)]}'
{"doc/source/security_compliance.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d1837d4ad6a909d8079cfadcf199eda57f55a654","unresolved":false,"context_lines":[{"line_number":91,"context_line":"be required to change their password at the next authentication (first use)."},{"line_number":92,"context_line":"After which, their password will become expired and invalid for authentication."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":".. NOTE::"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    It\u0027s critical to understand the consequences of this change and to plan"},{"line_number":97,"context_line":"    accordingly. Potentially, once this feature is enabled, all of your users"}],"source_content_type":"text/x-rst","patch_set":26,"id":"7a3c09a3_d4fcf474","line":94,"range":{"start_line":94,"start_character":3,"end_line":94,"end_character":7},"updated":"2017-01-18 18:45:38.000000000","message":"use WARNING instead of NOTE","commit_id":"739715c172a3ade47a83908a4822eb6a9f2d6d56"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"20d029f0ae7270ab7c8e8e71f3b75a775a8c2271","unresolved":false,"context_lines":[{"line_number":91,"context_line":"be required to change their password at the next authentication (first use)."},{"line_number":92,"context_line":"After which, their password will become expired and invalid for authentication."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":".. NOTE::"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    It\u0027s critical to understand the consequences of this change and to plan"},{"line_number":97,"context_line":"    accordingly. Potentially, once this feature is enabled, all of your users"}],"source_content_type":"text/x-rst","patch_set":26,"id":"7a3c09a3_03babc6e","line":94,"range":{"start_line":94,"start_character":3,"end_line":94,"end_character":7},"in_reply_to":"7a3c09a3_d4fcf474","updated":"2017-01-18 19:52:22.000000000","message":"Done","commit_id":"739715c172a3ade47a83908a4822eb6a9f2d6d56"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d1837d4ad6a909d8079cfadcf199eda57f55a654","unresolved":false,"context_lines":[{"line_number":112,"context_line":"    [security_compliance]"},{"line_number":113,"context_line":"    password_expires_ignore_user_ids \u003d 3a54353c9dcc44f690975ea768512f6a,ed84c3b95b814ff2827967e531f09247"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":".. NOTE::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    Failure to add service users to the ``password_expires_ignore_user_ids``"},{"line_number":118,"context_line":"    will result in your service account passwords becoming expired after the"}],"source_content_type":"text/x-rst","patch_set":26,"id":"7a3c09a3_54f1e494","line":115,"range":{"start_line":115,"start_character":3,"end_line":115,"end_character":7},"updated":"2017-01-18 18:45:38.000000000","message":"use WARNING instead of NOTE","commit_id":"739715c172a3ade47a83908a4822eb6a9f2d6d56"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"20d029f0ae7270ab7c8e8e71f3b75a775a8c2271","unresolved":false,"context_lines":[{"line_number":112,"context_line":"    [security_compliance]"},{"line_number":113,"context_line":"    password_expires_ignore_user_ids \u003d 3a54353c9dcc44f690975ea768512f6a,ed84c3b95b814ff2827967e531f09247"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":".. NOTE::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    Failure to add service users to the ``password_expires_ignore_user_ids``"},{"line_number":118,"context_line":"    will result in your service account passwords becoming expired after the"}],"source_content_type":"text/x-rst","patch_set":26,"id":"7a3c09a3_23afb82c","line":115,"range":{"start_line":115,"start_character":3,"end_line":115,"end_character":7},"in_reply_to":"7a3c09a3_54f1e494","updated":"2017-01-18 19:52:22.000000000","message":"Done","commit_id":"739715c172a3ade47a83908a4822eb6a9f2d6d56"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d1837d4ad6a909d8079cfadcf199eda57f55a654","unresolved":false,"context_lines":[{"line_number":126,"context_line":"    [security_compliance]"},{"line_number":127,"context_line":"    change_password_after_first_use \u003d True"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":".. _`user API`: http://developer.openstack.org/api-ref/identity/v3/index.html"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Password Expiration"},{"line_number":132,"context_line":"-------------------"}],"source_content_type":"text/x-rst","patch_set":26,"id":"7a3c09a3_54e484ab","line":129,"range":{"start_line":129,"start_character":16,"end_line":129,"end_character":77},"updated":"2017-01-18 18:45:38.000000000","message":"use http://developer.openstack.org/api-ref/identity/v3/index.html#users instead","commit_id":"739715c172a3ade47a83908a4822eb6a9f2d6d56"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"20d029f0ae7270ab7c8e8e71f3b75a775a8c2271","unresolved":false,"context_lines":[{"line_number":126,"context_line":"    [security_compliance]"},{"line_number":127,"context_line":"    change_password_after_first_use \u003d True"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":".. _`user API`: