)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2b46e515c5fea0d7aec6e143e5ee224aaf600ffd","unresolved":false,"context_lines":[{"line_number":10,"context_line":"where the location or hardcoding of binding checks are not optimal"},{"line_number":11,"context_line":"however fixing them will require having a proper authentication plugin"},{"line_number":12,"context_line":"scheme so just assume that they will be moved when that happens."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Implements: blueprint authentication-tied-to-token"},{"line_number":15,"context_line":"Change-Id: Ib34e5e0b6bd83837f6addbd45d4c5b828ce2f3bd"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"AAAAPn%2F%2Fb%2FU%3D","line":13,"updated":"2013-07-01 23:12:24.000000000","message":"add DocImpact because this is going to affect docs.","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"fb8a8b824ac21045351ce149d4cb4af72295345f","unresolved":false,"context_lines":[{"line_number":10,"context_line":"where the location or hardcoding of binding checks are not optimal"},{"line_number":11,"context_line":"however fixing them will require having a proper authentication plugin"},{"line_number":12,"context_line":"scheme so just assume that they will be moved when that happens."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Implements: blueprint authentication-tied-to-token"},{"line_number":15,"context_line":"Change-Id: Ib34e5e0b6bd83837f6addbd45d4c5b828ce2f3bd"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"AAAAPn%2F%2Fb4Q%3D","line":13,"in_reply_to":"AAAAPn%2F%2Fb%2FU%3D","updated":"2013-07-02 02:46:37.000000000","message":"Done","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"}],"doc/source/configuration.rst":[{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5e0105aca041dd4e39a68be790d6d940bf5d6c92","unresolved":false,"context_lines":[{"line_number":488,"context_line":"Token Binding"},{"line_number":489,"context_line":"-------------"},{"line_number":490,"context_line":""},{"line_number":491,"context_line":"Token binding refers to the practice of embedding information from external"},{"line_number":492,"context_line":"authentication providers (like a company\u0027s kerberos server) inside the token"},{"line_number":493,"context_line":"such that the token may only be used in conjunction with that specified"},{"line_number":494,"context_line":"authentication. This is an additional security mechanism as it means that if"}],"source_content_type":"text/x-rst","patch_set":13,"id":"AAAAP3%2F%2Fixk%3D","line":491,"updated":"2013-07-16 19:41:42.000000000","message":"I would have liked to seen some of this in the api document","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":489,"context_line":"-------------"},{"line_number":490,"context_line":""},{"line_number":491,"context_line":"Token binding refers to the practice of embedding information from external"},{"line_number":492,"context_line":"authentication providers (like a company\u0027s kerberos server) inside the token"},{"line_number":493,"context_line":"such that the token may only be used in conjunction with that specified"},{"line_number":494,"context_line":"authentication. This is an additional security mechanism as it means that if"},{"line_number":495,"context_line":"a token is stolen it will not be usable without also providing the external"}],"source_content_type":"text/x-rst","patch_set":13,"id":"AAAAP3%2F%2FiZA%3D","line":492,"updated":"2013-07-16 21:24:46.000000000","message":"capitalize Kerberos","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":490,"context_line":""},{"line_number":491,"context_line":"Token binding refers to the practice of embedding information from external"},{"line_number":492,"context_line":"authentication providers (like a company\u0027s kerberos server) inside the token"},{"line_number":493,"context_line":"such that the token may only be used in conjunction with that specified"},{"line_number":494,"context_line":"authentication. This is an additional security mechanism as it means that if"},{"line_number":495,"context_line":"a token is stolen it will not be usable without also providing the external"},{"line_number":496,"context_line":"authentication."}],"source_content_type":"text/x-rst","patch_set":13,"id":"AAAAP3%2F%2FiY0%3D","line":493,"updated":"2013-07-16 21:24:46.000000000","message":"we shouldn\u0027t document it like this because it\u0027s not the case.\n\nI think we should say that it\u0027s now possible for the services to validate the extra bind information in the token or something.","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":501,"context_line":"    [token]"},{"line_number":502,"context_line":"    bind \u003d kerberos"},{"line_number":503,"context_line":""},{"line_number":504,"context_line":"Currently only kerberos is supported."