"in_reply_to":"5a890539_f5a7fe08","updated":"2014-11-24 18:28:11.000000000","message":"Done","commit_id":"4c27cb39d5af6087cc700d5dca50718e77cb8fd3"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"7642fe08ed8e06b1320e21887f59094d3ce2fcae","unresolved":false,"context_lines":[{"line_number":942,"context_line":"        data \u003d jsonutils.loads(resp.body)"},{"line_number":943,"context_line":"        expected \u003d self._get_expected(\u0027https://%s:%s/\u0027 % (host_name,"},{"line_number":944,"context_line":"                                                          host_port))"},{"line_number":945,"context_line":"        self.assertEqual(data, expected)"}],"source_content_type":"text/x-python","patch_set":6,"id":"5a890539_d5a202fb","line":945,"updated":"2014-11-24 17:26:44.000000000","message":"Fix the order of the arguments. It should be (expected, observed).","commit_id":"4c27cb39d5af6087cc700d5dca50718e77cb8fd3"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"fec6d5a62367f7b5a138a99b3e0eee494cb71e6a","unresolved":false,"context_lines":[{"line_number":942,"context_line":"        data \u003d jsonutils.loads(resp.body)"},{"line_number":943,"context_line":"        expected \u003d self._get_expected(\u0027https://%s:%s/\u0027 % (host_name,"},{"line_number":944,"context_line":"                                                          host_port))"},{"line_number":945,"context_line":"        self.assertEqual(data, expected)"}],"source_content_type":"text/x-python","patch_set":6,"id":"5a890539_e322e4a1","line":945,"in_reply_to":"5a890539_d5a202fb","updated":"2014-11-24 18:28:11.000000000","message":"Done","commit_id":"4c27cb39d5af6087cc700d5dca50718e77cb8fd3"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df8c6cd045766b9abbf467832b1216440459aa4c","unresolved":false,"context_lines":[{"line_number":908,"context_line":"        self.public_app \u003d self.loadapp(\u0027keystone\u0027, \u0027main\u0027)"},{"line_number":909,"context_line":""},{"line_number":910,"context_line":"        self.config_fixture.config("},{"line_number":911,"context_line":"            secure_proxy_ssl_header\u003d\u0027HTTP_X_FORWARDED_PROTO\u0027)"},{"line_number":912,"context_line":""},{"line_number":913,"context_line":"    def _paste_in_port(self, response, port):"},{"line_number":914,"context_line":"        for link in response[\u0027links\u0027]:"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_c7ad5d9d","line":911,"updated":"2014-12-01 01:13:12.000000000","message":"this should be done in an overridden config_overrides()","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"},{"author":{"_account_id":10234,"name":"Andrey Pavlov","email":"andrey.mp@gmail.com","username":"andrey-mp"},"change_message_id":"85c5300343365a71c88f31cf4a509ce599dd4a5c","unresolved":false,"context_lines":[{"line_number":908,"context_line":"        self.public_app \u003d self.loadapp(\u0027keystone\u0027, \u0027main\u0027)"},{"line_number":909,"context_line":""},{"line_number":910,"context_line":"        self.config_fixture.config("},{"line_number":911,"context_line":"            secure_proxy_ssl_header\u003d\u0027HTTP_X_FORWARDED_PROTO\u0027)"},{"line_number":912,"context_line":""},{"line_number":913,"context_line":"    def _paste_in_port(self, response, port):"},{"line_number":914,"context_line":"        for link in response[\u0027links\u0027]:"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a890539_b3bdf205","line":911,"in_reply_to":"5a890539_c7ad5d9d","updated":"2014-12-01 08:58:24.000000000","message":"Done","commit_id":"90c6b8094015990906e258ba2bf4bdacca91eb50"}]}