http://developer.openstack.org/api-ref/identity/v3/index.html"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Password Expiration"},{"line_number":132,"context_line":"-------------------"}],"source_content_type":"text/x-rst","patch_set":26,"id":"7a3c09a3_63a9c024","line":129,"range":{"start_line":129,"start_character":16,"end_line":129,"end_character":77},"in_reply_to":"7a3c09a3_54e484ab","updated":"2017-01-18 19:52:22.000000000","message":"Done","commit_id":"739715c172a3ade47a83908a4822eb6a9f2d6d56"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"PCI-DSS 8.2.6 requires users to change their password for first time use and"},{"line_number":86,"context_line":"upon an administrative password reset. Within the identity `user API`_,"},{"line_number":87,"context_line":"``create user`` and ``update user`` are considered administrative password"},{"line_number":88,"context_line":"changes. Whereas, ``change password for user`` is a self-service password"},{"line_number":89,"context_line":"change. Once this feature is enabled, all users, new and existing, that have"},{"line_number":90,"context_line":"not performed a self-service password change for their current password, will"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_4330d39e","line":87,"updated":"2017-01-20 22:18:28.000000000","message":"nit: neither one of these should be literals (maybe regular double quotes, but they\u0027re not literals of anything).","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ab61a391bd8ac14ac711739d978bdb7d290003ea","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"PCI-DSS 8.2.6 requires users to change their password for first time use and"},{"line_number":86,"context_line":"upon an administrative password reset. Within the identity `user API`_,"},{"line_number":87,"context_line":"``create user`` and ``update user`` are considered administrative password"},{"line_number":88,"context_line":"changes. Whereas, ``change password for user`` is a self-service password"},{"line_number":89,"context_line":"change. Once this feature is enabled, all users, new and existing, that have"},{"line_number":90,"context_line":"not performed a self-service password change for their current password, will"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_600dbce7","line":87,"in_reply_to":"5a3905b3_4330d39e","updated":"2017-01-21 05:21:46.000000000","message":"Done","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":85,"context_line":"PCI-DSS 8.2.6 requires users to change their password for first time use and"},{"line_number":86,"context_line":"upon an administrative password reset. Within the identity `user API`_,"},{"line_number":87,"context_line":"``create user`` and ``update user`` are considered administrative password"},{"line_number":88,"context_line":"changes. Whereas, ``change password for user`` is a self-service password"},{"line_number":89,"context_line":"change. Once this feature is enabled, all users, new and existing, that have"},{"line_number":90,"context_line":"not performed a self-service password change for their current password, will"},{"line_number":91,"context_line":"be required to change their password at the next authentication (first use)."}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_63278f64","line":88,"updated":"2017-01-20 22:18:28.000000000","message":"Same","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ab61a391bd8ac14ac711739d978bdb7d290003ea","unresolved":false,"context_lines":[{"line_number":85,"context_line":"PCI-DSS 8.2.6 requires users to change their password for first time use and"},{"line_number":86,"context_line":"upon an administrative password reset. Within the identity `user API`_,"},{"line_number":87,"context_line":"``create user`` and ``update user`` are considered administrative password"},{"line_number":88,"context_line":"changes. Whereas, ``change password for user`` is a self-service password"},{"line_number":89,"context_line":"change. Once this feature is enabled, all users, new and existing, that have"},{"line_number":90,"context_line":"not performed a self-service password change for their current password, will"},{"line_number":91,"context_line":"be required to change their password at the next authentication (first use)."}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_8012a807","line":88,"in_reply_to":"5a3905b3_63278f64","updated":"2017-01-21 05:21:46.000000000","message":"Done","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":".. WARNING::"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    It\u0027s critical to understand the consequences of this change and to plan"},{"line_number":97,"context_line":"    accordingly. Potentially, once this feature is enabled, all of your users"},{"line_number":98,"context_line":"    at once could be required to change their password. And if they fail to"},{"line_number":99,"context_line":"    change their password at the first authentication, their password will"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_0317abed","line":96,"updated":"2017-01-20 22:18:28.000000000","message":"By change, I think maybe you meant patch? But in terms of docs, I think this term should really be \"option\" or \"feature\".","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ab61a391bd8ac14ac711739d978bdb7d290003ea","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":".. WARNING::"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    It\u0027s critical to understand the consequences of this change and to plan"},{"line_number":97,"context_line":"    accordingly. Potentially, once this feature is enabled, all of your users"},{"line_number":98,"context_line":"    at once could be required to change their password. And if they fail to"},{"line_number":99,"context_line":"    change their password at the first authentication, their password will"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_a0fb24c0","line":96,"in_reply_to":"5a3905b3_0317abed","updated":"2017-01-21 05:21:46.000000000","message":"\"feature\"","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e76ffe7a497faee45e20ae7168572aca060e9579","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    It\u0027s critical to understand the consequences of this change and to plan"},{"line_number":97,"context_line":"    accordingly. Potentially, once this feature is enabled, all of your users"},{"line_number":98,"context_line":"    at once could be required to change their password. And if they fail to"},{"line_number":99,"context_line":"    change their password at the first authentication, their password will"},{"line_number":100,"context_line":"    become expired; thus, would require an administrator to reset their"},{"line_number":101,"context_line":"    password. Therefore, operators should plan and coordinate this change with"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_2835a4d9","line":98,"updated":"2017-01-19 22:54:46.000000000","message":"Won\u0027t the users be required to change there password? There shouldn\u0027t be an question in this statement should there?","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    It\u0027s critical to understand the consequences of this change and to plan"},{"line_number":97,"context_line":"    accordingly. Potentially, once this feature is enabled, all of your users"},{"line_number":98,"context_line":"    at once could be required to change their password. And if they fail to"},{"line_number":99,"context_line":"    change their password at the first authentication, their password will"},{"line_number":100,"context_line":"    become expired; thus, would require an administrator to reset their"},{"line_number":101,"context_line":"    password. Therefore, operators should plan and coordinate this change with"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_a3e897e3","line":98,"updated":"2017-01-20 22:18:28.000000000","message":"nit: \"at once\" appears awkwardly early in the sentence, IMO.\n\n  could be required to change their password at once.","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ab61a391bd8ac14ac711739d978bdb7d290003ea","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    It\u0027s critical to understand the consequences of this change and to plan"},{"line_number":97,"context_line":"    accordingly. Potentially, once this feature is enabled, all of your users"},{"line_number":98,"context_line":"    at once could be required to change their password. And if they fail to"},{"line_number":99,"context_line":"    change their password at the first authentication, their password will"},{"line_number":100,"context_line":"    become expired; thus, would require an administrator to reset their"},{"line_number":101,"context_line":"    password. Therefore, operators should plan and coordinate this change with"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_202e5443","line":98,"in_reply_to":"5a3905b3_a3e897e3","updated":"2017-01-21 05:21:46.000000000","message":"tweaked this","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    accordingly. Potentially, once this feature is enabled, all of your users"},{"line_number":98,"context_line":"    at once could be required to change their password. And if they fail to"},{"line_number":99,"context_line":"    change their password at the first authentication, their password will"},{"line_number":100,"context_line":"    become expired; thus, would require an administrator to reset their"},{"line_number":101,"context_line":"    password. Therefore, operators should plan and coordinate this change with"},{"line_number":102,"context_line":"    their stakeholders in order to minimize the impact."},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_23a2e7ae","line":100,"updated":"2017-01-20 22:18:28.000000000","message":"nit: The phrase after the semicolon is not a complete sentence, as a use of a semicolon requires. Instead:\n\n  an administrator would be required to reset their password.","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ab61a391bd8ac14ac711739d978bdb7d290003ea","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    accordingly. Potentially, once this feature is enabled, all of your users"},{"line_number":98,"context_line":"    at once could be required to change their password. And if they fail to"},{"line_number":99,"context_line":"    change their password at the first authentication, their password will"},{"line_number":100,"context_line":"    become expired; thus, would require an administrator to reset their"},{"line_number":101,"context_line":"    password. Therefore, operators should plan and coordinate this change with"},{"line_number":102,"context_line":"    their stakeholders in order to minimize the impact."