)]}'
{"keystone/common/config.py":[{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c6e653ed01a7f8b574af47c24bf765b72740c0f5","unresolved":false,"context_lines":[{"line_number":1027,"context_line":"                         \u0027on.\u0027),"},{"line_number":1028,"context_line":"    ],"},{"line_number":1029,"context_line":"    \u0027compliance\u0027: ["},{"line_number":1030,"context_line":"        cfg.BoolOpt(\u0027enable\u0027,"},{"line_number":1031,"context_line":"                    default\u003dFalse,"},{"line_number":1032,"context_line":"                    help\u003d\u0027enable the compliance settings\u0027),"},{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_318ade1b","line":1030,"range":{"start_line":1030,"start_character":21,"end_line":1030,"end_character":27},"updated":"2016-05-10 19:51:00.000000000","message":"Why do we need this?","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"160faf0aabfa657bc102d801e5c87088ed082f69","unresolved":false,"context_lines":[{"line_number":1027,"context_line":"                         \u0027on.\u0027),"},{"line_number":1028,"context_line":"    ],"},{"line_number":1029,"context_line":"    \u0027compliance\u0027: ["},{"line_number":1030,"context_line":"        cfg.BoolOpt(\u0027enable\u0027,"},{"line_number":1031,"context_line":"                    default\u003dFalse,"},{"line_number":1032,"context_line":"                    help\u003d\u0027enable the compliance settings\u0027),"},{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_a329259d","line":1030,"range":{"start_line":1030,"start_character":21,"end_line":1030,"end_character":27},"in_reply_to":"dab17558_318ade1b","updated":"2016-05-11 20:21:47.000000000","message":"this seems like an easy check to do in the code, and gives us added safety of this not being on by default. i\u0027m totally okay with this, do you have an alternative?","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8f767af9769554211cbe3d3b9e12bbfb65a0a60e","unresolved":false,"context_lines":[{"line_number":1027,"context_line":"                         \u0027on.\u0027),"},{"line_number":1028,"context_line":"    ],"},{"line_number":1029,"context_line":"    \u0027compliance\u0027: ["},{"line_number":1030,"context_line":"        cfg.BoolOpt(\u0027enable\u0027,"},{"line_number":1031,"context_line":"                    default\u003dFalse,"},{"line_number":1032,"context_line":"                    help\u003d\u0027enable the compliance settings\u0027),"},{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_ef0dc68f","line":1030,"range":{"start_line":1030,"start_character":21,"end_line":1030,"end_character":27},"in_reply_to":"dab17558_49d977f2","updated":"2016-05-12 01:58:32.000000000","message":"ah okay, i see what you mean... how do you propose to solve the issue of deployers who don\u0027t want any PCI support? \n\nwe could change the defaults to None... but doesn\u0027t seem so great.\n\none negative about an \"enabled\" switch is that it\u0027s an all or nothing deal.","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"76958602456a5e7ccbe31a88fc3f65ca2e3be0f3","unresolved":false,"context_lines":[{"line_number":1027,"context_line":"                         \u0027on.\u0027),"},{"line_number":1028,"context_line":"    ],"},{"line_number":1029,"context_line":"    \u0027compliance\u0027: ["},{"line_number":1030,"context_line":"        cfg.BoolOpt(\u0027enable\u0027,"},{"line_number":1031,"context_line":"                    default\u003dFalse,"},{"line_number":1032,"context_line":"                    help\u003d\u0027enable the compliance settings\u0027),"},{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_5bfdb4af","line":1030,"range":{"start_line":1030,"start_character":21,"end_line":1030,"end_character":27},"in_reply_to":"dab17558_822e91a2","updated":"2016-05-12 16:12:34.000000000","message":"I\u0027ll remove the option. I think the defaults are reasonable. If an operator has a problem with the compliance defaults they can change them. I agree with Ron since the enable option would be hard to maintain since the other config variables would have to reference the enable variable.","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"43396ffcf7a0fcce6265baef81dc9ea80c302415","unresolved":false,"context_lines":[{"line_number":1027,"context_line":"                         \u0027on.\u0027),"},{"line_number":1028,"context_line":"    ],"},{"line_number":1029,"context_line":"    \u0027compliance\u0027: ["},{"line_number":1030,"context_line":"        cfg.BoolOpt(\u0027enable\u0027,"},{"line_number":1031,"context_line":"                    default\u003dFalse,"},{"line_number":1032,"context_line":"                    help\u003d\u0027enable the compliance settings\u0027),"},{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_49d977f2","line":1030,"range":{"start_line":1030,"start_character":21,"end_line":1030,"end_character":27},"in_reply_to":"dab17558_a329259d","updated":"2016-05-11 21:32:44.000000000","message":"I would totally just take this out because it would be difficult to maintain.  Compliance standards will change overtime and how they are implemented can vary between operators.  Thus, I think we just want to give them options and then it would be up to them to say that the settings they have configured are compliant.","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"cab0affe948eadbc432a7d49b215b3f37b391602","unresolved":false,"context_lines":[{"line_number":1027,"context_line":"                         \u0027on.\u0027),"},{"line_number":1028,"context_line":"    ],"},{"line_number":1029,"context_line":"    \u0027compliance\u0027: ["},{"line_number":1030,"context_line":"        cfg.BoolOpt(\u0027enable\u0027,"},{"line_number":1031,"context_line":"                    default\u003dFalse,"},{"line_number":1032,"context_line":"                    help\u003d\u0027enable the compliance settings\u0027),"},{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_822e91a2","line":1030,"range":{"start_line":1030,"start_character":21,"end_line":1030,"end_character":27},"in_reply_to":"dab17558_ef0dc68f","updated":"2016-05-12 02:45:13.000000000","message":"Yeah, I think we do have to have some default values, but again, it\u0027s sort of up to operators to configure those setting to comply with PCI, HIPAA or any other standards.  The point being, is that they will now have options/settings they can configure to comply with those standards.","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c6e653ed01a7f8b574af47c24bf765b72740c0f5","unresolved":false,"context_lines":[{"line_number":1030,"context_line":"        cfg.BoolOpt(\u0027enable\u0027,"},{"line_number":1031,"context_line":"                    default\u003dFalse,"},{"line_number":1032,"context_line":"                    help\u003d\u0027enable the compliance settings\u0027),"},{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"},{"line_number":1034,"context_line":"                   default\u003d90,"},{"line_number":1035,"context_line":"                   help\u003d\u0027number of days for which a user can be inactive\u0027"},{"line_number":1036,"context_line":"                        \u0027before being locked out\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_f1d97623","line":1033,"range":{"start_line":1033,"start_character":20,"end_line":1033,"end_character":44},"updated":"2016-05-10 19:51:00.000000000","message":"I think this should be disable_user_account_days_inactive.  It\u0027s really disable; not lockout.","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"160faf0aabfa657bc102d801e5c87088ed082f69","unresolved":false,"context_lines":[{"line_number":1030,"context_line":"        cfg.BoolOpt(\u0027enable\u0027,"},{"line_number":1031,"context_line":"                    default\u003dFalse,"},{"line_number":1032,"context_line":"                    help\u003d\u0027enable the compliance settings\u0027),"},{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"},{"line_number":1034,"context_line":"                   default\u003d90,"},{"line_number":1035,"context_line":"                   help\u003d\u0027number of days for which a user can be inactive\u0027"},{"line_number":1036,"context_line":"                        \u0027before being locked out\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_e31ded73","line":1033,"range":{"start_line":1033,"start_character":20,"end_line":1033,"end_character":44},"in_reply_to":"dab17558_f1d97623","updated":"2016-05-11 20:21:47.000000000","message":"++","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"76958602456a5e7ccbe31a88fc3f65ca2e3be0f3","unresolved":false,"context_lines":[{"line_number":1030,"context_line":"        cfg.BoolOpt(\u0027enable\u0027,"},{"line_number":1031,"context_line":"                    default\u003dFalse,"},{"line_number":1032,"context_line":"                    help\u003d\u0027enable the compliance settings\u0027),"},{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"},{"line_number":1034,"context_line":"                   default\u003d90,"},{"line_number":1035,"context_line":"                   help\u003d\u0027number of days for which a user can be inactive\u0027"},{"line_number":1036,"context_line":"                        \u0027before being locked out\u0027),"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_3b239057","line":1033,"range":{"start_line":1033,"start_character":20,"end_line":1033,"end_character":44},"in_reply_to":"dab17558_f1d97623","updated":"2016-05-12 16:12:34.000000000","message":"Done","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"160faf0aabfa657bc102d801e5c87088ed082f69","unresolved":false,"context_lines":[{"line_number":1032,"context_line":"                    