)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"e58408bff26f92d92aa569691de8d024fd6ac2a3","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Return 404 instead of 401 for tokens w/o roles"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"If a scoped-token was validate and the user didn\u0027t have any role assignment on"},{"line_number":10,"context_line":"a project, keystone would return a 401 Unauthorized. This was particularly the"},{"line_number":11,"context_line":"case when the fernet token provider was enabled because the reference is"},{"line_number":12,"context_line":"rebuilt on every request. The uuid token provider has a different behavior - if"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"7af24918_12792efd","line":9,"range":{"start_line":9,"start_character":22,"end_line":9,"end_character":30},"updated":"2016-03-01 15:18:55.000000000","message":"validated","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"772751919045cd99154446ca3ab50723dacb73d8","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Return 404 instead of 401 for tokens w/o roles"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"If a scoped-token was validate and the user didn\u0027t have any role assignment on"},{"line_number":10,"context_line":"a project, keystone would return a 401 Unauthorized. This was particularly the"},{"line_number":11,"context_line":"case when the fernet token provider was enabled because the reference is"},{"line_number":12,"context_line":"rebuilt on every request. The uuid token provider has a different behavior - if"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"7af24918_c22246b9","line":9,"range":{"start_line":9,"start_character":22,"end_line":9,"end_character":30},"in_reply_to":"7af24918_12792efd","updated":"2016-03-01 18:18:55.000000000","message":"Done","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"e58408bff26f92d92aa569691de8d024fd6ac2a3","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Return 404 instead of 401 for tokens w/o roles"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"If a scoped-token was validate and the user didn\u0027t have any role assignment on"},{"line_number":10,"context_line":"a project, keystone would return a 401 Unauthorized. This was particularly the"},{"line_number":11,"context_line":"case when the fernet token provider was enabled because the reference is"},{"line_number":12,"context_line":"rebuilt on every request. The uuid token provider has a different behavior - if"},{"line_number":13,"context_line":"the token isn\u0027t found the in backend a 404 Not Found is returned. This is"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"7af24918_92db7eed","line":10,"range":{"start_line":10,"start_character":62,"end_line":10,"end_character":74},"updated":"2016-03-01 15:18:55.000000000","message":"remove particularly","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"772751919045cd99154446ca3ab50723dacb73d8","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Return 404 instead of 401 for tokens w/o roles"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"If a scoped-token was validate and the user didn\u0027t have any role assignment on"},{"line_number":10,"context_line":"a project, keystone would return a 401 Unauthorized. This was particularly the"},{"line_number":11,"context_line":"case when the fernet token provider was enabled because the reference is"},{"line_number":12,"context_line":"rebuilt on every request. The uuid token provider has a different behavior - if"},{"line_number":13,"context_line":"the token isn\u0027t found the in backend a 404 Not Found is returned. This is"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"7af24918_22304a01","line":10,"range":{"start_line":10,"start_character":62,"end_line":10,"end_character":74},"in_reply_to":"7af24918_92db7eed","updated":"2016-03-01 18:18:55.000000000","message":"Done","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"e58408bff26f92d92aa569691de8d024fd6ac2a3","unresolved":false,"context_lines":[{"line_number":10,"context_line":"a project, keystone would return a 401 Unauthorized. This was particularly the"},{"line_number":11,"context_line":"case when the fernet token provider was enabled because the reference is"},{"line_number":12,"context_line":"rebuilt on every request. The uuid token provider has a different behavior - if"},{"line_number":13,"context_line":"the token isn\u0027t found the in backend a 404 Not Found is returned. This is"},{"line_number":14,"context_line":"because when a user\u0027s role assignments are removed from a project the token is"},{"line_number":15,"context_line":"removed from the backend."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"7af24918_b24b1ab0","line":13,"range":{"start_line":13,"start_character":26,"end_line":13,"end_character":36},"updated":"2016-03-01 15:18:55.000000000","message":"in the backend","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"772751919045cd99154446ca3ab50723dacb73d8","unresolved":false,"context_lines":[{"line_number":10,"context_line":"a project, keystone would return a 401 Unauthorized. This was particularly the"},{"line_number":11,"context_line":"case when the fernet token provider was enabled because the reference is"},{"line_number":12,"context_line":"rebuilt on every request. The uuid token provider has a different behavior - if"},{"line_number":13,"context_line":"the token isn\u0027t found the in backend a 404 Not Found is returned. This is"},{"line_number":14,"context_line":"because when a user\u0027s role assignments are removed from a project the token is"},{"line_number":15,"context_line":"removed from the backend."