)]}'
{"etc/keystone-paste.ini":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e550ceb7a88a53ab60873c80b1e90d984332c462","unresolved":false,"context_lines":[{"line_number":21,"context_line":"[filter:user_crud_extension]"},{"line_number":22,"context_line":"use \u003d egg:keystone#user_crud_extension"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"[filter:cors]"},{"line_number":25,"context_line":"paste.filter_factory \u003d oslo_middleware.cors:filter_factory"},{"line_number":26,"context_line":"oslo_config_project \u003d keystone"},{"line_number":27,"context_line":""}],"source_content_type":"text/x-properties","patch_set":1,"id":"fa80f949_8863471a","line":24,"updated":"2015-11-04 02:11:57.000000000","message":"create an entry point in setup.cfg and use that?\nhttps://github.com/openstack/keystone/blob/master/setup.cfg#L189","commit_id":"ca6d030a3ae5b4d84a4c8d3be2bc93124f6d0e6e"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"f624a50421eded70acec5d132bc1b9fbe55ec268","unresolved":false,"context_lines":[{"line_number":24,"context_line":"[filter:cors]"},{"line_number":25,"context_line":"use \u003d egg:keystone#cors_extension"},{"line_number":26,"context_line":"oslo_config_project \u003d keystone"},{"line_number":27,"context_line":"latent_allow_headers \u003d X-Auth-Token, X-Openstack-Request-Id"},{"line_number":28,"context_line":"latent_expose_headers \u003d X-Auth-Token, X-Openstack-Request-Id"},{"line_number":29,"context_line":"latent_allow_methods \u003d GET, PUT, POST, DELETE, PATCH"},{"line_number":30,"context_line":""}],"source_content_type":"text/x-properties","patch_set":8,"id":"7a5de9d1_eea8e1dd","line":27,"range":{"start_line":27,"start_character":0,"end_line":27,"end_character":20},"updated":"2016-02-02 15:13:23.000000000","message":"We need to add x509 tokenless auth headers in here too\n\nSee https://github.com/openstack/keystone/blob/af399474b2e67b023225a8abffe8933af40c1548/doc/source/configure_tokenless_x509.rst#scope-information","commit_id":"1c47ed36ba546228974c5ee0a727bc60846889c2"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"3dd295cb67800a840772dc060fa1ad9806a6643b","unresolved":false,"context_lines":[{"line_number":25,"context_line":"use \u003d egg:keystone#cors_extension"},{"line_number":26,"context_line":"oslo_config_project \u003d keystone"},{"line_number":27,"context_line":"latent_allow_headers \u003d X-Auth-Token, X-Openstack-Request-Id, X-Project-Id, X-Project-Name, X-Project-Domain-Id, X-Project-Domain-Name, X-Domain-Id, X-Domain-Name"},{"line_number":28,"context_line":"latent_expose_headers \u003d X-Auth-Token, X-Openstack-Request-Id, X-Project-Id, X-Project-Name, X-Project-Domain-Id, X-Project-Domain-Name, X-Domain-Id, X-Domain-Name"},{"line_number":29,"context_line":"latent_allow_methods \u003d GET, PUT, POST, DELETE, PATCH"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"[filter:crud_extension]"}],"source_content_type":"text/x-properties","patch_set":9,"id":"5a5ae5dd_390a6522","line":28,"updated":"2016-02-04 20:16:51.000000000","message":"keystone doesn\u0027t return any other header other than \nX-Auth-Token and  X-Openstack-Request-Id to any clients. Why do you want to expose those headers that are not returned?\n\nSame for allow headers, why do you want to allow those headers other than X-Auth-Token and X-Openstack-Request-Id","commit_id":"5a96686abcd1f6dbf553a9ddf9bea5aa56600ebb"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"29dc1fda7e70ede3267c7524b621150e8b085227","unresolved":false,"context_lines":[{"line_number":25,"context_line":"use \u003d egg:keystone#cors_extension"},{"line_number":26,"context_line":"oslo_config_project \u003d keystone"},{"line_number":27,"context_line":"latent_allow_headers \u003d X-Auth-Token, X-Openstack-Request-Id, X-Project-Id, X-Project-Name, X-Project-Domain-Id, X-Project-Domain-Name, X-Domain-Id, X-Domain-Name"},{"line_number":28,"context_line":"latent_expose_headers \u003d X-Auth-Token, X-Openstack-Request-Id, X-Project-Id, X-Project-Name, X-Project-Domain-Id, X-Project-Domain-Name, X-Domain-Id, X-Domain-Name"},{"line_number":29,"context_line":"latent_allow_methods \u003d GET, PUT, POST, DELETE, PATCH"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"[filter:crud_extension]"}],"source_content_type":"text/x-properties","patch_set":9,"id":"5a5ae5dd_2fe37bda","line":28,"in_reply_to":"5a5ae5dd_0938323c","updated":"2016-02-08 17:11:36.000000000","message":"Isn\u0027t expose headers means allow these headers to be returned?  Keystone never returns those headers.\n\nAlso X509 is for client certs. To invoke any operation via client certs, you need a client cert.  CORS is for cross domain and the request is originating from browser.Is the browser going to use client cert?  