)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"fdf36e270049865e56f68e795923fa5d16f5d6d9","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Deepti Ramakrishna \u003cdeepti.ramakrishna@intel.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2015-07-02 21:46:40 -0700"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Reject user creation using admin_token."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"admin_token is not associated with any domain and hence a user creation using"},{"line_number":10,"context_line":"this token should fail."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"ba3cc151_cae5f4dc","line":7,"updated":"2015-07-04 07:56:35.000000000","message":"This issue not restrict in user creation but also in creating a group, and maybe other entities in keystone as well.\n\nI filed a bug here: https://bugs.launchpad.net/keystone/+bug/1471385, feel free to take it if you have interests.","commit_id":"5ae7fb335eda24490bd14b8d2a51096596a16067"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"7fac694a57b56d158aa7b18d6ac304dff14c0d95","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Reject user creation using admin token without explicitly passing the domain."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"admin_token is not associated with any domain and hence a user creation using"},{"line_number":10,"context_line":"this token should fail."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"There already exists a check for admin_token in the current code in the form"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"ba3cc151_99482f5e","line":9,"updated":"2015-07-08 01:26:46.000000000","message":"change \"user creation\" to \"user creation without specifying the domain\"\n\nchange \"admin_token\" to \"admin token\"","commit_id":"7417900a23ecbdc6fe355f0141719d01ceb1fc91"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"9b17c8f657d62eff9df001127a925b79809a5b49","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Reject user creation using admin token without explicitly passing the domain."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"admin_token is not associated with any domain and hence a user creation using"},{"line_number":10,"context_line":"this token should fail."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"There already exists a check for admin_token in the current code in the form"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"ba3cc151_1024e9c2","line":9,"in_reply_to":"ba3cc151_99482f5e","updated":"2015-07-08 07:13:59.000000000","message":"Done","commit_id":"7417900a23ecbdc6fe355f0141719d01ceb1fc91"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"864ebdb24061c4ee868d6424919a6b4bb367c45d","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Reject user creation using admin token without explicitly passing the domain."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Admin token is not associated with any domain and hence user creation without"},{"line_number":10,"context_line":"specifying the domain should fail."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I82b9acccaa8d5f00d326604ce2992fc423db0b62"},{"line_number":13,"context_line":"Closes-Bug: #1434000"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"1a4dcd0f_7271aca7","line":10,"updated":"2015-08-07 00:28:17.000000000","message":"why should it fail? Why not use the default domain?","commit_id":"2c67320a590f62039a8fd978c5b878ebdfc8808a"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"8f9634f5219244c932e951c2971a91876551f6f0","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Reject user creation using admin token without explicitly passing the domain."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Admin token is not associated with any domain and hence user creation without"},{"line_number":10,"context_line":"specifying the domain should fail."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I82b9acccaa8d5f00d326604ce2992fc423db0b62"},{"line_number":13,"context_line":"Closes-Bug: #1434000"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"1a4dcd0f_c3b3cf4b","line":10,"in_reply_to":"1a4dcd0f_7271aca7","updated":"2015-08-07 06:03:31.000000000","message":"Brant, in case of v3 create entity call that does not specify a domain ID, the spec says that we should use the domain scoping from the token being used. But it does not say what we should do if the token itself is not associated with a domain. Also, if we use default domain for admin tokens, then when the TODO by henry-nash (https://github.com/openstack/keystone/blob/9cdbe6039b55ee401a31a18f734f88b17629b760/keystone/common/controller.py#L719-L724) is fixed, the behavior of admin token will become inconsistent with other non-domain scoped tokens.\n\nIf you feel strongly that we should use the default domain, I can make that change. Your call.","commit_id":"2c67320a590f62039a8fd978c5b878ebdfc8808a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d2458d0f5544337a0d0d666d32c61e4cde24cf3f","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Reject user creation using admin token without explicitly passing the domain."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Admin token is not associated with any domain and hence user creation without"},{"line_number":10,"context_line":"specifying the domain should fail."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I82b9acccaa8d5f00d326604ce2992fc423db0b62"},{"line_number":13,"context_line":"Closes-Bug: #1434000"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"3a29b11f_4f54e3fd","line":10,"updated":"2015-10-21 20:52:25.000000000","message":"the commit message should say why.","commit_id":"d03161593f868e1b80aed2b7d627cb7f10b36c60"}],"keystone/common/controller.py":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"7b797396ad3747d8e9ce4bdeddd6502c54590196","unresolved":false,"context_lines":[{"line_number":721,"context_line":"        \"\"\""},{"line_number":722,"context_line":"        if context.get(\u0027is_admin\u0027, False):"},{"line_number":723,"context_line":"            raise exception.ValidationError("},{"line_number":724,"context_line":"                _(\u0027A domain-scoped token must be used\u0027))"},{"line_number":725,"context_line":""},{"line_number":726,"context_line":"        # We could make this more efficient by loading the domain_id"},{"line_number":727,"context_line":"        # into the context in the wrapper function above (since"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba3cc151_260c5740","line":724,"updated":"2015-07-02 00:23:03.000000000","message":"might give some hint that admin token is in use?","commit_id":"8d9b57eb476fb30a260077f277b446d3546584c9"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"594aaa97eaecfeb3ad75d63b7d75a365731572a1","unresolved":false,"context_lines":[{"line_number":721,"context_line":"        \"\"\""},{"line_number":722,"context_line":"        if context.get(\u0027is_admin\u0027, False):"},{"line_number":723,"context_line":"            raise exception.ValidationError("},{"line_number":724,"context_line":"                _(\u0027A domain-scoped token must be used\u0027))"},{"line_number":725,"context_line":""},{"line_number":726,"context_line":"        # We could make this more efficient by loading the domain_id"},{"line_number":727,"context_line":"        # into the context in the wrapper function above (since"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba3cc151_338bde20","line":724,"in_reply_to":"ba3cc151_260c5740","updated":"2015-07-03 04:48:50.000000000","message":"Done","commit_id":"8d9b57eb476fb30a260077f277b446d3546584c9"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"7b797396ad3747d8e9ce4bdeddd6502c54590196","unresolved":false,"context_lines":[{"line_number":736,"context_line":"        except (exception.TokenNotFound,"},{"line_number":737,"context_line":"                exception.UnsupportedTokenVersionException):"},{"line_number":738,"context_line":"            LOG.warning(_LW(\u0027Invalid token found while getting domain ID \u0027"},{"line_number":739,"context_line":"                            \u0027for create request\u0027))"},{"line_number":740,"context_line":"            raise exception.Unauthorized()"},{"line_number":741,"context_line":""},{"line_number":742,"context_line":"        if token_ref.domain_scoped:"}],"source_content_type":"text/x-python","patch_set":1,"id":"ba3cc151_05eee6b3","line":739,"updated":"2015-07-02 00:23:03.000000000","message":"Good catch, :)","commit_id":"8d9b57eb476fb30a260077f277b446d3546584c9"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"7fac694a57b56d158aa7b18d6ac304dff14c0d95","unresolved":false,"context_lines":[{"line_number":721,"context_line":"        \"\"\""},{"line_number":722,"context_line":"        if context.get(\u0027is_admin\u0027, False):"},{"line_number":723,"context_line":"            raise exception.ValidationError("},{"line_number":724,"context_line":"                _(\u0027The admin token is not a domain-scoped token.\u0027))"},{"line_number":725,"context_line":""},{"line_number":726,"context_line":"        # We could make this more efficient by loading the domain_id"},{"line_number":727,"context_line":"        # into the context in the wrapper function above (since"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba3cc151_99690f8f","line":724,"updated":"2015-07-08 01:26:46.000000000","message":"the code below shows that the user doesn\u0027t need to present a domain-scoped token since the server will use the default domain ID instead. So either the error message is unclear or the code is incorrect.\n\nThe code should be changed so that rather than raising an exception use the default domain id instead.","commit_id":"7417900a23ecbdc6fe355f0141719d01ceb1fc91"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"efa5795700855cb97b96e75b9420c189baba1f24","unresolved":false,"context_lines":[{"line_number":721,"context_line":"        \"\"\""},{"line_number":722,"context_line":"        if context.get(\u0027is_admin\u0027, False):"},{"line_number":723,"context_line":"            raise exception.ValidationError("},{"line_number":724,"context_line":"                _(\u0027The admin token is not a domain-scoped token.\u0027))"},{"line_number":725,"context_line":""},{"line_number":726,"context_line":"        # We could make this more efficient by loading the domain_id"},{"line_number":727,"context_line":"        # into the context in the wrapper function above (since"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba3cc151_46c71b98","line":724,"in_reply_to":"ba3cc151_6d324212","updated":"2015-07-08 08:04:39.000000000","message":"\u0027These tests do not use admin token\u0027, assume once up a time these tempest test didn\u0027t use domain-scoped token or specify the domain-id neither, thus, we need the workaround here.","commit_id":"7417900a23ecbdc6fe355f0141719d01ceb1fc91"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"9b17c8f657d62eff9df001127a925b79809a5b49","unresolved":false,"context_lines":[{"line_number":721,"context_line":"        \"\"\""},{"line_number":722,"context_line":"        if context.get(\u0027is_admin\u0027, False):"},{"line_number":723,"context_line":"            raise exception.ValidationError("},{"line_number":724,"context_line":"                _(\u0027The admin token is not a domain-scoped token.\u0027))"},{"line_number":725,"context_line":""},{"line_number":726,"context_line":"        # We could make this more efficient by loading the domain_id"},{"line_number":727,"context_line":"        # into the context in the wrapper function above (since"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba3cc151_6d324212","line":724,"in_reply_to":"ba3cc151_99690f8f","updated":"2015-07-08 07:13:59.000000000","message":"As the TODO comment in the code you refer to says, we should ideally throw an exception for non domain-scoped tokens and that we are using the default domain only as a temporary fix for some failing tempest tests. These tests do not use admin token, so I see no reason why we should use the default domain for it (the admin can always specify the default domain explicitly while creating the user if he/she wants). We cannot claim consistency as a reason either since the admin token is a special-case token (i.e. not fernet/PKI/UUID)","commit_id":"7417900a23ecbdc6fe355f0141719d01ceb1fc91"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"7fac694a57b56d158aa7b18d6ac304dff14c0d95","unresolved":false,"context_lines":[{"line_number":736,"context_line":"        except (exception.TokenNotFound,"},{"line_number":737,"context_line":"                exception.UnsupportedTokenVersionException):"},{"line_number":738,"context_line":"            LOG.warning(_LW(\u0027Invalid token found while getting domain ID \u0027"},{"line_number":739,"context_line":"                            \u0027for create request\u0027))"},{"line_number":740,"context_line":"            raise exception.Unauthorized()"},{"line_number":741,"context_line":""},{"line_number":742,"context_line":"        if token_ref.domain_scoped:"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba3cc151_39cc83ba","line":739,"updated":"2015-07-08 01:26:46.000000000","message":"this change is unrelated and should be a in a separate commit.","commit_id":"7417900a23ecbdc6fe355f0141719d01ceb1fc91"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"9b17c8f657d62eff9df001127a925b79809a5b49","unresolved":false,"context_lines":[{"line_number":736,"context_line":"        except (exception.TokenNotFound,"},{"line_number":737,"context_line":"                exception.UnsupportedTokenVersionException):"},{"line_number":738,"context_line":"            LOG.warning(_LW(\u0027Invalid token found while getting domain ID \u0027"},{"line_number":739,"context_line":"                            \u0027for create request\u0027))"},{"line_number":740,"context_line":"            raise exception.Unauthorized()"},{"line_number":741,"context_line":""},{"line_number":742,"context_line":"        if token_ref.domain_scoped:"}],"source_content_type":"text/x-python","patch_set":5,"id":"ba3cc151_d000c104","line":739,"in_reply_to":"ba3cc151_39cc83ba","updated":"2015-07-08 07:13:59.000000000","message":"Done. Please review https://review.openstack.org/#/c/199420/","commit_id":"7417900a23ecbdc6fe355f0141719d01ceb1fc91"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"526428e73314450b996b275c9557f0698b793450","unresolved":false,"context_lines":[{"line_number":726,"context_line":"        being used."