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"7af24918_62189285","line":13,"range":{"start_line":13,"start_character":26,"end_line":13,"end_character":36},"in_reply_to":"7af24918_b24b1ab0","updated":"2016-03-01 18:18:55.000000000","message":"Done","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"e58408bff26f92d92aa569691de8d024fd6ac2a3","unresolved":false,"context_lines":[{"line_number":12,"context_line":"rebuilt on every request. The uuid token provider has a different behavior - if"},{"line_number":13,"context_line":"the token isn\u0027t found the in backend a 404 Not Found is returned. This is"},{"line_number":14,"context_line":"because when a user\u0027s role assignments are removed from a project the token is"},{"line_number":15,"context_line":"removed from the backend."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"These two behaviors should be consistent regardless of the token provider."},{"line_number":18,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"7af24918_529f3603","line":15,"updated":"2016-03-01 15:18:55.000000000","message":"tokens aren\u0027t removed from the token backend when using uuid, they\u0027re marked as invalid. tokens are only removed from the backend when cleaning up expired tokens through keystone-manage token_flush","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"772751919045cd99154446ca3ab50723dacb73d8","unresolved":false,"context_lines":[{"line_number":12,"context_line":"rebuilt on every request. The uuid token provider has a different behavior - if"},{"line_number":13,"context_line":"the token isn\u0027t found the in backend a 404 Not Found is returned. This is"},{"line_number":14,"context_line":"because when a user\u0027s role assignments are removed from a project the token is"},{"line_number":15,"context_line":"removed from the backend."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"These two behaviors should be consistent regardless of the token provider."},{"line_number":18,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"7af24918_c53ed0b7","line":15,"in_reply_to":"7af24918_529f3603","updated":"2016-03-01 18:18:55.000000000","message":"Done","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"}],"keystone/tests/unit/rest.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"e58408bff26f92d92aa569691de8d024fd6ac2a3","unresolved":false,"context_lines":[{"line_number":191,"context_line":"        # we can save some code \u0026 improve coverage by always doing this"},{"line_number":192,"context_line":"        if (method !\u003d \u0027HEAD\u0027 and"},{"line_number":193,"context_line":"                response.status_code \u003e\u003d http_client.BAD_REQUEST):"},{"line_number":194,"context_line":"            expected_status \u003d kwargs.get(\u0027expected_status\u0027,"},{"line_number":195,"context_line":"                                         http_client.BAD_REQUEST)"},{"line_number":196,"context_line":"            self.assertValidErrorResponse(response,"},{"line_number":197,"context_line":"                                          expected_status\u003dexpected_status)"}],"source_content_type":"text/x-python","patch_set":9,"id":"7af24918_b51ae46c","line":194,"updated":"2016-03-01 15:18:55.000000000","message":"expected_status should be added to the function arguments.","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"772751919045cd99154446ca3ab50723dacb73d8","unresolved":false,"context_lines":[{"line_number":191,"context_line":"        # we can save some code \u0026 improve coverage by always doing this"},{"line_number":192,"context_line":"        if (method !\u003d \u0027HEAD\u0027 and"},{"line_number":193,"context_line":"                response.status_code \u003e\u003d http_client.BAD_REQUEST):"},{"line_number":194,"context_line":"            expected_status \u003d kwargs.get(\u0027expected_status\u0027,"},{"line_number":195,"context_line":"                                         http_client.BAD_REQUEST)"},{"line_number":196,"context_line":"            self.assertValidErrorResponse(response,"},{"line_number":197,"context_line":"                                          expected_status\u003dexpected_status)"}],"source_content_type":"text/x-python","patch_set":9,"id":"7af24918_2277aa3b","line":194,"in_reply_to":"7af24918_b51ae46c","updated":"2016-03-01 18:18:55.000000000","message":"I don\u0027t think we can do that because expected_status is for validate error response only. Its not part of the request itself. Otherwise, we would have to pop it before passing kwargs down to request().","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"}],"keystone/tests/unit/test_auth.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"e58408bff26f92d92aa569691de8d024fd6ac2a3","unresolved":false,"context_lines":[{"line_number":403,"context_line":"            })"},{"line_number":404,"context_line":"        unscoped_token_id \u003d r[\u0027access\u0027][\u0027token\u0027][\u0027id\u0027]"},{"line_number":405,"context_line":"        self.assertRaises("},{"line_number":406,"context_line":"            exception.TokenNotFound,"},{"line_number":407,"context_line":"            self.controller.validate_token,"},{"line_number":408,"context_line":"            dict(is_admin\u003dTrue, query_string\u003d{\u0027belongsTo\u0027: \u0027BAR\u0027}),"},{"line_number":409,"context_line":"            token_id\u003dunscoped_token_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"7af24918_95dd2873","line":406,"updated":"2016-03-01 15:18:55.000000000","message":"this test change is showing that this change is changing the behavior of the keystone server in a non-backwards compatible way, which is not allowed by OpenStack API stability guidelines.","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"772751919045cd99154446ca3ab50723dacb73d8","unresolved":false,"context_lines":[{"line_number":403,"context_line":"            })"},{"line_number":404,"context_line":"        unscoped_token_id \u003d r[\u0027access\u0027][\u0027token\u0027][\u0027id\u0027]"},{"line_number":405,"context_line":"        self.assertRaises("},{"line_number":406,"context_line":"            exception.TokenNotFound,"},{"line_number":407,"context_line":"            self.controller.validate_token,"},{"line_number":408,"context_line":"            dict(is_admin\u003dTrue, query_string\u003d{\u0027belongsTo\u0027: \u0027BAR\u0027}),"},{"line_number":409,"context_line":"            token_id\u003dunscoped_token_id)"}],"source_content_type":"text/x-python","patch_set":9,"id":"7af24918_a59f4402","line":406,"in_reply_to":"7af24918_95dd2873","updated":"2016-03-01 18:18:55.000000000","message":"isn\u0027t correcting error code still allow? I am not clear on that one.","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"}],"keystone/tests/unit/test_credential.