)]}'
{"keystone/tests/unit/test_auth.py":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"b146c04d3bf402de52403c082686491ea73da02c","unresolved":false,"context_lines":[{"line_number":1361,"context_line":"        # We need to disable the user using the driver directly for the same"},{"line_number":1362,"context_line":"        # reason stated above. This test really just ensures that if a trustee"},{"line_number":1363,"context_line":"        # is disabled the logic in"},{"line_number":1364,"context_line":"        # keystone.token.controller:Auth._authenticate_token will throw a"},{"line_number":1365,"context_line":"        # Forbidden."},{"line_number":1366,"context_line":"        user \u003d {\u0027enabled\u0027: False}"},{"line_number":1367,"context_line":"        self.identity_api.driver.update_user(self.trustee[\u0027id\u0027], user)"},{"line_number":1368,"context_line":"        self.assertRaises("}],"source_content_type":"text/x-python","patch_set":5,"id":"da6895a0_4cce9284","line":1365,"range":{"start_line":1364,"start_character":8,"end_line":1365,"end_character":20},"updated":"2016-10-21 03:13:47.000000000","message":"pls change this to Unauthorized","commit_id":"6ee6e3dfbb53209a897ee0b873f2a14abff509b9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3e3cbd6d322b80c569eaf0b0c0eea01f14fc98a4","unresolved":false,"context_lines":[{"line_number":1362,"context_line":"        # reason stated above. This test really just ensures that if a trustee"},{"line_number":1363,"context_line":"        # is disabled the logic in"},{"line_number":1364,"context_line":"        # keystone.token.controller:Auth._authenticate_token will throw a"},{"line_number":1365,"context_line":"        # Forbidden."},{"line_number":1366,"context_line":"        user \u003d {\u0027enabled\u0027: False}"},{"line_number":1367,"context_line":"        self.identity_api.driver.update_user(self.trustee[\u0027id\u0027], user)"},{"line_number":1368,"context_line":"        self.assertRaises("}],"source_content_type":"text/x-python","patch_set":5,"id":"da6895a0_78d141cd","line":1365,"in_reply_to":"da6895a0_4cce9284","updated":"2016-10-21 13:45:50.000000000","message":"Good catch. Done.","commit_id":"6ee6e3dfbb53209a897ee0b873f2a14abff509b9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18cd30d75ff03803a8d2dacda8bfc4f150ac3a34","unresolved":false,"context_lines":[{"line_number":1336,"context_line":"        # reason stated above. This test really just ensures that if a trustee"},{"line_number":1337,"context_line":"        # is disabled the logic in"},{"line_number":1338,"context_line":"        # keystone.token.controller:Auth._authenticate_token will throw an"},{"line_number":1339,"context_line":"        # Unauthorized."},{"line_number":1340,"context_line":"        user \u003d {\u0027enabled\u0027: False}"},{"line_number":1341,"context_line":"        self.identity_api.driver.update_user(self.trustee[\u0027id\u0027], user)"},{"line_number":1342,"context_line":"        self.assertRaises("}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_b77b1fbd","line":1339,"updated":"2016-11-11 17:41:28.000000000","message":"The reason this changes is because we are leaving it up to the controller logic to determine if the user is enabled or not, if the user isn\u0027t enabled an Unauthorized is thrown. This is the same behavior we use if a regular user is disabled and they try to authenticate with a token. We\u0027re just making it consistent for the trust use case, too.","commit_id":"03119996ba7838a8b98c5c43db5ddaa18f3d5ed7"}],"keystone/token/controllers.