},{"line_number":727,"context_line":""},{"line_number":728,"context_line":"        \"\"\""},{"line_number":729,"context_line":"        if context.get(\u0027is_admin\u0027, False):"},{"line_number":730,"context_line":"            raise exception.ValidationError("},{"line_number":731,"context_line":"                _(\u0027The admin token is not a domain-scoped token.\u0027))"},{"line_number":732,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"3a29b11f_344057a5","line":729,"updated":"2015-10-19 17:04:59.000000000","message":"This doesn\u0027t seem to make sense when reading; If not the admin, raise an error saying the admin token is not domain-scoped? This could use a comment describing the motive behind using context[\u0027is_admin\u0027] to determine if we\u0027re dealing with the admin token or not.\n\nCouldn\u0027t we also do something like;\n\n    token_id \u003d token_ref[\u0027id\u0027]\n    if CONF.admin_token \u003d\u003d token_id:\n        raise exception.ValidationError()\n\n\nHow does this tie into having the domain in the request body?","commit_id":"d03161593f868e1b80aed2b7d627cb7f10b36c60"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"333e2e5d4612b1c2d4f65fdb8807654c7454041f","unresolved":false,"context_lines":[{"line_number":726,"context_line":"        being used."},{"line_number":727,"context_line":""},{"line_number":728,"context_line":"        \"\"\""},{"line_number":729,"context_line":"        if context.get(\u0027is_admin\u0027, False):"},{"line_number":730,"context_line":"            raise exception.ValidationError("},{"line_number":731,"context_line":"                _(\u0027The admin token is not a domain-scoped token.\u0027))"},{"line_number":732,"context_line":""}],"source_content_type":"text/x-python","patch_set":11,"id":"3a29b11f_f49ba6c7","line":729,"in_reply_to":"3a29b11f_344057a5","updated":"2015-10-20 04:39:26.000000000","message":"\u003e If not the admin, raise an error saying the admin token is not domain-scoped?\nYou are reading it wrong. It is the other way around; if it *is* the admin token, raise an error ....\n\n\n\u003e This could use a comment describing the motive behind using context[\u0027is_admin\u0027] to determine if we\u0027re dealing with the admin token or not.\nUsing context seems to be the most common way. This file itself has 3 other instances of its usage.\n\n\n\u003e Couldn\u0027t we also do something like ...\nThat is how context[\u0027is_admin\u0027] is set in the first place in AdminTokenAuthMiddleware. Better not to dupe this logic. AFAICS, all checks for \"is it the admin token\" in the keystone codebase use context[\u0027is_admin\u0027].\n\n\n\u003e How does this tie into having the domain in the request body?\nIf the domain is specified in the body, execution flow never uses this code path. It is only when it is not provided, do we come here trying to get the token\u0027s domain. Since the admin_token is not a real token, we need to handle it explicitly and as the first step, which is what I do. I did not put this explanation along with my code change since the method doc says as much.","commit_id":"d03161593f868e1b80aed2b7d627cb7f10b36c60"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"89da51e8ef36c0f6f4a4ca3c4e02271d24ab78c0","unresolved":false,"context_lines":[{"line_number":730,"context_line":"                    _(\u0027You have tried to create a resource using the admin \u0027)"},{"line_number":731,"context_line":"                     (\u0027token. As this token is not within a domain you must \u0027)"},{"line_number":732,"context_line":"                     (\u0027explicitly include a domain for this resource to \u0027)"},{"line_number":733,"context_line":"                     (\u0027belong to.\u0027))"},{"line_number":734,"context_line":""},{"line_number":735,"context_line":"        if token_ref.domain_scoped:"},{"line_number":736,"context_line":"            return token_ref.domain_id"}],"source_content_type":"text/x-python","patch_set":12,"id":"da85f559_6360efcf","line":733,"updated":"2015-11-11 19:51:04.000000000","message":"if is_admin is False or not present then the original Unauthorized exception should be raised.","commit_id":"19f8ffcac41eebce12bb8f224f8eb170d6698488"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"d50681b2042496f48443038d43383238d24ecc29","unresolved":false,"context_lines":[{"line_number":730,"context_line":"                    _(\u0027You have tried to create a resource using the admin \u0027)"},{"line_number":731,"context_line":"                     (\u0027token. As this token is not within a domain you must \u0027)"},{"line_number":732,"context_line":"                     (\u0027explicitly include a domain for this resource to \u0027)"},{"line_number":733,"context_line":"                     (\u0027belong to.\u0027))"},{"line_number":734,"context_line":""},{"line_number":735,"context_line":"        if token_ref.domain_scoped:"},{"line_number":736,"context_line":"            return token_ref.domain_id"}],"source_content_type":"text/x-python","patch_set":12,"id":"da85f559_6d08c7da","line":733,"in_reply_to":"da85f559_6360efcf","updated":"2015-11-12 05:50:41.000000000","message":"Done","commit_id":"19f8ffcac41eebce12bb8f224f8eb170d6698488"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"be7f45cea81bd9b4552e0d48de5afcc2a8355ab8","unresolved":false,"context_lines":[{"line_number":727,"context_line":"        except exception.Unauthorized:"},{"line_number":728,"context_line":"            if context.get(\u0027is_admin\u0027):"},{"line_number":729,"context_line":"                raise exception.ValidationError("},{"line_number":730,"context_line":"                    _(\u0027You have tried to create a resource using the admin \u0027)"},{"line_number":731,"context_line":"                     (\u0027token. As this token is not within a domain you must \u0027)"},{"line_number":732,"context_line":"                     (\u0027explicitly include a domain for this resource to \u0027)"},{"line_number":733,"context_line":"                     (\u0027belong to.\u0027))"}],"source_content_type":"text/x-python","patch_set":13,"id":"da85f559_baa51eb6","line":730,"updated":"2015-11-13 19:13:46.000000000","message":"Are all these lines being passed to i18n.  I think you need to remove some of these parenthesis.\n\ne.g.