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"e58408bff26f92d92aa569691de8d024fd6ac2a3","unresolved":false,"context_lines":[{"line_number":63,"context_line":"                            expected_status\u003dhttp_client.UNAUTHORIZED)"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"    def assertValidErrorResponse(self, r,"},{"line_number":66,"context_line":"                                 expected_status\u003dhttp_client.BAD_REQUEST):"},{"line_number":67,"context_line":"        # FIXME(wwwjfy): it\u0027s copied from test_v3.py. The logic of this method"},{"line_number":68,"context_line":"        # in test_v2.py and test_v3.py (both are inherited from rest.py) has no"},{"line_number":69,"context_line":"        # difference, so they should be refactored into one place. Also, the"}],"source_content_type":"text/x-python","patch_set":9,"id":"7af24918_b569448e","line":66,"updated":"2016-03-01 15:18:55.000000000","message":"this argument isn\u0027t used so it doesn\u0027t matter what\u0027s passed in and it\u0027s going to be confusing for users.","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"}],"keystone/tests/unit/test_v2.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"e58408bff26f92d92aa569691de8d024fd6ac2a3","unresolved":false,"context_lines":[{"line_number":1015,"context_line":"        self.assertEqual([], r[\u0027roles\u0027])"},{"line_number":1016,"context_line":""},{"line_number":1017,"context_line":"    def assertValidErrorResponse(self, r,"},{"line_number":1018,"context_line":"                                 expected_status\u003dhttp_client.BAD_REQUEST):"},{"line_number":1019,"context_line":"        self.assertIsNotNone(r.result.get(\u0027error\u0027))"},{"line_number":1020,"context_line":"        self.assertValidError(r.result[\u0027error\u0027])"},{"line_number":1021,"context_line":"        self.assertEqual(r.result[\u0027error\u0027][\u0027code\u0027], r.status_code)"}],"source_content_type":"text/x-python","patch_set":9,"id":"7af24918_55828001","line":1018,"updated":"2016-03-01 15:18:55.000000000","message":"adding an argument that\u0027s ignored is going to be confusing since test writers and reviewers will assume that the function actually validates that the status is as expected and we\u0027ll wind up with bugs.\n\nThis applies to all these changes to assertValidErrorResponse.","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"}],"keystone/tests/unit/test_v3_auth.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"e58408bff26f92d92aa569691de8d024fd6ac2a3","unresolved":false,"context_lines":[{"line_number":182,"context_line":"            method\u003d\u0027GET\u0027,"},{"line_number":183,"context_line":"            path\u003d\u0027/v2.0/tokens/%s\u0027 % v3_token,"},{"line_number":184,"context_line":"            token\u003dself.get_admin_token(),"},{"line_number":185,"context_line":"            expected_status\u003dhttp_client.NOT_FOUND)"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"    def test_v3_v2_intermix_non_default_project_succeed(self):"},{"line_number":188,"context_line":"        # self.project is in a non-default domain"}],"source_content_type":"text/x-python","patch_set":9,"id":"7af24918_f5c0ece2","line":185,"updated":"2016-03-01 15:18:55.000000000","message":"this can\u0027t change without breaking our API stability guarantees. this applies to all these changes.","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"02b1a0f131b22d6752a367e51a2b6a35c0a789b9","unresolved":false,"context_lines":[{"line_number":956,"context_line":"        super(TestFernetTokenAPIs, self).setUp()"},{"line_number":957,"context_line":"        self.doSetUp()"},{"line_number":958,"context_line":""},{"line_number":959,"context_line":"    def test_remove_all_roles_from_scope_result_in_404(self):"},{"line_number":960,"context_line":"        # setup a new user for authentication"},{"line_number":961,"context_line":"        new_user \u003d unit.create_user(self.identity_api,"},{"line_number":962,"context_line":"                                    domain_id\u003dself.domain[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":11,"id":"7af24918_6cec00c8","line":959,"updated":"2016-03-01 20:12:41.000000000","message":"The commit message says that this change isn\u0027t Fernet-specific. This test should live in TokenAPITests: \n\nhttps://github.com/openstack/keystone/blob/f39ac2e8a8026c54c085235eea4c9e0aa3d6f6c5/keystone/tests/unit/test_v3_auth.py#L122\n\nIt will be run against the Fernet provider here: \n\nhttps://github.com/openstack/keystone/blob/f39ac2e8a8026c54c085235eea4c9e0aa3d6f6c5/keystone/tests/unit/test_v3_auth.py#L948-L949","commit_id":"48d23d6ed45b269d03ff3ef08b1b5620761c232b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6e4fe7d5deca329fddf7077b60a2068bd51ad574","unresolved":false,"context_lines":[{"line_number":956,"context_line":"        super(TestFernetTokenAPIs, self).setUp()"},{"line_number":957,"context_line":"        self.doSetUp()"},{"line_number":958,"context_line":""},{"line_number":959,"context_line":"    def test_remove_all_roles_from_scope_result_in_404(self):"},{"line_number":960,"context_line":"        # setup a new user for authentication"},{"line_number":961,"context_line":"        new_user \u003d unit.create_user(self.identity_api,"},{"line_number":962,"context_line":"                                    domain_id\u003dself.domain[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":11,"id":"7af24918_5fcf28b0","line":959,"in_reply_to":"7af24918_6cec00c8","updated":"2016-03-01 20:23:29.000000000","message":"Done","commit_id":"48d23d6ed45b269d03ff3ef08b1b5620761c232b"}],"keystone/token/provider.py":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"0b22934d2bd04b01122ef48b90d89ebb93a6f6be","unresolved":false,"context_lines":[{"line_number":284,"context_line":"            elif version \u003d\u003d self.V2:"},{"line_number":285,"context_line":"                return self.driver.validate_v2_token(token_ref)"},{"line_number":286,"context_line":"            raise exception.UnsupportedTokenVersionException()"},{"line_number":287,"context_line":"        except exception.Forbidden:"},{"line_number":288,"context_line":"            # FIXME(lbragstad): According to the API spec, keystone"},{"line_number":289,"context_line":"            # shouldn\u0027t be returning 401 for invalid tokens."