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"fc6b91a0efdf6f086ba3771ff14d2a010e8148a0","unresolved":false,"context_lines":[{"line_number":97,"context_line":"                # Try local authentication"},{"line_number":98,"context_line":"                auth_info \u003d self._authenticate_local(request, auth)"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"        user_ref, tenant_ref, metadata_ref, expiry, bind, audit_id \u003d auth_info"},{"line_number":101,"context_line":"        # Validate that the auth info is valid and nothing is disabled"},{"line_number":102,"context_line":"        try:"},{"line_number":103,"context_line":"            self.identity_api.assert_user_enabled("}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_36155f9b","side":"PARENT","line":100,"updated":"2016-10-15 12:28:13.000000000","message":"why was the metadata removed?","commit_id":"d59973e6281d07daa0378069966b6bfeabbb66c8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2fe854bfac856dd9c3df079efdc27aeeec67fc94","unresolved":false,"context_lines":[{"line_number":97,"context_line":"                # Try local authentication"},{"line_number":98,"context_line":"                auth_info \u003d self._authenticate_local(request, auth)"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"        user_ref, tenant_ref, metadata_ref, expiry, bind, audit_id \u003d auth_info"},{"line_number":101,"context_line":"        # Validate that the auth info is valid and nothing is disabled"},{"line_number":102,"context_line":"        try:"},{"line_number":103,"context_line":"            self.identity_api.assert_user_enabled("}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_c8429e67","side":"PARENT","line":100,"in_reply_to":"fa6399be_36155f9b","updated":"2016-10-17 13:58:27.000000000","message":"Because it was apparently only used to relay the roles a user had on the project and the trust id - which we can acknowledge and pass directly - https://github.com/openstack/keystone/blob/696a10ceae9d0d82f69e739d5533e98ce9e213b9/keystone/token/providers/common.py#L661-L664\n\nhttps://github.com/openstack/keystone/blob/696a10ceae9d0d82f69e739d5533e98ce9e213b9/keystone/token/controllers.py#L240-L242\n\nNow we can remove `metadata` since it was ambiguous and unclear. The new validation and creation paths build this in the token provider.","commit_id":"d59973e6281d07daa0378069966b6bfeabbb66c8"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"fc6b91a0efdf6f086ba3771ff14d2a010e8148a0","unresolved":false,"context_lines":[{"line_number":158,"context_line":"        :param request: request object"},{"line_number":159,"context_line":"        :param auth: Dictionary representing the authentication request"},{"line_number":160,"context_line":"        :returns: A tuple containing the user reference, project identifier,"},{"line_number":161,"context_line":"                  dictionary of metadata, token expiration, bind information,"},{"line_number":162,"context_line":"                  and original audit information."},{"line_number":163,"context_line":"        \"\"\""},{"line_number":164,"context_line":"        if \u0027token\u0027 not in auth:"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_9600eb67","line":161,"range":{"start_line":161,"start_character":18,"end_line":161,"end_character":40},"updated":"2016-10-15 12:28:13.000000000","message":"same as the comments below","commit_id":"173df38e2d5d7e1e5a51dd026c8793ba4df5c2cb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2fe854bfac856dd9c3df079efdc27aeeec67fc94","unresolved":false,"context_lines":[{"line_number":158,"context_line":"        :param request: request object"},{"line_number":159,"context_line":"        :param auth: Dictionary representing the authentication request"},{"line_number":160,"context_line":"        :returns: A tuple containing the user reference, project identifier,"},{"line_number":161,"context_line":"                  dictionary of metadata, token expiration, bind information,"},{"line_number":162,"context_line":"                  and original audit information."},{"line_number":163,"context_line":"        \"\"\""},{"line_number":164,"context_line":"        if \u0027token\u0027 not in auth:"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_6800b202","line":161,"in_reply_to":"fa6399be_9600eb67","updated":"2016-10-17 13:58:27.000000000","message":"Done","commit_id":"173df38e2d5d7e1e5a51dd026c8793ba4df5c2cb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"fc6b91a0efdf6f086ba3771ff14d2a010e8148a0","unresolved":false,"context_lines":[{"line_number":230,"context_line":"        :param request: request object"},{"line_number":231,"context_line":"        :param auth: Dictionary representing the authentication request"},{"line_number":232,"context_line":"        :returns: A tuple containing the user reference, project identifier,"},{"line_number":233,"context_line":"                  dictionary of metadata, token expiration, bind information,"},{"line_number":234,"context_line":"                  and original audit information."