)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"94009a5233aacf2907fb51aaf3f721290ddd0d33","unresolved":false,"context_lines":[{"line_number":19,"context_line":"for backward compatibility."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Change-Id: I3cca2bd1f103ccdd1e59024a8db7efc09ddee089"},{"line_number":22,"context_line":"Closes-Bug: #968696"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"1a6eadb0_a462b0d6","line":22,"range":{"start_line":22,"start_character":0,"end_line":22,"end_character":19},"updated":"2016-12-20 01:40:11.000000000","message":"does this actually close this bug ? I see what you reported here as being another bug that needs to be reported in launchpad (regression was added in one of the patches in the way to fix #968696, the one which added is_admin_project to tokens).\n\nI suggest you open a new bug report so that we can discuss the validity and severity there, does this makes sense to you ?","commit_id":"0b535a1ff8dd5ea5dd890bc7cdc67a278fae0e82"}],"keystone/tests/unit/test_v3.py":[{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"51d9dbe6b3301cc43547088679463420b36e9233","unresolved":false,"context_lines":[{"line_number":732,"context_line":"        return token"},{"line_number":733,"context_line":""},{"line_number":734,"context_line":"    def assertValidProjectScopedTokenResponse(self, r, *args, **kwargs):"},{"line_number":735,"context_line":"        role_id \u003d kwargs.pop(\u0027role_id\u0027, self.role_id)"},{"line_number":736,"context_line":"        is_admin_project \u003d kwargs.pop(\u0027is_admin_project\u0027, True)"},{"line_number":737,"context_line":"        token \u003d self.assertValidScopedTokenResponse(r, *args, **kwargs)"},{"line_number":738,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_faa02bf6","line":735,"updated":"2016-05-16 19:55:02.000000000","message":"I didn\u0027t get what is the problem to stay using self.role_id here","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"7d0e61ef0ee1c19dada83a8cbe9f73380895d4fc","unresolved":false,"context_lines":[{"line_number":732,"context_line":"        return token"},{"line_number":733,"context_line":""},{"line_number":734,"context_line":"    def assertValidProjectScopedTokenResponse(self, r, *args, **kwargs):"},{"line_number":735,"context_line":"        role_id \u003d kwargs.pop(\u0027role_id\u0027, self.role_id)"},{"line_number":736,"context_line":"        is_admin_project \u003d kwargs.pop(\u0027is_admin_project\u0027, True)"},{"line_number":737,"context_line":"        token \u003d self.assertValidScopedTokenResponse(r, *args, **kwargs)"},{"line_number":738,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_a6c65265","line":735,"in_reply_to":"dab17558_43ae7981","updated":"2016-05-17 18:44:03.000000000","message":"So, we we don\u0027t need two tests here? one with admin role and another for a member? They will have the same behavior?","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"32c1b9a2d14523fea303ac16cfabc85c9f6fee77","unresolved":false,"context_lines":[{"line_number":732,"context_line":"        return token"},{"line_number":733,"context_line":""},{"line_number":734,"context_line":"    def assertValidProjectScopedTokenResponse(self, r, *args, **kwargs):"},{"line_number":735,"context_line":"        role_id \u003d kwargs.pop(\u0027role_id\u0027, self.role_id)"},{"line_number":736,"context_line":"        is_admin_project \u003d kwargs.pop(\u0027is_admin_project\u0027, True)"},{"line_number":737,"context_line":"        token \u003d self.assertValidScopedTokenResponse(r, *args, **kwargs)"},{"line_number":738,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_668bcac3","line":735,"in_reply_to":"dab17558_a6c65265","updated":"2016-05-17 18:51:49.000000000","message":"we have 2 tests... see the changes in test_v3_auth. The first test tries non-admin, the second test tries admin.","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"7e8e9c7ffe1ea5711cde79a60746de91fead4f1d","unresolved":false,"context_lines":[{"line_number":732,"context_line":"        return token"},{"line_number":733,"context_line":""},{"line_number":734,"context_line":"    def assertValidProjectScopedTokenResponse(self, r, *args, **kwargs):"},{"line_number":735,"context_line":"        role_id \u003d kwargs.pop(\u0027role_id\u0027, self.role_id)"},{"line_number":736,"context_line":"        is_admin_project \u003d