help\u003d\u0027enable the compliance settings\u0027),"},{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"},{"line_number":1034,"context_line":"                   default\u003d90,"},{"line_number":1035,"context_line":"                   help\u003d\u0027number of days for which a user can be inactive\u0027"},{"line_number":1036,"context_line":"                        \u0027before being locked out\u0027),"},{"line_number":1037,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1038,"context_line":"                   default\u003d6,"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_2314154b","line":1035,"range":{"start_line":1035,"start_character":25,"end_line":1035,"end_character":31},"updated":"2016-05-11 20:21:47.000000000","message":"Capitalize the start of sentences","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"76958602456a5e7ccbe31a88fc3f65ca2e3be0f3","unresolved":false,"context_lines":[{"line_number":1032,"context_line":"                    help\u003d\u0027enable the compliance settings\u0027),"},{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"},{"line_number":1034,"context_line":"                   default\u003d90,"},{"line_number":1035,"context_line":"                   help\u003d\u0027number of days for which a user can be inactive\u0027"},{"line_number":1036,"context_line":"                        \u0027before being locked out\u0027),"},{"line_number":1037,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1038,"context_line":"                   default\u003d6,"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_0d774d03","line":1035,"range":{"start_line":1035,"start_character":25,"end_line":1035,"end_character":31},"in_reply_to":"dab17558_2314154b","updated":"2016-05-12 16:12:34.000000000","message":"Done","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"160faf0aabfa657bc102d801e5c87088ed082f69","unresolved":false,"context_lines":[{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"},{"line_number":1034,"context_line":"                   default\u003d90,"},{"line_number":1035,"context_line":"                   help\u003d\u0027number of days for which a user can be inactive\u0027"},{"line_number":1036,"context_line":"                        \u0027before being locked out\u0027),"},{"line_number":1037,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1038,"context_line":"                   default\u003d6,"},{"line_number":1039,"context_line":"                   help\u003d\u0027number of times a user can fail login attempts until \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_830fc135","line":1036,"range":{"start_line":1036,"start_character":45,"end_line":1036,"end_character":48},"updated":"2016-05-11 20:21:47.000000000","message":"end sentences with periods.","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"76958602456a5e7ccbe31a88fc3f65ca2e3be0f3","unresolved":false,"context_lines":[{"line_number":1033,"context_line":"        cfg.IntOpt(\u0027lockout_days_no_activity\u0027,"},{"line_number":1034,"context_line":"                   default\u003d90,"},{"line_number":1035,"context_line":"                   help\u003d\u0027number of days for which a user can be inactive\u0027"},{"line_number":1036,"context_line":"                        \u0027before being locked out\u0027),"},{"line_number":1037,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1038,"context_line":"                   default\u003d6,"},{"line_number":1039,"context_line":"                   help\u003d\u0027number of times a user can fail login attempts until \u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_ed73e913","line":1036,"range":{"start_line":1036,"start_character":45,"end_line":1036,"end_character":48},"in_reply_to":"dab17558_830fc135","updated":"2016-05-12 16:12:34.000000000","message":"Done","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c6e653ed01a7f8b574af47c24bf765b72740c0f5","unresolved":false,"context_lines":[{"line_number":1041,"context_line":"        cfg.IntOpt(\u0027lockout_duration_mins\u0027,"},{"line_number":1042,"context_line":"                   default\u003d30,"},{"line_number":1043,"context_line":"                   help\u003d\u0027how long in minutes a user will be locked out for \u0027),"},{"line_number":1044,"context_line":"        cfg.IntOpt(\u0027change_password_days\u0027,"},{"line_number":1045,"context_line":"                   default\u003d90,"},{"line_number":1046,"context_line":"                   help\u003d\u0027number of days for which a password will be \u0027"},{"line_number":1047,"context_line":"                        \u0027considered valid before requiring the user to change\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_d1ed52b8","line":1044,"range":{"start_line":1044,"start_character":20,"end_line":1044,"end_character":40},"updated":"2016-05-10 19:51:00.000000000","message":"How about password_expires_days?","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"76958602456a5e7ccbe31a88fc3f65ca2e3be0f3","unresolved":false,"context_lines":[{"line_number":1041,"context_line":"        cfg.IntOpt(\u0027lockout_duration_mins\u0027,"},{"line_number":1042,"context_line":"                   default\u003d30,"},{"line_number":1043,"context_line":"                   help\u003d\u0027how long in minutes a user will be locked out for \u0027),"},{"line_number":1044,"context_line":"        cfg.IntOpt(\u0027change_password_days\u0027,"},{"line_number":1045,"context_line":"                   default\u003d90,"},{"line_number":1046,"context_line":"                   help\u003d\u0027number of days for which a password will be \u0027"},{"line_number":1047,"context_line":"                        \u0027considered valid before requiring the user to change\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_1b932c5c","line":1044,"range":{"start_line":1044,"start_character":20,"end_line":1044,"end_character":40},"in_reply_to":"dab17558_d1ed52b8","updated":"2016-05-12 16:12:34.000000000","message":"Done","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c6e653ed01a7f8b574af47c24bf765b72740c0f5","unresolved":false,"context_lines":[{"line_number":1050,"context_line":"                   default\u003d4,"},{"line_number":1051,"context_line":"                   help\u003d\u0027number of latest password iterations for which the \u0027"},{"line_number":1052,"context_line":"                        \u0027password must be unique\u0027),"},{"line_number":1053,"context_line":"        cfg.IntOpt(\u0027password_change_limit_days\u0027,"},{"line_number":1054,"context_line":"                   default\u003d4,"},{"line_number":1055,"context_line":"                   help\u003d\u0027number of days for which a password will be \u0027"},{"line_number":1056,"context_line":"                        \u0027considered valid before requiring the user to change\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_b1dd2ee2","line":1053,"range":{"start_line":1053,"start_character":20,"end_line":1053,"end_character":46},"updated":"2016-05-10 19:51:00.000000000","message":"How is this different than the one above?","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"76958602456a5e7ccbe31a88fc3f65ca2e3be0f3","unresolved":false,"context_lines":[{"line_number":1050,"context_line":"                   default\u003d4,"},{"line_number":1051,"context_line":"                   help\u003d\u0027number of latest password iterations for which the \u0027"},{"line_number":1052,"context_line":"                        \u0027password must be unique\u0027),"},{"line_number":1053,"context_line":"        cfg.IntOpt(\u0027password_change_limit_days\u0027,"},{"line_number":1054,"context_line":"                   default\u003d4,"},{"line_number":1055,"context_line":"                   help\u003d\u0027number of days for which a password will be \u0027"},{"line_number":1056,"context_line":"                        \u0027considered valid before requiring the user to change\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_5b993478","line":1053,"range":{"start_line":1053,"start_character":20,"end_line":1053,"end_character":46},"in_reply_to":"dab17558_a333e4f4","updated":"2016-05-12 16:12:34.000000000","message":"I will change it to password_change_limit_per_day.","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"ab3ba786f45c78466fe5207442d684d0d086718f","unresolved":false,"context_lines":[{"line_number":1050,"context_line":"                   default\u003d4,"},{"line_number":1051,"context_line":"                   help\u003d\u0027number of latest password iterations for which the \u0027"},{"line_number":1052,"context_line":"                        \u0027password must be unique\u0027),"},{"line_number":1053,"context_line":"        cfg.IntOpt(\u0027password_change_limit_days\u0027,"},{"line_number":1054,"context_line":"                   default\u003d4,"},{"line_number":1055,"context_line":"                   help\u003d\u0027number of days for which a password will be \u0027"},{"line_number":1056,"context_line":"                        \u0027considered valid before requiring the user to change\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_f237c2ad","line":1053,"range":{"start_line":1053,"start_character":20,"end_line":1053,"end_character":46},"in_reply_to":"dab17558_a333e4f4","updated":"2016-05-16 15:17:01.000000000","message":"The number of times a user can change their password?  