)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6949faac6b943ac95ec05f1199675af717b132bf","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"This commit makes it so that all token formats issuing v3 tokens"},{"line_number":21,"context_line":"validate tokens by reconstructing them, instead of relying on"},{"line_number":22,"context_line":"possibly stale data from creation time."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Change-Id: I9584ce9627a91666f4dba62eb46e593f2053193b"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"7a8ec9b2_caa5fb47","line":22,"updated":"2016-09-20 12:33:02.000000000","message":"Am I right in thinking that the only thing not stale is the trust information? Everything else seems to be pulled from the existing token data verbatim.","commit_id":"3e80adf6886bc7497cc10b397c52c6fd3f373da3"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"e1d9ba1753454becbc3083098a365f931ee640dd","unresolved":false,"context_lines":[{"line_number":17,"context_line":"is that less revocation events are needed and token data is considered"},{"line_number":18,"context_line":"accurate at validation time."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"This commit makes it so that all token formats issuing v3 tokens"},{"line_number":21,"context_line":"validate tokens by reconstructing them, instead of relying on"},{"line_number":22,"context_line":"possibly stale data from creation time."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Change-Id: I9584ce9627a91666f4dba62eb46e593f2053193b"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"7a8ec9b2_6afc4bb8","line":22,"range":{"start_line":20,"start_character":12,"end_line":22,"end_character":39},"updated":"2016-09-18 10:12:49.000000000","message":"I think we consumer \u0027expires\u0027 to make sure the token is not expired, any other properties that is necessary so that we need reconstruct all? If the \u0027expires\u0027 got updated the cache should be invalidated.\n\nAlso not sure about the impact on the performance.","commit_id":"3e80adf6886bc7497cc10b397c52c6fd3f373da3"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"25b626a3e6b95068b7b0fe0770c883ced0123e09","unresolved":false,"context_lines":[{"line_number":17,"context_line":"is that less revocation events are needed and token data is considered"},{"line_number":18,"context_line":"accurate at validation time."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"This commit makes it so that all token formats issuing v3 tokens"},{"line_number":21,"context_line":"validate tokens by reconstructing them, instead of relying on"},{"line_number":22,"context_line":"possibly stale data from creation time."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Change-Id: I9584ce9627a91666f4dba62eb46e593f2053193b"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"7a8ec9b2_0a31075a","line":22,"range":{"start_line":20,"start_character":12,"end_line":22,"end_character":39},"in_reply_to":"7a8ec9b2_6afc4bb8","updated":"2016-09-18 10:51:41.000000000","message":"Ignore that.","commit_id":"3e80adf6886bc7497cc10b397c52c6fd3f373da3"}],"keystone/token/providers/common.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"65fa77fc361e040322b9b321034583781403cf1f","unresolved":false,"context_lines":[{"line_number":845,"context_line":""},{"line_number":846,"context_line":"        token_data \u003d token_ref.get(\u0027token_data\u0027)"},{"line_number":847,"context_line":"        if not token_data or \u0027token\u0027 not in token_data:"},{"line_number":848,"context_line":"            # NOTE(lbragstad): v2.0 tokens have an `access` dictionary instead"},{"line_number":849,"context_line":"            # of a `token` one. At this point we can safely assume we are"},{"line_number":850,"context_line":"            # validating a token that was created using the v2.0 API."},{"line_number":851,"context_line":"            methods \u003d [\u0027password\u0027, \u0027token\u0027]"},{"line_number":852,"context_line":"            bind \u003d token_ref.get(\u0027bind\u0027)"},{"line_number":853,"context_line":"            # I have no idea why issued_at and expires_at come from two"}],"source_content_type":"text/x-python","patch_set":4,"id":"5a8bc5a2_6501a839","line":850,"range":{"start_line":848,"start_character":0,"end_line":850,"end_character":69},"updated":"2016-09-28 04:10:29.000000000","message":"it\u0027s weird to see this v2 vs v3 logic in a function called \"validate_v3_token\", but looking at the other patches in your chain, i understand what you\u0027re doing.","commit_id":"a29f47803ab3a17c9d08afafd890ee8852ec02bc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"65fa77fc361e040322b9b321034583781403cf1f","unresolved":false,"context_lines":[{"line_number":888,"context_line":"            