)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b48783b8a149ffda9508c14c1012e6ed6e2c3778","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Select the code to handle REMOTE_USER based on a config file option"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Fixes the REMOTE_USER logic to get the domain name from"},{"line_number":12,"context_line":"REALM, which is the least surprise option."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Disregards the auth_data passed in, as we should be using REMOTE_USER"},{"line_number":15,"context_line":"to get the user name."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"AAAAP3%2F%2FioU%3D","line":12,"updated":"2013-07-16 20:13:20.000000000","message":"This should probably have a DocImpact.","commit_id":"8894cf0c9b1003dbd1679d3c89dd8b64b243ded8"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b48783b8a149ffda9508c14c1012e6ed6e2c3778","unresolved":false,"context_lines":[{"line_number":14,"context_line":"Disregards the auth_data passed in, as we should be using REMOTE_USER"},{"line_number":15,"context_line":"to get the user name."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"External Plugin is inow executed in conjunction with the auth methods,"},{"line_number":18,"context_line":"as opposed to in place of them."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"blueprint pluggable-remote-user"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"AAAAP3%2F%2Finw%3D","line":17,"updated":"2013-07-16 20:13:20.000000000","message":"change \"inow\" to \"now\".","commit_id":"8894cf0c9b1003dbd1679d3c89dd8b64b243ded8"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"04947cb4b76db1b22de3c04131679ad0d6fa195f","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Select the code to handle REMOTE_USER based on a config file option"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Fixes the REMOTE_USER logic to get the domain name from"},{"line_number":12,"context_line":"REALM, which is the least surprise option."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Disregards the auth_data passed in, as we should be using REMOTE_USER"},{"line_number":15,"context_line":"to get the user name."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"AAAAP3%2F%2Fih8%3D","line":12,"updated":"2013-07-16 20:33:43.000000000","message":"This should probably have a DocImpact.","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"04947cb4b76db1b22de3c04131679ad0d6fa195f","unresolved":false,"context_lines":[{"line_number":14,"context_line":"Disregards the auth_data passed in, as we should be using REMOTE_USER"},{"line_number":15,"context_line":"to get the user name."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"External Plugin is inow executed in conjunction with the auth methods,"},{"line_number":18,"context_line":"as opposed to in place of them."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"blueprint pluggable-remote-user"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"AAAAP3%2F%2Fih4%3D","line":17,"updated":"2013-07-16 20:33:43.000000000","message":"change \"inow\" to \"now\".","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"}],"doc/source/configuration.rst":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"691f168b8099d4b2f1f37528d248a63d97709055","unresolved":false,"context_lines":[{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Keystone provides three authentication methods by default. ``password`` handles password"},{"line_number":110,"context_line":"authentication and ``token`` handles token authentication.  ``external`` is used in conjunction"},{"line_number":111,"context_line":"with authemntication performed by a container web server that sets the ``REMOTE_USER``"},{"line_number":112,"context_line":"environment variable."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"How to Implement an Authentication Plugin"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAP3%2F%2Fh%2FE%3D","line":111,"updated":"2013-07-16 22:11:10.000000000","message":"change \"authemntication\" to \"authentication\"","commit_id":"7ad2aab3b21174be4cf349f8cde1f7930a961986"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"691f168b8099d4b2f1f37528d248a63d97709055","unresolved":false,"context_lines":[{"line_number":151,"context_line":"authentication to be successful. Furthermore, all the plugins invoked must"},{"line_number":152,"context_line":"agree on the ``user_id`` in the ``auth_context``."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"The ``REMOTE_USER`` environment variable is only set from an containing webserver.  However,"},{"line_number":155,"context_line":"to ensure that a user must go through other authentication mechanisms, even if this variable"},{"line_number":156,"context_line":"is set, remove ``external`` from the lists of plugins specified in ``methods``.  This effectively"},{"line_number":157,"context_line":"disables external authentication."}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAP3%2F%2Fh%2B8%3D","line":154,"updated":"2013-07-16 22:11:10.000000000","message":"change \"an containing\" to \"a containing\" (an to a)","commit_id":"7ad2aab3b21174be4cf349f8cde1f7930a961986"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"691f168b8099d4b2f1f37528d248a63d97709055","unresolved":false,"context_lines":[{"line_number":153,"context_line":""},{"line_number":154,"context_line":"The ``REMOTE_USER`` environment variable is only set from an containing webserver.  However,"},{"line_number":155,"context_line":"to ensure that a user must go through other authentication mechanisms, even if this variable"},{"line_number":156,"context_line":"is set, remove ``external`` from the lists of plugins specified in ``methods``.  This effectively"},{"line_number":157,"context_line":"disables external authentication."