)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d21634b9d6afebbb52c57ba2ca8fff4c0317d759","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"disable admin_token by default"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"admin_token enabled by default is a security issue"},{"line_number":10,"context_line":"and suggesting users to edit paste.ini is bad[*] Instead,"},{"line_number":11,"context_line":"users should be able to simply remove or comment out admin_token"},{"line_number":12,"context_line":"in keystone.conf"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7a016987_5c80ba8b","line":9,"updated":"2015-05-26 06:39:33.000000000","message":"I have my doubt about this claim.","commit_id":"cc3b19c2b33e460b20d60b6d4f5ba223a63af1b4"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"0203189f25ef1c6f8c01d54aec1286ec9191fce2","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"disable admin_token by default"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"admin_token enabled by default is a security issue"},{"line_number":10,"context_line":"and suggesting users to edit paste.ini is bad[*] Instead,"},{"line_number":11,"context_line":"users should be able to simply remove or comment out admin_token"},{"line_number":12,"context_line":"in keystone.conf"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7a016987_7fafbe7d","line":9,"in_reply_to":"7a016987_2949338f","updated":"2015-05-27 05:53:17.000000000","message":"Seems valid.  The docs highly recommend disabling the admin_token after bootstrapping. \n\nSee http://docs.openstack.org/developer/keystone/configuringservices.html#admin-token","commit_id":"cc3b19c2b33e460b20d60b6d4f5ba223a63af1b4"},{"author":{"_account_id":8290,"name":"liusheng","email":"liusheng2048@gmail.com","username":"LiuSheng"},"change_message_id":"2ec64a8549cf00e6825a740d3b970a6583647399","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"disable admin_token by default"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"admin_token enabled by default is a security issue"},{"line_number":10,"context_line":"and suggesting users to edit paste.ini is bad[*] Instead,"},{"line_number":11,"context_line":"users should be able to simply remove or comment out admin_token"},{"line_number":12,"context_line":"in keystone.conf"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7a016987_2949338f","line":9,"in_reply_to":"7a016987_5c80ba8b","updated":"2015-05-26 12:14:52.000000000","message":"could please file a bug to describe this if you think this is a security issue (so others can confirm the issue if it actually is ), I am also doubt this claim.","commit_id":"cc3b19c2b33e460b20d60b6d4f5ba223a63af1b4"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"0203189f25ef1c6f8c01d54aec1286ec9191fce2","unresolved":false,"context_lines":[{"line_number":7,"context_line":"disable admin_token by default"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"admin_token enabled by default is a security issue"},{"line_number":10,"context_line":"and suggesting users to edit paste.ini is bad[*] Instead,"},{"line_number":11,"context_line":"users should be able to simply remove or comment out admin_token"},{"line_number":12,"context_line":"in keystone.conf"},{"line_number":13,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"7a016987_df4592b3","line":10,"updated":"2015-05-27 05:53:17.000000000","message":"Agreed, this is messy for deployers.","commit_id":"cc3b19c2b33e460b20d60b6d4f5ba223a63af1b4"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"7a4b6015ed4266172b08c472413809662999dab2","unresolved":false,"context_lines":[{"line_number":11,"context_line":"in keystone.conf"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] http://docs.openstack.org/developer/keystone/configuringservices.html#admin-token"},{"line_number":14,"context_line":"[2] paste.ini contains code paths so must be treated as \"code\""},{"line_number":15,"context_line":"which could change on upgrades vs configuration which must stay backward"},{"line_number":16,"context_line":"compatible across releases"},{"line_number":17,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"ba3cc151_02a0789e","line":14,"updated":"2015-06-30 01:58:07.000000000","message":"I don\u0027t agree with this. Most of the ways I have installed Keystone will put the *.ini in /etc/keystone because it really is a config file.","commit_id":"4fba2ec7b786410c7359f736ce6fd1058de71c81"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"746117894b9f067c84858ccd90724240b1bd70aa","unresolved":false,"context_lines":[{"line_number":11,"context_line":"in keystone.conf"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] http://docs.openstack.org/developer/keystone/configuringservices.html#admin-token"},{"line_number":14,"context_line":"[2] paste.ini contains code paths so must be treated as \"code\""},{"line_number":15,"context_line":"which could change on upgrades vs configuration which must stay backward"},{"line_number":16,"context_line":"compatible across releases"},{"line_number":17,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"ba3cc151_e5b8692c","line":14,"updated":"2015-07-02 15:29:44.000000000","message":"we can\u0027t break a customer\u0027s paste.ini on upgrades without the normal deprecation period.