},{"line_number":235,"context_line":"        \"\"\""},{"line_number":236,"context_line":"        if \u0027passwordCredentials\u0027 not in auth:"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_560ad38a","line":233,"range":{"start_line":233,"start_character":18,"end_line":233,"end_character":40},"updated":"2016-10-15 12:28:13.000000000","message":"this is no longer returned","commit_id":"173df38e2d5d7e1e5a51dd026c8793ba4df5c2cb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2fe854bfac856dd9c3df079efdc27aeeec67fc94","unresolved":false,"context_lines":[{"line_number":230,"context_line":"        :param request: request object"},{"line_number":231,"context_line":"        :param auth: Dictionary representing the authentication request"},{"line_number":232,"context_line":"        :returns: A tuple containing the user reference, project identifier,"},{"line_number":233,"context_line":"                  dictionary of metadata, token expiration, bind information,"},{"line_number":234,"context_line":"                  and original audit information."},{"line_number":235,"context_line":"        \"\"\""},{"line_number":236,"context_line":"        if \u0027passwordCredentials\u0027 not in auth:"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_1a121d59","line":233,"in_reply_to":"fa6399be_560ad38a","updated":"2016-10-17 13:58:27.000000000","message":"Done","commit_id":"173df38e2d5d7e1e5a51dd026c8793ba4df5c2cb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"fc6b91a0efdf6f086ba3771ff14d2a010e8148a0","unresolved":false,"context_lines":[{"line_number":290,"context_line":"        :param request: request object"},{"line_number":291,"context_line":"        :param auth: Dictionary representing the authentication request"},{"line_number":292,"context_line":"        :returns: A tuple containing the user reference, project identifier,"},{"line_number":293,"context_line":"                  dictionary of metadata, token expiration, bind information,"},{"line_number":294,"context_line":"                  and original audit information."},{"line_number":295,"context_line":"        \"\"\""},{"line_number":296,"context_line":"        username \u003d request.environ.get(\u0027REMOTE_USER\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_36071f83","line":293,"range":{"start_line":293,"start_character":18,"end_line":293,"end_character":40},"updated":"2016-10-15 12:28:13.000000000","message":"this is no longer correct","commit_id":"173df38e2d5d7e1e5a51dd026c8793ba4df5c2cb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2fe854bfac856dd9c3df079efdc27aeeec67fc94","unresolved":false,"context_lines":[{"line_number":290,"context_line":"        :param request: request object"},{"line_number":291,"context_line":"        :param auth: Dictionary representing the authentication request"},{"line_number":292,"context_line":"        :returns: A tuple containing the user reference, project identifier,"},{"line_number":293,"context_line":"                  dictionary of metadata, token expiration, bind information,"},{"line_number":294,"context_line":"                  and original audit information."},{"line_number":295,"context_line":"        \"\"\""},{"line_number":296,"context_line":"        username \u003d request.environ.get(\u0027REMOTE_USER\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"fa6399be_9a246db3","line":293,"in_reply_to":"fa6399be_36071f83","updated":"2016-10-17 13:58:27.000000000","message":"Good catch - done.","commit_id":"173df38e2d5d7e1e5a51dd026c8793ba4df5c2cb"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"2ca6721186e34d1b2321911e67bfd130ae299077","unresolved":false,"context_lines":[{"line_number":228,"context_line":"            if not trustee_user_ref[\u0027enabled\u0027]:"},{"line_number":229,"context_line":"                raise exception.Forbidden()"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"            if trust_ref[\u0027impersonation\u0027] is