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAP3%2F%2Fh%2Bs%3D","line":156,"updated":"2013-07-16 22:11:10.000000000","message":"change \"lists\" to \"list\"","commit_id":"7ad2aab3b21174be4cf349f8cde1f7930a961986"}],"etc/keystone.conf.sample":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3a7db5490a10087fac71abccd42e2e7d91e4eb86","unresolved":false,"context_lines":[{"line_number":257,"context_line":"# user_additional_attribute_mapping \u003d"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"[auth]"},{"line_number":260,"context_line":"#external \u003d keystone.auth.plugins.external.ExternalDefault"},{"line_number":261,"context_line":"methods \u003d external,password,token"},{"line_number":262,"context_line":"password \u003d keystone.auth.plugins.password.Password"},{"line_number":263,"context_line":"token \u003d keystone.auth.plugins.token.Token"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"AAAAP3%2F%2Fico%3D","line":260,"updated":"2013-07-16 20:38:56.000000000","message":"seems like this line should be below \"methods\"","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"30ca4bf7eb0752ed597b734f76396f3ee275261d","unresolved":false,"context_lines":[{"line_number":257,"context_line":"# user_additional_attribute_mapping \u003d"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"[auth]"},{"line_number":260,"context_line":"#external \u003d keystone.auth.plugins.external.ExternalDefault"},{"line_number":261,"context_line":"methods \u003d external,password,token"},{"line_number":262,"context_line":"password \u003d keystone.auth.plugins.password.Password"},{"line_number":263,"context_line":"token \u003d keystone.auth.plugins.token.Token"}],"source_content_type":"application/octet-stream","patch_set":7,"id":"AAAAP3%2F%2FiS0%3D","line":260,"in_reply_to":"AAAAP3%2F%2Fico%3D","updated":"2013-07-16 21:36:22.000000000","message":"Done","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"}],"keystone/auth/controllers.py":[{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"e1626055ee73d7ab1a9b44ee175f56a692c110c3","unresolved":false,"context_lines":[{"line_number":273,"context_line":"        self.token_controllers_ref \u003d token.controllers.Auth()"},{"line_number":274,"context_line":"        config.setup_authentication()"},{"line_number":275,"context_line":"        driver \u003d CONF.auth.external"},{"line_number":276,"context_line":"        self.external \u003d importutils.import_object(driver)"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"    def authenticate_for_token(self, context, auth\u003dNone):"},{"line_number":279,"context_line":"        \"\"\"Authenticate user and issue a token.\"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAP3%2F%2FtXE%3D","line":276,"updated":"2013-07-12 16:46:16.000000000","message":"Can this be generalized to  chain into multiple external auth providers?\n  e.g   REMOTE_USER, CLIENT_CERT etc. (i.e) if REMOTE_USER is not found, then check CLIENT_CERT is provided. (i.e ) CLIENT_CERT CN\u003dusername.\n\nIn this model, the services(swfit,nova) can be configured with a client_cert and they can use client_cert to validate  the user token","commit_id":"baa9d050492b8642a244cbce37a7339128249ae5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f173366880c4d45e500d4366309bb5a260a9cbaa","unresolved":false,"context_lines":[{"line_number":273,"context_line":"        self.token_controllers_ref \u003d token.controllers.Auth()"},{"line_number":274,"context_line":"        config.setup_authentication()"},{"line_number":275,"context_line":"        driver \u003d CONF.auth.external"},{"line_number":276,"context_line":"        self.external \u003d importutils.import_object(driver)"},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"    def authenticate_for_token(self, context, auth\u003dNone):"},{"line_number":279,"context_line":"        \"\"\"Authenticate user and issue a token.\"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAP3%2F%2FsSM%3D","line":276,"in_reply_to":"AAAAP3%2F%2FtXE%3D","updated":"2013-07-13 04:01:53.000000000","message":"Haneef, yes, but I think that it might not make sense to.  For a Multifactor deployment, you would want it all in one plugin, just checking that the proper number of factors were used.  Otherwise, you should probably let the front end dictate which forms are used, and just have generic backend that does the same thing regardless of X509/Kerberos.  \n\nThis is just for Keystone, though, and not for the auth_token middelware.  That will come later, as part of the token binding work.","commit_id":"baa9d050492b8642a244cbce37a7339128249ae5"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"28b09e91809583fb0486af3ebf8f031e43007c06","unresolved":false,"context_lines":[{"line_number":282,"context_line":"    def external(self):"},{"line_number":283,"context_line":"        if self._external is None:"},{"line_number":284,"context_line":"            driver \u003d CONF.auth.external"},{"line_number":285,"context_line":"            self._external \u003d importutils.import_object(driver)"},{"line_number":286,"context_line":"        return self._external"},{"line_number":287,"context_line":""},{"line_number":288,"context_line":"    def authenticate_for_token(self, context, auth\u003dNone):"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAP3%2F%2FmeU%3D","line":285,"updated":"2013-07-16 00:05:41.000000000","message":"should not be do your own import. Instead, we should create an external auth method and let the plug-in do its thing. i.e.\n\n{\"auth\": {\n  \"identity\": {\n    \"methods\": [\"external\"]\n  }\n}\n\nexternal auth plugin should be able to extract everything else from the context","commit_id":"9d481acbc07d0cda2c2ebfe5f37650b559555f21"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"188eb664ad877cd68582d5bc5edf144af1d41f2f","unresolved":false,"context_lines":[{"line_number":282,"context_line":"    def external(self):"},{"line_number":283,"context_line":"        if self._external is None:"},{"line_number":284,"context_line":"            driver \u003d CONF.auth.external"},{"line_number":285,"context_line":"            self._external \u003d importutils.import_object(driver)"},{"line_number":286,"context_line":"        return self._external"},{"line_number":287,"context_line":""},{"line_number":288,"context_line":"    def authenticate_for_token(self, context, auth\u003dNone):"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAP3%2F%2Fmbk%3D","line":285,"in_reply_to":"AAAAP3%2F%2FmeU%3D","updated":"2013-07-16 01:39:13.000000000","message":"You might recall that we had that and you nacked that approach.  However, we also have to keep in mind that people are already doing REMOTE_USER auth, and adding any thing custom to the body of the request will mess them up.  I think that this approach is the right balance.  I see absolutely no benefit to making the user add something to the body of the request. All that does it break the client and make integration even harder.\n\nI\u0027ve modified the patch so that REMOTE_USER triggers a code path that happens before the pipeline, but doesn;t stop the pipleline from executing.  