},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_403360ab","line":100,"in_reply_to":"5a3905b3_23a2e7ae","updated":"2017-01-21 05:21:46.000000000","message":"this is no longer the case, expired passwords can be self-service now","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":98,"context_line":"    at once could be required to change their password. And if they fail to"},{"line_number":99,"context_line":"    change their password at the first authentication, their password will"},{"line_number":100,"context_line":"    become expired; thus, would require an administrator to reset their"},{"line_number":101,"context_line":"    password. Therefore, operators should plan and coordinate this change with"},{"line_number":102,"context_line":"    their stakeholders in order to minimize the impact."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Prior to enabling this feature, you\u0027ll want to add any service users to the"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_a396d749","line":101,"updated":"2017-01-20 22:18:28.000000000","message":"nit: maybe cut \"plan and\"","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ab61a391bd8ac14ac711739d978bdb7d290003ea","unresolved":false,"context_lines":[{"line_number":98,"context_line":"    at once could be required to change their password. And if they fail to"},{"line_number":99,"context_line":"    change their password at the first authentication, their password will"},{"line_number":100,"context_line":"    become expired; thus, would require an administrator to reset their"},{"line_number":101,"context_line":"    password. Therefore, operators should plan and coordinate this change with"},{"line_number":102,"context_line":"    their stakeholders in order to minimize the impact."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Prior to enabling this feature, you\u0027ll want to add any service users to the"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_6024dc5f","line":101,"in_reply_to":"5a3905b3_a396d749","updated":"2017-01-21 05:21:46.000000000","message":"Done","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":101,"context_line":"    password. Therefore, operators should plan and coordinate this change with"},{"line_number":102,"context_line":"    their stakeholders in order to minimize the impact."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Prior to enabling this feature, you\u0027ll want to add any service users to the"},{"line_number":105,"context_line":"``password_expires_ignore_user_ids`` list, so that service accounts are not"},{"line_number":106,"context_line":"required to change their password and inadvertently become locked out."},{"line_number":107,"context_line":"Likewise, you can add other users to this list in order to bypass this"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_e377ff37","line":104,"updated":"2017-01-20 22:18:28.000000000","message":"This implies that this is a requirement: \"you\u0027ll want to add any service users\"\n\nHowever, I think this should be worded with \"may\" and merely use service users as an example.","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Prior to enabling this feature, you\u0027ll want to add any service users to the"},{"line_number":105,"context_line":"``password_expires_ignore_user_ids`` list, so that service accounts are not"},{"line_number":106,"context_line":"required to change their password and inadvertently become locked out."},{"line_number":107,"context_line":"Likewise, you can add other users to this list in order to bypass this"},{"line_number":108,"context_line":"security requirement."},{"line_number":109,"context_line":""}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_43ba93c1","line":106,"updated":"2017-01-20 22:18:28.000000000","message":"Generalize this use case to not refer to service users; it was the original use case, but wording it this way will encourage everyone to configure their service users this way (which is an anti-pattern) and discourage use of this feature for other legitimate use cases that we have not yet heard about.","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ab61a391bd8ac14ac711739d978bdb7d290003ea","unresolved":false,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Prior to enabling this feature, you\u0027ll want to add any service users to the"},{"line_number":105,"context_line":"``password_expires_ignore_user_ids`` list, so that service accounts are not"},{"line_number":106,"context_line":"required to change their password and inadvertently become locked out."},{"line_number":107,"context_line":"Likewise, you can add other users to this list in order to bypass this"},{"line_number":108,"context_line":"security requirement."