},{"line_number":505,"context_line":""},{"line_number":506,"context_line":"To enforce checking of token binding the ``enforce_token_bind`` parameter"},{"line_number":507,"context_line":"should be set to one of the following modes:"}],"source_content_type":"text/x-rst","patch_set":13,"id":"AAAAP3%2F%2FiYg%3D","line":504,"updated":"2013-07-16 21:24:46.000000000","message":"put ``kerberos`` in quotes.","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":513,"context_line":"  unknown to the server then this token should be rejected."},{"line_number":514,"context_line":"* ``required`` enable bind checking and require that at least 1 bind mechanism"},{"line_number":515,"context_line":"  is used for tokens."},{"line_number":516,"context_line":"* ``named`` enable bind checking and require that the ``named`` authentication"},{"line_number":517,"context_line":"  mechanism is used. e.g.::"},{"line_number":518,"context_line":""},{"line_number":519,"context_line":"    [token]"}],"source_content_type":"text/x-rst","patch_set":13,"id":"AAAAP3%2F%2FiX8%3D","line":516,"updated":"2013-07-16 21:24:46.000000000","message":"suggest don\u0027t put named in quotes here since it makes it seems like you should use \"named\" as the value.","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":514,"context_line":"* ``required`` enable bind checking and require that at least 1 bind mechanism"},{"line_number":515,"context_line":"  is used for tokens."},{"line_number":516,"context_line":"* ``named`` enable bind checking and require that the ``named`` authentication"},{"line_number":517,"context_line":"  mechanism is used. e.g.::"},{"line_number":518,"context_line":""},{"line_number":519,"context_line":"    [token]"},{"line_number":520,"context_line":"    enforce_token_bind \u003d kerberos"}],"source_content_type":"text/x-rst","patch_set":13,"id":"AAAAP3%2F%2FiWM%3D","line":517,"updated":"2013-07-16 21:24:46.000000000","message":"should this be a list to allow requiring multiple named authentication mechanisms?","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bb8a3a47645811699a71fb53a6e54778cf1b9c7d","unresolved":false,"context_lines":[{"line_number":519,"context_line":"    [token]"},{"line_number":520,"context_line":"    enforce_token_bind \u003d kerberos"},{"line_number":521,"context_line":""},{"line_number":522,"context_line":"  *Do not* set ``enforce_token_bind \u003d named``."},{"line_number":523,"context_line":""},{"line_number":524,"context_line":""},{"line_number":525,"context_line":"Sample Configuration Files"}],"source_content_type":"text/x-rst","patch_set":13,"id":"AAAAP3%2F%2Firc%3D","line":522,"updated":"2013-07-16 19:56:13.000000000","message":"Here how do I set one of the previous mentioned modes if I can\u0027t explicitly define it, if I don\u0027t want the \u0027permissive\u0027 default?","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"}],"etc/keystone.conf.sample":[{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5e0105aca041dd4e39a68be790d6d940bf5d6c92","unresolved":false,"context_lines":[{"line_number":129,"context_line":"# expiration \u003d 86400"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"# bind \u003d"},{"line_number":132,"context_line":"# enforce_token_bind \u003d permissive"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"[policy]"},{"line_number":135,"context_line":"# driver \u003d keystone.policy.backends.sql.Policy"}],"source_content_type":"application/octet-stream","patch_set":13,"id":"AAAAP3%2F%2FixE%3D","line":132,"updated":"2013-07-16 19:41:42.000000000","message":"would be good to have a comment here that lists all the possible values you can use for enforce_token_bind","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bb8a3a47645811699a71fb53a6e54778cf1b9c7d","unresolved":false,"context_lines":[{"line_number":129,"context_line":"# expiration \u003d 86400"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"# bind \u003d"},{"line_number":132,"context_line":"# enforce_token_bind \u003d permissive"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"[policy]"},{"line_number":135,"context_line":"# driver \u003d keystone.policy.backends.sql.Policy"}],"source_content_type":"application/octet-stream","patch_set":13,"id":"AAAAP3%2F%2FirI%3D","line":132,"in_reply_to":"AAAAP3%2F%2FixE%3D","updated":"2013-07-16 19:56:13.000000000","message":"I agree, especially since we should use \u0027enforce_token_bind \u003d named\u0027 according to the docs in this change.","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"}],"keystone/auth/controllers.