We can make an external plugin that acts as part of the pipeline in the future if it is required.","commit_id":"9d481acbc07d0cda2c2ebfe5f37650b559555f21"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"c9b760c26a9c9e0b187efd5edb244cc18aa5bc5f","unresolved":false,"context_lines":[{"line_number":282,"context_line":"    def external(self):"},{"line_number":283,"context_line":"        if self._external is None:"},{"line_number":284,"context_line":"            driver \u003d CONF.auth.external"},{"line_number":285,"context_line":"            self._external \u003d importutils.import_object(driver)"},{"line_number":286,"context_line":"        return self._external"},{"line_number":287,"context_line":""},{"line_number":288,"context_line":"    def authenticate_for_token(self, context, auth\u003dNone):"}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAP3%2F%2Fi1g%3D","line":285,"updated":"2013-07-16 19:21:13.000000000","message":"Very cool. I like that","commit_id":"8894cf0c9b1003dbd1679d3c89dd8b64b243ded8"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b48783b8a149ffda9508c14c1012e6ed6e2c3778","unresolved":false,"context_lines":[{"line_number":334,"context_line":""},{"line_number":335,"context_line":"        # user have been authenticated externally"},{"line_number":336,"context_line":"        if \u0027REMOTE_USER\u0027 in context:"},{"line_number":337,"context_line":"            self.external.authenticate(context, auth_info, auth_context)"},{"line_number":338,"context_line":""},{"line_number":339,"context_line":"        # need to aggregate the results in case two or more methods"},{"line_number":340,"context_line":"        # are specified"}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAP3%2F%2Filc%3D","line":337,"updated":"2013-07-16 20:13:20.000000000","message":"there should be some indication that auth_context is an in-out parameter... for example, auth_context_in_out\u003dauth_context","commit_id":"8894cf0c9b1003dbd1679d3c89dd8b64b243ded8"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"8801d7d1f74d88e1daae8750912c3b65e8d2c316","unresolved":false,"context_lines":[{"line_number":326,"context_line":""},{"line_number":327,"context_line":"        # user have been authenticated externally"},{"line_number":328,"context_line":"        if \u0027REMOTE_USER\u0027 in context:"},{"line_number":329,"context_line":"            external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":330,"context_line":"            external.authenticate(context, auth_info, auth_context)"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"        # need to aggregate the results in case two or more methods"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2Fifg%3D","line":329,"updated":"2013-07-16 20:27:51.000000000","message":"Where is this method \"external\" populated?  I don\u0027t think user is going to send this.  Is external authentication entity going to populate this?\n\nAlso for this external auth to work, we expect external authenticating entity to populate few things and also in certain specific format.  Can this be documented somewhere?","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"30ca4bf7eb0752ed597b734f76396f3ee275261d","unresolved":false,"context_lines":[{"line_number":326,"context_line":""},{"line_number":327,"context_line":"        # user have been authenticated externally"},{"line_number":328,"context_line":"        if \u0027REMOTE_USER\u0027 in context:"},{"line_number":329,"context_line":"            external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":330,"context_line":"            external.authenticate(context, auth_info, auth_context)"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"        # need to aggregate the results in case two or more methods"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2FiSA%3D","line":329,"in_reply_to":"AAAAP3%2F%2Fifg%3D","updated":"2013-07-16 21:36:22.000000000","message":"external is configured in the [auth] section just like other plugins.  It is a special one, in that it is triggered by REMOTE_USER instead of an explict list in the token.  It does not require any additional data in the token.","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"04947cb4b76db1b22de3c04131679ad0d6fa195f","unresolved":false,"context_lines":[{"line_number":327,"context_line":"        # user have been authenticated externally"},{"line_number":328,"context_line":"        if \u0027REMOTE_USER\u0027 in context:"},{"line_number":329,"context_line":"            external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":330,"context_line":"            external.authenticate(context, auth_info, auth_context)"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"        # need to aggregate the results in case two or more methods"},{"line_number":333,"context_line":"        # are specified"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2Fihw%3D","line":330,"updated":"2013-07-16 20:33:43.000000000","message":"there should be some indication that auth_context is an in-out parameter... for example, auth_context_in_out\u003dauth_context","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"30ca4bf7eb0752ed597b734f76396f3ee275261d","unresolved":false,"context_lines":[{"line_number":327,"context_line":"        # user have been authenticated externally"},{"line_number":328,"context_line":"        if \u0027REMOTE_USER\u0027 in context:"},{"line_number":329,"context_line":"            external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":330,"context_line":"            external.authenticate(context, auth_info, auth_context)"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"        # need to aggregate the results in case two or more methods"},{"line_number":333,"context_line":"        # are specified"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2FiSU%3D","line":330,"in_reply_to":"AAAAP3%2F%2Fihw%3D","updated":"2013-07-16 21:36:22.000000000","message":"that probably goes for all of the auth plugins.  