},{"line_number":290,"context_line":"            # See bug 1541621 for more details."}],"source_content_type":"text/x-python","patch_set":4,"id":"bae84128_7625f4ac","line":287,"range":{"start_line":287,"start_character":8,"end_line":287,"end_character":35},"updated":"2016-02-25 09:48:11.000000000","message":"actually, should catch exception.Unauthorized instead of exception.Forbidden.\n\nexception.Unauthorized:  code \u003d\u003d 401\nexception.Forbidden: code \u003d\u003d 403","commit_id":"5bd88ad5d7af8de2e2ead8280697823b94884290"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"39433324d8065819b619d5f2fb625c7ae5cb602a","unresolved":false,"context_lines":[{"line_number":284,"context_line":"            elif version \u003d\u003d self.V2:"},{"line_number":285,"context_line":"                return self.driver.validate_v2_token(token_ref)"},{"line_number":286,"context_line":"            raise exception.UnsupportedTokenVersionException()"},{"line_number":287,"context_line":"        except exception.Forbidden:"},{"line_number":288,"context_line":"            # FIXME(lbragstad): According to the API spec, keystone"},{"line_number":289,"context_line":"            # shouldn\u0027t be returning 401 for invalid tokens."},{"line_number":290,"context_line":"            # See bug 1541621 for more details."}],"source_content_type":"text/x-python","patch_set":4,"id":"9aed3d3a_375ffe73","line":287,"in_reply_to":"bae84128_7625f4ac","updated":"2016-02-25 22:23:43.000000000","message":"++, this shows the occurrences of Forbidden in the token provider.\n\nhttp://cdn.pasteraw.com/eeg2pr4irihdi4jgtfwbn12vtqg52uc\n\nI think we want those Forbidden\u0027s to bubble up the user and we want to catch the Unauthorized exceptions and return NotFound.\n\nhttp://cdn.pasteraw.com/8xvlifnvrve8j776b18bx53507cxzto","commit_id":"5bd88ad5d7af8de2e2ead8280697823b94884290"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"39433324d8065819b619d5f2fb625c7ae5cb602a","unresolved":false,"context_lines":[{"line_number":285,"context_line":"                return self.driver.validate_v2_token(token_ref)"},{"line_number":286,"context_line":"            raise exception.UnsupportedTokenVersionException()"},{"line_number":287,"context_line":"        except exception.Forbidden:"},{"line_number":288,"context_line":"            # FIXME(lbragstad): According to the API spec, keystone"},{"line_number":289,"context_line":"            # shouldn\u0027t be returning 401 for invalid tokens."},{"line_number":290,"context_line":"            # See bug 1541621 for more details."},{"line_number":291,"context_line":"            raise exception.TokenNotFound(token_id\u003dtoken_id)"}],"source_content_type":"text/x-python","patch_set":4,"id":"9aed3d3a_17dd9a14","line":288,"updated":"2016-02-25 22:23:43.000000000","message":"This comment could probably be removed now that this patch is fixing bug 1541621","commit_id":"5bd88ad5d7af8de2e2ead8280697823b94884290"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"04f043ba6f0bdfcd94b0728f9101df0567ef70aa","unresolved":false,"context_lines":[{"line_number":220,"context_line":"            token_data, CONF.identity.default_domain_id)"},{"line_number":221,"context_line":"        self.revoke_api.check_token(token_values)"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"    def validate_v2_token(self, token_id, belongs_to\u003dNone):"},{"line_number":224,"context_line":"        try:"},{"line_number":225,"context_line":"            # NOTE(lbragstad): Only go to the persistence backend if the token"},{"line_number":226,"context_line":"            # provider requires it."},{"line_number":227,"context_line":"            if self._needs_persistence:"}],"source_content_type":"text/x-python","patch_set":9,"id":"9aed3d3a_39bf3562","line":224,"range":{"start_line":223,"start_character":0,"end_line":224,"end_character":12},"updated":"2016-03-01 08:32:00.000000000","message":"why do we need to wrap this? it\u0027s already covered by _validate_token","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"04f043ba6f0bdfcd94b0728f9101df0567ef70aa","unresolved":false,"context_lines":[{"line_number":269,"context_line":"        else:"},{"line_number":270,"context_line":"            return self.check_revocation_v3(token)"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    def validate_v3_token(self, token_id):"},{"line_number":273,"context_line":"        if not token_id:"},{"line_number":274,"context_line":"            raise exception.TokenNotFound(_(\u0027No token in the request\u0027))"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"        try:"},{"line_number":277,"context_line":"            # NOTE(lbragstad): Only go to persistent storage if we have a token"},{"line_number":278,"context_line":"            # to fetch from the backend (the driver persists the token)."