kwargs.pop(\u0027is_admin_project\u0027, True)"},{"line_number":737,"context_line":"        token \u003d self.assertValidScopedTokenResponse(r, *args, **kwargs)"},{"line_number":738,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_43ae7981","line":735,"in_reply_to":"dab17558_faa02bf6","updated":"2016-05-17 18:03:32.000000000","message":"self.role_id \u003d\u003d \u0027admin\u0027 and the test I added needed to use a non-admin user.","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"51d9dbe6b3301cc43547088679463420b36e9233","unresolved":false,"context_lines":[{"line_number":774,"context_line":"            project_scoped_token_schema)"},{"line_number":775,"context_line":"        validator_object.validate(token)"},{"line_number":776,"context_line":""},{"line_number":777,"context_line":"        self.assertEqual(role_id, token[\u0027roles\u0027][0][\u0027id\u0027])"},{"line_number":778,"context_line":"        self.assertIs(is_admin_project, token.get(\u0027is_admin_project\u0027))"},{"line_number":779,"context_line":""},{"line_number":780,"context_line":"        return token"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_5aa217fd","line":777,"updated":"2016-05-16 19:55:02.000000000","message":"same here","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"}],"keystone/token/providers/common.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"65811af5fe5fbe9d79d292c7763c91ae20f5bb81","unresolved":false,"context_lines":[{"line_number":275,"context_line":"        if (project[\u0027name\u0027] \u003d\u003d r.admin_project_name and"},{"line_number":276,"context_line":"                project[\u0027domain\u0027][\u0027name\u0027] \u003d\u003d r.admin_project_domain_name):"},{"line_number":277,"context_line":"            token_data[\u0027is_admin_project\u0027] \u003d True"},{"line_number":278,"context_line":"        # (edmondsw) Also set is_admin_project when admin_project_name is"},{"line_number":279,"context_line":"        # not set in CONF and the role is admin, as a way to maintain backward"},{"line_number":280,"context_line":"        # compatibility for users depending on the legacy behavior that anyone"},{"line_number":281,"context_line":"        # with the admin role is not restricted to the scope of their token"}],"source_content_type":"text/x-python","patch_set":1,"id":"1a122d0e_43981bc0","line":278,"range":{"start_line":278,"start_character":10,"end_line":278,"end_character":20},"updated":"2016-04-29 18:38:51.000000000","message":"style remark: if you\u0027re leaving a comment with your name, make it of the form:\n\n  NOTE(edmondsw): Also set ...","commit_id":"e51c7a8625d63890372587117034c30874ff152e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"cd7acf804df5d00a64c0f3c40605cfc401da0804","unresolved":false,"context_lines":[{"line_number":281,"context_line":"            # scope of their token."},{"line_number":282,"context_line":"            for role in token_data[\u0027roles\u0027]:"},{"line_number":283,"context_line":"                if role[\u0027name\u0027] \u003d\u003d \u0027admin\u0027:"},{"line_number":284,"context_line":"                    token_data[\u0027is_admin_project\u0027] \u003d True"},{"line_number":285,"context_line":"            return"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        project \u003d token_data[\u0027project\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_9995ffe5","line":284,"updated":"2016-05-13 19:39:08.000000000","message":"Just make it true for all roles, and the fix is backwards compatible.  There is nothing special about admin.  If the conf values are set and they don\u0027t match, explicitly set is_admin_project \u003d False.","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"5486eaf67cccde4e942eac3794a921c5dc90d91e","unresolved":false,"context_lines":[{"line_number":281,"context_line":"            # scope of their token."