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2b46e515c5fea0d7aec6e143e5ee224aaf600ffd","unresolved":false,"context_lines":[{"line_number":322,"context_line":"            user_ref \u003d auth_info.lookup_user(user_info[\u0027user\u0027])"},{"line_number":323,"context_line":"            auth_context[\u0027user_id\u0027] \u003d user_ref[\u0027id\u0027]"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"            if \u0027kerberos\u0027 in CONF.token.bind and \\"},{"line_number":326,"context_line":"                    context.get(\u0027AUTH_TYPE\u0027, \u0027\u0027).lower() \u003d\u003d \u0027negotiate\u0027:"},{"line_number":327,"context_line":"                auth_context[\u0027bind\u0027][\u0027kerberos\u0027] \u003d username"},{"line_number":328,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb%2Fk%3D","line":325,"updated":"2013-07-01 23:12:24.000000000","message":"use () to continue long lines, see https://github.com/openstack/keystone/blame/master/HACKING.rst#L14","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"fb8a8b824ac21045351ce149d4cb4af72295345f","unresolved":false,"context_lines":[{"line_number":322,"context_line":"            user_ref \u003d auth_info.lookup_user(user_info[\u0027user\u0027])"},{"line_number":323,"context_line":"            auth_context[\u0027user_id\u0027] \u003d user_ref[\u0027id\u0027]"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"            if \u0027kerberos\u0027 in CONF.token.bind and \\"},{"line_number":326,"context_line":"                    context.get(\u0027AUTH_TYPE\u0027, \u0027\u0027).lower() \u003d\u003d \u0027negotiate\u0027:"},{"line_number":327,"context_line":"                auth_context[\u0027bind\u0027][\u0027kerberos\u0027] \u003d username"},{"line_number":328,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb4U%3D","line":325,"in_reply_to":"AAAAPn%2F%2Fb%2Fk%3D","updated":"2013-07-02 02:46:37.000000000","message":"Done","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5e0105aca041dd4e39a68be790d6d940bf5d6c92","unresolved":false,"context_lines":[{"line_number":225,"context_line":"        :returns: list of auth method names"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        \"\"\""},{"line_number":228,"context_line":"        return self.auth[\u0027identity\u0027][\u0027methods\u0027] or []"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"    def get_method_data(self, method):"},{"line_number":231,"context_line":"        \"\"\"Get the auth method payload."}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2Fiw0%3D","line":228,"updated":"2013-07-16 19:41:42.000000000","message":"Why did you need to add the or [] ?","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":225,"context_line":"        :returns: list of auth method names"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        \"\"\""},{"line_number":228,"context_line":"        return self.auth[\u0027identity\u0027][\u0027methods\u0027] or []"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"    def get_method_data(self, method):"},{"line_number":231,"context_line":"        \"\"\"Get the auth method payload."}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2FiXM%3D","line":228,"updated":"2013-07-16 21:24:46.000000000","message":"this looks like it\u0027s fixing a different problem? suggest submit it as a separate change.","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bb8a3a47645811699a71fb53a6e54778cf1b9c7d","unresolved":false,"context_lines":[{"line_number":225,"context_line":"        :returns: list of auth method names"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"        \"\"\""},{"line_number":228,"context_line":"        return self.auth[\u0027identity\u0027][\u0027methods\u0027] or []"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"    def get_method_data(self, method):"},{"line_number":231,"context_line":"        \"\"\"Get the auth method payload."}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2Fiqs%3D","line":228,"in_reply_to":"AAAAP3%2F%2Fiw0%3D","updated":"2013-07-16 19:56:13.000000000","message":"So we ensure either the contents of self.auth[\u0027identity\u0027][\u0027methods\u0027] is returned or an empty set? This is just making sure we don\u0027t return None?","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"}],"keystone/auth/token_factory.