)]}'
{"keystone/cmd/doctor/database.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d5ed6acee2a5920f688fad2f8f4692780684d7d5","unresolved":false,"context_lines":[{"line_number":20,"context_line":"    \"\"\"SQLite is not recommended for production deployments."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    SQLite does not enforce type checking and has limited support for"},{"line_number":23,"context_line":"    migrations, making it unsuitable for use keystone. Please change your"},{"line_number":24,"context_line":"    `keystone.conf [database] connection` value to point to a supported"},{"line_number":25,"context_line":"    database driver, such as MySQL."},{"line_number":26,"context_line":"    \"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"dada55a8_a5ff4233","line":23,"updated":"2016-07-18 14:36:49.000000000","message":"making it unsuitable for real use in keystone. ?","commit_id":"55d7b095770a3b48aa203080ba48a793e814fbd6"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ddd69fff81fbe972a349a1fc57c32287d8d78141","unresolved":false,"context_lines":[{"line_number":20,"context_line":"    \"\"\"SQLite is not recommended for production deployments."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    SQLite does not enforce type checking and has limited support for"},{"line_number":23,"context_line":"    migrations, making it unsuitable for use keystone. Please change your"},{"line_number":24,"context_line":"    `keystone.conf [database] connection` value to point to a supported"},{"line_number":25,"context_line":"    database driver, such as MySQL."},{"line_number":26,"context_line":"    \"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"dada55a8_12e3dba4","line":23,"in_reply_to":"dada55a8_a5ff4233","updated":"2016-07-18 22:51:47.000000000","message":"Done","commit_id":"55d7b095770a3b48aa203080ba48a793e814fbd6"}],"keystone/cmd/doctor/tokens.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94b9174aaf761addce6eb39aeb46414e4f3b20e2","unresolved":false,"context_lines":[{"line_number":16,"context_line":"CONF \u003d keystone.conf.CONF"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"def symptom_unreasonable_max_token_size():"},{"line_number":20,"context_line":"    \"\"\"`keystone.conf [DEFAULT] max_token_size` should be adjusted."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    This option is intended to protect keystone from unreasonably sized tokens,"}],"source_content_type":"text/x-python","patch_set":1,"id":"dada55a8_f4460abe","line":19,"range":{"start_line":19,"start_character":4,"end_line":19,"end_character":39},"updated":"2016-07-18 15:12:18.000000000","message":"we could also break this up into 4 checks","commit_id":"55d7b095770a3b48aa203080ba48a793e814fbd6"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ddd69fff81fbe972a349a1fc57c32287d8d78141","unresolved":false,"context_lines":[{"line_number":16,"context_line":"CONF \u003d keystone.conf.CONF"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"def symptom_unreasonable_max_token_size():"},{"line_number":20,"context_line":"    \"\"\"`keystone.conf [DEFAULT] max_token_size` should be adjusted."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    This option is intended to protect keystone from unreasonably sized tokens,"}],"source_content_type":"text/x-python","patch_set":1,"id":"dada55a8_92bb4b72","line":19,"in_reply_to":"dada55a8_f4460abe","updated":"2016-07-18 22:51:47.000000000","message":"I kept it as one mostly to keep the help text in one place.","commit_id":"55d7b095770a3b48aa203080ba48a793e814fbd6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d5ed6acee2a5920f688fad2f8f4692780684d7d5","unresolved":false,"context_lines":[{"line_number":33,"context_line":"      and they tend to break certain implementations of HTTP."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"    - For Fernet, set `keystone.conf [DEFAULT] max_token_size \u003d 255`, because"},{"line_number":36,"context_line":"      Fernet tokens should never exceed this length."},{"line_number":37,"context_line":"    \"\"\""},{"line_number":38,"context_line":"    return ("},{"line_number":39,"context_line":"        \u0027uuid\u0027 in CONF.token.provider and CONF.max_token_size !\u003d 32"}],"source_content_type":"text/x-python","patch_set":1,"id":"dada55a8_65170a52","line":36,"updated":"2016-07-18 14:36:49.000000000","message":"They should never exceed 255 bytes if the tokens are built using uuid-like id strings (which might not be the case if keystone is deployed with LDAP where the user ID/project ID are large and not uuid-like where we can convert them to bytes before packing up the payload.