\n\nwhile I don\u0027t agree with the reasoning I agree with the change since it\u0027ll provide for better security since it will be harder to do the wrong thing here.","commit_id":"4fba2ec7b786410c7359f736ce6fd1058de71c81"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"de0dec87f2e098e5b9b03439a3f6866e3fcc2ac8","unresolved":false,"context_lines":[{"line_number":11,"context_line":"in keystone.conf"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"[1] http://docs.openstack.org/developer/keystone/configuringservices.html#admin-token"},{"line_number":14,"context_line":"[2] paste.ini contains code paths so must be treated as \"code\""},{"line_number":15,"context_line":"which could change on upgrades vs configuration which must stay backward"},{"line_number":16,"context_line":"compatible across releases"},{"line_number":17,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"ba3cc151_ce3156a4","line":14,"in_reply_to":"ba3cc151_02a0789e","updated":"2015-06-30 07:06:11.000000000","message":"I agree with David. I\u0027ve seen chef/puppet/ansible scripts modifying paste.ini so the filters and pipelines are definitely *configurable*.\n\nI would think the only thing that needs to be backward compatible are the public APIs. Everything else should be deployer/operator options.","commit_id":"4fba2ec7b786410c7359f736ce6fd1058de71c81"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"47c25cec08c71495f16cbf08d3c4b2045dae5938","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"DocImpact"},{"line_number":19,"context_line":"Related-Bug: #1458720"},{"line_number":20,"context_line":"Signed-off-by: Alberto Murillo \u003cpowerbsd@yahoo.com\u003e"},{"line_number":21,"context_line":"Change-Id: Ifcf99a6c20bce62b59e4f5f65b4dab8a3ec9d3d2"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"ba3cc151_0aed1c8e","line":20,"updated":"2015-07-04 08:58:33.000000000","message":"This is not necessary but it harmless to keep it here.","commit_id":"8298070324b590006dd68d19c6cee087c0f01835"}],"etc/keystone.conf.sample":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"39cb2f3b02cc6acf38d90860bdf8ad5f4817eaee","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"7a016987_7bb59cce","updated":"2015-05-26 21:50:46.000000000","message":"avoid updating sample conf by default.\nwe always try to do that in a separate patch, just update config.py","commit_id":"cc3b19c2b33e460b20d60b6d4f5ba223a63af1b4"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d21634b9d6afebbb52c57ba2ca8fff4c0317d759","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"# A \"shared secret\" that can be used to bootstrap Keystone. This \"token\" does"},{"line_number":8,"context_line":"# not represent a user, and carries no explicit authorization. It is"},{"line_number":9,"context_line":"# highly recommended to keep it disabled in"},{"line_number":10,"context_line":"# production. (string value)"},{"line_number":11,"context_line":"#admin_token \u003d \u003cNone\u003e"},{"line_number":12,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7a016987_5cbd5a01","line":9,"updated":"2015-05-26 06:39:33.000000000","message":"keystone.conf.sample is generated by tox target *genconfig* instead of updating it manually, the change here will cause the format inconsistency.","commit_id":"cc3b19c2b33e460b20d60b6d4f5ba223a63af1b4"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"d21634b9d6afebbb52c57ba2ca8fff4c0317d759","unresolved":false,"context_lines":[{"line_number":8,"context_line":"# not represent a user, and carries no explicit authorization. It is"},{"line_number":9,"context_line":"# highly recommended to keep it disabled in"},{"line_number":10,"context_line":"# production. (string value)"},{"line_number":11,"context_line":"#admin_token \u003d \u003cNone\u003e"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"# The base public endpoint URL for Keystone that is advertised to clients"},{"line_number":14,"context_line":"# (NOTE: this does NOT affect how Keystone listens for connections). Defaults"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"7a016987_7c6ed697","line":11,"updated":"2015-05-26 06:39:33.000000000","message":"This is just a sample configuration and it has been masked by default, I think it\u0027s better to address in devstack instead in case you deploy your env by devstack.\n\nhttps://github.com/openstack-dev/devstack/blob/master/lib/keystone#L243","commit_id":"cc3b19c2b33e460b20d60b6d4f5ba223a63af1b4"}],"keystone/common/config.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"746117894b9f067c84858ccd90724240b1bd70aa","unresolved":false,"context_lines":[{"line_number":29,"context_line":"                        \u0027Keystone. This \"token\" does not represent a user, \u0027"},{"line_number":30,"context_line":"                        \u0027and carries no explicit authorization. To disable \u0027"},{"line_number":31,"context_line":"                        \u0027in production (highly recommended), remove \u0027"},{"line_number":32,"context_line":"                        \u0027AdminTokenAuthMiddleware from your paste \u0027"},{"line_number":33,"context_line":"                        \u0027application pipelines (for example, in \u0027"},{"line_number":34,"context_line":"                        \u0027keystone-paste.ini).