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2b46e515c5fea0d7aec6e143e5ee224aaf600ffd","unresolved":false,"context_lines":[{"line_number":305,"context_line":"        domain_id,"},{"line_number":306,"context_line":"        project_id,"},{"line_number":307,"context_line":"        auth_context.get(\u0027expires_at\u0027, None),"},{"line_number":308,"context_line":"        auth_context[\u0027bind\u0027],"},{"line_number":309,"context_line":"        trust)"},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"    if CONF.signing.token_format \u003d\u003d \u0027UUID\u0027:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb%2Fc%3D","line":308,"updated":"2013-07-01 23:12:24.000000000","message":"use keyword argument for keyword parameter, so use\n\n bind\u003dauth_context[\u0027bind\u0027]","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"fb8a8b824ac21045351ce149d4cb4af72295345f","unresolved":false,"context_lines":[{"line_number":305,"context_line":"        domain_id,"},{"line_number":306,"context_line":"        project_id,"},{"line_number":307,"context_line":"        auth_context.get(\u0027expires_at\u0027, None),"},{"line_number":308,"context_line":"        auth_context[\u0027bind\u0027],"},{"line_number":309,"context_line":"        trust)"},{"line_number":310,"context_line":""},{"line_number":311,"context_line":"    if CONF.signing.token_format \u003d\u003d \u0027UUID\u0027:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb38%3D","line":308,"in_reply_to":"AAAAPn%2F%2Fb%2Fc%3D","updated":"2013-07-02 02:46:37.000000000","message":"arguably not a keyword parameter as it is always provided, it\u0027s in this position because trust is not used as a keyword provider here.\n\nProbably increases readability though so, done.","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"}],"keystone/common/serializer.py":[{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5e0105aca041dd4e39a68be790d6d940bf5d6c92","unresolved":false,"context_lines":[{"line_number":126,"context_line":"        decoded_tag \u003d XmlDeserializer._tag_name(element.tag, namespace)"},{"line_number":127,"context_line":"        list_item_tag \u003d None"},{"line_number":128,"context_line":"        if (decoded_tag[-1] \u003d\u003d \u0027s\u0027 and len(values) \u003d\u003d 0 and"},{"line_number":129,"context_line":"                decoded_tag !\u003d \u0027access\u0027):"},{"line_number":130,"context_line":"            # FIXME(gyee): special-case lists for now unti we"},{"line_number":131,"context_line":"            # figure out how to properly handle them."},{"line_number":132,"context_line":"            # If any key ends with an \u0027s\u0027, we are assuming it is a list."}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2Fiv8%3D","line":129,"updated":"2013-07-16 19:41:42.000000000","message":"good catch!","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"}],"keystone/common/wsgi.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2b46e515c5fea0d7aec6e143e5ee224aaf600ffd","unresolved":false,"context_lines":[{"line_number":86,"context_line":"    # get the named mode if bind_mode is not one of the known"},{"line_number":87,"context_line":"    name \u003d None if permissive or bind_mode \u003d\u003d \u0027required\u0027 else bind_mode"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"    if len(bind) \u003d\u003d 0:"},{"line_number":90,"context_line":"        if permissive:"},{"line_number":91,"context_line":"            return"},{"line_number":92,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb%2FA%3D","line":89,"updated":"2013-07-01 23:12:24.000000000","message":"suggest use \"not bind\"","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"fb8a8b824ac21045351ce149d4cb4af72295345f","unresolved":false,"context_lines":[{"line_number":86,"context_line":"    # get the named mode if bind_mode is not one of the known"},{"line_number":87,"context_line":"    name \u003d None if permissive or bind_mode \u003d\u003d \u0027required\u0027 else bind_mode"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"    if len(bind) \u003d\u003d 0:"},{"line_number":90,"context_line":"        if permissive:"},{"line_number":91,"context_line":"            return"},{"line_number":92,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb2I%3D","line":89,"in_reply_to":"AAAAPn%2F%2Fb%2FA%3D","updated":"2013-07-02 02:46:37.000000000","message":"Done","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2b46e515c5fea0d7aec6e143e5ee224aaf600ffd","unresolved":false,"context_lines":[{"line_number":90,"context_line":"        if permissive:"},{"line_number":91,"context_line":"            return"},{"line_number":92,"context_line":"        else:"},{"line_number":93,"context_line":"            LOG.info(\"No bind information present in token\")"},{"line_number":94,"context_line":"            raise exception.Unauthorized()"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    if name and name not in bind:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb%2FQ%3D","line":93,"updated":"2013-07-01 23:12:24.000000000","message":"wrap strings in _() for translation. This applies