True:"},{"line_number":232,"context_line":"                current_user_ref \u003d trustor_user_ref"},{"line_number":233,"context_line":"            else:"},{"line_number":234,"context_line":"                current_user_ref \u003d trustee_user_ref"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"        else:"},{"line_number":237,"context_line":"            current_user_ref \u003d self.identity_api.get_user(user_id)"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_c2683d24","side":"PARENT","line":234,"range":{"start_line":231,"start_character":0,"end_line":234,"end_character":51},"updated":"2016-10-20 03:14:07.000000000","message":"This patch doesn\u0027t intend to change trust behavior, why change the logic of how \"user_ref\" is fetched? This looks like still valid, at least in this patch.","commit_id":"4ac5cb927486a3461255f30c86c1cd9df4d46f16"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3faf7c445ac44942d02f019603607907e71ed2b9","unresolved":false,"context_lines":[{"line_number":231,"context_line":"            if trust_ref[\u0027impersonation\u0027] is True:"},{"line_number":232,"context_line":"                current_user_ref \u003d trustor_user_ref"},{"line_number":233,"context_line":"            else:"},{"line_number":234,"context_line":"                current_user_ref \u003d trustee_user_ref"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"        else:"},{"line_number":237,"context_line":"            current_user_ref \u003d self.identity_api.get_user(user_id)"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_926afeeb","side":"PARENT","line":234,"in_reply_to":"fa6399be_c2683d24","updated":"2016-10-20 16:19:11.000000000","message":"This logic is duplicated here - https://github.com/openstack/keystone/blob/d45d82f6edae4bb3f38eb1abe321b802b638dd56/keystone/token/providers/common.py#L443\n\nOne of the benefits of consolidating the token creation and validation paths is that we can remove duplicate logic (like in this case).","commit_id":"4ac5cb927486a3461255f30c86c1cd9df4d46f16"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"2ca6721186e34d1b2321911e67bfd130ae299077","unresolved":false,"context_lines":[{"line_number":281,"context_line":"        expiry \u003d common.default_expire_time()"},{"line_number":282,"context_line":"        bind \u003d None"},{"line_number":283,"context_line":"        audit_id \u003d None"},{"line_number":284,"context_line":"        return (user_ref, tenant_id, expiry, bind, audit_id)"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"    def _authenticate_external(self, request, auth):"},{"line_number":287,"context_line":"        \"\"\"Try to authenticate an external user via REMOTE_USER variable."}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_a2b0a98c","line":284,"range":{"start_line":284,"start_character":26,"end_line":284,"end_character":35},"updated":"2016-10-20 03:14:07.000000000","message":"maybe a good chance to use \"project_id\" instead, keystone is trying to eliminate the appearance of \"tenant\".","commit_id":"6133b8acd777d4c69026ac95ddfec1b47ffb0b43"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3faf7c445ac44942d02f019603607907e71ed2b9","unresolved":false,"context_lines":[{"line_number":281,"context_line":"        expiry \u003d common.default_expire_time()"},{"line_number":282,"context_line":"        bind \u003d None"},{"line_number":283,"context_line":"        audit_id \u003d None"},{"line_number":284,"context_line":"        return (user_ref, tenant_id, expiry, bind, audit_id)"},{"line_number":285,"context_line":""},{"line_number":286,"context_line":"    def _authenticate_external(self, request, auth):"},{"line_number":287,"context_line":"        \"\"\"Try to authenticate an external user via REMOTE_USER variable."