},{"line_number":279,"context_line":"            # Otherwise the information about the token must be in the token"}],"source_content_type":"text/x-python","patch_set":9,"id":"9aed3d3a_f992edf4","line":276,"range":{"start_line":272,"start_character":0,"end_line":276,"end_character":12},"updated":"2016-03-01 08:32:00.000000000","message":"why do we need to wrap this? it\u0027s already covered by _validate_token","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"772751919045cd99154446ca3ab50723dacb73d8","unresolved":false,"context_lines":[{"line_number":269,"context_line":"        else:"},{"line_number":270,"context_line":"            return self.check_revocation_v3(token)"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    def validate_v3_token(self, token_id):"},{"line_number":273,"context_line":"        if not token_id:"},{"line_number":274,"context_line":"            raise exception.TokenNotFound(_(\u0027No token in the request\u0027))"},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"        try:"},{"line_number":277,"context_line":"            # NOTE(lbragstad): Only go to persistent storage if we have a token"},{"line_number":278,"context_line":"            # to fetch from the backend (the driver persists the token)."},{"line_number":279,"context_line":"            # Otherwise the information about the token must be in the token"}],"source_content_type":"text/x-python","patch_set":9,"id":"7af24918_e8c48393","line":276,"range":{"start_line":272,"start_character":0,"end_line":276,"end_character":12},"in_reply_to":"9aed3d3a_f992edf4","updated":"2016-03-01 18:18:55.000000000","message":"Doesn\u0027t look like it. See\n\nhttps://github.com/openstack/keystone/blob/master/keystone/auth/controllers.py#L552","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"04f043ba6f0bdfcd94b0728f9101df0567ef70aa","unresolved":false,"context_lines":[{"line_number":305,"context_line":"            token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":306,"context_line":"            version \u003d self.get_token_version(token_ref)"},{"line_number":307,"context_line":"            if version \u003d\u003d self.V3:"},{"line_number":308,"context_line":"                return self.driver.validate_v3_token(token_ref)"},{"line_number":309,"context_line":"            elif version \u003d\u003d self.V2:"},{"line_number":310,"context_line":"                return self.driver.validate_v2_token(token_ref)"},{"line_number":311,"context_line":"            raise exception.UnsupportedTokenVersionException()"},{"line_number":312,"context_line":"        except exception.Unauthorized as e:"},{"line_number":313,"context_line":"            LOG.debug(\u0027Unable to validate token: %s\u0027, e)"}],"source_content_type":"text/x-python","patch_set":9,"id":"9aed3d3a_799edd07","line":310,"range":{"start_line":308,"start_character":0,"end_line":310,"end_character":63},"updated":"2016-03-01 08:32:00.000000000","message":"validate_vX_token is already done here\n\nedit -- oh, i think we do this because of the tests? that\u0027s not ideal...","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"772751919045cd99154446ca3ab50723dacb73d8","unresolved":false,"context_lines":[{"line_number":305,"context_line":"            token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":306,"context_line":"            version \u003d self.get_token_version(token_ref)"},{"line_number":307,"context_line":"            if version \u003d\u003d self.V3:"},{"line_number":308,"context_line":"                return self.driver.validate_v3_token(token_ref)"},{"line_number":309,"context_line":"            elif version \u003d\u003d self.V2:"},{"line_number":310,"context_line":"                return self.driver.validate_v2_token(token_ref)"},{"line_number":311,"context_line":"            raise exception.UnsupportedTokenVersionException()"},{"line_number":312,"context_line":"        except exception.Unauthorized as e:"},{"line_number":313,"context_line":"            LOG.debug(\u0027Unable to validate token: %s\u0027, e)"}],"source_content_type":"text/x-python","patch_set":9,"id":"7af24918_c86f0791","line":310,"range":{"start_line":308,"start_character":0,"end_line":310,"end_character":63},"in_reply_to":"9aed3d3a_799edd07","updated":"2016-03-01 18:18:55.000000000","message":"I agreed. This stuff needs more refactoring. In fact, we need to refactor the entire token backend. Newton release perhaps?","commit_id":"3b6fcba1707a8f1779e9d1f07c04ce4f53f7ec2a"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"dbb66b8ca4910b741074a65dcdecde014f04d055","unresolved":false,"context_lines":[{"line_number":295,"context_line":"        if not self._needs_persistence:"},{"line_number":296,"context_line":"            # NOTE(lbragstad): This will validate v2 and v3 non-persistent"},{"line_number":297,"context_line":"            # tokens."},{"line_number":298,"context_line":"            return self.driver.validate_non_persistent_token(token_id)"},{"line_number":299,"context_line":"        token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":300,"context_line":"        version \u003d self.get_token_version(token_ref)"},{"line_number":301,"context_line":"        if version \u003d\u003d self.V3:"}],"source_content_type":"text/x-python","patch_set":12,"id":"7af24918_00035f0e","line":298,"range":{"start_line":298,"start_character":12,"end_line":298,"end_character":70},"updated":"2016-03-02 08:51:06.000000000","message":"need catch the exception raised from this method? I tried it and exception.Unauthorized is thrown from this method, so it still return 401 instead of 404.","commit_id":"f1792f4089ccf28ec870104d0853e7fba242f24c"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"ddade0b6b47cb03f7f0bd425e2be91718dbbe3a6","unresolved":false,"context_lines":[{"line_number":295,"context_line":"        if not self._needs_persistence:"},{"line_number":296,"context_line":"            # NOTE(lbragstad): This will validate v2 and v3 non-persistent"},{"line_number":297,"context_line":"            # tokens."},{"line_number":298,"context_line":"            return self.driver.validate_non_persistent_token(token_id)"},{"line_number":299,"context_line":"        token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":300,"context_line":"        version \u003d self.get_token_version(token_ref)"},{"line_number":301,"context_line":"        if version \u003d\u003d self.V3:"}],"source_content_type":"text/x-python","patch_set":12,"id":"7af24918_d64ae1c4","line":298,"range":{"start_line":298,"start_character":12,"end_line":298,"end_character":70},"in_reply_to":"7af24918_00035f0e","updated":"2016-03-02 09:39:50.000000000","message":"if the role is removed from the user, it will raise exception.Unauthorized. This is not caught by the code.