)]}'
{"keystone/trust/controllers.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"46522e4e2a01a6453c2164def4ae7d9a2703bbdc","unresolved":false,"context_lines":[{"line_number":141,"context_line":"            original_trust \u003d trust_chain[-1]"},{"line_number":142,"context_line":"            if original_trust[\u0027impersonation\u0027]:"},{"line_number":143,"context_line":"                raise exception.Forbidden("},{"line_number":144,"context_line":"                    _(\u0027Cannot create trust using an impersonated token\u0027))"},{"line_number":145,"context_line":"        else:"},{"line_number":146,"context_line":"            redelegated_trust \u003d None"},{"line_number":147,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"7a5de9d1_709d2709","line":144,"updated":"2016-01-29 22:29:52.000000000","message":"We can\u0027t create a \"redelegated trust\" using an impersonated token, right? Or does this apply to all trusts?","commit_id":"e2368078439da9bb9d766da64f3c752e60c02df2"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"23155775e1695654e95fd252fb5ccb6faeae6d50","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"            # Impersonation case"},{"line_number":141,"context_line":"            original_trust \u003d trust_chain[-1]"},{"line_number":142,"context_line":"            if original_trust[\u0027impersonation\u0027]:"},{"line_number":143,"context_line":"                raise exception.Forbidden("},{"line_number":144,"context_line":"                    _(\u0027Cannot create redelegated trust using an impersonated\u0027"},{"line_number":145,"context_line":"                      \u0027token\u0027))"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a5de9d1_a0a26a97","line":142,"updated":"2016-01-30 00:55:11.000000000","message":"the right logic here should be if  trust[\u0027impersonation\u0027] and ! if original_trust[\u0027impersonation\u0027]: raise....","commit_id":"cb43726646f95e7bb42365473bfa27688f97b135"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"a9ed913754ed3584939def069025f77738ec9c72","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"            # Impersonation case"},{"line_number":141,"context_line":"            original_trust \u003d trust_chain[-1]"},{"line_number":142,"context_line":"            if original_trust[\u0027impersonation\u0027]:"},{"line_number":143,"context_line":"                raise exception.Forbidden("},{"line_number":144,"context_line":"                    _(\u0027Cannot create redelegated trust using an impersonated\u0027"},{"line_number":145,"context_line":"                      \u0027token\u0027))"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a5de9d1_698508cd","line":142,"in_reply_to":"7a5de9d1_83b17849","updated":"2016-02-01 16:03:40.000000000","message":"Actually, my previous comment would not work in the scenario where a user uses an impersonated token and attempt to create a trust setting the trustor\u0027s id to the original trustor user id(Bypass policy file).","commit_id":"cb43726646f95e7bb42365473bfa27688f97b135"},{"author":{"_account_id":13152,"name":"Jorge Munoz","email":"elkidster@gmail.com","username":"jmunoz"},"change_message_id":"535e2c09b9b16addc42fd50d8ee50212265fb897","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"            # Impersonation case"},{"line_number":141,"context_line":"            original_trust \u003d trust_chain[-1]"},{"line_number":142,"context_line":"            if original_trust[\u0027impersonation\u0027]:"},{"line_number":143,"context_line":"                raise exception.Forbidden("},{"line_number":144,"context_line":"                    _(\u0027Cannot create redelegated trust using an impersonated\u0027"},{"line_number":145,"context_line":"                      \u0027token\u0027))"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a5de9d1_83b17849","line":142,"in_reply_to":"7a5de9d1_a0a26a97","updated":"2016-01-30 01:40:16.000000000","message":"Well, I was thinking that it would just be:\nif trust[\u0027impersonation\u0027]: raise\nand remove the code to get the chain of trust, because in which scenario would we want a user with a trusted token(user impersonating a trustor) to create a trust. So the logic would be, if this is a delegated auth and impersonation is set to true on the trust for create return forbidden. Please correct me if I\u0027m wrong on my logic.","commit_id":"cb43726646f95e7bb42365473bfa27688f97b135"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"81d3580fc9b928803b40c1df74372cabfe4ee101","unresolved":false,"context_lines":[{"line_number":146,"context_line":"            # Policy bypass case"},{"line_number":147,"context_line":"            if trust[\u0027trustor_user_id\u0027] \u003d\u003d original_trust[\u0027trustor_user_id\u0027]:"},{"line_number":148,"context_line":"                raise exception.Forbidden("},{"line_number":149,"context_line":"                    _(\u0027Cannot create a trust using impersonation\u0027))"},{"line_number":150,"context_line":"        else:"},{"line_number":151,"context_line":"            redelegated_trust \u003d None"},{"line_number":152,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"5a5ae5dd_77c9b325","line":149,"range":{"start_line":149,"start_character":23,"end_line":149,"end_character":64},"updated":"2016-02-05 08:14:54.000000000","message":"this message isn\u0027t accurate and too similar to the other check before","commit_id":"c81fe1eb11f81b44ba40b716c781b0f4a04e4003"}]}