Lets make that a separate patch.","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"691f168b8099d4b2f1f37528d248a63d97709055","unresolved":false,"context_lines":[{"line_number":326,"context_line":""},{"line_number":327,"context_line":"        # user have been authenticated externally"},{"line_number":328,"context_line":"        if \u0027REMOTE_USER\u0027 in context:"},{"line_number":329,"context_line":"            external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":330,"context_line":"            external.authenticate(context, auth_info, auth_context)"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"        # need to aggregate the results in case two or more methods"}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAAP3%2F%2Fh%2BM%3D","line":329,"updated":"2013-07-16 22:11:10.000000000","message":"what would happen if they did put \"external\" in the methods? should have a test.","commit_id":"7ad2aab3b21174be4cf349f8cde1f7930a961986"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"4f34946beccc42a61a3c54c42a23af1883348184","unresolved":false,"context_lines":[{"line_number":326,"context_line":""},{"line_number":327,"context_line":"        # user have been authenticated externally"},{"line_number":328,"context_line":"        if \u0027REMOTE_USER\u0027 in context:"},{"line_number":329,"context_line":"            external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":330,"context_line":"            external.authenticate(context, auth_info, auth_context)"},{"line_number":331,"context_line":""},{"line_number":332,"context_line":"        # need to aggregate the results in case two or more methods"}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAAP3%2F%2Fh0E%3D","line":329,"in_reply_to":"AAAAP3%2F%2Fh%2BM%3D","updated":"2013-07-16 22:59:24.000000000","message":"401 if REMOTE_USER is not in the context. But yeah, agree with adding a test.","commit_id":"7ad2aab3b21174be4cf349f8cde1f7930a961986"}],"keystone/auth/plugins/external.py":[{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"3820c480909d0bcc1e5db3bb23af304b301769d3","unresolved":false,"context_lines":[{"line_number":27,"context_line":"        # the user_id from auth_info for now, assuming external auth"},{"line_number":28,"context_line":"        # has check to make sure user is the same as the one specify"},{"line_number":29,"context_line":"        # in \"identity\"."},{"line_number":30,"context_line":"        if \u0027password\u0027 in auth_info.get_method_names():"},{"line_number":31,"context_line":"            user_info \u003d auth_info.get_method_data(\u0027password\u0027)"},{"line_number":32,"context_line":"            user_ref \u003d auth_info.lookup_user(user_info[\u0027user\u0027])"},{"line_number":33,"context_line":"            auth_context[\u0027user_id\u0027] \u003d user_ref[\u0027id\u0027]"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAP3%2F%2FrPg%3D","line":30,"updated":"2013-07-13 22:30:31.000000000","message":"I understand that you are just trying to refactor existing code. But this code is wrong.\n\n1)  Since in v3 username is unique within a domain, we can\u0027t get correct user id from user name\n2) Code assumes that  in case of external auth, client is going to send userid/password instead of username/pasword\n3)  So I can send any valid user id and not necessarily the remote_user\u0027s user id. This looks like  a security hole\n4)  Looks like password in request doesn\u0027t matter in case of external auth. Any password should work.\n\nAm is missing something here?","commit_id":"baa9d050492b8642a244cbce37a7339128249ae5"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"48a48db261f5fac97e582bf36dc99c6d1023e0e7","unresolved":false,"context_lines":[{"line_number":27,"context_line":"        # the user_id from auth_info for now, assuming external auth"},{"line_number":28,"context_line":"        # has check to make sure user is the same as the one specify"},{"line_number":29,"context_line":"        # in \"identity\"."},{"line_number":30,"context_line":"        if \u0027password\u0027 in auth_info.get_method_names():"},{"line_number":31,"context_line":"            user_info \u003d auth_info.get_method_data(\u0027password\u0027)"},{"line_number":32,"context_line":"            user_ref \u003d auth_info.lookup_user(user_info[\u0027user\u0027])"},{"line_number":33,"context_line":"            auth_context[\u0027user_id\u0027] \u003d user_ref[\u0027id\u0027]"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAP3%2F%2FqiQ%3D","line":30,"in_reply_to":"AAAAP3%2F%2FrPg%3D","updated":"2013-07-15 00:15:04.000000000","message":"REMOTE_USER is completely broken in v3, but you are right, i didn\u0027t think it was that broken. The fact that remote user is present means that the user is authenticated, but because username is taken from the payload and not the REMOTE_USER variable any user authenticated externally could spoof themselves as any other user.\n\nRegarding password, REMOTE_USER is what apache sends to say that this user has been authenticated by (for example) kerberos or basic auth. We can then say that the auth has already happened, the \u0027password\u0027 section should just be used to get domain information until we figure out how that will work with external auth, so yes we are right to ignore that password (it would probably not be provided). \n\nI\u0027m not sure what a valid fix is at the moment though.","commit_id":"baa9d050492b8642a244cbce37a7339128249ae5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"04947cb4b76db1b22de3c04131679ad0d6fa195f","unresolved":false,"context_lines":[{"line_number":23,"context_line":"CONF \u003d config.CONF"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"class ExternalDefault(object):"},{"line_number":27,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":28,"context_line":"        try:"},{"line_number":29,"context_line":"            REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2Fihs%3D","line":26,"updated":"2013-07-16 20:33:43.000000000","message":"suggest have a base class for the plugins.","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"30ca4bf7eb0752ed597b734f76396f3ee275261d","unresolved":false,"context_lines":[{"line_number":23,"context_line":"CONF \u003d config.CONF"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"class ExternalDefault(object):"},{"line_number":27,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":28,"context_line":"        try:"},{"line_number":29,"context_line":"            REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2FiOg%3D","line":26,"in_reply_to":"AAAAP3%2F%2Fihs%3D","updated":"2013-07-16 21:36:22.000000000","message":"no need yet, but we can refactor to that when we do.","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"04947cb4b76db1b22de3c04131679ad0d6fa195f","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"class ExternalDefault(object):"},{"line_number":27,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":28,"context_line":"        try:"},{"line_number":29,"context_line":"            REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"},{"line_number":30,"context_line":"            names \u003d REMOTE_USER.split(\u0027@\u0027)"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2Fiho%3D","line":27,"updated":"2013-07-16 20:33:43.000000000","message":"there should be some indication that auth_context is an in-out parameter... suggest call it auth_context_in_out.","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"04947cb4b76db1b22de3c04131679ad0d6fa195f","unresolved":false,"context_lines":[{"line_number":26,"context_line":"class ExternalDefault(object):"},{"line_number":27,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":28,"context_line":"        try:"},{"line_number":29,"context_line":"            REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"},{"line_number":30,"context_line":"            names \u003d REMOTE_USER.split(\u0027@\u0027)"},{"line_number":31,"context_line":"            username \u003d names.pop(0)"},{"line_number":32,"context_line":"            domain_id \u003d CONF.identity.default_domain_id"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2Fihk%3D","line":29,"updated":"2013-07-16 20:33:43.000000000","message":"suggest move this out of the try, otherwise creating the message at 43 would fail if there\u0027s no context[\u0027REMOTE_USER\u0027]","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"30ca4bf7eb0752ed597b734f76396f3ee275261d","unresolved":false,"context_lines":[{"line_number":26,"context_line":"class ExternalDefault(object):"},{"line_number":27,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":28,"context_line":"        try:"},{"line_number":29,"context_line":"            REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"},{"line_number":30,"context_line":"            names \u003d REMOTE_USER.split(\u0027@\u0027)"},{"line_number":31,"context_line":"            username \u003d names.pop(0)"},{"line_number":32,"context_line":"            domain_id \u003d CONF.identity.default_domain_id"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2FiOc%3D","line":29,"in_reply_to":"AAAAP3%2F%2Fihk%3D","updated":"2013-07-16 21:36:22.000000000","message":"Done","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fe072e1db5e49ddeadc7855ae0f55c1f72cbbbaf","unresolved":false,"context_lines":[{"line_number":38,"context_line":"            raise exception.Unauthorized(msg)"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"class ExternalDomain(object):"},{"line_number":42,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":43,"context_line":"        try:"},{"line_number":44,"context_line":"            REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2Fif0%3D","line":41,"updated":"2013-07-16 20:22:28.000000000","message":"why do we need ExternalDefault? seem like ExternalDomain is good enough","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"30ca4bf7eb0752ed597b734f76396f3ee275261d","unresolved":false,"context_lines":[{"line_number":38,"context_line":"            raise exception.Unauthorized(msg)"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"class ExternalDomain(object):"},{"line_number":42,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":43,"context_line":"        try:"},{"line_number":44,"context_line":"            REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2FiRk%3D","line":41,"in_reply_to":"AAAAP3%2F%2Fif0%3D","updated":"2013-07-16 21:36:22.000000000","message":"Yes, but default is the current expected behavior. External domain is an expansion, but might mess up current deployments.","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fe072e1db5e49ddeadc7855ae0f55c1f72cbbbaf","unresolved":false,"context_lines":[{"line_number":59,"context_line":"            raise exception.Unauthorized(msg)"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"class ExternalDisabled(object):"},{"line_number":63,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":64,"context_line":"        msg \u003d _(\u0027Unable to lookup user %s\u0027) % (context[\u0027REMOTE_USER\u0027])"},{"line_number":65,"context_line":"        raise exception.Unauthorized(msg)"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2Figc%3D","line":62,"updated":"2013-07-16 20:22:28.000000000","message":"no need for this one","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"30ca4bf7eb0752ed597b734f76396f3ee275261d","unresolved":false,"context_lines":[{"line_number":59,"context_line":"            raise exception.Unauthorized(msg)"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"class ExternalDisabled(object):"},{"line_number":63,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":64,"context_line":"        msg \u003d _(\u0027Unable to lookup user %s\u0027) % (context[\u0027REMOTE_USER\u0027])"},{"line_number":65,"context_line":"        raise exception.Unauthorized(msg)"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2FiRg%3D","line":62,"in_reply_to":"AAAAP3%2F%2Figc%3D","updated":"2013-07-16 21:36:22.000000000","message":"Done","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"691f168b8099d4b2f1f37528d248a63d97709055","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":28,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"        auth_context is an in-out variable that  will be updated with the"},{"line_number":31,"context_line":"        username from the REMOTE_USER environment variable."},{"line_number":32,"context_line":"        \"\"\""},{"line_number":33,"context_line":"        REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAAP3%2F%2Fh9w%3D","line":30,"updated":"2013-07-16 22:11:10.000000000","message":"(nit) there\u0027s 2 spaces between \"that  will\", remove one of them (doesn\u0027t matter to me which)","commit_id":"7ad2aab3b21174be4cf349f8cde1f7930a961986"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"691f168b8099d4b2f1f37528d248a63d97709055","unresolved":false,"context_lines":[{"line_number":47,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":48,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"        auth_context is an in-out variable that  will be updated with the"},{"line_number":51,"context_line":"        username from the REMOTE_USER environment variable."