}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_8da2dffa","line":284,"in_reply_to":"fa6399be_a2b0a98c","updated":"2016-10-20 16:19:11.000000000","message":"I completely agree. I have a subsequent patch that does exactly that - https://review.openstack.org/#/c/386726/8/keystone/token/controllers.py\n\nI thought about doing the rename here but I left it for a subsequent patch because I had a feeling I was going to do a major refactor anyway. I wanted to keep the patch sizes minimal.","commit_id":"6133b8acd777d4c69026ac95ddfec1b47ffb0b43"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"2ca6721186e34d1b2321911e67bfd130ae299077","unresolved":false,"context_lines":[{"line_number":311,"context_line":"            bind \u003d {\u0027kerberos\u0027: username}"},{"line_number":312,"context_line":"        audit_id \u003d None"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"        return (user_ref, tenant_id, expiry, bind, audit_id)"},{"line_number":315,"context_line":""},{"line_number":316,"context_line":"    def _get_auth_token_data(self, user, tenant, metadata, expiry, audit_id):"},{"line_number":317,"context_line":"        return dict(user\u003duser,"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_02a6b552","line":314,"range":{"start_line":314,"start_character":26,"end_line":314,"end_character":35},"updated":"2016-10-20 03:14:07.000000000","message":"same here.","commit_id":"6133b8acd777d4c69026ac95ddfec1b47ffb0b43"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3faf7c445ac44942d02f019603607907e71ed2b9","unresolved":false,"context_lines":[{"line_number":311,"context_line":"            bind \u003d {\u0027kerberos\u0027: username}"},{"line_number":312,"context_line":"        audit_id \u003d None"},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"        return (user_ref, tenant_id, expiry, bind, audit_id)"},{"line_number":315,"context_line":""},{"line_number":316,"context_line":"    def _get_auth_token_data(self, user, tenant, metadata, expiry, audit_id):"},{"line_number":317,"context_line":"        return dict(user\u003duser,"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_4d836756","line":314,"in_reply_to":"fa6399be_02a6b552","updated":"2016-10-20 16:19:11.000000000","message":"++ same comment as above.","commit_id":"6133b8acd777d4c69026ac95ddfec1b47ffb0b43"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"2ca6721186e34d1b2321911e67bfd130ae299077","unresolved":false,"context_lines":[{"line_number":323,"context_line":"    def _get_project_id_from_auth(self, auth):"},{"line_number":324,"context_line":"        \"\"\"Extract and normalize tenant information from auth dict."},{"line_number":325,"context_line":""},{"line_number":326,"context_line":"        :param auth: Dictionary representing the authentication request."},{"line_number":327,"context_line":"        :returns: A string representing the project in the authentication"},{"line_number":328,"context_line":"                  request. If project scope isn\u0027t present in the request None"},{"line_number":329,"context_line":"                  is returned."},{"line_number":330,"context_line":"        \"\"\""},{"line_number":331,"context_line":"        tenant_id \u003d auth.get(\u0027tenantId\u0027)"},{"line_number":332,"context_line":"        if tenant_id and len(tenant_id) \u003e CONF.max_param_size:"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_c2591d5d","line":329,"range":{"start_line":326,"start_character":0,"end_line":329,"end_character":30},"updated":"2016-10-20 03:14:07.000000000","message":"docstring for private method won\u0027t be rendered by Sphinx.","commit_id":"6133b8acd777d4c69026ac95ddfec1b47ffb0b43"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3faf7c445ac44942d02f019603607907e71ed2b9","unresolved":false,"context_lines":[{"line_number":326,"context_line":"        :param auth: Dictionary representing the authentication request."},{"line_number":327,"context_line":"        :returns: A string representing the project in the authentication"},{"line_number":328,"context_line":"                  request. If project scope isn\u0027t present in the request None"},{"line_number":329,"context_line":"                  is returned."