},{"line_number":282,"context_line":"            for role in token_data[\u0027roles\u0027]:"},{"line_number":283,"context_line":"                if role[\u0027name\u0027] \u003d\u003d \u0027admin\u0027:"},{"line_number":284,"context_line":"                    token_data[\u0027is_admin_project\u0027] \u003d True"},{"line_number":285,"context_line":"            return"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        project \u003d token_data[\u0027project\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_0cccebb9","line":284,"in_reply_to":"dab17558_47643221","updated":"2016-05-16 14:52:14.000000000","message":"that rewriting of policy files is exactly what is going to start happening, though, making all roles global-capable. That is only safe, for the reasons I described above, if we check for the admin role here.","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"ec16db7c96681ae3238e097768de8769d8c92445","unresolved":false,"context_lines":[{"line_number":281,"context_line":"            # scope of their token."},{"line_number":282,"context_line":"            for role in token_data[\u0027roles\u0027]:"},{"line_number":283,"context_line":"                if role[\u0027name\u0027] \u003d\u003d \u0027admin\u0027:"},{"line_number":284,"context_line":"                    token_data[\u0027is_admin_project\u0027] \u003d True"},{"line_number":285,"context_line":"            return"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        project \u003d token_data[\u0027project\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_47643221","line":284,"in_reply_to":"dab17558_87358847","updated":"2016-05-15 23:02:08.000000000","message":"All roles aren\u0027t magically going to become global - that would require rewriting the policy files. admin is by convention the only role that is used across projects but all roles work the same way here. \n\nkeystoneauth is required to expose the flag via auth_token middleware. auth_token middleware and oslo.context are what is required to do enforcement properly.","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"c878718f55f89034a7aea25d28b9583cc1bf43b4","unresolved":false,"context_lines":[{"line_number":281,"context_line":"            # scope of their token."},{"line_number":282,"context_line":"            for role in token_data[\u0027roles\u0027]:"},{"line_number":283,"context_line":"                if role[\u0027name\u0027] \u003d\u003d \u0027admin\u0027:"},{"line_number":284,"context_line":"                    token_data[\u0027is_admin_project\u0027] \u003d True"},{"line_number":285,"context_line":"            return"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        project \u003d token_data[\u0027project\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_e4e73b10","line":284,"in_reply_to":"dab17558_9995ffe5","updated":"2016-05-13 22:15:36.000000000","message":"Right - ayoung and i had a debate over this as to whether it was necessary to put true - because True is the default, it\u0027s False we\u0027re really interested in here.\n\nWhat i most dislike is you are looking for the admin role rather than just saying everything is in the admin project. I don\u0027t want to make the string \u0027admin\u0027 any more special than it already is.\n\nBut yea - if nothing is in the token then we assume True. Adding True here doesn\u0027t buy us anything.","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"7caaf599a2a06725063129e533f0da3b92534fc2","unresolved":false,"context_lines":[{"line_number":281,"context_line":"            # scope of their token."},{"line_number":282,"context_line":"            for role in token_data[\u0027roles\u0027]:"},{"line_number":283,"context_line":"                if role[\u0027name\u0027] \u003d\u003d \u0027admin\u0027:"},{"line_number":284,"context_line":"                    token_data[\u0027is_admin_project\u0027] \u003d True"},{"line_number":285,"context_line":"            return"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        project \u003d token_data[\u0027project\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_87358847","line":284,"in_reply_to":"dab17558_e4e73b10","updated":"2016-05-14 13:45:26.000000000","message":"checking for the admin role is essential. Otherwise as soon as the code and policy files for nova, etc. are updated to check for is_admin_project\u003dTrue and consider that global, ALL role assignments will be global for environments that don\u0027t have the admin project specified in keystone\u0027s conf. Doing that for admin is backward compatible because that\u0027s the current behavior for admin roles... but doing that for anything else is most definitely NOT backward compatible.