\n\nhttps://github.com/openstack/keystone/blob/master/keystone/token/providers/common.py#L441-L453","commit_id":"f1792f4089ccf28ec870104d0853e7fba242f24c"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"1b120b28d1e107c0973ac093d9f6e8c4a002eac2","unresolved":false,"context_lines":[{"line_number":295,"context_line":"        if not self._needs_persistence:"},{"line_number":296,"context_line":"            # NOTE(lbragstad): This will validate v2 and v3 non-persistent"},{"line_number":297,"context_line":"            # tokens."},{"line_number":298,"context_line":"            return self.driver.validate_non_persistent_token(token_id)"},{"line_number":299,"context_line":"        token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":300,"context_line":"        version \u003d self.get_token_version(token_ref)"},{"line_number":301,"context_line":"        if version \u003d\u003d self.V3:"}],"source_content_type":"text/x-python","patch_set":12,"id":"7af24918_09e18a9a","line":298,"in_reply_to":"7af24918_a51c0b14","updated":"2016-03-03 01:58:22.000000000","message":"@Lance, I did exactly the same as you with fernet token, will check it again if i got a chance, thanks for double check.","commit_id":"f1792f4089ccf28ec870104d0853e7fba242f24c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"dacd4e223597b224e907af2f85972e8cb0c01158","unresolved":false,"context_lines":[{"line_number":295,"context_line":"        if not self._needs_persistence:"},{"line_number":296,"context_line":"            # NOTE(lbragstad): This will validate v2 and v3 non-persistent"},{"line_number":297,"context_line":"            # tokens."},{"line_number":298,"context_line":"            return self.driver.validate_non_persistent_token(token_id)"},{"line_number":299,"context_line":"        token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":300,"context_line":"        version \u003d self.get_token_version(token_ref)"},{"line_number":301,"context_line":"        if version \u003d\u003d self.V3:"}],"source_content_type":"text/x-python","patch_set":12,"id":"7af24918_88075b17","line":298,"in_reply_to":"7af24918_a51c0b14","updated":"2016-03-02 23:23:19.000000000","message":"I pushed this through, we can address specific followup on this line as a followup since this doesn\u0027t look to be duplicatable.","commit_id":"f1792f4089ccf28ec870104d0853e7fba242f24c"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"fca0e5162582e56d6785e208f62e1273a95f7aaf","unresolved":false,"context_lines":[{"line_number":295,"context_line":"        if not self._needs_persistence:"},{"line_number":296,"context_line":"            # NOTE(lbragstad): This will validate v2 and v3 non-persistent"},{"line_number":297,"context_line":"            # tokens."},{"line_number":298,"context_line":"            return self.driver.validate_non_persistent_token(token_id)"},{"line_number":299,"context_line":"        token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":300,"context_line":"        version \u003d self.get_token_version(token_ref)"},{"line_number":301,"context_line":"        if version \u003d\u003d self.V3:"}],"source_content_type":"text/x-python","patch_set":12,"id":"7af24918_c43947d9","line":298,"in_reply_to":"7af24918_a958568b","updated":"2016-03-03 02:02:35.000000000","message":"it was called within decorator, and `subject_token_id` is validated twice, the one is in decorator and the other is within API.","commit_id":"f1792f4089ccf28ec870104d0853e7fba242f24c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"14b8103901c19db74a44f0d1b9210a44dc123a33","unresolved":false,"context_lines":[{"line_number":295,"context_line":"        if not self._needs_persistence:"},{"line_number":296,"context_line":"            # NOTE(lbragstad): This will validate v2 and v3 non-persistent"},{"line_number":297,"context_line":"            # tokens."},{"line_number":298,"context_line":"            return self.driver.validate_non_persistent_token(token_id)"},{"line_number":299,"context_line":"        token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":300,"context_line":"        version \u003d self.get_token_version(token_ref)"},{"line_number":301,"context_line":"        if version \u003d\u003d self.V3:"}],"source_content_type":"text/x-python","patch_set":12,"id":"7af24918_c6584b35","line":298,"in_reply_to":"7af24918_c37208ad","updated":"2016-03-02 17:20:02.000000000","message":"AFAICT, v3 validate token does not go through this code path. See\n\nhttps://github.com/openstack/keystone/blob/master/keystone/auth/controllers.py#L552\n\nLooking at the code, it seems only token revoke and v2 token auth is using this code path.\n\nDave, for your test, please make sure you are using two separate accounts. For example, make sure your X-Auth-Token and X-Subject-Token are not from the same user and same scope. Otherwise, you\u0027ll get a 401 for your X-Auth-Token first.","commit_id":"f1792f4089ccf28ec870104d0853e7fba242f24c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5969e0fd1b3d15aa8b5cc00ece0333fcabf6ed2c","unresolved":false,"context_lines":[{"line_number":295,"context_line":"        if not self._needs_persistence:"},{"line_number":296,"context_line":"            # NOTE(lbragstad): This will validate v2 and v3 non-persistent"},{"line_number":297,"context_line":"            # tokens."