)]}'
{"keystone/conf/security_compliance.py":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"577aaf79f1267cab316a33b0112e35eda228ed5e","unresolved":false,"context_lines":[{"line_number":71,"context_line":"    \u0027password_expires_ignore_list\u0027,"},{"line_number":72,"context_line":"    default\u003d[],"},{"line_number":73,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":74,"context_line":"Comma separated list of user IDs to be ignored when checking if a password"},{"line_number":75,"context_line":"is expired. Passwords for users in this list will not expire. This feature"},{"line_number":76,"context_line":"will only be enabled if `[security_compliance] password_expires_days` is set."},{"line_number":77,"context_line":"\"\"\"))"}],"source_content_type":"text/x-python","patch_set":2,"id":"bacf61ea_af213da0","line":74,"range":{"start_line":74,"start_character":24,"end_line":74,"end_character":32},"updated":"2016-08-05 15:08:30.000000000","message":"IMO, using IDs makes it harder for deployers since they have to start keystone once to create and get the IDs, then restart again to set this option. Although I understand that user IDs are the only thing unique across domains, but my 2 cents.","commit_id":"4f4f4078073f296a3cd35ce6b8c0730643fe0b7f"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"91ce8587e9dd73197192685a32d45c4fc096ea2a","unresolved":false,"context_lines":[{"line_number":71,"context_line":"    \u0027password_expires_ignore_list\u0027,"},{"line_number":72,"context_line":"    default\u003d[],"},{"line_number":73,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":74,"context_line":"Comma separated list of user IDs to be ignored when checking if a password"},{"line_number":75,"context_line":"is expired. Passwords for users in this list will not expire. This feature"},{"line_number":76,"context_line":"will only be enabled if `[security_compliance] password_expires_days` is set."},{"line_number":77,"context_line":"\"\"\"))"}],"source_content_type":"text/x-python","patch_set":2,"id":"3ac371cc_57ba37c1","line":74,"range":{"start_line":74,"start_character":24,"end_line":74,"end_character":32},"in_reply_to":"9ad45d7e_52042f14","updated":"2016-08-16 14:49:33.000000000","message":"the main reason why this is added is service users. Lets just assume (and doc) that names are expected only in the default domain, where the service users almost always are.","commit_id":"4f4f4078073f296a3cd35ce6b8c0730643fe0b7f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"59c8b37865b1e973ecd507b671c2992678d8ebea","unresolved":false,"context_lines":[{"line_number":71,"context_line":"    \u0027password_expires_ignore_list\u0027,"},{"line_number":72,"context_line":"    default\u003d[],"},{"line_number":73,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":74,"context_line":"Comma separated list of user IDs to be ignored when checking if a password"},{"line_number":75,"context_line":"is expired. Passwords for users in this list will not expire. This feature"},{"line_number":76,"context_line":"will only be enabled if `[security_compliance] password_expires_days` is set."},{"line_number":77,"context_line":"\"\"\"))"}],"source_content_type":"text/x-python","patch_set":2,"id":"9ad45d7e_52042f14","line":74,"range":{"start_line":74,"start_character":24,"end_line":74,"end_character":32},"in_reply_to":"bacf61ea_085caa17","updated":"2016-08-09 08:11:15.000000000","message":"as you both pointed out, IDs were selected because they are immutable. if we did name@domain_name, the user name (and domain_name) could be updated.\n\non the flip side, specifying garbage values in here should be pretty harmless since it\u0027ll just be used as an ignore list. adding support for names shouldn\u0027t be too hard, do we want to call this option _ids and create another one _names?","commit_id":"4f4f4078073f296a3cd35ce6b8c0730643fe0b7f"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"caec054ce1afb801e90bf1acb61c209961a78ae1","unresolved":false,"context_lines":[{"line_number":71,"context_line":"    \u0027password_expires_ignore_list\u0027,"},{"line_number":72,"context_line":"    default\u003d[],"},{"line_number":73,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":74,"context_line":"Comma separated list of user IDs to be ignored when checking if a password"},{"line_number":75,"context_line":"is expired. Passwords for users in this list will not expire. This feature"},{"line_number":76,"context_line":"will only be enabled if `[security_compliance] password_expires_days` is set."