throughout this file (at lines 97, etc)","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"fb8a8b824ac21045351ce149d4cb4af72295345f","unresolved":false,"context_lines":[{"line_number":90,"context_line":"        if permissive:"},{"line_number":91,"context_line":"            return"},{"line_number":92,"context_line":"        else:"},{"line_number":93,"context_line":"            LOG.info(\"No bind information present in token\")"},{"line_number":94,"context_line":"            raise exception.Unauthorized()"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    if name and name not in bind:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb2E%3D","line":93,"in_reply_to":"AAAAPn%2F%2Fb%2FQ%3D","updated":"2013-07-02 02:46:37.000000000","message":"Done","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"def validate_token_bind(context, token_ref):"},{"line_number":77,"context_line":"    bind \u003d token_ref.get(\u0027bind\u0027, {})"},{"line_number":78,"context_line":"    bind_mode \u003d CONF.token.enforce_token_bind"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    if bind_mode \u003d\u003d \u0027disabled\u0027:"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2FiVU%3D","line":77,"updated":"2013-07-16 21:24:46.000000000","message":"suggest move this after 81 since don\u0027t need it if bind_mode \u003d\u003d \u0027disabled\u0027","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":87,"context_line":"    name \u003d None if permissive or bind_mode \u003d\u003d \u0027required\u0027 else bind_mode"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"    if not bind:"},{"line_number":90,"context_line":"        if permissive:"},{"line_number":91,"context_line":"            return"},{"line_number":92,"context_line":"        else:"},{"line_number":93,"context_line":"            LOG.info(_(\"No bind information present in token\"))"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2FiUk%3D","line":90,"updated":"2013-07-16 21:24:46.000000000","message":"suggest add a comment here why it\u0027s ok to just return here...\n\n # Nothing to do because there\u0027s no bind data and it\u0027s not required.","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":101,"context_line":"        if bind_type \u003d\u003d \u0027kerberos\u0027:"},{"line_number":102,"context_line":"            if not (context.get(\u0027AUTH_TYPE\u0027, \u0027\u0027).lower() \u003d\u003d \u0027negotiate\u0027 and"},{"line_number":103,"context_line":"                    context.get(\u0027REMOTE_USER\u0027) \u003d\u003d identifier):"},{"line_number":104,"context_line":"                LOG.info(_(\"Kerberos credentials not present or do not match\"))"},{"line_number":105,"context_line":"                raise exception.Unauthorized()"},{"line_number":106,"context_line":"        elif bind_mode \u003d\u003d \u0027permissive\u0027:"},{"line_number":107,"context_line":"            LOG.info(_(\"Ignoring Unknown bind for permissive mode: \""}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2FiTA%3D","line":104,"updated":"2013-07-16 21:24:46.000000000","message":"seems like it would be useful to an administrator trying to figure out why this isn\u0027t working to know which one it is, so suggest split this up.","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":102,"context_line":"            if not (context.get(\u0027AUTH_TYPE\u0027, \u0027\u0027).lower() \u003d\u003d \u0027negotiate\u0027 and"},{"line_number":103,"context_line":"                    context.get(\u0027REMOTE_USER\u0027) \u003d\u003d identifier):"},{"line_number":104,"context_line":"                LOG.info(_(\"Kerberos credentials not present or do not match\"))"},{"line_number":105,"context_line":"                raise exception.Unauthorized()"},{"line_number":106,"context_line":"        elif bind_mode \u003d\u003d \u0027permissive\u0027:"},{"line_number":107,"context_line":"            LOG.info(_(\"Ignoring Unknown bind for permissive mode: \""},{"line_number":108,"context_line":"                       \"{%(bind_type)s: %(identifier)s}\"),"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2FiRs%3D","line":105,"updated":"2013-07-16 21:24:46.000000000","message":"suggest add an else leg and log a successful kerberos bind.","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":104,"context_line":"                LOG.info(_(\"Kerberos credentials not present or do not match\"))"},{"line_number":105,"context_line":"                raise exception.Unauthorized()"},{"line_number":106,"context_line":"        elif bind_mode \u003d\u003d \u0027permissive\u0027:"},{"line_number":107,"context_line":"            LOG.info(_(\"Ignoring Unknown bind for permissive mode: \""},{"line_number":108,"context_line":"                       \"{%(bind_type)s: %(identifier)s}\"),"},{"line_number":109,"context_line":"                     {\u0027bind_type\u0027: bind_type, \u0027identifier\u0027: identifier})"},{"line_number":110,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2FiSw%3D","line":107,"updated":"2013-07-16 21:24:46.000000000","message":"lowercase \"unknown\"\n\nAlso, make it a debug.","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d8b2e3449dcf66e70f0fb88241bf76ccc4c04d87","unresolved":false,"context_lines":[{"line_number":109,"context_line":"                LOG.info(_(\"Kerberos credentials do not match those in bind\"))"},{"line_number":110,"context_line":"                raise exception.Unauthorized()"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"            LOG.info(_(\"Kerberos bind authentication successful\"))"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"        elif bind_mode \u003d\u003d \u0027permissive\u0027:"},{"line_number":115,"context_line":"            LOG.debug(_(\"Ignoring unknown bind for permissive mode: \""}],"source_content_type":"text/x-python","patch_set":16,"id":"AAAAP3%2F%2FhAY%3D","line":112,"updated":"2013-07-17 03:58:58.000000000","message":"(nit) this should be debug","commit_id":"6d7783a852b742bbaa4501acfed3eb32d5fa690d"}],"keystone/token/controllers.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2b46e515c5fea0d7aec6e143e5ee224aaf600ffd","unresolved":false,"context_lines":[{"line_number":350,"context_line":""},{"line_number":351,"context_line":"        expiry \u003d core.default_expire_time()"},{"line_number":352,"context_line":"        bind \u003d None"},{"line_number":353,"context_line":"        if \u0027kerberos\u0027 in CONF.token.bind and \\"},{"line_number":354,"context_line":"                context.get(\u0027AUTH_TYPE\u0027, \u0027\u0027).lower() \u003d\u003d \u0027negotiate\u0027:"},{"line_number":355,"context_line":"            bind \u003d {\u0027kerberos\u0027: username}"},{"line_number":356,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb%2BE%3D","line":353,"updated":"2013-07-01 23:12:24.000000000","message":"use () to continue long lines, see https://github.com/openstack/keystone/blame/master/HACKING.rst#L14","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"fb8a8b824ac21045351ce149d4cb4af72295345f","unresolved":false,"context_lines":[{"line_number":350,"context_line":""},{"line_number":351,"context_line":"        expiry \u003d core.default_expire_time()"},{"line_number":352,"context_line":"        bind \u003d None"},{"line_number":353,"context_line":"        if \u0027kerberos\u0027 in CONF.token.bind and \\"},{"line_number":354,"context_line":"                context.get(\u0027AUTH_TYPE\u0027, \u0027\u0027).lower() \u003d\u003d \u0027negotiate\u0027:"},{"line_number":355,"context_line":"            bind \u003d {\u0027kerberos\u0027: username}"},{"line_number":356,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb2M%3D","line":353,"in_reply_to":"AAAAPn%2F%2Fb%2BE%3D","updated":"2013-07-02 02:46:37.000000000","message":"Done","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":136,"context_line":"        except exception.NotFound as e:"},{"line_number":137,"context_line":"            raise exception.Unauthorized(e)"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"        wsgi.validate_token_bind(context, old_token_ref)"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"        #A trust token cannot be used to get another token"},{"line_number":142,"context_line":"        if \u0027trust\u0027 in old_token_ref:"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2FiQ4%3D","line":139,"updated":"2013-07-16 21:24:46.000000000","message":"why are we doing this in so many places?","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5e0105aca041dd4e39a68be790d6d940bf5d6c92","unresolved":false,"context_lines":[{"line_number":269,"context_line":"        if \u0027REMOTE_USER\u0027 not in context:"},{"line_number":270,"context_line":"            raise ExternalAuthNotApplicable()"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"        #NOTE(jamielennox): xml and json differ and get confused about what"},{"line_number":273,"context_line":"        # empty auth should look like so just reset it."},{"line_number":274,"context_line":"        if not auth:"},{"line_number":275,"context_line":"            auth \u003d {}"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2Fivc%3D","line":272,"updated":"2013-07-16 19:41:42.000000000","message":"good comment!","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":272,"context_line":"        #NOTE(jamielennox): xml and json differ and get confused about what"},{"line_number":273,"context_line":"        # empty auth should look like so just reset it."