\n\nNot sure how we would relay that in a useful way here. Or the fact that the use of LDAP in another part of keystone can have an impact on token length when fernet is enabled.","commit_id":"55d7b095770a3b48aa203080ba48a793e814fbd6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d5ed6acee2a5920f688fad2f8f4692780684d7d5","unresolved":false,"context_lines":[{"line_number":39,"context_line":"        \u0027uuid\u0027 in CONF.token.provider and CONF.max_token_size !\u003d 32"},{"line_number":40,"context_line":"        or \u0027pki\u0027 in CONF.token.provider and CONF.max_token_size \u003c 8192"},{"line_number":41,"context_line":"        or \u0027pkiz\u0027 in CONF.token.provider and CONF.max_token_size \u003c 8192"},{"line_number":42,"context_line":"        or \u0027fernet\u0027 in CONF.token.provider and CONF.max_token_size \u003e 255)"}],"source_content_type":"text/x-python","patch_set":1,"id":"dada55a8_e89c6f6b","line":42,"updated":"2016-07-18 14:36:49.000000000","message":"Do we want to add another check for max_active_keys if/when fernet is enabled? Do we want to add a check for making sure fernet is in use to avoid token bloat problems?","commit_id":"55d7b095770a3b48aa203080ba48a793e814fbd6"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ddd69fff81fbe972a349a1fc57c32287d8d78141","unresolved":false,"context_lines":[{"line_number":39,"context_line":"        \u0027uuid\u0027 in CONF.token.provider and CONF.max_token_size !\u003d 32"},{"line_number":40,"context_line":"        or \u0027pki\u0027 in CONF.token.provider and CONF.max_token_size \u003c 8192"},{"line_number":41,"context_line":"        or \u0027pkiz\u0027 in CONF.token.provider and CONF.max_token_size \u003c 8192"},{"line_number":42,"context_line":"        or \u0027fernet\u0027 in CONF.token.provider and CONF.max_token_size \u003e 255)"}],"source_content_type":"text/x-python","patch_set":1,"id":"dada55a8_351ec963","line":42,"in_reply_to":"dada55a8_e89c6f6b","updated":"2016-07-18 22:51:47.000000000","message":"I don\u0027t think we\u0027re ready to have a check to see if Fernet is in use or not, yet. A UUID deployment is still a perfectly valid choice until we\u0027re confident enough in Fernet to be able to deprecate it.","commit_id":"55d7b095770a3b48aa203080ba48a793e814fbd6"}],"keystone/cmd/doctor/tokens_fernet.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d5ed6acee2a5920f688fad2f8f4692780684d7d5","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    \"\"\""},{"line_number":41,"context_line":"    return ("},{"line_number":42,"context_line":"        \u0027fernet\u0027 in CONF.token.provider"},{"line_number":43,"context_line":"        and not fernet_utils.load_keys())"}],"source_content_type":"text/x-python","patch_set":1,"id":"dada55a8_8ef33b0a","line":43,"updated":"2016-07-18 14:36:49.000000000","message":"The call to load_keys() also prints some stuff to the console [0]. Do we want to suppress that since its kind of noisy against the neatly formatted output of `keystone-manage doctor`? \n\n[0] http://cdn.pasteraw.com/ti408rdr6t5z3jgbnmm3ossx99tnk2q","commit_id":"55d7b095770a3b48aa203080ba48a793e814fbd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"94b9174aaf761addce6eb39aeb46414e4f3b20e2","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    \"\"\""},{"line_number":41,"context_line":"    return ("},{"line_number":42,"context_line":"        \u0027fernet\u0027 in CONF.token.provider"},{"line_number":43,"context_line":"        and not fernet_utils.load_keys())"}],"source_content_type":"text/x-python","patch_set":1,"id":"dada55a8_94350e48","line":43,"in_reply_to":"dada55a8_8ef33b0a","updated":"2016-07-18 15:12:18.000000000","message":"i thought it was kinda helpful","commit_id":"55d7b095770a3b48aa203080ba48a793e814fbd6"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ddd69fff81fbe972a349a1fc57c32287d8d78141","unresolved":false,"context_lines":[{"line_number":40,"context_line":"    \"\"\""},{"line_number":41,"context_line":"    return ("},{"line_number":42,"context_line":"        \u0027fernet\u0027 in CONF.token.provider"},{"line_number":43,"context_line":"        and not fernet_utils.load_keys())"}],"source_content_type":"text/x-python","patch_set":1,"id":"dada55a8_752681bb","line":43,"in_reply_to":"dada55a8_94350e48","updated":"2016-07-18 22:51:47.000000000","message":"If you want to suppress it, I guess disable debug?","commit_id":"55d7b095770a3b48aa203080ba48a793e814fbd6"}]}