\nhttp://paste.openstack.org/show/478832/","commit_id":"98354c126e3ed9003f1615032664b40943401fa7"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"068b0bf6569b68294120ff8e629de11bcd4f7eda","unresolved":false,"context_lines":[{"line_number":727,"context_line":"        except exception.Unauthorized:"},{"line_number":728,"context_line":"            if context.get(\u0027is_admin\u0027):"},{"line_number":729,"context_line":"                raise exception.ValidationError("},{"line_number":730,"context_line":"                    _(\u0027You have tried to create a resource using the admin \u0027)"},{"line_number":731,"context_line":"                     (\u0027token. As this token is not within a domain you must \u0027)"},{"line_number":732,"context_line":"                     (\u0027explicitly include a domain for this resource to \u0027)"},{"line_number":733,"context_line":"                     (\u0027belong to.\u0027))"}],"source_content_type":"text/x-python","patch_set":13,"id":"ba8a016a_e517e742","line":730,"in_reply_to":"ba8a016a_5498e769","updated":"2015-11-19 18:02:42.000000000","message":"Done","commit_id":"98354c126e3ed9003f1615032664b40943401fa7"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"c953e630170b7b8a21db597cf09eed63a3c2acc3","unresolved":false,"context_lines":[{"line_number":727,"context_line":"        except exception.Unauthorized:"},{"line_number":728,"context_line":"            if context.get(\u0027is_admin\u0027):"},{"line_number":729,"context_line":"                raise exception.ValidationError("},{"line_number":730,"context_line":"                    _(\u0027You have tried to create a resource using the admin \u0027)"},{"line_number":731,"context_line":"                     (\u0027token. As this token is not within a domain you must \u0027)"},{"line_number":732,"context_line":"                     (\u0027explicitly include a domain for this resource to \u0027)"},{"line_number":733,"context_line":"                     (\u0027belong to.\u0027))"}],"source_content_type":"text/x-python","patch_set":13,"id":"ba8a016a_5498e769","line":730,"in_reply_to":"da85f559_baa51eb6","updated":"2015-11-19 16:59:36.000000000","message":"++","commit_id":"98354c126e3ed9003f1615032664b40943401fa7"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"068b0bf6569b68294120ff8e629de11bcd4f7eda","unresolved":false,"context_lines":[{"line_number":727,"context_line":"        except exception.Unauthorized:"},{"line_number":728,"context_line":"            if context.get(\u0027is_admin\u0027):"},{"line_number":729,"context_line":"                raise exception.ValidationError("},{"line_number":730,"context_line":"                    _(\u0027You have tried to create a resource using the admin \u0027)"},{"line_number":731,"context_line":"                     (\u0027token. As this token is not within a domain you must \u0027)"},{"line_number":732,"context_line":"                     (\u0027explicitly include a domain for this resource to \u0027)"},{"line_number":733,"context_line":"                     (\u0027belong to.\u0027))"}],"source_content_type":"text/x-python","patch_set":13,"id":"ba8a016a_c51c236c","line":730,"in_reply_to":"da85f559_baa51eb6","updated":"2015-11-19 18:02:42.000000000","message":"Done","commit_id":"98354c126e3ed9003f1615032664b40943401fa7"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"6bd19adb0697687f373b192556ff3e399f4ad7fc","unresolved":false,"context_lines":[{"line_number":731,"context_line":"                     (\u0027token. As this token is not within a domain you must \u0027)"},{"line_number":732,"context_line":"                     (\u0027explicitly include a domain for this resource to \u0027)"},{"line_number":733,"context_line":"                     (\u0027belong to.\u0027))"},{"line_number":734,"context_line":"            raise"},{"line_number":735,"context_line":""},{"line_number":736,"context_line":"        if token_ref.domain_scoped:"},{"line_number":737,"context_line":"            return token_ref.domain_id"}],"source_content_type":"text/x-python","patch_set":13,"id":"da85f559_036f71fc","line":734,"updated":"2015-11-12 14:50:06.000000000","message":"Shouldn\u0027t this raise be removed?","commit_id":"98354c126e3ed9003f1615032664b40943401fa7"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"40f025a48ce7f8210c54ab1ac062f77d12f81c48","unresolved":false,"context_lines":[{"line_number":731,"context_line":"                     (\u0027token. As this token is not within a domain you must \u0027)"},{"line_number":732,"context_line":"                     (\u0027explicitly include a domain for this resource to \u0027)"},{"line_number":733,"context_line":"                     (\u0027belong to.\u0027))"},{"line_number":734,"context_line":"            raise"},{"line_number":735,"context_line":""},{"line_number":736,"context_line":"        if token_ref.domain_scoped:"},{"line_number":737,"context_line":"            return token_ref.domain_id"}],"source_content_type":"text/x-python","patch_set":13,"id":"da85f559_a33f84b2","line":734,"in_reply_to":"da85f559_036f71fc","updated":"2015-11-12 15:35:21.000000000","message":"nvm i didn\u0027t realize you can do this, cool!  Okay 1 more question.  Is it a reach to assume that if the token is unauthorized and it is admin that the domain is not included?\n\nCan we add to your if statement \u0027not context.get(\u0027is_domain\u0027)\u0027\n\nlet me know what you think.","commit_id":"98354c126e3ed9003f1615032664b40943401fa7"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"2cc5407e26e26cf788866362ed7c9c7bc052d4db","unresolved":false,"context_lines":[{"line_number":731,"context_line":"                     (\u0027token. As this token is not within a domain you must \u0027)"},{"line_number":732,"context_line":"                     (\u0027explicitly include a domain for this resource to \u0027)"},{"line_number":733,"context_line":"                     (\u0027belong to.\u0027))"},{"line_number":734,"context_line":"            raise"},{"line_number":735,"context_line":""},{"line_number":736,"context_line":"        if token_ref.domain_scoped:"},{"line_number":737,"context_line":"            return token_ref.domain_id"}],"source_content_type":"text/x-python","patch_set":13,"id":"da85f559_f0a98c25","line":734,"in_reply_to":"da85f559_a33f84b2","updated":"2015-11-13 18:06:25.000000000","message":"Tom, the domain property is available on the user or token, but not on the context.","commit_id":"98354c126e3ed9003f1615032664b40943401fa7"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"be7f45cea81bd9b4552e0d48de5afcc2a8355ab8","unresolved":false,"context_lines":[{"line_number":731,"context_line":"                     (\u0027token. As this token is not within a domain you must \u0027)"},{"line_number":732,"context_line":"                     (\u0027explicitly include a domain for this resource to \u0027)"},{"line_number":733,"context_line":"                     (\u0027belong to.