Where in the spec is this defined?","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"160faf0aabfa657bc102d801e5c87088ed082f69","unresolved":false,"context_lines":[{"line_number":1050,"context_line":"                   default\u003d4,"},{"line_number":1051,"context_line":"                   help\u003d\u0027number of latest password iterations for which the \u0027"},{"line_number":1052,"context_line":"                        \u0027password must be unique\u0027),"},{"line_number":1053,"context_line":"        cfg.IntOpt(\u0027password_change_limit_days\u0027,"},{"line_number":1054,"context_line":"                   default\u003d4,"},{"line_number":1055,"context_line":"                   help\u003d\u0027number of days for which a password will be \u0027"},{"line_number":1056,"context_line":"                        \u0027considered valid before requiring the user to change\u0027"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_a333e4f4","line":1053,"range":{"start_line":1053,"start_character":20,"end_line":1053,"end_character":46},"in_reply_to":"dab17558_b1dd2ee2","updated":"2016-05-11 20:21:47.000000000","message":"it is different, the help text is wrong.\n\nthis should be \"max number of times per day a user can change their password\"","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"160faf0aabfa657bc102d801e5c87088ed082f69","unresolved":false,"context_lines":[{"line_number":1057,"context_line":"                        \u0027 it\u0027),"},{"line_number":1058,"context_line":"        cfg.StrOpt(\u0027password_regex\u0027,"},{"line_number":1059,"context_line":"                   default\u003d\"^(?\u003d.*[A-Za-z])(?\u003d.*\\d)[A-Za-z\\d]{7,}$\","},{"line_number":1060,"context_line":"                   help\u003d\u0027regex string to accept a valid password\u0027),"},{"line_number":1061,"context_line":"    ]"},{"line_number":1062,"context_line":"}"},{"line_number":1063,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_03591035","line":1060,"range":{"start_line":1060,"start_character":19,"end_line":1060,"end_character":67},"updated":"2016-05-11 20:21:47.000000000","message":"consider adding text explaining what the default actually checks","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"76958602456a5e7ccbe31a88fc3f65ca2e3be0f3","unresolved":false,"context_lines":[{"line_number":1057,"context_line":"                        \u0027 it\u0027),"},{"line_number":1058,"context_line":"        cfg.StrOpt(\u0027password_regex\u0027,"},{"line_number":1059,"context_line":"                   default\u003d\"^(?\u003d.*[A-Za-z])(?\u003d.*\\d)[A-Za-z\\d]{7,}$\","},{"line_number":1060,"context_line":"                   help\u003d\u0027regex string to accept a valid password\u0027),"},{"line_number":1061,"context_line":"    ]"},{"line_number":1062,"context_line":"}"},{"line_number":1063,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_6d87f9d7","line":1060,"range":{"start_line":1060,"start_character":19,"end_line":1060,"end_character":67},"in_reply_to":"dab17558_03591035","updated":"2016-05-12 16:12:34.000000000","message":"Done","commit_id":"fc85be5a8ca83eb9e7a56c2cb4f4337eb3d73bde"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f23f7bb5589cb32871b2deb78ca14a8f8c96c0de","unresolved":false,"context_lines":[{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"},{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user is locked out. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration_mins\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_b0081a2f","line":1038,"range":{"start_line":1038,"start_character":37,"end_line":1038,"end_character":47},"updated":"2016-05-12 16:47:04.000000000","message":"use the word disabled here","commit_id":"617576bb7f3f1034d86932a03d04f7d25eabd661"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"5f18cbacef0b5abae43562caac725e969ea31ee1","unresolved":false,"context_lines":[{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"},{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user is locked out. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration_mins\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_c3a31fb0","line":1038,"range":{"start_line":1038,"start_character":37,"end_line":1038,"end_character":47},"in_reply_to":"dab17558_b0081a2f","updated":"2016-05-13 15:34:52.000000000","message":"Done","commit_id":"617576bb7f3f1034d86932a03d04f7d25eabd661"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f23f7bb5589cb32871b2deb78ca14a8f8c96c0de","unresolved":false,"context_lines":[{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration_mins\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027How long in minutes a user will be locked out for. \u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"},{"line_number":1044,"context_line":"                   default\u003d90,"},{"line_number":1045,"context_line":"                   help\u003d\u0027Number of days for which a password will be \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_f002a20a","line":1042,"range":{"start_line":1042,"start_character":60,"end_line":1042,"end_character":70},"updated":"2016-05-12 16:47:04.000000000","message":"same","commit_id":"617576bb7f3f1034d86932a03d04f7d25eabd661"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"5f18cbacef0b5abae43562caac725e969ea31ee1","unresolved":false,"context_lines":[{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration_mins\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027How long in minutes a user will be locked out for. \u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"},{"line_number":1044,"context_line":"                   default\u003d90,"},{"line_number":1045,"context_line":"                   help\u003d\u0027Number of days for which a password will be \u0027"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_23ab0b8b","line":1042,"range":{"start_line":1042,"start_character":60,"end_line":1042,"end_character":70},"in_reply_to":"dab17558_f002a20a","updated":"2016-05-13 15:34:52.000000000","message":"Done","commit_id":"617576bb7f3f1034d86932a03d04f7d25eabd661"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f23f7bb5589cb32871b2deb78ca14a8f8c96c0de","unresolved":false,"context_lines":[{"line_number":1059,"context_line":"                        \u0027this feature.\u0027),"},{"line_number":1060,"context_line":"        cfg.StrOpt(\u0027password_regex\u0027,"},{"line_number":1061,"context_line":"                   default\u003d\"^(?\u003d.*[A-Za-z])(?\u003d.*\\d)[A-Za-z\\d]{7,}$\","},{"line_number":1062,"context_line":"                   help\u003d\u0027Regex string to accept a valid password. The default \u0027"},{"line_number":1063,"context_line":"                        \u0027accepts passwords that contain at least one letter \u0027"},{"line_number":1064,"context_line":"                        \u0027and one digit. The password must also contain only \u0027"},{"line_number":1065,"context_line":"                        \u0027alphanumeric characters and have a minimum length \u0027"},{"line_number":1066,"context_line":"                        \u0027of seven.\u0027)"},{"line_number":1067,"context_line":"    ]"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_7324fcae","line":1064,"range":{"start_line":1062,"start_character":66,"end_line":1064,"end_character":39},"updated":"2016-05-12 16:47:04.000000000","message":"the default also indicates that it must be 7 characters long.","commit_id":"617576bb7f3f1034d86932a03d04f7d25eabd661"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"5f18cbacef0b5abae43562caac725e969ea31ee1","unresolved":false,"context_lines":[{"line_number":1059,"context_line":"                        \u0027this feature.\u0027),"},{"line_number":1060,"context_line":"        cfg.StrOpt(\u0027password_regex\u0027,"},{"line_number":1061,"context_line":"                   default\u003d\"^(?\u003d.*[A-Za-z])(?\u003d.*\\d)[A-Za-z\\d]{7,}$\","},{"line_number":1062,"context_line":"                   help\u003d\u0027Regex string to accept a valid password. The default \u0027"},{"line_number":1063,"context_line":"                        \u0027accepts passwords that contain at least one letter \u0027"},{"line_number":1064,"context_line":"                        \u0027and one digit. The password must also contain only \u0027"},{"line_number":1065,"context_line":"                        \u0027alphanumeric characters and have a minimum length \u0027"},{"line_number":1066,"context_line":"                        \u0027of seven.\u0027)"},{"line_number":1067,"context_line":"    ]"}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_83c3d756","line":1064,"range":{"start_line":1062,"start_character":66,"end_line":1064,"end_character":39},"in_reply_to":"dab17558_7324fcae","updated":"2016-05-13 15:34:52.000000000","message":"I think {7,} means it should be at minimum 7 chars long.","commit_id":"617576bb7f3f1034d86932a03d04f7d25eabd661"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f23f7bb5589cb32871b2deb78ca14a8f8c96c0de","unresolved":false,"context_lines":[{"line_number":1061,"context_line":"                   default\u003d\"^(?\u003d.*[A-Za-z])(?\u003d.*\\d)[A-Za-z\\d]{7,}$\","},{"line_number":1062,"context_line":"                   help\u003d\u0027Regex string to accept a valid password. The default \u0027"},{"line_number":1063,"context_line":"                        \u0027accepts passwords that contain at least one letter \u0027"},{"line_number":1064,"context_line":"                        \u0027and one digit. The password must also contain only \u0027"},{"line_number":1065,"context_line":"                        \u0027alphanumeric characters and have a minimum length \u0027"},{"line_number":1066,"context_line":"                        \u0027of seven.