},{"line_number":330,"context_line":"        \"\"\""},{"line_number":331,"context_line":"        tenant_id \u003d auth.get(\u0027tenantId\u0027)"},{"line_number":332,"context_line":"        if tenant_id and len(tenant_id) \u003e CONF.max_param_size:"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_cdde976c","line":329,"in_reply_to":"fa6399be_c2591d5d","updated":"2016-10-20 16:19:11.000000000","message":"Yep - I more or less wanted to officially document this for developer benefit regardless of it getting published publicly anywhere.","commit_id":"6133b8acd777d4c69026ac95ddfec1b47ffb0b43"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18cd30d75ff03803a8d2dacda8bfc4f150ac3a34","unresolved":false,"context_lines":[{"line_number":100,"context_line":"        # Validate that the auth info is valid and nothing is disabled"},{"line_number":101,"context_line":"        try:"},{"line_number":102,"context_line":"            self.identity_api.assert_user_enabled("},{"line_number":103,"context_line":"                user_id\u003duser_ref[\u0027id\u0027], user\u003duser_ref)"},{"line_number":104,"context_line":"            if tenant_ref:"},{"line_number":105,"context_line":"                self.resource_api.assert_project_enabled("},{"line_number":106,"context_line":"                    project_id\u003dtenant_ref[\u0027id\u0027], project\u003dtenant_ref)"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_d7333312","side":"PARENT","line":103,"updated":"2016-11-11 17:41:28.000000000","message":"This call will raise an Assertion error if the trustee is disabled - https://github.com/openstack/keystone/blob/a74be79b0580f8510e254c47e0814f41826901f1/keystone/identity/core.py#L948-L949","commit_id":"142e9e760a03e3d95dfa7885ae47b7788156e4a3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18cd30d75ff03803a8d2dacda8bfc4f150ac3a34","unresolved":false,"context_lines":[{"line_number":104,"context_line":"            if tenant_ref:"},{"line_number":105,"context_line":"                self.resource_api.assert_project_enabled("},{"line_number":106,"context_line":"                    project_id\u003dtenant_ref[\u0027id\u0027], project\u003dtenant_ref)"},{"line_number":107,"context_line":"        except AssertionError as e:"},{"line_number":108,"context_line":"            six.reraise(exception.Unauthorized, exception.Unauthorized(e),"},{"line_number":109,"context_line":"                        sys.exc_info()[2])"},{"line_number":110,"context_line":"        # NOTE(morganfainberg): Make sure the data is in correct form since it"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a629dbe_173a0be7","side":"PARENT","line":107,"updated":"2016-11-11 17:41:28.000000000","message":"The Assertion error is caught here and an Unauthorized exception is raised.","commit_id":"142e9e760a03e3d95dfa7885ae47b7788156e4a3"}],"keystone/token/provider.py":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"2ca6721186e34d1b2321911e67bfd130ae299077","unresolved":false,"context_lines":[{"line_number":259,"context_line":"        if metadata_ref is None:"},{"line_number":260,"context_line":"            metadata_ref \u003d {}"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"        if \u0027project\u0027 in token_data[\u0027token\u0027]:"},{"line_number":263,"context_line":"            # project-scoped token, fill in the v2 token data"},{"line_number":264,"context_line":"            # all we care are the role IDs"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"            # FIXME(gyee): is there really a need to store roles in metadata?"},{"line_number":267,"context_line":"            role_ids \u003d [r[\u0027id\u0027] for r in token_data[\u0027token\u0027][\u0027roles\u0027]]"},{"line_number":268,"context_line":"            metadata_ref \u003d {\u0027roles\u0027: role_ids}"},{"line_number":269,"context_line":"            is_domain \u003d token_data[\u0027token\u0027][\u0027is_domain\u0027]"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"        if trust:"},{"line_number":272,"context_line":"            metadata_ref.setdefault(\u0027trust_id\u0027, trust[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_dfedacb8","side":"PARENT","line":269,"range":{"start_line":262,"start_character":0,"end_line":269,"end_character":56},"updated":"2016-10-20 03:14:07.000000000","message":"why this is removed entirely?","commit_id":"4ac5cb927486a3461255f30c86c1cd9df4d46f16"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3faf7c445ac44942d02f019603607907e71ed2b9","unresolved":false,"context_lines":[{"line_number":266,"context_line":"            # FIXME(gyee): is there really a need to store roles in metadata?"