\u0027))"},{"line_number":734,"context_line":"            raise"},{"line_number":735,"context_line":""},{"line_number":736,"context_line":"        if token_ref.domain_scoped:"},{"line_number":737,"context_line":"            return token_ref.domain_id"}],"source_content_type":"text/x-python","patch_set":13,"id":"da85f559_fa45e6b2","line":734,"in_reply_to":"da85f559_f0a98c25","updated":"2015-11-13 19:13:46.000000000","message":"Okay maybe I am confused. Your saying that the domain property is available on the user token, so at this point in the code how do you know that the missing domain property is the cause of the validation error?","commit_id":"98354c126e3ed9003f1615032664b40943401fa7"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"068b0bf6569b68294120ff8e629de11bcd4f7eda","unresolved":false,"context_lines":[{"line_number":731,"context_line":"                     (\u0027token. As this token is not within a domain you must \u0027)"},{"line_number":732,"context_line":"                     (\u0027explicitly include a domain for this resource to \u0027)"},{"line_number":733,"context_line":"                     (\u0027belong to.\u0027))"},{"line_number":734,"context_line":"            raise"},{"line_number":735,"context_line":""},{"line_number":736,"context_line":"        if token_ref.domain_scoped:"},{"line_number":737,"context_line":"            return token_ref.domain_id"}],"source_content_type":"text/x-python","patch_set":13,"id":"ba8a016a_45fd936c","line":734,"in_reply_to":"da85f559_fa45e6b2","updated":"2015-11-19 18:02:42.000000000","message":"The admin token is not a real token, so it is meaningless to talk about what domain it is associated with. utils.get_token_ref() throws an exception while trying to lookup the admin token (it won\u0027t find it since it is not a real token). Since the same exception could be thrown for a bogus (non-admin) token too, we check context.get(\u0027is_admin\u0027). If that is true, then we know that it is the admin token and re-throw the exception with a useful error info about the admin token not being associated with a domain.\n\n\nThe full logic is as follows:\n\n\n1.Check if domain passed with user obj in the create-user request. If yes, use it.\n\n2.If not, fetch the token ref for the token string passed by the user. If it can\u0027t be fetched, check if it is because it is the admin token. If yes, display a better error message.\n\n3.If the token can be fetched, use the domain associated with the token","commit_id":"98354c126e3ed9003f1615032664b40943401fa7"}],"keystone/tests/unit/test_v3.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"3d2c0151468e91b57ea2128d62d66e524a49a99a","unresolved":false,"context_lines":[{"line_number":305,"context_line":"        ref[\u0027parent_id\u0027] \u003d parent_id"},{"line_number":306,"context_line":"        return ref"},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"    def new_user_ref(self, domain_id\u003dNone, project_id\u003dNone):"},{"line_number":309,"context_line":"        ref \u003d self.new_ref()"},{"line_number":310,"context_line":"        if domain_id:"},{"line_number":311,"context_line":"            ref[\u0027domain_id\u0027] \u003d domain_id"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba3cc151_1f7766d5","line":308,"updated":"2015-07-06 20:14:40.000000000","message":"Now that you have made this a kwarg, we\u0027ll need to really fix the things that call new_user_ref to specify it as a kwarg.... or maybe a better way would be to not change this at all and delete the key from the resulting data structure in the test.","commit_id":"7cf94714474c96b0a555bc7359f52dbac7e6be39"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"c98672635721ef801c8e0bae200871e83c267451","unresolved":false,"context_lines":[{"line_number":305,"context_line":"        ref[\u0027parent_id\u0027] \u003d parent_id"},{"line_number":306,"context_line":"        return ref"},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"    def new_user_ref(self, domain_id\u003dNone, project_id\u003dNone):"},{"line_number":309,"context_line":"        ref \u003d self.new_ref()"},{"line_number":310,"context_line":"        if domain_id:"},{"line_number":311,"context_line":"            ref[\u0027domain_id\u0027] \u003d domain_id"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba3cc151_3f63401c","line":308,"in_reply_to":"ba3cc151_1f7766d5","updated":"2015-07-07 05:37:17.000000000","message":"I decided to follow your second suggestion. Deleting the domain id in the test makes the test intent clearer.","commit_id":"7cf94714474c96b0a555bc7359f52dbac7e6be39"}],"keystone/tests/unit/test_v3_identity.py":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"fdf36e270049865e56f68e795923fa5d16f5d6d9","unresolved":false,"context_lines":[{"line_number":76,"context_line":"            role_id\u003dself.role_id, user_id\u003duser[\u0027id\u0027],"},{"line_number":77,"context_line":"            domain_id\u003ddomain[\u0027id\u0027])"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"        ref \u003d self.new_user_ref(domain_id\u003ddomain[\u0027id\u0027])"},{"line_number":80,"context_line":"        ref_nd \u003d ref.copy()"},{"line_number":81,"context_line":"        ref_nd.pop(\u0027domain_id\u0027)"},{"line_number":82,"context_line":"        auth \u003d self.build_authentication_request("}],"source_content_type":"text/x-python","patch_set":3,"id":"ba3cc151_8a404c37","line":79,"updated":"2015-07-04 07:56:35.000000000","message":"once your patch got merged, code here and in L90~92 could be cleaned up, but this is a seperated thing, keep it as is, and would be addressed in a following up patch.","commit_id":"5ae7fb335eda24490bd14b8d2a51096596a16067"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"fdf36e270049865e56f68e795923fa5d16f5d6d9","unresolved":false,"context_lines":[{"line_number":103,"context_line":"        return self.assertValidUserResponse(r, ref)"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    def test_create_user_with_static_admin_token(self):"},{"line_number":106,"context_line":"        \"\"\"Call ``POST /users`` with static admin_token."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"        We should not be able to create a user using admin_token since it is"},{"line_number":109,"context_line":"        not a domain-scoped token."}],"source_content_type":"text/x-python","patch_set":3,"id":"ba3cc151_4a4a4457","line":106,"updated":"2015-07-04 07:56:35.000000000","message":"suggest to use admin token here.\n\nscoped token, unscoped token, and admin token is more accurate here.","commit_id":"5ae7fb335eda24490bd14b8d2a51096596a16067"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"9b95991e2dee6f112b28e9fe1e95464dd652397a","unresolved":false,"context_lines":[{"line_number":103,"context_line":"        return self.assertValidUserResponse(r, ref)"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    def test_create_user_with_static_admin_token(self):"},{"line_number":106,"context_line":"        \"\"\"Call ``POST /users`` with static admin_token."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"        We should not be able to create a user using admin_token since it is"},{"line_number":109,"context_line":"        not a domain-scoped token."