},{"line_number":298,"context_line":"            return self.driver.validate_non_persistent_token(token_id)"},{"line_number":299,"context_line":"        token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":300,"context_line":"        version \u003d self.get_token_version(token_ref)"},{"line_number":301,"context_line":"        if version \u003d\u003d self.V3:"}],"source_content_type":"text/x-python","patch_set":12,"id":"7af24918_a51c0b14","line":298,"in_reply_to":"7af24918_c37208ad","updated":"2016-03-02 19:46:02.000000000","message":"I can\u0027t seem to recreate this locally. Here is what I did: \n\nAs the admin user:\n  - I created a new user (lbragstad)\n  - I created a new project (project)\n  - I assigned lbragstad the admin role on project\nAs the lbragstad user:\n  - I authenticated for a scoped token to project\nAs the admin user:\n  - I removed lbragstad\u0027s role assignment from project\nAs the lbragstad user:\n  - I attempted to validate my scoped token and received a 404.","commit_id":"f1792f4089ccf28ec870104d0853e7fba242f24c"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"1b120b28d1e107c0973ac093d9f6e8c4a002eac2","unresolved":false,"context_lines":[{"line_number":295,"context_line":"        if not self._needs_persistence:"},{"line_number":296,"context_line":"            # NOTE(lbragstad): This will validate v2 and v3 non-persistent"},{"line_number":297,"context_line":"            # tokens."},{"line_number":298,"context_line":"            return self.driver.validate_non_persistent_token(token_id)"},{"line_number":299,"context_line":"        token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":300,"context_line":"        version \u003d self.get_token_version(token_ref)"},{"line_number":301,"context_line":"        if version \u003d\u003d self.V3:"}],"source_content_type":"text/x-python","patch_set":12,"id":"7af24918_a958568b","line":298,"in_reply_to":"7af24918_c6584b35","updated":"2016-03-03 01:58:22.000000000","message":"@guang, code path is @controller.protected() -\u003e token_provider_api.validate_token(...) -\u003e self._validate_token(unique_id) -\u003e self.driver.validate_non_persistent_token(token_id) -\u003e raise exception.Unauthorized","commit_id":"f1792f4089ccf28ec870104d0853e7fba242f24c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d3521236eee2bf4b5ec3b2ea516b1774047afc5e","unresolved":false,"context_lines":[{"line_number":295,"context_line":"        if not self._needs_persistence:"},{"line_number":296,"context_line":"            # NOTE(lbragstad): This will validate v2 and v3 non-persistent"},{"line_number":297,"context_line":"            # tokens."},{"line_number":298,"context_line":"            return self.driver.validate_non_persistent_token(token_id)"},{"line_number":299,"context_line":"        token_ref \u003d self._persistence.get_token(token_id)"},{"line_number":300,"context_line":"        version \u003d self.get_token_version(token_ref)"},{"line_number":301,"context_line":"        if version \u003d\u003d self.V3:"}],"source_content_type":"text/x-python","patch_set":12,"id":"7af24918_c37208ad","line":298,"in_reply_to":"7af24918_d64ae1c4","updated":"2016-03-02 15:23:02.000000000","message":"Dave, let me test this locally. I want to see if I can create what you\u0027re seeing.","commit_id":"f1792f4089ccf28ec870104d0853e7fba242f24c"}],"keystone/token/providers/common.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e8e1bef3aa54e6287eb3c7ba96bff7f23b7c4bcd","unresolved":false,"context_lines":[{"line_number":411,"context_line":"                # shouldn\u0027t be returning 401 for tokens that don\u0027t have roles."},{"line_number":412,"context_line":"                # See bug 1541621 for more details."},{"line_number":413,"context_line":"                # raise exception.Unauthorized(msg)"},{"line_number":414,"context_line":"                raise exception.NotFound()"},{"line_number":415,"context_line":""},{"line_number":416,"context_line":"            token_data[\u0027roles\u0027] \u003d filtered_roles"},{"line_number":417,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"5a5ae5dd_38c3a83a","line":414,"range":{"start_line":414,"start_character":22,"end_line":414,"end_character":42},"updated":"2016-02-09 03:22:27.000000000","message":"TokenNotFound?","commit_id":"ca978c3dcf2c97860f2806e8e28c03756981196a"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"45357420c74d5f6d6326c3adcc0c1e3e9de3ae98","unresolved":false,"context_lines":[{"line_number":410,"context_line":"                # FIXME(lbragstad): According to the API spec, keystone"},{"line_number":411,"context_line":"                # shouldn\u0027t be returning 401 for tokens that don\u0027t have roles."},{"line_number":412,"context_line":"                # See bug 1541621 for more details."},{"line_number":413,"context_line":"                token_id \u003d self._get_token_id(token_data)"},{"line_number":414,"context_line":"                raise exception.TokenNotFound(token_id\u003dtoken_id)"},{"line_number":415,"context_line":""},{"line_number":416,"context_line":"            token_data[\u0027roles\u0027] \u003d filtered_roles"}],"source_content_type":"text/x-python","patch_set":3,"id":"dae33548_fc211b9f","line":413,"range":{"start_line":413,"start_character":32,"end_line":413,"end_character":45},"updated":"2016-02-18 17:52:13.000000000","message":"we don\u0027t have this method here","commit_id":"ef9abdbf5c11450ad1c964004eb7ed5f9e608785"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fabd3c6c028e1b4db2dee773fd07b57758025842","unresolved":false,"context_lines":[{"line_number":411,"context_line":"                # shouldn\u0027t be returning 401 for tokens that don\u0027t have roles."},{"line_number":412,"context_line":"                # See bug 1541621 for more details."},{"line_number":413,"context_line":"                token_id \u003d self._get_token_id(token_data)"},{"line_number":414,"context_line":"                raise exception.TokenNotFound(token_id\u003dtoken_id)"},{"line_number":415,"context_line":""},{"line_number":416,"context_line":"            token_data[\u0027roles\u0027] \u003d filtered_roles"},{"line_number":417,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"3a57f1b5_09414938","line":414,"range":{"start_line":414,"start_character":63,"end_line":414,"end_character":64},"updated":"2016-02-11 18:33:50.000000000","message":"I think we should make the changes higher up.