},{"line_number":274,"context_line":"        if not auth:"},{"line_number":275,"context_line":"            auth \u003d {}"},{"line_number":276,"context_line":""},{"line_number":277,"context_line":"        username \u003d context[\u0027REMOTE_USER\u0027]"},{"line_number":278,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2FiQQ%3D","line":275,"updated":"2013-07-16 21:24:46.000000000","message":"this looks like a fix for a different problem, if so, submit it separately.","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"}],"keystone/token/providers/uuid.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":287,"context_line":""},{"line_number":288,"context_line":"    def get_token_data(self, user_id, method_names, extras,"},{"line_number":289,"context_line":"                       domain_id\u003dNone, project_id\u003dNone, expires\u003dNone,"},{"line_number":290,"context_line":"                       bind\u003dNone, trust\u003dNone, token\u003dNone):"},{"line_number":291,"context_line":"        token_data \u003d {\u0027methods\u0027: method_names,"},{"line_number":292,"context_line":"                      \u0027extras\u0027: extras}"},{"line_number":293,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2FiPo%3D","line":290,"updated":"2013-07-16 21:24:46.000000000","message":"suggest add new arguments at the end.","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"}],"tests/test_auth.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2b46e515c5fea0d7aec6e143e5ee224aaf600ffd","unresolved":false,"context_lines":[{"line_number":382,"context_line":"        self.assertEqual(bind[\u0027kerberos\u0027], \u0027FOO\u0027)"},{"line_number":383,"context_line":""},{"line_number":384,"context_line":"        body_dict \u003d _build_user_auth("},{"line_number":385,"context_line":"            token\u003dunscoped_token[\"access\"][\"token\"],"},{"line_number":386,"context_line":"            tenant_name\u003d\"BAR\")"},{"line_number":387,"context_line":""},{"line_number":388,"context_line":"        self.assertRaises("}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb90%3D","line":385,"updated":"2013-07-01 23:12:24.000000000","message":"use \u0027 for strings consistently. This applies throughout this file.","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"fb8a8b824ac21045351ce149d4cb4af72295345f","unresolved":false,"context_lines":[{"line_number":382,"context_line":"        self.assertEqual(bind[\u0027kerberos\u0027], \u0027FOO\u0027)"},{"line_number":383,"context_line":""},{"line_number":384,"context_line":"        body_dict \u003d _build_user_auth("},{"line_number":385,"context_line":"            token\u003dunscoped_token[\"access\"][\"token\"],"},{"line_number":386,"context_line":"            tenant_name\u003d\"BAR\")"},{"line_number":387,"context_line":""},{"line_number":388,"context_line":"        self.assertRaises("}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb3I%3D","line":385,"in_reply_to":"AAAAPn%2F%2Fb90%3D","updated":"2013-07-02 02:46:37.000000000","message":"Done","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2b46e515c5fea0d7aec6e143e5ee224aaf600ffd","unresolved":false,"context_lines":[{"line_number":388,"context_line":"        self.assertRaises("},{"line_number":389,"context_line":"            exception.Unauthorized,"},{"line_number":390,"context_line":"            self.controller.authenticate,"},{"line_number":391,"context_line":"            {}, body_dict)"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"        scoped_token \u003d self.controller.authenticate(context, body_dict)"},{"line_number":394,"context_line":"        bind \u003d scoped_token[\u0027access\u0027][\u0027token\u0027][\u0027bind\u0027]"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fb9o%3D","line":391,"updated":"2013-07-01 23:12:24.000000000","message":"this looks like it\u0027s testing something other than \"bind is transferred\" ... move it to a separate test?","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"fb8a8b824ac21045351ce149d4cb4af72295345f","unresolved":false,"context_lines":[{"line_number":388,"context_line":"        self.assertRaises("},{"line_number":389,"context_line":"            exception.Unauthorized,"},{"line_number":390,"context_line":"            self.controller.authenticate,"},{"line_number":391,"context_line":"            {}, body_dict)"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"        scoped_token \u003d self.controller.authenticate(context, body_dict)"},{"line_number":394,"context_line":"        bind \u003d scoped_token[\u0027access\u0027][\u0027token\u0027][\u0027bind\u0027]"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAPn%2F%2Fbs8%3D","line":391,"in_reply_to":"AAAAPn%2F%2Fb9o%3D","updated":"2013-07-02 02:46:37.000000000","message":"Renamed the entire test. To get to the next point you would have to do all the previous steps anyway and testing the same thing twice.","commit_id":"c66f936e6f95db6044e60159639a3e742508eef9"}],"tests/test_token_bind.