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"        If REMOTE_USER contains an `@` assume that the substring before the @"}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAAP3%2F%2Fh9Q%3D","line":50,"updated":"2013-07-16 22:11:10.000000000","message":"(nit) same here.","commit_id":"7ad2aab3b21174be4cf349f8cde1f7930a961986"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"a18c50920573002867a9cff33d444037ba58bbc5","unresolved":false,"context_lines":[{"line_number":42,"context_line":"            user_ref \u003d auth_info.identity_api.get_user_by_name(username,"},{"line_number":43,"context_line":"                                                               domain_id)"},{"line_number":44,"context_line":"            auth_context[\u0027user_id\u0027] \u003d user_ref[\u0027id\u0027]"},{"line_number":45,"context_line":"        except Exception:"},{"line_number":46,"context_line":"            msg \u003d _(\u0027Unable to lookup user %s\u0027) % (REMOTE_USER)"},{"line_number":47,"context_line":"            raise exception.Unauthorized(msg)"},{"line_number":48,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAP3%2F%2FhX8%3D","line":45,"updated":"2013-07-17 01:28:12.000000000","message":"?","commit_id":"426b612b56ca5f9fc1d6af922b918641a2d533c7"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"a18c50920573002867a9cff33d444037ba58bbc5","unresolved":false,"context_lines":[{"line_number":75,"context_line":"            user_ref \u003d auth_info.identity_api.get_user_by_name(username,"},{"line_number":76,"context_line":"                                                               domain_id)"},{"line_number":77,"context_line":"            auth_context[\u0027user_id\u0027] \u003d user_ref[\u0027id\u0027]"},{"line_number":78,"context_line":"        except Exception:"},{"line_number":79,"context_line":"            msg \u003d _(\u0027Unable to lookup user %s\u0027) % (REMOTE_USER)"},{"line_number":80,"context_line":"            raise exception.Unauthorized(msg)"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAAP3%2F%2FhYA%3D","line":78,"updated":"2013-07-17 01:28:12.000000000","message":"?","commit_id":"426b612b56ca5f9fc1d6af922b918641a2d533c7"}],"keystone/auth/plugins/external_default.py":[{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"c8a4c0ebb3717f1f87c014986d74e99cef0689a4","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":28,"context_line":"        try:"},{"line_number":29,"context_line":"            REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"},{"line_number":30,"context_line":"            if \u0027@\u0027 in REMOTE_USER:"},{"line_number":31,"context_line":"                at_index \u003d REMOTE_USER.index(\u0027@\u0027)"},{"line_number":32,"context_line":"                username \u003d REMOTE_USER[0: at_index]"},{"line_number":33,"context_line":"                domain_name \u003d REMOTE_USER[at_index + 1:len(REMOTE_USER)]"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAP3%2F%2FmL4%3D","line":30,"updated":"2013-07-16 01:53:53.000000000","message":"what about: \n\nnames \u003d REMOTE_USER.split(\u0027@\u0027) \nusername \u003d names.pop(0)\nif names:\n    domain_name \u003d names[0] \n    # get domain id\nelse:\n    # default domain id","commit_id":"15f4b70de37327064c3a8bf08a0e05787f997829"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b48783b8a149ffda9508c14c1012e6ed6e2c3778","unresolved":false,"context_lines":[{"line_number":23,"context_line":"CONF \u003d config.CONF"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"class ExternalDefault(object):"},{"line_number":27,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":28,"context_line":"        try:"},{"line_number":29,"context_line":"            REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAP3%2F%2Fijc%3D","line":26,"updated":"2013-07-16 20:13:20.000000000","message":"suggest have a base class for the plugins.","commit_id":"8894cf0c9b1003dbd1679d3c89dd8b64b243ded8"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b48783b8a149ffda9508c14c1012e6ed6e2c3778","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"class ExternalDefault(object):"},{"line_number":27,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":28,"context_line":"        try:"},{"line_number":29,"context_line":"            REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"},{"line_number":30,"context_line":"            names \u003d REMOTE_USER.split(\u0027@\u0027)"}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAP3%2F%2FikU%3D","line":27,"updated":"2013-07-16 20:13:20.000000000","message":"there should be some indication that auth_context is an in-out parameter... suggest call it auth_context_in_out.","commit_id":"8894cf0c9b1003dbd1679d3c89dd8b64b243ded8"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b48783b8a149ffda9508c14c1012e6ed6e2c3778","unresolved":false,"context_lines":[{"line_number":26,"context_line":"class ExternalDefault(object):"},{"line_number":27,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":28,"context_line":"        try:"},{"line_number":29,"context_line":"            REMOTE_USER \u003d context[\u0027REMOTE_USER\u0027]"},{"line_number":30,"context_line":"            names \u003d REMOTE_USER.split(\u0027@\u0027)"},{"line_number":31,"context_line":"            username \u003d names.pop(0)"},{"line_number":32,"context_line":"            if names:"}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAP3%2F%2FikE%3D","line":29,"updated":"2013-07-16 20:13:20.000000000","message":"suggest move this out of the try, otherwise creating the message at 43 would fail if there\u0027s no context[\u0027REMOTE_USER\u0027]","commit_id":"8894cf0c9b1003dbd1679d3c89dd8b64b243ded8"}],"keystone/common/config.py":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"28b09e91809583fb0486af3ebf8f031e43007c06","unresolved":false,"context_lines":[{"line_number":395,"context_line":"    register_str("},{"line_number":396,"context_line":"        \u0027external\u0027,"},{"line_number":397,"context_line":"        group\u003d\u0027auth\u0027,"},{"line_number":398,"context_line":"        default\u003d\u0027keystone.auth.plugins.external_disabled.ExternalDisabled\u0027)"},{"line_number":399,"context_line":"    # register any non-default auth methods here (used by extensions, etc)"},{"line_number":400,"context_line":"    for method_name in CONF.auth.methods:"},{"line_number":401,"context_line":"        if method_name not in _DEFAULT_AUTH_METHODS:"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAP3%2F%2Fmew%3D","line":398,"updated":"2013-07-16 00:05:41.000000000","message":"Disabled? Why? If \u0027external\u0027 is not part of _DEFAULT_AUTH_METHODS, it is disabled by defualt.","commit_id":"9d481acbc07d0cda2c2ebfe5f37650b559555f21"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"188eb664ad877cd68582d5bc5edf144af1d41f2f","unresolved":false,"context_lines":[{"line_number":395,"context_line":"    register_str("},{"line_number":396,"context_line":"        \u0027external\u0027,"},{"line_number":397,"context_line":"        group\u003d\u0027auth\u0027,"},{"line_number":398,"context_line":"        default\u003d\u0027keystone.auth.plugins.external_disabled.ExternalDisabled\u0027)"},{"line_number":399,"context_line":"    # register any non-default auth methods here (used by extensions, etc)"},{"line_number":400,"context_line":"    for method_name in CONF.auth.methods:"},{"line_number":401,"context_line":"        if method_name not in _DEFAULT_AUTH_METHODS:"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAP3%2F%2Fmbg%3D","line":398,"in_reply_to":"AAAAP3%2F%2Fmew%3D","updated":"2013-07-16 01:39:13.000000000","message":"No.  