Or do you except the client cert to be  installed in the  browser?\n\nKeystone being a security service should not blindly open up everything by default.  It should be closed by default and  should be open for specific use case. I will be happy to remove my -1, if we can present a concrete use case on how this will be used with CORS.\n\nStill it didn\u0027t answer the question, how is this going to be help if keystone is configured to run under Apache?","commit_id":"5a96686abcd1f6dbf553a9ddf9bea5aa56600ebb"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"48dd7cb9262d4c61e546a86cadf409a3d5c702f3","unresolved":false,"context_lines":[{"line_number":25,"context_line":"use \u003d egg:keystone#cors_extension"},{"line_number":26,"context_line":"oslo_config_project \u003d keystone"},{"line_number":27,"context_line":"latent_allow_headers \u003d X-Auth-Token, X-Openstack-Request-Id, X-Project-Id, X-Project-Name, X-Project-Domain-Id, X-Project-Domain-Name, X-Domain-Id, X-Domain-Name"},{"line_number":28,"context_line":"latent_expose_headers \u003d X-Auth-Token, X-Openstack-Request-Id, X-Project-Id, X-Project-Name, X-Project-Domain-Id, X-Project-Domain-Name, X-Domain-Id, X-Domain-Name"},{"line_number":29,"context_line":"latent_allow_methods \u003d GET, PUT, POST, DELETE, PATCH"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"[filter:crud_extension]"}],"source_content_type":"text/x-properties","patch_set":9,"id":"5a5ae5dd_0938323c","line":28,"in_reply_to":"5a5ae5dd_390a6522","updated":"2016-02-06 11:00:21.000000000","message":"Hi Haneef, the rest are x509 tokenless auth headers.\n\nSee https://github.com/openstack/keystone/blob/af399474b2e67b023225a8abffe8933af40c1548/doc/source/configure_tokenless_x509.rst#scope-information","commit_id":"5a96686abcd1f6dbf553a9ddf9bea5aa56600ebb"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"6281227a639aaccaf54b805a4b508b7bc3c45805","unresolved":false,"context_lines":[{"line_number":19,"context_line":"use \u003d egg:keystone#json_body"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"[filter:cors]"},{"line_number":22,"context_line":"use \u003d egg:keystone#cors_extension"},{"line_number":23,"context_line":"oslo_config_project \u003d keystone"},{"line_number":24,"context_line":"latent_allow_headers \u003d X-Auth-Token, X-Openstack-Request-Id, X-Subject-Token"},{"line_number":25,"context_line":"latent_expose_headers \u003d X-Auth-Token, X-Openstack-Request-Id, X-Subject-Token"}],"source_content_type":"text/x-properties","patch_set":10,"id":"3a57f1b5_41a7954f","line":22,"updated":"2016-02-09 20:51:55.000000000","message":"this should be egg:oslo.middleware#cors_extension","commit_id":"16be798a2e74f90fce84bd4ce9fddfdb2e8e420c"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"d38fc85de0ccbc2ae9058183934f74ef8936978f","unresolved":false,"context_lines":[{"line_number":21,"context_line":"[filter:cors]"},{"line_number":22,"context_line":"use \u003d egg:oslo.middleware#cors"},{"line_number":23,"context_line":"oslo_config_project \u003d keystone"},{"line_number":24,"context_line":"latent_allow_headers \u003d X-Auth-Token, X-Openstack-Request-Id, X-Subject-Token"},{"line_number":25,"context_line":"latent_expose_headers \u003d X-Auth-Token, X-Openstack-Request-Id, X-Subject-Token"},{"line_number":26,"context_line":"latent_allow_methods \u003d GET, PUT, POST, DELETE, PATCH"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"[filter:ec2_extension]"}],"source_content_type":"text/x-properties","patch_set":13,"id":"3a57f1b5_66770a3b","line":25,"range":{"start_line":24,"start_character":0,"end_line":25,"end_character":77},"updated":"2016-02-10 19:39:43.000000000","message":"As discussed on IRC (samueldmq, krotscheck, gyee), we still need the tokenless auth headers, as in patchset 9","commit_id":"55b056fa9e5d776b00b666ca74fa56461f2b4dfc"}],"keystone/tests/unit/test_entry_points.py":[{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"85e0cfe9fc586d758224dde95b393e2db26810fd","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        actual_names \u003d [extension.name for extension in em]"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"        self.assertThat(actual_names, matchers.ContainsAll(expected_names))"},{"line_number":49,"context_line":"        self.assertThat(expected_names, matchers.ContainsAll(actual_names))"}],"source_content_type":"text/x-python","patch_set":4,"id":"da85f559_b13ca1e1","line":49,"updated":"2015-11-12 19:24:29.000000000","message":"So i changed my tests just a little in patch set 10 from a suggestion from Dave since we decided that was the most efficient way to make the test.