\u0027)"},{"line_number":1067,"context_line":"    ]"},{"line_number":1068,"context_line":"}"},{"line_number":1069,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_b33dc4bd","line":1066,"range":{"start_line":1064,"start_character":40,"end_line":1066,"end_character":35},"updated":"2016-05-12 16:47:04.000000000","message":"this sentence doesn\u0027t sound necessary, since a user can change this regex it doesn\u0027t have to meet this criteria","commit_id":"617576bb7f3f1034d86932a03d04f7d25eabd661"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"5f18cbacef0b5abae43562caac725e969ea31ee1","unresolved":false,"context_lines":[{"line_number":1061,"context_line":"                   default\u003d\"^(?\u003d.*[A-Za-z])(?\u003d.*\\d)[A-Za-z\\d]{7,}$\","},{"line_number":1062,"context_line":"                   help\u003d\u0027Regex string to accept a valid password. The default \u0027"},{"line_number":1063,"context_line":"                        \u0027accepts passwords that contain at least one letter \u0027"},{"line_number":1064,"context_line":"                        \u0027and one digit. The password must also contain only \u0027"},{"line_number":1065,"context_line":"                        \u0027alphanumeric characters and have a minimum length \u0027"},{"line_number":1066,"context_line":"                        \u0027of seven.\u0027)"},{"line_number":1067,"context_line":"    ]"},{"line_number":1068,"context_line":"}"},{"line_number":1069,"context_line":""}],"source_content_type":"text/x-python","patch_set":2,"id":"dab17558_03e087f9","line":1066,"range":{"start_line":1064,"start_character":40,"end_line":1066,"end_character":35},"in_reply_to":"dab17558_b33dc4bd","updated":"2016-05-13 15:34:52.000000000","message":"I meant for the two sentences to refer to the default. I will combine the sentences into one.","commit_id":"617576bb7f3f1034d86932a03d04f7d25eabd661"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"b382cbb3566282c3c53e0fe75004f9ff8ccad1c2","unresolved":false,"context_lines":[{"line_number":1053,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1054,"context_line":"        cfg.IntOpt(\u0027password_change_limit_per_day\u0027,"},{"line_number":1055,"context_line":"                   default\u003d4,"},{"line_number":1056,"context_line":"                   help\u003d\u0027Number of days for which a password will be \u0027"},{"line_number":1057,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1058,"context_line":"                        \u0027change it. Setting the value to 0 disables \u0027"},{"line_number":1059,"context_line":"                        \u0027this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"dab17558_921476e9","line":1056,"range":{"start_line":1056,"start_character":19,"end_line":1056,"end_character":23},"updated":"2016-05-16 15:20:03.000000000","message":"This has the exact same description as password_expires_days and I\u0027m not sure why this is needed.  I don\u0027t see it in the specs.  Thus, I think we should take this out.","commit_id":"be4c56b9837c3eef7399e03d2e06deb34cfcab29"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"fdf0916d6fe5eb256bb8765c02f734c976ffd8e7","unresolved":false,"context_lines":[{"line_number":1053,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1054,"context_line":"        cfg.IntOpt(\u0027password_change_limit_per_day\u0027,"},{"line_number":1055,"context_line":"                   default\u003d4,"},{"line_number":1056,"context_line":"                   help\u003d\u0027Number of days for which a password will be \u0027"},{"line_number":1057,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1058,"context_line":"                        \u0027change it. Setting the value to 0 disables \u0027"},{"line_number":1059,"context_line":"                        \u0027this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"dab17558_22171c46","line":1056,"range":{"start_line":1056,"start_character":19,"end_line":1056,"end_character":23},"in_reply_to":"dab17558_3e9c5e0d","updated":"2016-05-17 03:54:51.000000000","message":"Nice catch, I need to change the description. Thanks Ron.","commit_id":"be4c56b9837c3eef7399e03d2e06deb34cfcab29"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"f0664aed86486e20401ee52563f47e4f97428114","unresolved":false,"context_lines":[{"line_number":1053,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1054,"context_line":"        cfg.IntOpt(\u0027password_change_limit_per_day\u0027,"},{"line_number":1055,"context_line":"                   default\u003d4,"},{"line_number":1056,"context_line":"                   help\u003d\u0027Number of days for which a password will be \u0027"},{"line_number":1057,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1058,"context_line":"                        \u0027change it. Setting the value to 0 disables \u0027"},{"line_number":1059,"context_line":"                        \u0027this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"dab17558_3e9c5e0d","line":1056,"range":{"start_line":1056,"start_character":19,"end_line":1056,"end_character":23},"in_reply_to":"dab17558_8a5f0840","updated":"2016-05-17 01:08:40.000000000","message":"Okay, so we want to limit how many times a user can change their password in a day?  Is that what this config option is defining?","commit_id":"be4c56b9837c3eef7399e03d2e06deb34cfcab29"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"1b78a1af16ebf5b5878b088154d2acfb68ef8400","unresolved":false,"context_lines":[{"line_number":1053,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1054,"context_line":"        cfg.IntOpt(\u0027password_change_limit_per_day\u0027,"},{"line_number":1055,"context_line":"                   default\u003d4,"},{"line_number":1056,"context_line":"                   help\u003d\u0027Number of days for which a password will be \u0027"},{"line_number":1057,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1058,"context_line":"                        \u0027change it. Setting the value to 0 disables \u0027"},{"line_number":1059,"context_line":"                        \u0027this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"dab17558_8a5f0840","line":1056,"range":{"start_line":1056,"start_character":19,"end_line":1056,"end_character":23},"in_reply_to":"dab17558_921476e9","updated":"2016-05-16 22:33:05.000000000","message":"we (ibm) brought this up as a requirement that we internally have... we said this clearly at the work session and there weren\u0027t any dissenters. it\u0027s not in the spec, but it\u0027s related","commit_id":"be4c56b9837c3eef7399e03d2e06deb34cfcab29"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"57cbcee7b06fde58fafb754eccd59a5a815fced1","unresolved":false,"context_lines":[{"line_number":1026,"context_line":"                    help\u003d\u0027The port number which the admin service listens \u0027"},{"line_number":1027,"context_line":"                         \u0027on.\u0027),"},{"line_number":1028,"context_line":"    ],"},{"line_number":1029,"context_line":"    \u0027compliance\u0027: ["},{"line_number":1030,"context_line":"        cfg.IntOpt(\u0027disable_user_account_days_inactive\u0027,"},{"line_number":1031,"context_line":"                   default\u003d90,"},{"line_number":1032,"context_line":"                   help\u003d\u0027Number of days for which a user can be inactive \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"dab17558_2d136466","line":1029,"range":{"start_line":1029,"start_character":5,"end_line":1029,"end_character":15},"updated":"2016-05-17 17:49:11.000000000","message":"Need a better name than compliance, too generic. Perhaps, security_compliance.  And you could separate some of this out into password_validation or password compliance.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d340de5597d0ad731dfde8421c27aa13d3fa9b69","unresolved":false,"context_lines":[{"line_number":1026,"context_line":"                    help\u003d\u0027The port number which the admin service listens \u0027"},{"line_number":1027,"context_line":"                         \u0027on.\u0027),"},{"line_number":1028,"context_line":"    ],"},{"line_number":1029,"context_line":"    \u0027compliance\u0027: ["},{"line_number":1030,"context_line":"        cfg.IntOpt(\u0027disable_user_account_days_inactive\u0027,"},{"line_number":1031,"context_line":"                   default\u003d90,"},{"line_number":1032,"context_line":"                   help\u003d\u0027Number of days for which a user can be inactive \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_e58f2eca","line":1029,"range":{"start_line":1029,"start_character":5,"end_line":1029,"end_character":15},"in_reply_to":"dab17558_2d136466","updated":"2016-05-19 19:13:34.000000000","message":"++","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"57cbcee7b06fde58fafb754eccd59a5a815fced1","unresolved":false,"context_lines":[{"line_number":1028,"context_line":"    ],"},{"line_number":1029,"context_line":"    \u0027compliance\u0027: ["},{"line_number":1030,"context_line":"        cfg.IntOpt(\u0027disable_user_account_days_inactive\u0027,"},{"line_number":1031,"context_line":"                   default\u003d90,"},{"line_number":1032,"context_line":"                   help\u003d\u0027Number of days for which a user can be inactive \u0027"},{"line_number":1033,"context_line":"                        \u0027before the account becomes disabled. Setting the \u0027"},{"line_number":1034,"context_line":"                        \u0027value to 0 disables this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":4,"id":"dab17558_e8514a0f","line":1031,"range":{"start_line":1031,"start_character":27,"end_line":1031,"end_character":29},"updated":"2016-05-17 17:49:11.000000000","message":"I think we need to agree on defaults for these settings.  