REMOTE_USER is a different code path.  This is just the ultra-conservative approach for the external approach.","commit_id":"9d481acbc07d0cda2c2ebfe5f37650b559555f21"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"c8a4c0ebb3717f1f87c014986d74e99cef0689a4","unresolved":false,"context_lines":[{"line_number":395,"context_line":"    register_str("},{"line_number":396,"context_line":"        \u0027external\u0027,"},{"line_number":397,"context_line":"        group\u003d\u0027auth\u0027,"},{"line_number":398,"context_line":"        default\u003d\u0027keystone.auth.plugins.external_disabled.ExternalDisabled\u0027)"},{"line_number":399,"context_line":"    # register any non-default auth methods here (used by extensions, etc)"},{"line_number":400,"context_line":"    for method_name in CONF.auth.methods:"},{"line_number":401,"context_line":"        if method_name not in _DEFAULT_AUTH_METHODS:"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAP3%2F%2FmLI%3D","line":398,"updated":"2013-07-16 01:53:53.000000000","message":"shouldn\u0027t this default to external_default? otherwise we are changing behaviour","commit_id":"15f4b70de37327064c3a8bf08a0e05787f997829"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"3a7db5490a10087fac71abccd42e2e7d91e4eb86","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"_DEFAULT_LOG_FORMAT \u003d \"%(asctime)s %(levelname)8s [%(name)s] %(message)s\""},{"line_number":26,"context_line":"_DEFAULT_LOG_DATE_FORMAT \u003d \"%Y-%m-%d %H:%M:%S\""},{"line_number":27,"context_line":"_DEFAULT_AUTH_METHODS \u003d [\u0027password\u0027, \u0027token\u0027, \u0027external\u0027]"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"COMMON_CLI_OPTS \u003d ["},{"line_number":30,"context_line":"    cfg.BoolOpt(\u0027debug\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2FicE%3D","line":27,"updated":"2013-07-16 20:38:56.000000000","message":"suggest put external first like the sample config file.","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"30ca4bf7eb0752ed597b734f76396f3ee275261d","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"_DEFAULT_LOG_FORMAT \u003d \"%(asctime)s %(levelname)8s [%(name)s] %(message)s\""},{"line_number":26,"context_line":"_DEFAULT_LOG_DATE_FORMAT \u003d \"%Y-%m-%d %H:%M:%S\""},{"line_number":27,"context_line":"_DEFAULT_AUTH_METHODS \u003d [\u0027password\u0027, \u0027token\u0027, \u0027external\u0027]"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"COMMON_CLI_OPTS \u003d ["},{"line_number":30,"context_line":"    cfg.BoolOpt(\u0027debug\u0027,"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2FiNo%3D","line":27,"in_reply_to":"AAAAP3%2F%2FicE%3D","updated":"2013-07-16 21:36:22.000000000","message":"Done","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"}],"tests/auth_plugin_external_disabled.conf":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fe072e1db5e49ddeadc7855ae0f55c1f72cbbbaf","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[auth]"},{"line_number":2,"context_line":"methods \u003d external"},{"line_number":3,"context_line":"external \u003d keystone.auth.plugins.external.ExternalDisabled"}],"source_content_type":"text/plain","patch_set":7,"id":"AAAAP3%2F%2Figo%3D","line":3,"updated":"2013-07-16 20:22:28.000000000","message":"you don\u0027t need ExternalDisabled, simply removing \u0027external\u0027 from the methods list will disable external auth\n\nalso, may want to drop a couple of lines in configuration.rst explaining how to disable external auth","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"30ca4bf7eb0752ed597b734f76396f3ee275261d","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[auth]"},{"line_number":2,"context_line":"methods \u003d external"},{"line_number":3,"context_line":"external \u003d keystone.auth.plugins.external.ExternalDisabled"}],"source_content_type":"text/plain","patch_set":7,"id":"AAAAP3%2F%2FiWc%3D","line":3,"in_reply_to":"AAAAP3%2F%2Figo%3D","updated":"2013-07-16 21:36:22.000000000","message":"Done","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"}],"tests/test_v3_auth.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b48783b8a149ffda9508c14c1012e6ed6e2c3778","unresolved":false,"context_lines":[{"line_number":1187,"context_line":""},{"line_number":1188,"context_line":"    def test_remote_user_no_realm(self):"},{"line_number":1189,"context_line":"        CONF.auth.external \u003d ("},{"line_number":1190,"context_line":"            \"keystone.auth.plugins.external_default.ExternalDefault\")"},{"line_number":1191,"context_line":"        api \u003d auth.controllers.Auth()"},{"line_number":1192,"context_line":"        auth_data \u003d self.build_authentication_request()[\u0027auth\u0027]"},{"line_number":1193,"context_line":"        context \u003d {\u0027REMOTE_USER\u0027: self.default_domain_user[\u0027name\u0027]}"}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAP3%2F%2Fiiw%3D","line":1190,"updated":"2013-07-16 20:13:20.000000000","message":"this should be a constant rather than copy-pasting it.","commit_id":"8894cf0c9b1003dbd1679d3c89dd8b64b243ded8"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b48783b8a149ffda9508c14c1012e6ed6e2c3778","unresolved":false,"context_lines":[{"line_number":1192,"context_line":"        auth_data \u003d self.build_authentication_request()[\u0027auth\u0027]"},{"line_number":1193,"context_line":"        context \u003d {\u0027REMOTE_USER\u0027: self.default_domain_user[\u0027name\u0027]}"},{"line_number":1194,"context_line":"        auth_info \u003d auth.controllers.AuthInfo(None, auth_data)"},{"line_number":1195,"context_line":"        auth_context \u003d {\u0027extras\u0027: {}, \u0027method_names\u0027: []}"},{"line_number":1196,"context_line":"        api.authenticate(context, auth_info, auth_context)"},{"line_number":1197,"context_line":"        