token_dict \u003d None"},{"line_number":889,"context_line":"            if token_data[\u0027token\u0027][\u0027user\u0027].get("},{"line_number":890,"context_line":"                    federation_constants.FEDERATION):"},{"line_number":891,"context_line":"                token_dict \u003d {\u0027user\u0027: token_ref[\u0027user\u0027]}"},{"line_number":892,"context_line":""},{"line_number":893,"context_line":"        return self.v3_token_data_helper.get_token_data("},{"line_number":894,"context_line":"            user_id,"}],"source_content_type":"text/x-python","patch_set":4,"id":"5a8bc5a2_256c0008","line":891,"range":{"start_line":891,"start_character":38,"end_line":891,"end_character":56},"updated":"2016-09-28 04:10:29.000000000","message":"shouldn\u0027t this look into the FEDERATION bit here?","commit_id":"a29f47803ab3a17c9d08afafd890ee8852ec02bc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c74bd78436d8ada0c1d31995244892f5bb5f6746","unresolved":false,"context_lines":[{"line_number":888,"context_line":"            token_dict \u003d None"},{"line_number":889,"context_line":"            if token_data[\u0027token\u0027][\u0027user\u0027].get("},{"line_number":890,"context_line":"                    federation_constants.FEDERATION):"},{"line_number":891,"context_line":"                token_dict \u003d {\u0027user\u0027: token_ref[\u0027user\u0027]}"},{"line_number":892,"context_line":""},{"line_number":893,"context_line":"        return self.v3_token_data_helper.get_token_data("},{"line_number":894,"context_line":"            user_id,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3a98d1f4_e9571b00","line":891,"in_reply_to":"3a98d1f4_2c05b4c1","updated":"2016-09-29 15:31:54.000000000","message":"Nope - in that case we should be rebuilding the user context like we do with all other resources in the token. If the user reference already exists in the token before we get into get_token_data(), the _populate_user() method will short-circuit, which can possibly lead to returning stale data.\n\nBy not populating the user reference we are forcing the V3 token data helper to rebuild the user reference from the identity API.\n\nhttps://github.com/openstack/keystone/blob/93c19263b01ac53e80b2baa88164152ef3678cb8/keystone/token/providers/common.py#L384","commit_id":"a29f47803ab3a17c9d08afafd890ee8852ec02bc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c263e6d6d31264d5b493c04c75f70df03fdca1d","unresolved":false,"context_lines":[{"line_number":888,"context_line":"            token_dict \u003d None"},{"line_number":889,"context_line":"            if token_data[\u0027token\u0027][\u0027user\u0027].get("},{"line_number":890,"context_line":"                    federation_constants.FEDERATION):"},{"line_number":891,"context_line":"                token_dict \u003d {\u0027user\u0027: token_ref[\u0027user\u0027]}"},{"line_number":892,"context_line":""},{"line_number":893,"context_line":"        return self.v3_token_data_helper.get_token_data("},{"line_number":894,"context_line":"            user_id,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3a98d1f4_2c05b4c1","line":891,"in_reply_to":"3a98d1f4_763410de","updated":"2016-09-29 06:10:28.000000000","message":"my point here is that why even both looking at federation_constants.FEDERATION if we\u0027re not going to use it?\n\nshouldn\u0027t \"token_dict \u003d {\u0027user\u0027: token_ref[\u0027user\u0027]}\" happen regardless of whether or not the user is federated?","commit_id":"a29f47803ab3a17c9d08afafd890ee8852ec02bc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"07ec06ea5205c6e05ad191ad96d1a331c196d9e9","unresolved":false,"context_lines":[{"line_number":888,"context_line":"            token_dict \u003d None"},{"line_number":889,"context_line":"            if token_data[\u0027token\u0027][\u0027user\u0027].get("},{"line_number":890,"context_line":"                    federation_constants.FEDERATION):"},{"line_number":891,"context_line":"                token_dict \u003d {\u0027user\u0027: token_ref[\u0027user\u0027]}"},{"line_number":892,"context_line":""},{"line_number":893,"context_line":"        return self.v3_token_data_helper.get_token_data("},{"line_number":894,"context_line":"            user_id,"}],"source_content_type":"text/x-python","patch_set":4,"id":"3a98d1f4_763410de","line":891,"in_reply_to":"5a8bc5a2_256c0008","updated":"2016-09-28 13:57:03.000000000","message":"Isn\u0027t that what we\u0027re doing by checking for the FEDERATION constant in the user reference?","commit_id":"a29f47803ab3a17c9d08afafd890ee8852ec02bc"}]}