90 days seems too short for the default.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d340de5597d0ad731dfde8421c27aa13d3fa9b69","unresolved":false,"context_lines":[{"line_number":1028,"context_line":"    ],"},{"line_number":1029,"context_line":"    \u0027compliance\u0027: ["},{"line_number":1030,"context_line":"        cfg.IntOpt(\u0027disable_user_account_days_inactive\u0027,"},{"line_number":1031,"context_line":"                   default\u003d90,"},{"line_number":1032,"context_line":"                   help\u003d\u0027Number of days for which a user can be inactive \u0027"},{"line_number":1033,"context_line":"                        \u0027before the account becomes disabled. Setting the \u0027"},{"line_number":1034,"context_line":"                        \u0027value to 0 disables this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_504eb66f","line":1031,"range":{"start_line":1031,"start_character":27,"end_line":1031,"end_character":29},"in_reply_to":"dab17558_e8514a0f","updated":"2016-05-19 19:13:34.000000000","message":"I think it has to be the default. According to section 8.1.4 the requirement is within 90 days. A deployer could relax that if they wanted to, but I think out of the box we should be PCI compliant where possible.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d340de5597d0ad731dfde8421c27aa13d3fa9b69","unresolved":false,"context_lines":[{"line_number":1030,"context_line":"        cfg.IntOpt(\u0027disable_user_account_days_inactive\u0027,"},{"line_number":1031,"context_line":"                   default\u003d90,"},{"line_number":1032,"context_line":"                   help\u003d\u0027Number of days for which a user can be inactive \u0027"},{"line_number":1033,"context_line":"                        \u0027before the account becomes disabled. Setting the \u0027"},{"line_number":1034,"context_line":"                        \u0027value to 0 disables this feature.\u0027),"},{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_50751696","line":1033,"updated":"2016-05-19 19:13:34.000000000","message":"What is the difference between disabled and locked? From what I gather disabled means locked indefinitely until an admin unlocks.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"9499b03c8557bc8b351122805d9efd99113fa8cd","unresolved":false,"context_lines":[{"line_number":1030,"context_line":"        cfg.IntOpt(\u0027disable_user_account_days_inactive\u0027,"},{"line_number":1031,"context_line":"                   default\u003d90,"},{"line_number":1032,"context_line":"                   help\u003d\u0027Number of days for which a user can be inactive \u0027"},{"line_number":1033,"context_line":"                        \u0027before the account becomes disabled. Setting the \u0027"},{"line_number":1034,"context_line":"                        \u0027value to 0 disables this feature.\u0027),"},{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_a03b5137","line":1033,"in_reply_to":"bab6814e_50751696","updated":"2016-05-19 20:13:51.000000000","message":"Hmm...  Good question.  Disabled to me is more of a long term setting, where a user account is disabled because they are no longer with the organization for example.  Locked is a temporary security to prevent a brute force attack.  User is locked out for 30 minutes after 3 failed attempts.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"44ae3a626f4e827f18eb6b45d3bc7b38b094e80c","unresolved":false,"context_lines":[{"line_number":1030,"context_line":"        cfg.IntOpt(\u0027disable_user_account_days_inactive\u0027,"},{"line_number":1031,"context_line":"                   default\u003d90,"},{"line_number":1032,"context_line":"                   help\u003d\u0027Number of days for which a user can be inactive \u0027"},{"line_number":1033,"context_line":"                        \u0027before the account becomes disabled. Setting the \u0027"},{"line_number":1034,"context_line":"                        \u0027value to 0 disables this feature.\u0027),"},{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_407a65f2","line":1033,"in_reply_to":"bab6814e_a03b5137","updated":"2016-05-19 20:16:58.000000000","message":"We should add this to a doc somewhere so that nobody has to guess","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"57cbcee7b06fde58fafb754eccd59a5a815fced1","unresolved":false,"context_lines":[{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"},{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user is disabled out. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration_mins\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"}],"source_content_type":"text/x-python","patch_set":4,"id":"dab17558_e8866a63","line":1038,"range":{"start_line":1038,"start_character":49,"end_line":1038,"end_character":50},"updated":"2016-05-17 17:49:11.000000000","message":"\"until the user account is locked\"","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"57cbcee7b06fde58fafb754eccd59a5a815fced1","unresolved":false,"context_lines":[{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration_mins\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027How long in minutes a user will be disabled. \u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"},{"line_number":1044,"context_line":"                   default\u003d90,"},{"line_number":1045,"context_line":"                   help\u003d\u0027Number of days for which a password will be \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"dab17558_6848ba2d","line":1042,"range":{"start_line":1042,"start_character":25,"end_line":1042,"end_character":28},"updated":"2016-05-17 17:49:11.000000000","message":"\"The number of minutes a user account will be locked after reaching the maximum number of failed attempts.\"","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"57cbcee7b06fde58fafb754eccd59a5a815fced1","unresolved":false,"context_lines":[{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027How long in minutes a user will be disabled. \u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"},{"line_number":1044,"context_line":"                   default\u003d90,"},{"line_number":1045,"context_line":"                   help\u003d\u0027Number of days for which a password will be \u0027"},{"line_number":1046,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1047,"context_line":"                        \u0027change it. Setting the value to 0 disables this \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"dab17558_c860c6d1","line":1044,"range":{"start_line":1044,"start_character":27,"end_line":1044,"end_character":29},"updated":"2016-05-17 17:49:11.000000000","message":"I think the default should be 0 by default.  Or, something longer.  90 days is pretty aggressive.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"9499b03c8557bc8b351122805d9efd99113fa8cd","unresolved":false,"context_lines":[{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027How long in minutes a user will be disabled. \u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"},{"line_number":1044,"context_line":"                   default\u003d90,"},{"line_number":1045,"context_line":"                   help\u003d\u0027Number of days for which a password will be \u0027"},{"line_number":1046,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1047,"context_line":"                        \u0027change it. Setting the value to 0 disables this \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_80de0d3d","line":1044,"range":{"start_line":1044,"start_character":27,"end_line":1044,"end_character":29},"in_reply_to":"bab6814e_70ce5ab5","updated":"2016-05-19 20:13:51.000000000","message":"Agree, but I think we should relax these settings by default.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"44ae3a626f4e827f18eb6b45d3bc7b38b094e80c","unresolved":false,"context_lines":[{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027How long in minutes a user will be disabled. \u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"},{"line_number":1044,"context_line":"                   default\u003d90,"},{"line_number":1045,"context_line":"                   help\u003d\u0027Number of days for which a password will be \u0027"},{"line_number":1046,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1047,"context_line":"                        \u0027change it. Setting the value to 0 disables this \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_20c001e0","line":1044,"range":{"start_line":1044,"start_character":27,"end_line":1044,"end_character":29},"in_reply_to":"bab6814e_80de0d3d","updated":"2016-05-19 20:16:58.000000000","message":"That\u0027s a good point. We should probably just use 0 since we currently don\u0027t have this feature.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d340de5597d0ad731dfde8421c27aa13d3fa9b69","unresolved":false,"context_lines":[{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027How long in minutes a user will be disabled. \u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"},{"line_number":1044,"context_line":"                   default\u003d90,"},{"line_number":1045,"context_line":"                   help\u003d\u0027Number of days for which a password will be \u0027"},{"line_number":1046,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1047,"context_line":"                        \u0027change it. Setting the value to 0 disables this \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_70ce5ab5","line":1044,"range":{"start_line":1044,"start_character":27,"end_line":1044,"end_character":29},"in_reply_to":"dab17558_c860c6d1","updated":"2016-05-19 19:13:34.000000000","message":"90 days is in section 8.2.4 of the spec.