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bb8a3a47645811699a71fb53a6e54778cf1b9c7d","unresolved":false,"context_lines":[{"line_number":38,"context_line":"    \"\"\""},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    def assert_kerberos_bind(self, tokens, bind_level,"},{"line_number":41,"context_line":"                             use_kerberos\u003dTrue, success\u003dTrue):"},{"line_number":42,"context_line":"        if not isinstance(tokens, dict):"},{"line_number":43,"context_line":"            for token in tokens:"},{"line_number":44,"context_line":"                self.assert_kerberos_bind(token, bind_level,"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2FioI%3D","line":41,"updated":"2013-07-16 19:56:13.000000000","message":"slick","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a2c41cfde718694741069f9b9b1d937dc9ee7485","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        elif use_kerberos \u003d\u003d ANY:"},{"line_number":47,"context_line":"            for val in (True, False):"},{"line_number":48,"context_line":"                self.assert_kerberos_bind(tokens, bind_level,"},{"line_number":49,"context_line":"                                          val, success)"},{"line_number":50,"context_line":"        else:"},{"line_number":51,"context_line":"            context \u003d {}"},{"line_number":52,"context_line":"            CONF.token.enforce_token_bind \u003d bind_level"}],"source_content_type":"text/x-python","patch_set":13,"id":"AAAAP3%2F%2FiNU%3D","line":49,"updated":"2013-07-16 21:24:46.000000000","message":"use named argument for named parameters, e.g., use_kerberos\u003dval, success\u003dsuccess","commit_id":"743497783adb2b7b59f5ab1673b8a2856306bf0f"}],"tests/test_v3_auth.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d8b2e3449dcf66e70f0fb88241bf76ccc4c04d87","unresolved":false,"context_lines":[{"line_number":766,"context_line":"                          auth_context)"},{"line_number":767,"context_line":""},{"line_number":768,"context_line":""},{"line_number":769,"context_line":"class TestAuthExternalDomain(test_v3.RestfulTestCase):"},{"line_number":770,"context_line":"    content_type \u003d \u0027json\u0027"},{"line_number":771,"context_line":""},{"line_number":772,"context_line":"    def config_files(self):"}],"source_content_type":"text/x-python","patch_set":16,"id":"AAAAP3%2F%2Fg%2BY%3D","line":769,"updated":"2013-07-17 03:58:58.000000000","message":"shouldn\u0027t this be TestAuthExternalDomainJSON?","commit_id":"6d7783a852b742bbaa4501acfed3eb32d5fa690d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d8b2e3449dcf66e70f0fb88241bf76ccc4c04d87","unresolved":false,"context_lines":[{"line_number":767,"context_line":""},{"line_number":768,"context_line":""},{"line_number":769,"context_line":"class TestAuthExternalDomain(test_v3.RestfulTestCase):"},{"line_number":770,"context_line":"    content_type \u003d \u0027json\u0027"},{"line_number":771,"context_line":""},{"line_number":772,"context_line":"    def config_files(self):"},{"line_number":773,"context_line":"        list \u003d self._config_file_list[:]"}],"source_content_type":"text/x-python","patch_set":16,"id":"AAAAP3%2F%2Fg%2BU%3D","line":770,"updated":"2013-07-17 03:58:58.000000000","message":"this looks like it\u0027s fixing a different problem.","commit_id":"6d7783a852b742bbaa4501acfed3eb32d5fa690d"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d8b2e3449dcf66e70f0fb88241bf76ccc4c04d87","unresolved":false,"context_lines":[{"line_number":1354,"context_line":""},{"line_number":1355,"context_line":"        v2_token_data \u003d resp.result"},{"line_number":1356,"context_line":""},{"line_number":1357,"context_line":"        bind \u003d v2_token_data[\u0027access\u0027][\u0027token\u0027][\u0027bind\u0027]"},{"line_number":1358,"context_line":"        self.assertEqual(bind[\u0027kerberos\u0027], self.default_domain_user[\u0027name\u0027])"},{"line_number":1359,"context_line":""},{"line_number":1360,"context_line":"        v2_token_id \u003d v2_token_data[\u0027access\u0027][\u0027token\u0027][\u0027id\u0027]"}],"source_content_type":"text/x-python","patch_set":16,"id":"AAAAP3%2F%2Fg88%3D","line":1357,"updated":"2013-07-17 03:58:58.000000000","message":"Where\u0027s the documentation change for the v2 tokens?","commit_id":"6d7783a852b742bbaa4501acfed3eb32d5fa690d"}]}