},{"line_number":267,"context_line":"            role_ids \u003d [r[\u0027id\u0027] for r in token_data[\u0027token\u0027][\u0027roles\u0027]]"},{"line_number":268,"context_line":"            metadata_ref \u003d {\u0027roles\u0027: role_ids}"},{"line_number":269,"context_line":"            is_domain \u003d token_data[\u0027token\u0027][\u0027is_domain\u0027]"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"        if trust:"},{"line_number":272,"context_line":"            metadata_ref.setdefault(\u0027trust_id\u0027, trust[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_0dc6cf67","side":"PARENT","line":269,"in_reply_to":"fa6399be_dfedacb8","updated":"2016-10-20 16:19:11.000000000","message":"Previously, the v2.0 token controller would actually populate the roles for the user and the project before asking the token provider to create the token [0]. Since we are leaving all the token construction logic in the V3TokenDataHelper class, we can leverage that code instead of duplicating it here. \n\nThe metadata dictionary was only a place to store roles before passing them to the token provider. If we rebuild the roles in the token data helpers, we don\u0027t need to do it here.\n\n\n[0] https://github.com/openstack/keystone/blob/d45d82f6edae4bb3f38eb1abe321b802b638dd56/keystone/token/controllers.py#L394","commit_id":"4ac5cb927486a3461255f30c86c1cd9df4d46f16"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"2ca6721186e34d1b2321911e67bfd130ae299077","unresolved":false,"context_lines":[{"line_number":278,"context_line":"                    expires\u003dtoken_data[\u0027token\u0027][\u0027expires_at\u0027],"},{"line_number":279,"context_line":"                    user\u003dtoken_data[\u0027token\u0027][\u0027user\u0027],"},{"line_number":280,"context_line":"                    tenant\u003dtoken_data[\u0027token\u0027].get(\u0027project\u0027),"},{"line_number":281,"context_line":"                    is_domain\u003dis_domain,"},{"line_number":282,"context_line":"                    metadata\u003dmetadata_ref,"},{"line_number":283,"context_line":"                    token_data\u003dtoken_data,"},{"line_number":284,"context_line":"                    trust_id\u003dtrust[\u0027id\u0027] if trust else None,"},{"line_number":285,"context_line":"                    token_version\u003dself.V3)"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_3d291e8a","side":"PARENT","line":282,"range":{"start_line":281,"start_character":0,"end_line":282,"end_character":42},"updated":"2016-10-20 03:14:07.000000000","message":"Isn\u0027t still used here?","commit_id":"4ac5cb927486a3461255f30c86c1cd9df4d46f16"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3faf7c445ac44942d02f019603607907e71ed2b9","unresolved":false,"context_lines":[{"line_number":279,"context_line":"                    user\u003dtoken_data[\u0027token\u0027][\u0027user\u0027],"},{"line_number":280,"context_line":"                    tenant\u003dtoken_data[\u0027token\u0027].get(\u0027project\u0027),"},{"line_number":281,"context_line":"                    is_domain\u003dis_domain,"},{"line_number":282,"context_line":"                    metadata\u003dmetadata_ref,"},{"line_number":283,"context_line":"                    token_data\u003dtoken_data,"},{"line_number":284,"context_line":"                    trust_id\u003dtrust[\u0027id\u0027] if trust else None,"},{"line_number":285,"context_line":"                    token_version\u003dself.V3)"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_ad9b2365","side":"PARENT","line":282,"in_reply_to":"fa6399be_3d291e8a","updated":"2016-10-20 16:19:11.000000000","message":"Yep - I would like to propose a separate patch to remove all this stuff before persisting the token.","commit_id":"4ac5cb927486a3461255f30c86c1cd9df4d46f16"}],"keystone/token/providers/common.py":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"2ca6721186e34d1b2321911e67bfd130ae299077","unresolved":false,"context_lines":[{"line_number":157,"context_line":"                if (trustor_user_ref[\u0027domain_id\u0027] !