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"57cbcee7b06fde58fafb754eccd59a5a815fced1","unresolved":false,"context_lines":[{"line_number":1046,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1047,"context_line":"                        \u0027change it. Setting the value to 0 disables this \u0027"},{"line_number":1048,"context_line":"                        \u0027feature.\u0027),"},{"line_number":1049,"context_line":"        cfg.IntOpt(\u0027cannot_match_last_password\u0027,"},{"line_number":1050,"context_line":"                   default\u003d4,"},{"line_number":1051,"context_line":"                   help\u003d\u0027Number of latest password iterations for which the \u0027"},{"line_number":1052,"context_line":"                        \u0027password must be unique. Setting the value to 0 \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"dab17558_2827d263","line":1049,"range":{"start_line":1049,"start_character":46,"end_line":1049,"end_character":48},"updated":"2016-05-17 17:49:11.000000000","message":"cannot_match_last_password_count or something.  cannot_match_last_password sounds like a boolean value.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"9499b03c8557bc8b351122805d9efd99113fa8cd","unresolved":false,"context_lines":[{"line_number":1046,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1047,"context_line":"                        \u0027change it. Setting the value to 0 disables this \u0027"},{"line_number":1048,"context_line":"                        \u0027feature.\u0027),"},{"line_number":1049,"context_line":"        cfg.IntOpt(\u0027cannot_match_last_password\u0027,"},{"line_number":1050,"context_line":"                   default\u003d4,"},{"line_number":1051,"context_line":"                   help\u003d\u0027Number of latest password iterations for which the \u0027"},{"line_number":1052,"context_line":"                        \u0027password must be unique. Setting the value to 0 \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_40bb85e5","line":1049,"range":{"start_line":1049,"start_character":46,"end_line":1049,"end_character":48},"in_reply_to":"bab6814e_d04c6644","updated":"2016-05-19 20:13:51.000000000","message":"++","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d340de5597d0ad731dfde8421c27aa13d3fa9b69","unresolved":false,"context_lines":[{"line_number":1046,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1047,"context_line":"                        \u0027change it. Setting the value to 0 disables this \u0027"},{"line_number":1048,"context_line":"                        \u0027feature.\u0027),"},{"line_number":1049,"context_line":"        cfg.IntOpt(\u0027cannot_match_last_password\u0027,"},{"line_number":1050,"context_line":"                   default\u003d4,"},{"line_number":1051,"context_line":"                   help\u003d\u0027Number of latest password iterations for which the \u0027"},{"line_number":1052,"context_line":"                        \u0027password must be unique. Setting the value to 0 \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_d04c6644","line":1049,"range":{"start_line":1049,"start_character":46,"end_line":1049,"end_character":48},"in_reply_to":"dab17558_2827d263","updated":"2016-05-19 19:13:34.000000000","message":"unique_last_password_count?","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"57cbcee7b06fde58fafb754eccd59a5a815fced1","unresolved":false,"context_lines":[{"line_number":1054,"context_line":"        cfg.IntOpt(\u0027password_change_limit_per_day\u0027,"},{"line_number":1055,"context_line":"                   default\u003d4,"},{"line_number":1056,"context_line":"                   help\u003d\u0027Max number of times a user can change their \u0027"},{"line_number":1057,"context_line":"                        \u0027password a day. Setting the value to 0 disables \u0027"},{"line_number":1058,"context_line":"                        \u0027this feature. \u0027),"},{"line_number":1059,"context_line":"        cfg.StrOpt(\u0027password_regex\u0027,"},{"line_number":1060,"context_line":"                   default\u003d\"^(?\u003d.*[A-Za-z])(?\u003d.*\\d)[A-Za-z\\d]{7,}$\","}],"source_content_type":"text/x-python","patch_set":4,"id":"dab17558_28deb23d","line":1057,"range":{"start_line":1057,"start_character":25,"end_line":1057,"end_character":33},"updated":"2016-05-17 17:49:11.000000000","message":"\"...password in a day\"","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"57cbcee7b06fde58fafb754eccd59a5a815fced1","unresolved":false,"context_lines":[{"line_number":1057,"context_line":"                        \u0027password a day. Setting the value to 0 disables \u0027"},{"line_number":1058,"context_line":"                        \u0027this feature. \u0027),"},{"line_number":1059,"context_line":"        cfg.StrOpt(\u0027password_regex\u0027,"},{"line_number":1060,"context_line":"                   default\u003d\"^(?\u003d.*[A-Za-z])(?\u003d.*\\d)[A-Za-z\\d]{7,}$\","},{"line_number":1061,"context_line":"                   help\u003d\u0027Regex string to accept a valid password. The default \u0027"},{"line_number":1062,"context_line":"                        \u0027accepts passwords that contain only alphanumeric \u0027"},{"line_number":1063,"context_line":"                        \u0027characters, contains at least one letter, \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"dab17558_68ff1a34","line":1060,"range":{"start_line":1060,"start_character":41,"end_line":1060,"end_character":49},"updated":"2016-05-17 17:49:11.000000000","message":"We should allow special characters as well by default.  Just require that passwords contain at least one letter and one digit.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d340de5597d0ad731dfde8421c27aa13d3fa9b69","unresolved":false,"context_lines":[{"line_number":1057,"context_line":"                        \u0027password a day. Setting the value to 0 disables \u0027"},{"line_number":1058,"context_line":"                        \u0027this feature. \u0027),"},{"line_number":1059,"context_line":"        cfg.StrOpt(\u0027password_regex\u0027,"},{"line_number":1060,"context_line":"                   default\u003d\"^(?\u003d.*[A-Za-z])(?\u003d.*\\d)[A-Za-z\\d]{7,}$\","},{"line_number":1061,"context_line":"                   help\u003d\u0027Regex string to accept a valid password. The default \u0027"},{"line_number":1062,"context_line":"                        \u0027accepts passwords that contain only alphanumeric \u0027"},{"line_number":1063,"context_line":"                        \u0027characters, contains at least one letter, \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_90de5e3d","line":1060,"range":{"start_line":1060,"start_character":41,"end_line":1060,"end_character":49},"in_reply_to":"dab17558_68ff1a34","updated":"2016-05-19 19:13:34.000000000","message":"++ without special characters my default password scheme won\u0027t work! i\u0027d rather see at least 1 number and 1 letter with a min length of 7. That way passwords like \u0027p@ssw0rd\u0027 would work and we wouldn\u0027t have to whitelist all the special characters.","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"57cbcee7b06fde58fafb754eccd59a5a815fced1","unresolved":false,"context_lines":[{"line_number":1058,"context_line":"                        \u0027this feature. \u0027),"},{"line_number":1059,"context_line":"        cfg.StrOpt(\u0027password_regex\u0027,"},{"line_number":1060,"context_line":"                   default\u003d\"^(?\u003d.*[A-Za-z])(?\u003d.*\\d)[A-Za-z\\d]{7,}$\","},{"line_number":1061,"context_line":"                   help\u003d\u0027Regex string to accept a valid password. The default \u0027"},{"line_number":1062,"context_line":"                        \u0027accepts passwords that contain only alphanumeric \u0027"},{"line_number":1063,"context_line":"                        \u0027characters, contains at least one letter, \u0027"},{"line_number":1064,"context_line":"                        \u0027contains one digit, and must also contain only \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"dab17558_2884f2d0","line":1061,"range":{"start_line":1061,"start_character":25,"end_line":1061,"end_character":30},"updated":"2016-05-17 17:49:11.000000000","message":"\"Regular expression used to validate password strength requirements.  The default requires that passwords must contain at least one letter, one digit, and have a minimum length of 7 characters.\"","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d340de5597d0ad731dfde8421c27aa13d3fa9b69","unresolved":false,"context_lines":[{"line_number":1058,"context_line":"                        \u0027this feature. \u0027),"},{"line_number":1059,"context_line":"        cfg.StrOpt(\u0027password_regex\u0027,"},{"line_number":1060,"context_line":"                   default\u003d\"^(?\u003d.*[A-Za-z])(?\u003d.*\\d)[A-Za-z\\d]{7,}$\","},{"line_number":1061,"context_line":"                   help\u003d\u0027Regex string to accept a valid password. The default \u0027"},{"line_number":1062,"context_line":"                        \u0027accepts passwords that contain only alphanumeric \u0027"},{"line_number":1063,"context_line":"                        \u0027characters, contains at least one letter, \u0027"},{"line_number":1064,"context_line":"                        \u0027contains one digit, and must also contain only \u0027"}],"source_content_type":"text/x-python","patch_set":4,"id":"bab6814e_b0e3a204","line":1061,"range":{"start_line":1061,"start_character":25,"end_line":1061,"end_character":30},"in_reply_to":"dab17558_2884f2d0","updated":"2016-05-19 19:13:34.000000000","message":"++","commit_id":"45f8a554f033c626e8191134be299c8819ed5366"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d86ead000d22622fb81d3968d5d6a535a69bcee9","unresolved":false,"context_lines":[{"line_number":1033,"context_line":"                        \u0027before the account becomes disabled. Setting the \u0027"},{"line_number":1034,"context_line":"                        \u0027value to 0 disables this feature.