},{"line_number":77,"context_line":"\"\"\"))"}],"source_content_type":"text/x-python","patch_set":2,"id":"bacf61ea_085caa17","line":74,"range":{"start_line":74,"start_character":24,"end_line":74,"end_character":32},"in_reply_to":"bacf61ea_af213da0","updated":"2016-08-06 01:59:05.000000000","message":"I agree with this. It\u0027s the same problem as needing the ID of the default domain for the policy file. Puppet especially is particularly bad at introspecting resources it has created in order to look up an ID as well as at manipulating a config file and service multiple times in the same run. It would be nice if maybe this accepted a username and domain name since that can be known ahead of time.","commit_id":"4f4f4078073f296a3cd35ce6b8c0730643fe0b7f"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"2b45ab307eb061d6da460ebabc7c53a23360995a","unresolved":false,"context_lines":[{"line_number":68,"context_line":"\"\"\"))"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"password_expires_ignore_list \u003d cfg.ListOpt("},{"line_number":71,"context_line":"    \u0027password_expires_ignore_list\u0027,"},{"line_number":72,"context_line":"    default\u003d[],"},{"line_number":73,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":74,"context_line":"Comma separated list of user IDs to be ignored when checking if a password"}],"source_content_type":"text/x-python","patch_set":3,"id":"3ac371cc_7b7fd514","line":71,"range":{"start_line":71,"start_character":5,"end_line":71,"end_character":33},"updated":"2016-08-18 14:27:52.000000000","message":"What about \u0027password_expires_ignore_user_ids\u0027? so we are more specific (from the name) on what we want to put here.\n\nit also allows for steve suggestion if we ever want to put names in the future","commit_id":"a3405c4270cad86fe564de48fb290cd37b530e51"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"b8b309e4ed27b87fdea56f68122cb9dcca6ad816","unresolved":false,"context_lines":[{"line_number":68,"context_line":"\"\"\"))"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"password_expires_ignore_list \u003d cfg.ListOpt("},{"line_number":71,"context_line":"    \u0027password_expires_ignore_list\u0027,"},{"line_number":72,"context_line":"    default\u003d[],"},{"line_number":73,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":74,"context_line":"Comma separated list of user IDs to be ignored when checking if a password"}],"source_content_type":"text/x-python","patch_set":3,"id":"3ac371cc_a1c3de36","line":71,"range":{"start_line":71,"start_character":5,"end_line":71,"end_character":33},"in_reply_to":"3ac371cc_7b7fd514","updated":"2016-08-18 14:51:39.000000000","message":"Good suggestion, done.","commit_id":"a3405c4270cad86fe564de48fb290cd37b530e51"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"33da473aceb4eca6611852a3335c493d3aa81be1","unresolved":false,"context_lines":[{"line_number":67,"context_line":"the `[identity] driver`."},{"line_number":68,"context_line":"\"\"\"))"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"password_expires_ignore_user_ids \u003d cfg.ListOpt("},{"line_number":71,"context_line":"    \u0027password_expires_ignore_user_ids\u0027,"},{"line_number":72,"context_line":"    default\u003d[],"},{"line_number":73,"context_line":"    help\u003dutils.fmt(\"\"\""}],"source_content_type":"text/x-python","patch_set":4,"id":"3ac371cc_e14cb69f","line":70,"updated":"2016-08-18 15:02:54.000000000","message":"super nit: \"ignored\" would read better to me","commit_id":"e6a0fd04c803cae052b095aeecb4a5d572b45273"}],"keystone/identity/backends/sql_model.