},{"line_number":109,"context_line":""}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_40da804d","line":106,"in_reply_to":"5a3905b3_43ba93c1","updated":"2017-01-21 05:21:46.000000000","message":"Done","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    Failure to add service users to the ``password_expires_ignore_user_ids``"},{"line_number":118,"context_line":"    will result in your service account passwords becoming expired after the"},{"line_number":119,"context_line":"    first authentication."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"When ready, you can configure it so that users are forced to change their"},{"line_number":122,"context_line":"password upon first use by setting ``change_password_after_first_use``:"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_c3cda35e","line":119,"updated":"2017-01-20 22:18:28.000000000","message":"I\u0027m not sure this needs to be a warning, but it should definitely be generalized for all users as well. **Maybe** call out service users as an example?","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ab61a391bd8ac14ac711739d978bdb7d290003ea","unresolved":false,"context_lines":[{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    Failure to add service users to the ``password_expires_ignore_user_ids``"},{"line_number":118,"context_line":"    will result in your service account passwords becoming expired after the"},{"line_number":119,"context_line":"    first authentication."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"When ready, you can configure it so that users are forced to change their"},{"line_number":122,"context_line":"password upon first use by setting ``change_password_after_first_use``:"}],"source_content_type":"text/x-rst","patch_set":28,"id":"5a3905b3_a0e964e8","line":119,"in_reply_to":"5a3905b3_c3cda35e","updated":"2017-01-21 05:21:46.000000000","message":"i\u0027d prefer this as a warning, feel free to tweak the wording if you want dolph","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c999f20a01ed0d09dbebb31b2e352d00a409994f","unresolved":false,"context_lines":[{"line_number":100,"context_line":"    become expired. Operators should coordinate this change with their"},{"line_number":101,"context_line":"    stakeholders in order to minimize the impact."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Prior to enabling this feature, you may specify user IDs that will not be"},{"line_number":104,"context_line":"required to change their passwords by adding them to the list defined in"},{"line_number":105,"context_line":"the ``password_expires_ignore_user_ids`` configuration option. For example,"},{"line_number":106,"context_line":"adding service users."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":".. code-block:: ini"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"    [security_compliance]"},{"line_number":111,"context_line":"    password_expires_ignore_user_ids \u003d 3a54353c9dcc44f690975ea768512f6a,ed84c3b95b814ff2827967e531f09247"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":".. WARNING::"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":31,"id":"5a3905b3_03724249","line":111,"range":{"start_line":103,"start_character":0,"end_line":111,"end_character":104},"updated":"2017-01-21 07:16:53.000000000","message":"It is far, far, far better to make this an attribute on the user (metadata) of some sort unless this is strictly designed to avoid the reset for a user when enabling the feature.\n\nI still will advocate that the design is poor because it is encoding user_ids in the config. It is much better to have attributes on the user as that can be changed without another restart of keystone. This means (potentially) all service accounts must have manual intervention *or* a restart of keystone to ensure passwords are not immediately expired upon login.","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"b90b14ca2533d55bd94ea93e42dbb720903aca85","unresolved":false,"context_lines":[{"line_number":100,"context_line":"    become expired. Operators should coordinate this change with their"},{"line_number":101,"context_line":"    stakeholders in order to minimize the impact."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Prior to enabling this feature, you may specify user IDs that will not be"},{"line_number":104,"context_line":"required to change their passwords by adding them to the list defined in"},{"line_number":105,"context_line":"the ``password_expires_ignore_user_ids`` configuration option. For example,"},{"line_number":106,"context_line":"adding service users."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":".. code-block:: ini"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"    [security_compliance]"},{"line_number":111,"context_line":"    password_expires_ignore_user_ids \u003d 3a54353c9dcc44f690975ea768512f6a,ed84c3b95b814ff2827967e531f09247"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":".. WARNING::"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":31,"id":"5a3905b3_bf741a68","line":111,"range":{"start_line":103,"start_character":0,"end_line":111,"end_character":104},"in_reply_to":"5a3905b3_03724249","updated":"2017-01-21 20:26:15.000000000","message":"While agree with you that there are better design options, password_expires_ignore_user_ids config setting was already in place for ignoring expired