\n\nhttps://review.openstack.org/#/c/233839/10/keystonemiddleware/tests/unit/test_entry_points.py\n\nIt is very similar to what you have just a small difference in the string list comprehension\n\nThanks","commit_id":"633455228b0b3ae3d7c29eb3bd31b52dd2b33b8e"},{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"fc6a23e0fcf0db3849ad68789b7252521422d3c8","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        actual_names \u003d [extension.name for extension in em]"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"        self.assertThat(actual_names, matchers.ContainsAll(expected_names))"},{"line_number":49,"context_line":"        self.assertThat(expected_names, matchers.ContainsAll(actual_names))"}],"source_content_type":"text/x-python","patch_set":4,"id":"da85f559_74ab86d7","line":49,"in_reply_to":"da85f559_5412025a","updated":"2015-11-12 19:50:04.000000000","message":"So the problem comes in if another library adds an entry point, which is possible and will crash your test.  I would just remove that last assert.\n\nAlso in the list comprehension I am checking the module as well as the name of the factory, it might be possible for another library to define a factory with the same name.\n\nIf you need any more help pls feel free to message me on IRC","commit_id":"633455228b0b3ae3d7c29eb3bd31b52dd2b33b8e"},{"author":{"_account_id":9717,"name":"Michael Krotscheck","email":"krotscheck@gmail.com","username":"krotscheck"},"change_message_id":"d03fa992682998eb16a039426196684863fc1087","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        actual_names \u003d [extension.name for extension in em]"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"        self.assertThat(actual_names, matchers.ContainsAll(expected_names))"},{"line_number":49,"context_line":"        self.assertThat(expected_names, matchers.ContainsAll(actual_names))"}],"source_content_type":"text/x-python","patch_set":4,"id":"da85f559_5412025a","line":49,"in_reply_to":"da85f559_b13ca1e1","updated":"2015-11-12 19:40:30.000000000","message":"I don\u0027t think I quite understand how patch 10 is different from mine - it removes the actual loading test, but nothing else. The only difference I notice is that I\u0027m testing exclusive membership - making sure that all expected extensions are being loaded, and all loaded extensions are being tested. This will cause the test to fail if someone comes along and adds another extension, or if they remove that extension.","commit_id":"633455228b0b3ae3d7c29eb3bd31b52dd2b33b8e"}],"setup.cfg":[{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"f5d2487f19717597b412b3fabc1292b66d6ed838","unresolved":false,"context_lines":[{"line_number":179,"context_line":"    admin_token_auth \u003d keystone.middleware:AdminTokenAuthMiddleware.factory"},{"line_number":180,"context_line":"    build_auth_context \u003d keystone.middleware:AuthContextMiddleware.factory"},{"line_number":181,"context_line":"    crud_extension \u003d keystone.contrib.admin_crud:CrudExtension.factory"},{"line_number":182,"context_line":"    cors_extension \u003d oslo_middleware.cors:filter_factory"},{"line_number":183,"context_line":"    debug \u003d keystone.common.wsgi:Debug.factory"},{"line_number":184,"context_line":"    endpoint_filter_extension \u003d keystone.contrib.endpoint_filter.routers:EndpointFilterExtension.factory"},{"line_number":185,"context_line":"    ec2_extension \u003d keystone.contrib.ec2:Ec2Extension.factory"}],"source_content_type":"text/x-ttcn-cfg","patch_set":2,"id":"fa80f949_0713a10e","line":182,"updated":"2015-11-06 16:50:14.000000000","message":"Do you think we could write a test for this, maybe something similar to whats in this patch?","commit_id":"c8a486f4fa0b30fcbdf62b0ec5a6f6bb842489a2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"6281227a639aaccaf54b805a4b508b7bc3c45805","unresolved":false,"context_lines":[{"line_number":173,"context_line":"    admin_token_auth \u003d keystone.middleware:AdminTokenAuthMiddleware.factory"},{"line_number":174,"context_line":"    build_auth_context \u003d keystone.middleware:AuthContextMiddleware.factory"},{"line_number":175,"context_line":"    crud_extension \u003d keystone.contrib.admin_crud:CrudExtension.factory"},{"line_number":176,"context_line":"    cors_extension \u003d oslo_middleware.cors:filter_factory"},{"line_number":177,"context_line":"    debug \u003d oslo_middleware:Debug.factory"},{"line_number":178,"context_line":"    endpoint_filter_extension \u003d keystone.contrib.endpoint_filter.routers:EndpointFilterExtension.factory"},{"line_number":179,"context_line":"    ec2_extension \u003d keystone.contrib.ec2:Ec2Extension.factory"}],"source_content_type":"text/x-ttcn-cfg","patch_set":10,"id":"3a57f1b5_617731d5","line":176,"updated":"2016-02-09 20:51:55.000000000","message":"no need to have this in keystone since it\u0027s provided by oslo.middleware.","commit_id":"16be798a2e74f90fce84bd4ce9fddfdb2e8e420c"}]}