\u0027),"},{"line_number":35,"context_line":"        cfg.StrOpt(\u0027public_endpoint\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba3cc151_c5bc45bd","side":"PARENT","line":32,"updated":"2015-07-02 15:29:44.000000000","message":"This documentation should instead be moved into admin token middleware. Have it log a warning if it\u0027s in the paste pipeline.","commit_id":"ffa15c9e4933e93bae5d45886a70ce45e4d99bdc"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"71902853d4234acf11e8dd56db770ad7398ef618","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"FILE_OPTIONS \u003d {"},{"line_number":26,"context_line":"    None: ["},{"line_number":27,"context_line":"        cfg.StrOpt(\u0027admin_token\u0027, secret\u003dTrue, default\u003d\u0027ADMIN\u0027,"},{"line_number":28,"context_line":"                   help\u003d\u0027A \"shared secret\" that can be used to bootstrap \u0027"},{"line_number":29,"context_line":"                        \u0027Keystone. This \"token\" does not represent a user, \u0027"},{"line_number":30,"context_line":"                        \u0027and carries no explicit authorization. To disable \u0027"}],"source_content_type":"text/x-python","patch_set":8,"id":"fa1b9901_4d97273a","side":"PARENT","line":27,"updated":"2015-08-19 23:10:45.000000000","message":"I would prefer to keep the default. The changes in core.py would still allow you to achieve your goal. But if we change the default, I am afraid that\u0027s going to break somebody out there.","commit_id":"909ed85053236b9109d948445a7dff325ee20d3e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"389383d54e63efcec7cfbdf7dd2a17b83071cafa","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"FILE_OPTIONS \u003d {"},{"line_number":26,"context_line":"    None: ["},{"line_number":27,"context_line":"        cfg.StrOpt(\u0027admin_token\u0027, secret\u003dTrue, default\u003d\u0027ADMIN\u0027,"},{"line_number":28,"context_line":"                   help\u003d\u0027A \"shared secret\" that can be used to bootstrap \u0027"},{"line_number":29,"context_line":"                        \u0027Keystone. This \"token\" does not represent a user, \u0027"},{"line_number":30,"context_line":"                        \u0027and carries no explicit authorization. To disable \u0027"}],"source_content_type":"text/x-python","patch_set":8,"id":"fa80f949_c041313b","side":"PARENT","line":27,"in_reply_to":"fa1b9901_4d97273a","updated":"2015-11-03 19:08:03.000000000","message":"If somebody\u0027s using the default then their config is insecure and it\u0027s probably a mistake.","commit_id":"909ed85053236b9109d948445a7dff325ee20d3e"}],"keystone/middleware/core.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"746117894b9f067c84858ccd90724240b1bd70aa","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    def process_request(self, request):"},{"line_number":68,"context_line":"        token \u003d request.headers.get(AUTH_TOKEN_HEADER)"},{"line_number":69,"context_line":"        context \u003d request.environ.get(CONTEXT_ENV, {})"},{"line_number":70,"context_line":"        context[\u0027is_admin\u0027] \u003d (CONF.admin_token is not None"},{"line_number":71,"context_line":"                               and token \u003d\u003d CONF.admin_token)"},{"line_number":72,"context_line":"        request.environ[CONTEXT_ENV] \u003d context"},{"line_number":73,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"ba3cc151_85007d67","line":70,"updated":"2015-07-02 15:29:44.000000000","message":"I think we should treat an empty string same as leaving it unset since that would be safer. Change \"CONF.admin_token is not None\" to \"CONF.admin_token\"\n\nAlso, this function should just return if CONF.admin_token isn\u0027t set since that would be more efficient.\n\n if not CONF.admin_token:\n     return","commit_id":"4fba2ec7b786410c7359f736ce6fd1058de71c81"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"746117894b9f067c84858ccd90724240b1bd70aa","unresolved":false,"context_lines":[{"line_number":173,"context_line":"    def _build_auth_context(self, request):"},{"line_number":174,"context_line":"        token_id \u003d request.headers.get(AUTH_TOKEN_HEADER).strip()"},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"        if (CONF.admin_token is not None and token_id \u003d\u003d CONF.admin_token):"},{"line_number":177,"context_line":"            # NOTE(gyee): no need to proceed any further as the special admin"},{"line_number":178,"context_line":"            # token is being handled by AdminTokenAuthMiddleware. This code"},{"line_number":179,"context_line":"            # will not be impacted even if AdminTokenAuthMiddleware is removed"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba3cc151_a5ca6119","line":176,"updated":"2015-07-02 15:29:44.000000000","message":"this line is correct but AuthContextMiddleware is wrong... it should be checking checking context.get(\u0027is_admin\u0027, False) rather than checking the token is the admin token again.","commit_id":"4fba2ec7b786410c7359f736ce6fd1058de71c81"}],"keystone/tests/unit/test_middleware.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a717154f6138d659b45d3e80067f83ad090e4627","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"CONF \u003d cfg.CONF"},{"line_number":23,"context_line":"CONF.admin_token \u003d \"ADMIN\""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"def make_request(**kwargs):"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba3cc151_517c1a72","line":23,"updated":"2015-06-29 19:09:10.000000000","message":"setting config options needs to be done using the config fixture -- see http://git.openstack.org/cgit/openstack/keystone/tree/keystone/tests/unit/core.py#n276","commit_id":"4434d961d0ccdb8fffc631621930dc90ee284647"}]}