}],"source_content_type":"text/x-python","patch_set":3,"id":"ba3cc151_95a35d4f","line":106,"in_reply_to":"ba3cc151_4a4a4457","updated":"2015-07-06 18:29:09.000000000","message":"Done. I had used admin_token since that is the name of the property in keystone.conf file.","commit_id":"5ae7fb335eda24490bd14b8d2a51096596a16067"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"fdf36e270049865e56f68e795923fa5d16f5d6d9","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    def test_create_user_with_static_admin_token(self):"},{"line_number":106,"context_line":"        \"\"\"Call ``POST /users`` with static admin_token."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"        We should not be able to create a user using admin_token since it is"},{"line_number":109,"context_line":"        not a domain-scoped token."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":3,"id":"ba3cc151_6a47084c","line":108,"updated":"2015-07-04 07:56:35.000000000","message":"s/admin_token/admin token.\n\nThere is something funny here, actually, you can create a user using admin token but just make sure that domain id is passed into req body.\n\npls check the code in `common/controller.py`, \n\nsee: https://github.com/openstack/keystone/blob/master/keystone/common/controller.py#L755-L757\n\nYour change in that file is make sense, but the docstring may misleading here, so pls update the docstring to make it more accurate.\n\nsee: http://paste.openstack.org/show/341294/","commit_id":"5ae7fb335eda24490bd14b8d2a51096596a16067"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"9b95991e2dee6f112b28e9fe1e95464dd652397a","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    def test_create_user_with_static_admin_token(self):"},{"line_number":106,"context_line":"        \"\"\"Call ``POST /users`` with static admin_token."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"        We should not be able to create a user using admin_token since it is"},{"line_number":109,"context_line":"        not a domain-scoped token."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":3,"id":"ba3cc151_95483d89","line":108,"in_reply_to":"ba3cc151_6a47084c","updated":"2015-07-06 18:29:09.000000000","message":"Done. I did notice that the same bug exists for some of the other operations also and was planning to file bugs for the same. Thanks for spotting it. I assigned it to myself.","commit_id":"5ae7fb335eda24490bd14b8d2a51096596a16067"},{"author":{"_account_id":10795,"name":"Rajesh Tailor","email":"tailor.rajesh88@gmail.com","username":"rajeshtailor"},"change_message_id":"6507813ffbe7d4d4dff71770420e693c277d4e7e","unresolved":false,"context_lines":[{"line_number":106,"context_line":"        \"\"\"Call ``POST /users`` with static admin_token."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"        We should not be able to create a user using admin_token since it is"},{"line_number":109,"context_line":"        not a domain-scoped token."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        \"\"\""},{"line_number":112,"context_line":"        ref \u003d self.new_user_ref()"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba3cc151_d5cfef26","line":109,"updated":"2015-07-03 09:56:39.000000000","message":"IMO you should rephrase the paragraph as below (because here \u0027We\u0027 can be interpreted for normal user as well):\n\nAdmin should not be able to create user using admin_token since it is not a domain-scoped token.","commit_id":"5ae7fb335eda24490bd14b8d2a51096596a16067"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"cfd1faae59d4d5f0f9fe0828b432df235b50b3e8","unresolved":false,"context_lines":[{"line_number":106,"context_line":"        \"\"\"Call ``POST /users`` with static admin_token."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"        We should not be able to create a user using admin_token since it is"},{"line_number":109,"context_line":"        not a domain-scoped token."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        \"\"\""},{"line_number":112,"context_line":"        ref \u003d self.new_user_ref()"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba3cc151_e7291139","line":109,"in_reply_to":"ba3cc151_d5cfef26","updated":"2015-07-04 04:07:59.000000000","message":"Rajesh,\n\nThe code-under-test only checks that the token specified in the call is the admin_token. It does not (and cannot) do anymore checks to see if the caller is truly the admin. So, if a non-admin somehow gets to know the secret admin_token value, he can make an API call as an admin. Thus, changing \"we\" to \"Admin\" is incorrect, in addition to being a nit.","commit_id":"5ae7fb335eda24490bd14b8d2a51096596a16067"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"3d2c0151468e91b57ea2128d62d66e524a49a99a","unresolved":false,"context_lines":[{"line_number":102,"context_line":"        ref[\u0027domain_id\u0027] \u003d CONF.identity.default_domain_id"},{"line_number":103,"context_line":"        return self.assertValidUserResponse(r, ref)"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    def test_create_user_with_static_admin_token(self):"},{"line_number":106,"context_line":"        \"\"\"Call ``POST /users`` with static admin token."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"        It should not be possible to use the admin token to create a user"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba3cc151_245ee145","line":105,"updated":"2015-07-06 20:14:40.000000000","message":"(nit) The static word is a little strange. Suggest \u0027test_create_user_with_admin_token_and_no_domain\u0027","commit_id":"7cf94714474c96b0a555bc7359f52dbac7e6be39"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"c98672635721ef801c8e0bae200871e83c267451","unresolved":false,"context_lines":[{"line_number":102,"context_line":"        ref[\u0027domain_id\u0027] \u003d CONF.identity.default_domain_id"},{"line_number":103,"context_line":"        return self.assertValidUserResponse(r, ref)"},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"    def test_create_user_with_static_admin_token(self):"},{"line_number":106,"context_line":"        \"\"\"Call ``POST /users`` with static admin token."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"        It should not be possible to use the admin token to create a user"}],"source_content_type":"text/x-python","patch_set":4,"id":"ba3cc151_ff6cf809","line":105,"in_reply_to":"ba3cc151_245ee145","updated":"2015-07-07 05:37:17.000000000","message":"Done","commit_id":"7cf94714474c96b0a555bc7359f52dbac7e6be39"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"3d2c0151468e91b57ea2128d62d66e524a49a99a","unresolved":false,"context_lines":[{"line_number":109,"context_line":"        while not explicitly passing the domain in the request body."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        \"\"\""},{"line_number":112,"context_line":"        ref \u003d self.new_user_ref()"},{"line_number":113,"context_line":"        self.post(\u0027/users\u0027, body\u003d{\u0027user\u0027: ref}, token\u003dCONF.admin_token,"},{"line_number":114,"context_line":"                  expected_status\u003dexception.ValidationError.code)"},{"line_number":115,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"ba3cc151_1fb0c68a","line":112,"updated":"2015-07-06 20:14:40.000000000","message":"Should there also be a test where None is explicitly passed in?","commit_id":"7cf94714474c96b0a555bc7359f52dbac7e6be39"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"c98672635721ef801c8e0bae200871e83c267451","unresolved":false,"context_lines":[{"line_number":109,"context_line":"        while not explicitly passing the domain in the request body."