self.assertEqual(auth_context[\u0027user_id\u0027],"},{"line_number":1198,"context_line":"                         self.default_domain_user[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAP3%2F%2Fiig%3D","line":1195,"updated":"2013-07-16 20:13:20.000000000","message":"suggest add a testcase where have method_names with password to validate that \"external Plugin is now executed in conjunction with the auth methods\"","commit_id":"8894cf0c9b1003dbd1679d3c89dd8b64b243ded8"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"04947cb4b76db1b22de3c04131679ad0d6fa195f","unresolved":false,"context_lines":[{"line_number":1199,"context_line":"        auth_data \u003d self.build_authentication_request()[\u0027auth\u0027]"},{"line_number":1200,"context_line":"        context \u003d {\u0027REMOTE_USER\u0027: self.default_domain_user[\u0027name\u0027]}"},{"line_number":1201,"context_line":"        auth_info \u003d auth.controllers.AuthInfo(None, auth_data)"},{"line_number":1202,"context_line":"        auth_context \u003d {\u0027extras\u0027: {}, \u0027method_names\u0027: []}"},{"line_number":1203,"context_line":"        api.authenticate(context, auth_info, auth_context)"},{"line_number":1204,"context_line":"        self.assertEqual(auth_context[\u0027user_id\u0027],"},{"line_number":1205,"context_line":"                         self.default_domain_user[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2FidA%3D","line":1202,"updated":"2013-07-16 20:33:43.000000000","message":"suggest add a testcase where have method_names with password to validate that \"external Plugin is now executed in conjunction with the auth methods\"","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"30ca4bf7eb0752ed597b734f76396f3ee275261d","unresolved":false,"context_lines":[{"line_number":1199,"context_line":"        auth_data \u003d self.build_authentication_request()[\u0027auth\u0027]"},{"line_number":1200,"context_line":"        context \u003d {\u0027REMOTE_USER\u0027: self.default_domain_user[\u0027name\u0027]}"},{"line_number":1201,"context_line":"        auth_info \u003d auth.controllers.AuthInfo(None, auth_data)"},{"line_number":1202,"context_line":"        auth_context \u003d {\u0027extras\u0027: {}, \u0027method_names\u0027: []}"},{"line_number":1203,"context_line":"        api.authenticate(context, auth_info, auth_context)"},{"line_number":1204,"context_line":"        self.assertEqual(auth_context[\u0027user_id\u0027],"},{"line_number":1205,"context_line":"                         self.default_domain_user[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAP3%2F%2FiIQ%3D","line":1202,"in_reply_to":"AAAAP3%2F%2FidA%3D","updated":"2013-07-16 21:36:22.000000000","message":"Done","commit_id":"580abdcbd7e09c231bb5698db9088ce7563bcc73"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"691f168b8099d4b2f1f37528d248a63d97709055","unresolved":false,"context_lines":[{"line_number":1224,"context_line":"            username\u003dself.user[\u0027name\u0027],"},{"line_number":1225,"context_line":"            password\u003dself.user[\u0027password\u0027])[\u0027auth\u0027]"},{"line_number":1226,"context_line":"        api \u003d auth.controllers.Auth()"},{"line_number":1227,"context_line":"        context \u003d {\u0027REMOTE_USER\u0027: self.default_domain_user[\u0027name\u0027]}"},{"line_number":1228,"context_line":"        auth_info \u003d auth.controllers.AuthInfo(None, auth_data)"},{"line_number":1229,"context_line":"        auth_context \u003d {\u0027extras\u0027: {}, \u0027method_names\u0027: []}"},{"line_number":1230,"context_line":"        api.authenticate(context, auth_info, auth_context)"}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAAP3%2F%2Fh7s%3D","line":1227,"updated":"2013-07-16 22:11:10.000000000","message":"Now I\u0027m wondering what happens if the ExternalDomain plugin is used and the domain is passed in through REMOTE_USER ? Does the \u0027password\u0027 method somehow get the user\u0027s domain from the plugin?","commit_id":"7ad2aab3b21174be4cf349f8cde1f7930a961986"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"4f34946beccc42a61a3c54c42a23af1883348184","unresolved":false,"context_lines":[{"line_number":1224,"context_line":"            username\u003dself.user[\u0027name\u0027],"},{"line_number":1225,"context_line":"            password\u003dself.user[\u0027password\u0027])[\u0027auth\u0027]"},{"line_number":1226,"context_line":"        api \u003d auth.controllers.Auth()"},{"line_number":1227,"context_line":"        context \u003d {\u0027REMOTE_USER\u0027: self.default_domain_user[\u0027name\u0027]}"},{"line_number":1228,"context_line":"        auth_info \u003d auth.controllers.AuthInfo(None, auth_data)"},{"line_number":1229,"context_line":"        auth_context \u003d {\u0027extras\u0027: {}, \u0027method_names\u0027: []}"},{"line_number":1230,"context_line":"        api.authenticate(context, auth_info, auth_context)"}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAAP3%2F%2Fhyk%3D","line":1227,"in_reply_to":"AAAAP3%2F%2Fh7I%3D","updated":"2013-07-16 22:59:24.000000000","message":"right, remote user plugin extracts domain name from REMOTE_USER. It does not make use of anything from the request payload.","commit_id":"7ad2aab3b21174be4cf349f8cde1f7930a961986"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"ee36f1f63f2a79db9b2a37c2bd33e126cfcede78","unresolved":false,"context_lines":[{"line_number":1224,"context_line":"            username\u003dself.user[\u0027name\u0027],"},{"line_number":1225,"context_line":"            password\u003dself.user[\u0027password\u0027])[\u0027auth\u0027]"},{"line_number":1226,"context_line":"        api \u003d auth.controllers.Auth()"},{"line_number":1227,"context_line":"        context \u003d {\u0027REMOTE_USER\u0027: self.default_domain_user[\u0027name\u0027]}"},{"line_number":1228,"context_line":"        auth_info \u003d auth.controllers.AuthInfo(None, auth_data)"},{"line_number":1229,"context_line":"        auth_context \u003d {\u0027extras\u0027: {}, \u0027method_names\u0027: []}"},{"line_number":1230,"context_line":"        api.authenticate(context, auth_info, auth_context)"}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAAP3%2F%2Fh7I%3D","line":1227,"in_reply_to":"AAAAP3%2F%2Fh7s%3D","updated":"2013-07-16 22:15:04.000000000","message":"OK, I\u0027m convinced this isn\u0027t a problem since they\u0027d have to pass the username and domain info in the post data separately from how REMOTE_USER gets set.","commit_id":"7ad2aab3b21174be4cf349f8cde1f7930a961986"}]}