)]}'
{"keystone/common/sql/migrate_repo/versions/105_update_password_created_at_column.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"197914bf0b746a638069fe17230c0da65e0dc5a7","unresolved":false,"context_lines":[{"line_number":23,"context_line":"    stmt \u003d pwd_table.update().values(created_at\u003dnow)"},{"line_number":24,"context_line":"    stmt.execute()"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    pwd_table.c.created_at.alter(nullable\u003dFalse)"}],"source_content_type":"text/x-python","patch_set":6,"id":"bab6814e_0bc0837a","line":26,"updated":"2016-05-19 19:39:26.000000000","message":"We really have to figure out what we are doing for these rolling upgrade because I don\u0027t think this would be allowed until the O release.","commit_id":"281f16f6903376f75c5681b399629e50ccbb921b"}],"keystone/identity/backends/sql.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"395a989177f0b0283cdf57a27db8eb9856dfd836","unresolved":false,"context_lines":[{"line_number":214,"context_line":"                raise AssertionError(_(\u0027Invalid user / password\u0027))"},{"line_number":215,"context_line":"            return base.filter_user(user_ref.to_dict())"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"    def _is_change_password_required(self, user_ref):"},{"line_number":218,"context_line":"        return False"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_426b4085","line":217,"range":{"start_line":217,"start_character":8,"end_line":217,"end_character":36},"updated":"2016-05-17 04:06:51.000000000","message":"i envisioned an interface for the constraint database that made these calls. and we would work on that first, then update all the necessary controllers and managers. \n\ni don\u0027t think this check should exist in a backend.","commit_id":"5e16e9a5e922aa6dcddf7dbcd95333b34acc80e5"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"df85c933d6cff6f62692144e388bfbaa68c8fea4","unresolved":false,"context_lines":[{"line_number":214,"context_line":"                raise AssertionError(_(\u0027Invalid user / password\u0027))"},{"line_number":215,"context_line":"            return base.filter_user(user_ref.to_dict())"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"    def _is_change_password_required(self, user_ref):"},{"line_number":218,"context_line":"        return False"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":1,"id":"9abb7d3a_158e7dcf","line":217,"range":{"start_line":217,"start_character":8,"end_line":217,"end_character":36},"in_reply_to":"bab6814e_ab3b3737","updated":"2016-06-01 15:26:33.000000000","message":"Ah, good point Stanek.  Currently, service users\u0027 passwords would expire like everyone else.  As we have discussed though, I am returning the user\u0027s password expire date during auth.","commit_id":"5e16e9a5e922aa6dcddf7dbcd95333b34acc80e5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e6ba84ea251113e413768b838138eb800a2864f4","unresolved":false,"context_lines":[{"line_number":214,"context_line":"                raise AssertionError(_(\u0027Invalid user / password\u0027))"},{"line_number":215,"context_line":"            return base.filter_user(user_ref.to_dict())"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"    def _is_change_password_required(self, user_ref):"},{"line_number":218,"context_line":"        return False"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_d889af27","line":217,"range":{"start_line":217,"start_character":8,"end_line":217,"end_character":36},"in_reply_to":"dab17558_1e585030","updated":"2016-05-17 20:40:58.000000000","message":"so 2 concerns with your answers:\n\n1) what if i don\u0027t want my passwords to expire? I\u0027ve been running my openstack cloud for years and I don\u0027t want to change things.\n\n2) I also have service \"users\", like the \"nova\" account that talks to glance, specified in keystonemiddleware, how do i get notified upon login?","commit_id":"5e16e9a5e922aa6dcddf7dbcd95333b34acc80e5"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"b95f63cc640d958117444a51a2ae7c6633886f45","unresolved":false,"context_lines":[{"line_number":214,"context_line":"                raise AssertionError(_(\u0027Invalid user / password\u0027))"},{"line_number":215,"context_line":"            return base.filter_user(user_ref.to_dict())"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"    def _is_change_password_required(self, user_ref):"},{"line_number":218,"context_line":"        return False"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_b5484d2e","line":217,"range":{"start_line":217,"start_character":8,"end_line":217,"end_character":36},"in_reply_to":"dab17558_426b4085","updated":"2016-05-17 13:34:21.000000000","message":"An interface for the constraint database?  Not following, can you expand on this?\n\nThe reason why I think this check belongs here is because the check should happen at authentication and it is only relevant to the sql driver.","commit_id":"5e16e9a5e922aa6dcddf7dbcd95333b34acc80e5"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"2fbe416da4ed4d8bdc6b2edcae23c398a3071415","unresolved":false,"context_lines":[{"line_number":214,"context_line":"                raise AssertionError(_(\u0027Invalid user / password\u0027))"},{"line_number":215,"context_line":"            return base.filter_user(user_ref.to_dict())"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"    def _is_change_password_required(self, user_ref):"},{"line_number":218,"context_line":"        return False"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_1e585030","line":217,"range":{"start_line":217,"start_character":8,"end_line":217,"end_character":36},"in_reply_to":"dab17558_49a6a50f","updated":"2016-05-17 15:44:05.000000000","message":"As we discussed in IRC/etherpad, we\u0027ll create a new interface for most of the PCI functionality.  