},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"        \"\"\""},{"line_number":112,"context_line":"        ref \u003d self.new_user_ref()"},{"line_number":113,"context_line":"        self.post(\u0027/users\u0027, body\u003d{\u0027user\u0027: ref}, token\u003dCONF.admin_token,"},{"line_number":114,"context_line":"                  expected_status\u003dexception.ValidationError.code)"},{"line_number":115,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"ba3cc151_0909662c","line":112,"in_reply_to":"ba3cc151_1fb0c68a","updated":"2015-07-07 05:37:17.000000000","message":"With \u0027None\u0027 as the value for domain_id, we get a 400 bad request with the message \"Invalid input for field \u0027domain_id\u0027. The value is \u0027None\u0027.\" Since this is not related to admin token, I don\u0027t think we need a separate test.","commit_id":"7cf94714474c96b0a555bc7359f52dbac7e6be39"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"061ea165f241e3f3470054a36f063e5b5d65e521","unresolved":false,"context_lines":[{"line_number":112,"context_line":"        ref[\u0027domain_id\u0027] \u003d CONF.identity.default_domain_id"},{"line_number":113,"context_line":"        return self.assertValidUserResponse(r, ref)"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"\u003c\u003c\u003c\u003c\u003c\u003c\u003c HEAD"},{"line_number":116,"context_line":"    def test_create_user_bad_request(self):"},{"line_number":117,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":118,"context_line":"    def test_create_user_with_admin_token_and_no_domain(self):"}],"source_content_type":"text/x-python","patch_set":8,"id":"5a2ca52d_bc1e056e","line":115,"updated":"2015-10-16 20:40:09.000000000","message":"^^","commit_id":"2f20e77d290ea7e11ad368fcccbec5fc49ff8bcc"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"2b37a0f60f57fa2c75f778041e550620632903ca","unresolved":false,"context_lines":[{"line_number":115,"context_line":"    def test_create_user_bad_request(self):"},{"line_number":116,"context_line":"        \"\"\"Call ``POST /users``.\"\"\""},{"line_number":117,"context_line":"        self.post(\u0027/users\u0027, body\u003d{\u0027user\u0027: {}},"},{"line_number":118,"context_line":"                  expected_status\u003dhttp_client.BAD_REQUEST)"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"    def test_list_users(self):"},{"line_number":121,"context_line":"        \"\"\"Call ``GET /users``.\"\"\""}],"source_content_type":"text/x-python","patch_set":9,"id":"5a2ca52d_8284000b","side":"PARENT","line":118,"updated":"2015-10-16 21:22:04.000000000","message":"assert status like this ^","commit_id":"8bfb9aa303ff6741197e5114ec64e9a17b23ab57"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"2b37a0f60f57fa2c75f778041e550620632903ca","unresolved":false,"context_lines":[{"line_number":112,"context_line":"        ref[\u0027domain_id\u0027] \u003d CONF.identity.default_domain_id"},{"line_number":113,"context_line":"        return self.assertValidUserResponse(r, ref)"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"    def test_create_user_with_admin_token_and_no_domain(self):"},{"line_number":116,"context_line":"        \"\"\"Call ``POST /users`` with admin token."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"        It should not be possible to use the admin token to create a user"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a2ca52d_22996c7c","line":115,"updated":"2015-10-16 21:22:04.000000000","message":"Is there a positive version of this test already (to the effect of test_create_user_with_admin_token_and_domain to assert 200)? I\u0027m looking around this file, but don\u0027t see one. If there is not, this patch should add one.","commit_id":"d949e807c574bbb9c1633dee05a4c2d5f465f96e"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"ebf512c186e416d452e18de6ad64c7e66e1575a2","unresolved":false,"context_lines":[{"line_number":112,"context_line":"        ref[\u0027domain_id\u0027] \u003d CONF.identity.default_domain_id"},{"line_number":113,"context_line":"        return self.assertValidUserResponse(r, ref)"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"    def test_create_user_with_admin_token_and_no_domain(self):"},{"line_number":116,"context_line":"        \"\"\"Call ``POST /users`` with admin token."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"        It should not be possible to use the admin token to create a user"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a2ca52d_59949e41","line":115,"in_reply_to":"5a2ca52d_22996c7c","updated":"2015-10-16 22:31:27.000000000","message":"Done","commit_id":"d949e807c574bbb9c1633dee05a4c2d5f465f96e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"2b37a0f60f57fa2c75f778041e550620632903ca","unresolved":false,"context_lines":[{"line_number":118,"context_line":"        It should not be possible to use the admin token to create a user"},{"line_number":119,"context_line":"        while not explicitly passing the domain in the request body."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"        \"\"\""},{"line_number":122,"context_line":"        # Passing a valid domain id to new_user_ref() since domain_id is"},{"line_number":123,"context_line":"        # not an optional parameter."},{"line_number":124,"context_line":"        ref \u003d self.new_user_ref(domain_id\u003dself.domain_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a2ca52d_c28e782d","line":121,"updated":"2015-10-16 21:22:04.000000000","message":"nice docstr","commit_id":"d949e807c574bbb9c1633dee05a4c2d5f465f96e"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"ebf512c186e416d452e18de6ad64c7e66e1575a2","unresolved":false,"context_lines":[{"line_number":118,"context_line":"        It should not be possible to use the admin token to create a user"},{"line_number":119,"context_line":"        while not explicitly passing the domain in the request body."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"        \"\"\""},{"line_number":122,"context_line":"        # Passing a valid domain id to new_user_ref() since domain_id is"},{"line_number":123,"context_line":"        # not an optional parameter."},{"line_number":124,"context_line":"        ref \u003d self.new_user_ref(domain_id\u003dself.domain_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"5a2ca52d_f9756a31","line":121,"in_reply_to":"5a2ca52d_c28e782d","updated":"2015-10-16 22:31:27.000000000","message":"Thanks!","commit_id":"d949e807c574bbb9c1633dee05a4c2d5f465f96e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"2b37a0f60f57fa2c75f778041e550620632903ca","unresolved":false,"context_lines":[{"line_number":125,"context_line":"        # Delete the domain id before sending the request."