\u0027),"},{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"},{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":7,"id":"bab6814e_4cb8c52a","line":1036,"updated":"2016-05-20 10:05:31.000000000","message":"I\u0027m wondering if all these should be 0 since it is an opt-in feature? Or we could think about adding something like:\n\n    cfg.BoolOpt(\u0027enable_security_compliance\u0027, default\u003dFalse)\n\nIf enabled, we could safely assume all reasonable defaults for PCI-DSS.\n\nWe have this same pattern with the caching configuration. Each subsystem in keystone has it\u0027s own caching configs but they aren\u0027t honored in keystone unless the global caching configuration is enabled.","commit_id":"1bde5cbe71f2e5140c08db1dc1342a6643108bc6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"675105873350b30773461536806a236d6339615e","unresolved":false,"context_lines":[{"line_number":1033,"context_line":"                        \u0027before the account becomes disabled. Setting the \u0027"},{"line_number":1034,"context_line":"                        \u0027value to 0 disables this feature.\u0027),"},{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"},{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":7,"id":"bab6814e_7701fb05","line":1036,"in_reply_to":"bab6814e_2b6b99f2","updated":"2016-05-20 17:08:34.000000000","message":"I\u0027m fine with this as a default. It does change the behavior a bit, but only for attackers or people that truly screw up.","commit_id":"1bde5cbe71f2e5140c08db1dc1342a6643108bc6"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"ca77cb92554d836bef7dd4a715b59700455ad1f9","unresolved":false,"context_lines":[{"line_number":1033,"context_line":"                        \u0027before the account becomes disabled. Setting the \u0027"},{"line_number":1034,"context_line":"                        \u0027value to 0 disables this feature.\u0027),"},{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"},{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":7,"id":"bab6814e_f0bdfc68","line":1036,"in_reply_to":"bab6814e_4cb8c52a","updated":"2016-05-20 14:39:01.000000000","message":"No, I\u0027m not thinking of having a enable_security_compliance flag.  Instead, operators can turn on/off the various security settings.\n\nRegarding lockout_failure_attempts, while most settings are 0 by default, I think this security setting makes sense to turn on by default as it will prevent brute force attacks and not change existing system behavior.","commit_id":"1bde5cbe71f2e5140c08db1dc1342a6643108bc6"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"d617a8194894c7878de3bb65ac60131eaf603056","unresolved":false,"context_lines":[{"line_number":1033,"context_line":"                        \u0027before the account becomes disabled. Setting the \u0027"},{"line_number":1034,"context_line":"                        \u0027value to 0 disables this feature.\u0027),"},{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"},{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":7,"id":"bab6814e_2b6b99f2","line":1036,"in_reply_to":"bab6814e_f0bdfc68","updated":"2016-05-20 14:59:02.000000000","message":"* not change behavior for normal operations","commit_id":"1bde5cbe71f2e5140c08db1dc1342a6643108bc6"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"675105873350b30773461536806a236d6339615e","unresolved":false,"context_lines":[{"line_number":1052,"context_line":"                        \u0027password must be unique. Setting the value to 0 \u0027"},{"line_number":1053,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1054,"context_line":"        cfg.IntOpt(\u0027password_change_limit_per_day\u0027,"},{"line_number":1055,"context_line":"                   default\u003d4,"},{"line_number":1056,"context_line":"                   help\u003d\u0027Maximum number of times a user can change their \u0027"},{"line_number":1057,"context_line":"                        \u0027password in a day. Setting the value to 0 disables \u0027"},{"line_number":1058,"context_line":"                        \u0027this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":7,"id":"bab6814e_722f4988","line":1055,"updated":"2016-05-20 17:08:34.000000000","message":"Someone could make the argument that we want this to be 0 by default, but I don\u0027t think it would matter much either way.","commit_id":"1bde5cbe71f2e5140c08db1dc1342a6643108bc6"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"14c57e44a485ec945316c0d32d24ca69367646e3","unresolved":false,"context_lines":[{"line_number":1052,"context_line":"                        \u0027password must be unique. Setting the value to 0 \u0027"},{"line_number":1053,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1054,"context_line":"        cfg.IntOpt(\u0027password_change_limit_per_day\u0027,"},{"line_number":1055,"context_line":"                   default\u003d4,"},{"line_number":1056,"context_line":"                   help\u003d\u0027Maximum number of times a user can change their \u0027"},{"line_number":1057,"context_line":"                        \u0027password in a day. Setting the value to 0 disables \u0027"},{"line_number":1058,"context_line":"                        \u0027this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":7,"id":"bab6814e_52ccc569","line":1055,"in_reply_to":"bab6814e_722f4988","updated":"2016-05-20 17:21:22.000000000","message":"Yeah agree.  I missed this one, it should be 0.","commit_id":"1bde5cbe71f2e5140c08db1dc1342a6643108bc6"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"bfd36a7dd3eca71b4e1ba00ad9914e92d568a25a","unresolved":false,"context_lines":[{"line_number":1033,"context_line":"                        \u0027before the account becomes disabled. Setting the \u0027"},{"line_number":1034,"context_line":"                        \u0027value to 0 disables this feature.\u0027),"},{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"},{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_57e9a013","line":1036,"updated":"2016-05-30 16:22:11.000000000","message":"Defaults should make keystone behave as there was no change: in particular, lockout_failure_attempts should default to 0.","commit_id":"684b33ec968bf38129022d1ec35448340f8d80be"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"fb9e6d1b50b185f83f303113694284a1ef54a9bd","unresolved":false,"context_lines":[{"line_number":1033,"context_line":"                        \u0027before the account becomes disabled. Setting the \u0027"},{"line_number":1034,"context_line":"                        \u0027value to 0 disables this feature.\u0027),"},{"line_number":1035,"context_line":"        cfg.IntOpt(\u0027lockout_failure_attempts\u0027,"},{"line_number":1036,"context_line":"                   default\u003d6,"},{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"}],"source_content_type":"text/x-python","patch_set":11,"id":"9abb7d3a_60066e1e","line":1036,"in_reply_to":"9abb7d3a_57e9a013","updated":"2016-05-31 14:09:42.000000000","message":"Done","commit_id":"684b33ec968bf38129022d1ec35448340f8d80be"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"59772f4c5df14a16039f27152070d30cb5e052eb","unresolved":false,"context_lines":[{"line_number":1060,"context_line":"                   default\u003d\"^.(?\u003d.*\\w).*$\","},{"line_number":1061,"context_line":"                   help\u003d\u0027Regular expression used to validate password \u0027"},{"line_number":1062,"context_line":"                        \u0027strength requirements. The default matches any \u0027"},{"line_number":1063,"context_line":"                        \u0027single letter, digit, or underscore. The following \u0027"},{"line_number":1064,"context_line":"                        \u0027is an example of a stronger pattern which requires \u0027"},{"line_number":1065,"context_line":"                        \u0027at least 1 letter, 1 digit, and have a minimum \u0027"},{"line_number":1066,"context_line":"                        \u0027length of 7 characters: \u0027"}],"source_content_type":"text/x-python","patch_set":12,"id":"9abb7d3a_ebdcff74","line":1063,"updated":"2016-05-31 14:26:14.000000000","message":"The default should accept everything (as it is now)","commit_id":"bf28fd16c793859e11aaa3969d6be68ef0a68795"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"499f0aa6a8e3acaeb87b1d9abc6926c2119028a2","unresolved":false,"context_lines":[{"line_number":1059,"context_line":"        cfg.StrOpt(\u0027password_regex\u0027,"},{"line_number":1060,"context_line":"                   default\u003d\"\","},{"line_number":1061,"context_line":"                   help\u003d\u0027Regular expression used to validate password \u0027"},{"line_number":1062,"context_line":"                        \u0027strength requirements. The following \u0027"},{"line_number":1063,"context_line":"                        \u0027is an example of a pattern which requires \u0027"},{"line_number":1064,"context_line":"                        \u0027at least 1 letter, 1 digit, and have a minimum \u0027"},{"line_number":1065,"context_line":"                        \u0027length