\u003d"},{"line_number":158,"context_line":"                        CONF.identity.default_domain_id):"},{"line_number":159,"context_line":"                    raise exception.Unauthorized(msg)"},{"line_number":160,"context_line":"                if trust_ref.get(\u0027project_id\u0027):"},{"line_number":161,"context_line":"                    project_ref \u003d self.resource_api.get_project("},{"line_number":162,"context_line":"                        trust_ref[\u0027project_id\u0027])"},{"line_number":163,"context_line":"                    if (project_ref[\u0027domain_id\u0027] !\u003d"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_2cf1246b","line":160,"range":{"start_line":160,"start_character":16,"end_line":160,"end_character":47},"updated":"2016-10-20 03:14:07.000000000","message":"Good catch, this looks like a bug, is there any testcase for this?","commit_id":"6133b8acd777d4c69026ac95ddfec1b47ffb0b43"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3faf7c445ac44942d02f019603607907e71ed2b9","unresolved":false,"context_lines":[{"line_number":157,"context_line":"                if (trustor_user_ref[\u0027domain_id\u0027] !\u003d"},{"line_number":158,"context_line":"                        CONF.identity.default_domain_id):"},{"line_number":159,"context_line":"                    raise exception.Unauthorized(msg)"},{"line_number":160,"context_line":"                if trust_ref.get(\u0027project_id\u0027):"},{"line_number":161,"context_line":"                    project_ref \u003d self.resource_api.get_project("},{"line_number":162,"context_line":"                        trust_ref[\u0027project_id\u0027])"},{"line_number":163,"context_line":"                    if (project_ref[\u0027domain_id\u0027] !\u003d"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_6d310b5a","line":160,"in_reply_to":"fa6399be_2cf1246b","updated":"2016-10-20 16:19:11.000000000","message":"I believe so - I\u0027ll have to dig for it.","commit_id":"6133b8acd777d4c69026ac95ddfec1b47ffb0b43"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"2ca6721186e34d1b2321911e67bfd130ae299077","unresolved":false,"context_lines":[{"line_number":526,"context_line":""},{"line_number":527,"context_line":"        if token_domain_id or token_project_id:"},{"line_number":528,"context_line":"            filtered_roles \u003d []"},{"line_number":529,"context_line":"            if CONF.trust.enabled and trust and len(trust[\u0027roles\u0027]) !\u003d 0:"},{"line_number":530,"context_line":"                # First expand out any roles that were in the trust to include"},{"line_number":531,"context_line":"                # any implied roles, whether global or domain specific"},{"line_number":532,"context_line":"                refs \u003d [{\u0027role_id\u0027: role[\u0027id\u0027]} for role in trust[\u0027roles\u0027]]"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_cc77c800","line":529,"range":{"start_line":529,"start_character":44,"end_line":529,"end_character":72},"updated":"2016-10-20 03:14:07.000000000","message":"why do this change? shouldn\u0027t the loop below will exit if the length is 0? fine as it is.","commit_id":"6133b8acd777d4c69026ac95ddfec1b47ffb0b43"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3faf7c445ac44942d02f019603607907e71ed2b9","unresolved":false,"context_lines":[{"line_number":526,"context_line":""},{"line_number":527,"context_line":"        if token_domain_id or token_project_id:"},{"line_number":528,"context_line":"            filtered_roles \u003d []"},{"line_number":529,"context_line":"            if CONF.trust.enabled and trust and len(trust[\u0027roles\u0027]) !\u003d 0:"},{"line_number":530,"context_line":"                # First expand out any roles that were in the trust to include"},{"line_number":531,"context_line":"                # any implied roles, whether global or domain specific"},{"line_number":532,"context_line":"                refs \u003d [{\u0027role_id\u0027: role[\u0027id\u0027]} for role in trust[\u0027roles\u0027]]"}],"source_content_type":"text/x-python","patch_set":4,"id":"fa6399be_dfa71e09","line":529,"in_reply_to":"fa6399be_cc77c800","updated":"2016-10-20 16:19:11.000000000","message":"Huh - apparently this snuck in somehow. I removed it and all the tests passed. Done.","commit_id":"6133b8acd777d4c69026ac95ddfec1b47ffb0b43"}]}