Regarding upgrade, if operators set password expired days, when the user authenticates we\u0027ll check if the password is expired and set the expires_at date.  Finally, to answer your last question, if the current password doesn\u0027t match the required strength, then the user would be required to change their password.","commit_id":"5e16e9a5e922aa6dcddf7dbcd95333b34acc80e5"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2a63ba6467316c59550c16361e2b8841c10a6d54","unresolved":false,"context_lines":[{"line_number":214,"context_line":"                raise AssertionError(_(\u0027Invalid user / password\u0027))"},{"line_number":215,"context_line":"            return base.filter_user(user_ref.to_dict())"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"    def _is_change_password_required(self, user_ref):"},{"line_number":218,"context_line":"        return False"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":1,"id":"bab6814e_ab3b3737","line":217,"range":{"start_line":217,"start_character":8,"end_line":217,"end_character":36},"in_reply_to":"dab17558_8cab6874","updated":"2016-05-19 19:39:17.000000000","message":"I read #2 more as not having those passwords expire and not letting an admin know to change it (ahead of time).","commit_id":"5e16e9a5e922aa6dcddf7dbcd95333b34acc80e5"},{"author":{"_account_id":17579,"name":"Elvin Tubillara","email":"edtubill@us.ibm.com","username":"edtubill"},"change_message_id":"f2b1d7ffa8b6905b92e3dc42b2be13acf8130801","unresolved":false,"context_lines":[{"line_number":214,"context_line":"                raise AssertionError(_(\u0027Invalid user / password\u0027))"},{"line_number":215,"context_line":"            return base.filter_user(user_ref.to_dict())"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"    def _is_change_password_required(self, user_ref):"},{"line_number":218,"context_line":"        return False"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_49a6a50f","line":217,"range":{"start_line":217,"start_character":8,"end_line":217,"end_character":36},"in_reply_to":"dab17558_9e972547","updated":"2016-05-17 14:38:27.000000000","message":"hmm, I was going to put a validate_password (check password strength) function in keystone.common.utils (maybe it can be called here and in setting of the password?). . How do we want the upgrade path be (for customers/operators switching to the password requirements?  I was thinking either we turn on the expiration of the password and then let the user change their password to match the strength(only on setting/creating the password), or do we want to invalidate the password right a way and force them to change it(doesn\u0027t meet current rules)?","commit_id":"5e16e9a5e922aa6dcddf7dbcd95333b34acc80e5"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"ec6348350f77027741390c5202f2b47d34f607a7","unresolved":false,"context_lines":[{"line_number":214,"context_line":"                raise AssertionError(_(\u0027Invalid user / password\u0027))"},{"line_number":215,"context_line":"            return base.filter_user(user_ref.to_dict())"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"    def _is_change_password_required(self, user_ref):"},{"line_number":218,"context_line":"        return False"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_9e972547","line":217,"range":{"start_line":217,"start_character":8,"end_line":217,"end_character":36},"in_reply_to":"dab17558_b5484d2e","updated":"2016-05-17 14:28:29.000000000","message":"And by the way, I envision this method handling the following change password requirements:\n* Expired passwords\n* Password doesn’t meet current rules (password strength)\n* Password was created by someone else","commit_id":"5e16e9a5e922aa6dcddf7dbcd95333b34acc80e5"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"a1fcb30f3a9fa45a6cfd73f7de56fca35bfd0c06","unresolved":false,"context_lines":[{"line_number":214,"context_line":"                raise AssertionError(_(\u0027Invalid user / password\u0027))"},{"line_number":215,"context_line":"            return base.filter_user(user_ref.to_dict())"},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"    def _is_change_password_required(self, user_ref):"},{"line_number":218,"context_line":"        return False"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":1,"id":"dab17558_8cab6874","line":217,"range":{"start_line":217,"start_character":8,"end_line":217,"end_character":36},"in_reply_to":"dab17558_d889af27","updated":"2016-05-17 21:05:47.000000000","message":"1) what if i don\u0027t want my passwords to expire?\nThe config setting will be set to 0 and when we check if change_password_is_expired(), we evaluate that setting.  If it\u0027s not set, then it won\u0027t be expired.\n\n2) I also have service \"users\", like the \"nova\" account that talks to glance, specified in keystonemiddleware, how do i get notified upon login?\nHow do you get notified today?  I\u0027m not sure why this would change.","commit_id":"5e16e9a5e922aa6dcddf7dbcd95333b34acc80e5"}]}