of 7 characters: \u0027"}],"source_content_type":"text/x-python","patch_set":13,"id":"9abb7d3a_9f012408","line":1062,"updated":"2016-05-31 16:27:44.000000000","message":"Setting the value to an empty string disables this feature.","commit_id":"3e336da7882695003ecd2df47cc38bf382292d8f"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"def0bb2bb3fd3f2be4bdecb8b8e4df27aa90b037","unresolved":false,"context_lines":[{"line_number":1059,"context_line":"        cfg.StrOpt(\u0027password_regex\u0027,"},{"line_number":1060,"context_line":"                   default\u003d\"\","},{"line_number":1061,"context_line":"                   help\u003d\u0027Regular expression used to validate password \u0027"},{"line_number":1062,"context_line":"                        \u0027strength requirements. The following \u0027"},{"line_number":1063,"context_line":"                        \u0027is an example of a pattern which requires \u0027"},{"line_number":1064,"context_line":"                        \u0027at least 1 letter, 1 digit, and have a minimum \u0027"},{"line_number":1065,"context_line":"                        \u0027length of 7 characters: \u0027"}],"source_content_type":"text/x-python","patch_set":13,"id":"9abb7d3a_ff715077","line":1062,"in_reply_to":"9abb7d3a_9f012408","updated":"2016-05-31 16:30:55.000000000","message":"Done","commit_id":"3e336da7882695003ecd2df47cc38bf382292d8f"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"66a68e3a159e1b73e434a83445abcb3cc292b2bc","unresolved":false,"context_lines":[{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration_mins\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027Number of minutes a user account will be locked.\u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"}],"source_content_type":"text/x-python","patch_set":15,"id":"9abb7d3a_4bd6a64f","line":1040,"updated":"2016-06-01 15:48:17.000000000","message":"The usual practice is to specify duration in seconds. Why use minutes here?","commit_id":"ec555ea3c171195cd6f5cf046d7197c3e3e4e117"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"7a2b4b91f325f52d7195e4e1d66125271d5bfa01","unresolved":false,"context_lines":[{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration_mins\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027Number of minutes a user account will be locked.\u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"}],"source_content_type":"text/x-python","patch_set":15,"id":"9abb7d3a_61858b58","line":1040,"in_reply_to":"9abb7d3a_4bd6a64f","updated":"2016-06-01 16:19:43.000000000","message":"Good point, I\u0027ll change this to seconds.","commit_id":"ec555ea3c171195cd6f5cf046d7197c3e3e4e117"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"5c39da28d7e9948ed901610338f303d30724f96f","unresolved":false,"context_lines":[{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration_seconds\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027Number of seconds a user account will be locked.\u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"}],"source_content_type":"text/x-python","patch_set":18,"id":"9abb7d3a_1cfce23c","line":1040,"updated":"2016-06-01 16:50:02.000000000","message":"I think `_seconds` suffix is redundant - `lockout_duration` should be enough, can you please reduce it?","commit_id":"13982d0c542d5b3ba9c886ce44867157394185c1"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"56d766cb91cab1130668ec49a12cdeaca67b8ec3","unresolved":false,"context_lines":[{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration_seconds\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027Number of seconds a user account will be locked.\u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"}],"source_content_type":"text/x-python","patch_set":18,"id":"9abb7d3a_5798051c","line":1040,"in_reply_to":"9abb7d3a_1cfce23c","updated":"2016-06-01 17:04:16.000000000","message":"Done","commit_id":"13982d0c542d5b3ba9c886ce44867157394185c1"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"0e27814fe41ffe0e0c0abb2a2b8bc4f967c108c7","unresolved":false,"context_lines":[{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027Number of seconds a user account will be locked.\u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"},{"line_number":1044,"context_line":"                   default\u003d0,"}],"source_content_type":"text/x-python","patch_set":19,"id":"9abb7d3a_b70a1124","line":1041,"updated":"2016-06-01 17:07:05.000000000","message":"Sorry for bothering again: can you please multiply it for 60 to get initial 30 minutes? :)","commit_id":"1c5cf31ac2b006edfc9a90c92c3338139610b051"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"f4d0a695739293f0d4e7bef47cce18b77db54531","unresolved":false,"context_lines":[{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration\u0027,"},{"line_number":1041,"context_line":"                   default\u003d30,"},{"line_number":1042,"context_line":"                   help\u003d\u0027Number of seconds a user account will be locked.\u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"},{"line_number":1044,"context_line":"                   default\u003d0,"}],"source_content_type":"text/x-python","patch_set":19,"id":"9abb7d3a_b35ce419","line":1041,"in_reply_to":"9abb7d3a_b70a1124","updated":"2016-06-01 17:09:53.000000000","message":"Done","commit_id":"1c5cf31ac2b006edfc9a90c92c3338139610b051"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3e1d639abb6d11ca22e992bc7b71d198dd0b200","unresolved":false,"context_lines":[{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration\u0027,"},{"line_number":1041,"context_line":"                   default\u003d1800,"},{"line_number":1042,"context_line":"                   help\u003d\u0027Number of seconds a user account will be locked.\u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"}],"source_content_type":"text/x-python","patch_set":20,"id":"9abb7d3a_92a4314b","line":1040,"updated":"2016-06-01 20:35:36.000000000","message":"I assume this is only used if lockout_failure_attempts is set to something other than 0, so it wouldn\u0027t make sense to have a default for this, right?","commit_id":"f99552a8d8fd147b24b9aa8ed4ef206553bb667b"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"0f06067dd0cc75a12fa2aafe615363cdc1b6a3a2","unresolved":false,"context_lines":[{"line_number":1037,"context_line":"                   help\u003d\u0027Number of times a user can fail login attempts until \u0027"},{"line_number":1038,"context_line":"                        \u0027the user account is locked. Setting the value to 0  \u0027"},{"line_number":1039,"context_line":"                        \u0027disables this feature.\u0027),"},{"line_number":1040,"context_line":"        cfg.IntOpt(\u0027lockout_duration\u0027,"},{"line_number":1041,"context_line":"                   default\u003d1800,"},{"line_number":1042,"context_line":"                   help\u003d\u0027Number of seconds a user account will be locked.\u0027),"},{"line_number":1043,"context_line":"        cfg.IntOpt(\u0027password_expires_days\u0027,"}],"source_content_type":"text/x-python","patch_set":20,"id":"9abb7d3a_8e99a57b","line":1040,"in_reply_to":"9abb7d3a_92a4314b","updated":"2016-06-02 00:21:52.000000000","message":"Correct","commit_id":"f99552a8d8fd147b24b9aa8ed4ef206553bb667b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e3e1d639abb6d11ca22e992bc7b71d198dd0b200","unresolved":false,"context_lines":[{"line_number":1046,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1047,"context_line":"                        \u0027change it. Setting the value to 0 disables this \u0027"},{"line_number":1048,"context_line":"                        \u0027feature. Note: this feature is only supported \u0027"},{"line_number":1049,"context_line":"                        \u0027via the SQL backend driver for identity.\u0027),"},{"line_number":1050,"context_line":"        cfg.IntOpt(\u0027unique_last_password_count\u0027,"},{"line_number":1051,"context_line":"                   default\u003d0,"},{"line_number":1052,"context_line":"                   help\u003d\u0027Number of latest password iterations for which the \u0027"}],"source_content_type":"text/x-python","patch_set":20,"id":"9abb7d3a_b280558c","line":1049,"updated":"2016-06-01 20:35:36.000000000","message":"Do we have this documented anywhere else? Maybe after this patch lands we need to think about adding a support matrix for PCI and backends.","commit_id":"f99552a8d8fd147b24b9aa8ed4ef206553bb667b"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"0f06067dd0cc75a12fa2aafe615363cdc1b6a3a2","unresolved":false,"context_lines":[{"line_number":1046,"context_line":"                        \u0027considered valid before requiring the user to \u0027"},{"line_number":1047,"context_line":"                        \u0027change it. Setting the value to 0 disables this \u0027"},{"line_number":1048,"context_line":"                        \u0027feature. Note: this feature is only supported \u0027"},{"line_number":1049,"context_line":"                        \u0027via the SQL backend driver for identity.\u0027),"},{"line_number":1050,"context_line":"        cfg.IntOpt(\u0027unique_last_password_count\u0027,"},{"line_number":1051,"context_line":"                   default\u003d0,"},{"line_number":1052,"context_line":"                   help\u003d\u0027Number of latest password iterations for which the \u0027"}],"source_content_type":"text/x-python","patch_set":20,"id":"9abb7d3a_0e849508","line":1049,"in_reply_to":"9abb7d3a_b280558c","updated":"2016-06-02 00:21:52.000000000","message":"Good point. Thanks.","commit_id":"f99552a8d8fd147b24b9aa8ed4ef206553bb667b"}]}