\n\nhttps://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L304\n\nJust catch all Unauthorized, log them, and re-raise TokenNotFound.","commit_id":"ef9abdbf5c11450ad1c964004eb7ed5f9e608785"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"fe9be87e3b42a703382afab4148d2467a0544274","unresolved":false,"context_lines":[{"line_number":411,"context_line":"                # shouldn\u0027t be returning 401 for tokens that don\u0027t have roles."},{"line_number":412,"context_line":"                # See bug 1541621 for more details."},{"line_number":413,"context_line":"                token_id \u003d self._get_token_id(token_data)"},{"line_number":414,"context_line":"                raise exception.TokenNotFound(token_id\u003dtoken_id)"},{"line_number":415,"context_line":""},{"line_number":416,"context_line":"            token_data[\u0027roles\u0027] \u003d filtered_roles"},{"line_number":417,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"bae84128_fc556d1d","line":414,"range":{"start_line":414,"start_character":63,"end_line":414,"end_character":64},"in_reply_to":"3a57f1b5_09414938","updated":"2016-02-19 17:53:24.000000000","message":"Likely the easiest choice to solve the problem immediately.","commit_id":"ef9abdbf5c11450ad1c964004eb7ed5f9e608785"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"c99311a93cb96a7dea4cf4005ebe3007ad74078e","unresolved":false,"context_lines":[{"line_number":411,"context_line":"                # shouldn\u0027t be returning 401 for tokens that don\u0027t have roles."},{"line_number":412,"context_line":"                # See bug 1541621 for more details."},{"line_number":413,"context_line":"                token_id \u003d self._get_token_id(token_data)"},{"line_number":414,"context_line":"                raise exception.TokenNotFound(token_id\u003dtoken_id)"},{"line_number":415,"context_line":""},{"line_number":416,"context_line":"            token_data[\u0027roles\u0027] \u003d filtered_roles"},{"line_number":417,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"bae84128_fdd14324","line":414,"in_reply_to":"bae84128_3f7ea7e4","updated":"2016-02-23 23:02:16.000000000","message":"Yes, that\u0027s the catch-all place.","commit_id":"ef9abdbf5c11450ad1c964004eb7ed5f9e608785"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c037eb9281aea86ba528bf55539449f0203c0654","unresolved":false,"context_lines":[{"line_number":411,"context_line":"                # shouldn\u0027t be returning 401 for tokens that don\u0027t have roles."},{"line_number":412,"context_line":"                # See bug 1541621 for more details."},{"line_number":413,"context_line":"                token_id \u003d self._get_token_id(token_data)"},{"line_number":414,"context_line":"                raise exception.TokenNotFound(token_id\u003dtoken_id)"},{"line_number":415,"context_line":""},{"line_number":416,"context_line":"            token_data[\u0027roles\u0027] \u003d filtered_roles"},{"line_number":417,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"bae84128_3f7ea7e4","line":414,"in_reply_to":"bae84128_fc556d1d","updated":"2016-02-19 18:06:05.000000000","message":"Yep, that looks right. But we\u0027ll have to wrap that around the v3 validate call, too. \n\nSo - maybe here? https://github.com/openstack/keystone/blob/master/keystone/token/provider.py#L287","commit_id":"ef9abdbf5c11450ad1c964004eb7ed5f9e608785"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"191eb6627f36f08e1b18e27b706f9721e181e43f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"bae84128_5208d228","updated":"2016-02-24 22:04:45.000000000","message":"these changes seem unrelated, suggest reverting them","commit_id":"5bd88ad5d7af8de2e2ead8280697823b94884290"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"3ac0e084bb555c744d25e686fc567ff0bf7d0b22","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"bae84128_55571cca","in_reply_to":"bae84128_5208d228","updated":"2016-02-24 22:37:10.000000000","message":"ops, sorry, I\u0027ll revert it","commit_id":"5bd88ad5d7af8de2e2ead8280697823b94884290"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"39433324d8065819b619d5f2fb625c7ae5cb602a","unresolved":false,"context_lines":[{"line_number":473,"context_line":"            self._populate_is_admin_project(token_data)"},{"line_number":474,"context_line":"        self._populate_user(token_data, user_id, trust)"},{"line_number":475,"context_line":"        self._populate_roles(token_data, user_id, domain_id, project_id,"},{"line_number":476,"context_line":"                             trust, access_token)"},{"line_number":477,"context_line":"        self._populate_audit_info(token_data, audit_info)"},{"line_number":478,"context_line":""},{"line_number":479,"context_line":"        if include_catalog:"}],"source_content_type":"text/x-python","patch_set":4,"id":"9aed3d3a_b77e6eac","line":476,"updated":"2016-02-25 22:23:43.000000000","message":"did this need to change?","commit_id":"5bd88ad5d7af8de2e2ead8280697823b94884290"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"39433324d8065819b619d5f2fb625c7ae5cb602a","unresolved":false,"context_lines":[{"line_number":481,"context_line":"                                           project_id, trust)"},{"line_number":482,"context_line":"        self._populate_service_providers(token_data)"},{"line_number":483,"context_line":"        self._populate_token_dates(token_data, expires\u003dexpires,"},{"line_number":484,"context_line":"                                   trust\u003dtrust, issued_at\u003dissued_at)"},{"line_number":485,"context_line":"        self._populate_oauth_section(token_data, access_token)"},{"line_number":486,"context_line":"        return {\u0027token\u0027: token_data}"},{"line_number":487,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"9aed3d3a_57444273","line":484,"updated":"2016-02-25 22:23:43.000000000","message":"same comment here","commit_id":"5bd88ad5d7af8de2e2ead8280697823b94884290"}]}