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"33da473aceb4eca6611852a3335c493d3aa81be1","unresolved":false,"context_lines":[{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    def _get_password_expires_at(self, created_at):"},{"line_number":117,"context_line":"        expires_days \u003d CONF.security_compliance.password_expires_days"},{"line_number":118,"context_line":"        ignore_list \u003d CONF.security_compliance.password_expires_ignore_user_ids"},{"line_number":119,"context_line":"        if expires_days and (self.id not in ignore_list):"},{"line_number":120,"context_line":"            expired_date \u003d (created_at + datetime.timedelta(days\u003dexpires_days))"},{"line_number":121,"context_line":"            return expired_date.replace(microsecond\u003d0)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3ac371cc_6c16fd4c","line":118,"updated":"2016-08-18 15:02:54.000000000","message":"I\u0027d personally write this as a short circuit at the top of the method before actually checking expiration, as it would better clarify the different flows through the method:\n\n  def _get_password_expires_at(self, created_at):\n      if self.id in CONF.security_compliance.password_expires_ignore_user_ids:\n          return None\n\n      if CONF.security_compliance.password_expires_days:\n          # ...\n\n      return None","commit_id":"e6a0fd04c803cae052b095aeecb4a5d572b45273"}],"keystone/tests/unit/identity/test_backend_sql.py":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"60811f0b69019dd10fe5de5829f248e6b01713ba","unresolved":false,"context_lines":[{"line_number":461,"context_line":"        # test password is not expired due to ignore list"},{"line_number":462,"context_line":"        self.identity_api.authenticate(self.make_request(),"},{"line_number":463,"context_line":"                                       user_id\u003duser[\u0027id\u0027],"},{"line_number":464,"context_line":"                                       password\u003dself.password)"},{"line_number":465,"context_line":""},{"line_number":466,"context_line":"    def _get_test_user_dict(self, password):"},{"line_number":467,"context_line":"        test_user_dict \u003d {"}],"source_content_type":"text/x-python","patch_set":4,"id":"3ac371cc_8c453944","line":464,"updated":"2016-08-18 14:58:39.000000000","message":"it\u0027d be nice to have another user that is not in the list, and consequently cannot auth","commit_id":"e6a0fd04c803cae052b095aeecb4a5d572b45273"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"a22eabfa322a3d1f255fedcc46759ac41e7b7b9a","unresolved":false,"context_lines":[{"line_number":461,"context_line":"        # test password is not expired due to ignore list"},{"line_number":462,"context_line":"        self.identity_api.authenticate(self.make_request(),"},{"line_number":463,"context_line":"                                       user_id\u003duser[\u0027id\u0027],"},{"line_number":464,"context_line":"                                       password\u003dself.password)"},{"line_number":465,"context_line":""},{"line_number":466,"context_line":"    def _get_test_user_dict(self, password):"},{"line_number":467,"context_line":"        test_user_dict \u003d {"}],"source_content_type":"text/x-python","patch_set":4,"id":"3ac371cc_2c408506","line":464,"in_reply_to":"3ac371cc_8c453944","updated":"2016-08-18 15:01:43.000000000","message":"++","commit_id":"e6a0fd04c803cae052b095aeecb4a5d572b45273"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"33da473aceb4eca6611852a3335c493d3aa81be1","unresolved":false,"context_lines":[{"line_number":461,"context_line":"        # test password is not expired due to ignore list"},{"line_number":462,"context_line":"        self.identity_api.authenticate(self.make_request(),"},{"line_number":463,"context_line":"                                       user_id\u003duser[\u0027id\u0027],"},{"line_number":464,"context_line":"                                       password\u003dself.password)"},{"line_number":465,"context_line":""},{"line_number":466,"context_line":"    def _get_test_user_dict(self, password):"},{"line_number":467,"context_line":"        test_user_dict \u003d {"}],"source_content_type":"text/x-python","patch_set":4,"id":"3ac371cc_ac02b5b1","line":464,"in_reply_to":"3ac371cc_8c453944","updated":"2016-08-18 15:02:54.000000000","message":"See test_authenticate_with_expired_password() above.","commit_id":"e6a0fd04c803cae052b095aeecb4a5d572b45273"}]}