\n\nAnd the fact that keystoneauth will assume True if is_admin_project isn\u0027t in the token only helps those that use keystoneauth... which is not everyone. So doing this here rather than just in keystoneauth means it works for everyone, not just users of keystoneauth.","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"3691c4bf9065164701450c4b8b15ee8d04303c24","unresolved":false,"context_lines":[{"line_number":282,"context_line":"            for role in token_data[\u0027roles\u0027]:"},{"line_number":283,"context_line":"                if role[\u0027name\u0027] \u003d\u003d \u0027admin\u0027:"},{"line_number":284,"context_line":"                    token_data[\u0027is_admin_project\u0027] \u003d True"},{"line_number":285,"context_line":"            return"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"        project \u003d token_data[\u0027project\u0027]"},{"line_number":288,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_3e906bec","line":285,"range":{"start_line":285,"start_character":12,"end_line":285,"end_character":18},"updated":"2016-05-12 22:56:39.000000000","message":"Why? from a client side we default to is_admin_project True if nothing is set so this is exactly the same. \n\nalso just \u0027admin\u0027 in token_data[\u0027roles\u0027]","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a3abcef2d28b335af3af227fb4d591973f057f30","unresolved":false,"context_lines":[{"line_number":531,"context_line":"        self._populate_user(token_data, user_id, trust)"},{"line_number":532,"context_line":"        self._populate_roles(token_data, user_id, domain_id, project_id, trust,"},{"line_number":533,"context_line":"                             access_token)"},{"line_number":534,"context_line":"        if token_data.get(\u0027project\u0027):"},{"line_number":535,"context_line":"            self._populate_is_admin_project(token_data)"},{"line_number":536,"context_line":"        self._populate_audit_info(token_data, audit_info)"},{"line_number":537,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_989d6768","line":534,"updated":"2016-05-17 20:44:50.000000000","message":"we could add a comment here saying that this *has* to be after we populate the roles, because in order to set the admin project we need to know the roles a user has.","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"5ca0f20b95ec3afcb587eb8add6e077ca6ab32c0","unresolved":false,"context_lines":[{"line_number":531,"context_line":"        self._populate_user(token_data, user_id, trust)"},{"line_number":532,"context_line":"        self._populate_roles(token_data, user_id, domain_id, project_id, trust,"},{"line_number":533,"context_line":"                             access_token)"},{"line_number":534,"context_line":"        if token_data.get(\u0027project\u0027):"},{"line_number":535,"context_line":"            self._populate_is_admin_project(token_data)"},{"line_number":536,"context_line":"        self._populate_audit_info(token_data, audit_info)"},{"line_number":537,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"7aa08908_6beed6b5","line":534,"in_reply_to":"dab17558_989d6768","updated":"2016-09-07 01:19:23.000000000","message":"++","commit_id":"c2faedc19e63122a3a7d846abb04a96d5c7de060"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"9c73695a723c3ba7fd42a2a4d0793b11dfb7c337","unresolved":false,"context_lines":[{"line_number":375,"context_line":"            for role in token_data[\u0027roles\u0027]:"},{"line_number":376,"context_line":"                if role[\u0027name\u0027] \u003d\u003d \u0027admin\u0027:"},{"line_number":377,"context_line":"                    token_data[\u0027is_admin_project\u0027] \u003d True"},{"line_number":378,"context_line":"            return"},{"line_number":379,"context_line":""},{"line_number":380,"context_line":"        project \u003d token_data[\u0027project\u0027]"},{"line_number":381,"context_line":""}],"source_content_type":"text/x-python","patch_set":3,"id":"ba5201f7_3877bb3b","line":378,"updated":"2017-01-02 23:13:58.000000000","message":"I don\u0027t see how this is different. When no value is set in the token then auth_token middleware will default the value to True. \n\nThe only value that actually matters here is is_admin_project\u003dFalse.\n\nhttps://github.com/openstack/keystonemiddleware/blob/dfd53e55512cba6a8b7e69ac5bf7bea172dfe6b1/keystonemiddleware/auth_token/_request.py#L63\n\nhttps://github.com/openstack/keystoneauth/blob/014db209d877cfa74f4b2c0de5f081358ab56b7d/keystoneauth1/access/access.py#L609","commit_id":"0b535a1ff8dd5ea5dd890bc7cdc67a278fae0e82"}]}