},{"line_number":126,"context_line":"        del ref[\u0027domain_id\u0027]"},{"line_number":127,"context_line":"        self.post(\u0027/users\u0027, body\u003d{\u0027user\u0027: ref}, token\u003dCONF.admin_token,"},{"line_number":128,"context_line":"                  expected_status\u003dexception.ValidationError.code)"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"    def test_create_user_bad_request(self):"},{"line_number":131,"context_line":"        \"\"\"Call ``POST /users``.\"\"\""}],"source_content_type":"text/x-python","patch_set":9,"id":"5a2ca52d_e2f054cb","line":128,"updated":"2015-10-16 21:22:04.000000000","message":"try not to reach into the implementation -- use http_client.BAD_REQUEST instead","commit_id":"d949e807c574bbb9c1633dee05a4c2d5f465f96e"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"ebf512c186e416d452e18de6ad64c7e66e1575a2","unresolved":false,"context_lines":[{"line_number":125,"context_line":"        # Delete the domain id before sending the request."},{"line_number":126,"context_line":"        del ref[\u0027domain_id\u0027]"},{"line_number":127,"context_line":"        self.post(\u0027/users\u0027, body\u003d{\u0027user\u0027: ref}, token\u003dCONF.admin_token,"},{"line_number":128,"context_line":"                  expected_status\u003dexception.ValidationError.code)"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"    def test_create_user_bad_request(self):"},{"line_number":131,"context_line":"        \"\"\"Call ``POST /users``.\"\"\""}],"source_content_type":"text/x-python","patch_set":9,"id":"5a2ca52d_19714644","line":128,"in_reply_to":"5a2ca52d_e2f054cb","updated":"2015-10-16 22:31:27.000000000","message":"Done","commit_id":"d949e807c574bbb9c1633dee05a4c2d5f465f96e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"89da51e8ef36c0f6f4a4ca3c4e02271d24ab78c0","unresolved":false,"context_lines":[{"line_number":127,"context_line":"        \"\"\""},{"line_number":128,"context_line":"        # Passing a valid domain id to new_user_ref() since domain_id is"},{"line_number":129,"context_line":"        # not an optional parameter."},{"line_number":130,"context_line":"        ref \u003d self.new_user_ref(domain_id\u003dself.domain_id)"},{"line_number":131,"context_line":"        # Delete the domain id before sending the request."},{"line_number":132,"context_line":"        del ref[\u0027domain_id\u0027]"},{"line_number":133,"context_line":"        self.post(\u0027/users\u0027, body\u003d{\u0027user\u0027: ref}, token\u003dCONF.admin_token,"}],"source_content_type":"text/x-python","patch_set":12,"id":"da85f559_a8b23492","line":130,"updated":"2015-11-11 19:51:04.000000000","message":"new_user_ref is meant to be used in places where the test needs to create a user in a normal manner. Since this test is not creating a user in the normal manner it shouldn\u0027t be using new_user_ref.","commit_id":"19f8ffcac41eebce12bb8f224f8eb170d6698488"},{"author":{"_account_id":15225,"name":"Deepti Ramakrishna","email":"deepti.ramakrishna@intel.com","username":"dramakri"},"change_message_id":"d50681b2042496f48443038d43383238d24ecc29","unresolved":false,"context_lines":[{"line_number":127,"context_line":"        \"\"\""},{"line_number":128,"context_line":"        # Passing a valid domain id to new_user_ref() since domain_id is"},{"line_number":129,"context_line":"        # not an optional parameter."},{"line_number":130,"context_line":"        ref \u003d self.new_user_ref(domain_id\u003dself.domain_id)"},{"line_number":131,"context_line":"        # Delete the domain id before sending the request."},{"line_number":132,"context_line":"        del ref[\u0027domain_id\u0027]"},{"line_number":133,"context_line":"        self.post(\u0027/users\u0027, body\u003d{\u0027user\u0027: ref}, token\u003dCONF.admin_token,"}],"source_content_type":"text/x-python","patch_set":12,"id":"da85f559_edfcb7b9","line":130,"in_reply_to":"da85f559_a8b23492","updated":"2015-11-12 05:50:41.000000000","message":"We want to pass a normal user (except for the absent domain id) so that the system-under-test does not fail for a different reason (e.g. invalid user) than what we are testing for.","commit_id":"19f8ffcac41eebce12bb8f224f8eb170d6698488"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"8d02ffb848d41b86f3797e04c268bfef0380d279","unresolved":false,"context_lines":[{"line_number":109,"context_line":"        return self.assertValidUserResponse(r, ref)"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"    def test_create_user_with_admin_token_and_domain(self):"},{"line_number":112,"context_line":"        \"\"\"Call ``POST /users`` with admin token and domain id.\"\"\""},{"line_number":113,"context_line":"        ref \u003d unit.new_user_ref(domain_id\u003dself.domain_id)"},{"line_number":114,"context_line":"        self.post(\u0027/users\u0027, body\u003d{\u0027user\u0027: ref}, token\u003dCONF.admin_token,"},{"line_number":115,"context_line":"                  expected_status\u003dhttp_client.CREATED)"}],"source_content_type":"text/x-python","patch_set":15,"id":"9a8ffd7b_e0bccbbc","line":112,"updated":"2015-11-27 15:51:28.000000000","message":"(nit) ID","commit_id":"9a41fbf1da00ec66774efd9766749e7bd19e7030"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"8d02ffb848d41b86f3797e04c268bfef0380d279","unresolved":false,"context_lines":[{"line_number":115,"context_line":"                  expected_status\u003dhttp_client.CREATED)"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    def test_create_user_with_admin_token_and_no_domain(self):"},{"line_number":118,"context_line":"        \"\"\"Call ``POST /users`` with admin token but no domain id."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"        It should not be possible to use the admin token to create a user"},{"line_number":121,"context_line":"        while not explicitly passing the domain in the request body."}],"source_content_type":"text/x-python","patch_set":15,"id":"9a8ffd7b_a0b243e3","line":118,"updated":"2015-11-27 15:51:28.000000000","message":"ditto","commit_id":"9a41fbf1da00ec66774efd9766749e7bd19e7030"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"8d02ffb848d41b86f3797e04c268bfef0380d279","unresolved":false,"context_lines":[{"line_number":121,"context_line":"        while not explicitly passing the domain in the request body."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"        \"\"\""},{"line_number":124,"context_line":"        # Passing a valid domain id to new_user_ref() since domain_id is"},{"line_number":125,"context_line":"        # not an optional parameter."},{"line_number":126,"context_line":"        ref \u003d unit.new_user_ref(domain_id\u003dself.domain_id)"},{"line_number":127,"context_line":"        # Delete the domain id before sending the request."}],"source_content_type":"text/x-python","patch_set":15,"id":"9a8ffd7b_e0e36bd7","line":124,"updated":"2015-11-27 15:51:28.000000000","message":"ditto","commit_id":"9a41fbf1da00ec66774efd9766749e7bd19e7030"}]}