passwords:\nhttps://github.com/openstack/keystone/blob/master/keystone/conf/security_compliance.py#L78\n\nhttps://github.com/openstack/keystone/blob/master/doc/source/security_compliance.rst","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"cb79d063cfe3a630bdb2685e22bb6ef5253d0f10","unresolved":false,"context_lines":[{"line_number":108,"context_line":".. code-block:: ini"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"    [security_compliance]"},{"line_number":111,"context_line":"    password_expires_ignore_user_ids \u003d 3a54353c9dcc44f690975ea768512f6a,ed84c3b95b814ff2827967e531f09247"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":".. WARNING::"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":31,"id":"5a3905b3_70bd1701","line":111,"in_reply_to":"5a3905b3_410f7036","updated":"2017-01-24 15:31:11.000000000","message":"And just to add, the main reason for not changing it, is that it will likely cause an API change.","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"9e58b075018b886083cdf80aa02a5a54fe47e82a","unresolved":false,"context_lines":[{"line_number":108,"context_line":".. code-block:: ini"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"    [security_compliance]"},{"line_number":111,"context_line":"    password_expires_ignore_user_ids \u003d 3a54353c9dcc44f690975ea768512f6a,ed84c3b95b814ff2827967e531f09247"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":".. WARNING::"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":31,"id":"5a3905b3_410f7036","line":111,"in_reply_to":"5a3905b3_56f738d2","updated":"2017-01-24 15:10:09.000000000","message":"Morgan, I believe, is working on that. I didn\u0027t see this as a huge design flaw when I started this, so didn\u0027t think to change it. And it can certainly be changed later.","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"56c6901b0621cb2345dc3c0d5789dd1affb466df","unresolved":false,"context_lines":[{"line_number":108,"context_line":".. code-block:: ini"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"    [security_compliance]"},{"line_number":111,"context_line":"    password_expires_ignore_user_ids \u003d 3a54353c9dcc44f690975ea768512f6a,ed84c3b95b814ff2827967e531f09247"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":".. WARNING::"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":31,"id":"5a3905b3_e255acfa","line":111,"in_reply_to":"5a3905b3_70bd1701","updated":"2017-01-24 19:41:53.000000000","message":"I like Morgan\u0027s approach, didn\u0027t think about that when first saw this setting.\n\n@Ron, can you explain what are the API changes?","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"20c55e3b323cd432353c948779f852921ef63d93","unresolved":false,"context_lines":[{"line_number":108,"context_line":".. code-block:: ini"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"    [security_compliance]"},{"line_number":111,"context_line":"    password_expires_ignore_user_ids \u003d 3a54353c9dcc44f690975ea768512f6a,ed84c3b95b814ff2827967e531f09247"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":".. WARNING::"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":31,"id":"5a3905b3_56f738d2","line":111,"in_reply_to":"5a3905b3_bf741a68","updated":"2017-01-24 15:00:33.000000000","message":"Why not use a better alternative then? Maybe we need to go back in and fix the old setting at some point.","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c3a54c88c6ccc33aded41fc9abfb9523cd96b422","unresolved":false,"context_lines":[{"line_number":108,"context_line":".. code-block:: ini"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"    [security_compliance]"},{"line_number":111,"context_line":"    password_expires_ignore_user_ids \u003d 3a54353c9dcc44f690975ea768512f6a,ed84c3b95b814ff2827967e531f09247"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":".. WARNING::"},{"line_number":114,"context_line":""}],"source_content_type":"text/x-rst","patch_set":31,"id":"5a3905b3_6248dccd","line":111,"in_reply_to":"5a3905b3_e255acfa","updated":"2017-01-24 19:49:25.000000000","message":"@Rodrigo we\u0027d be adding new attributes to user, so we would need to change the API to add those attributes to the request and response.","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"}],"keystone/conf/security_compliance.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a33e9d3458ffaef7eb9a3f93e58969ae3bd099b3","unresolved":false,"context_lines":[{"line_number":140,"context_line":"and reset passwords for existings users, will expire after the first use and no"},{"line_number":141,"context_line":"longer be valid for authentication. This feature is disabled by default. This"},{"line_number":142,"context_line":"feature depends on the `sql` backend for the `[identity] driver`. Note: this"},{"line_number":143,"context_line":"feature would require all existing users to meet the new standard. Therefore,"},{"line_number":144,"context_line":"enabling this feature should be carefully considered and planned."},{"line_number":145,"context_line":"\"\"\"))"},{"line_number":146,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_42b914e9","line":143,"updated":"2016-12-29 19:53:37.000000000","message":"I wouldn\u0027t mind actually pointing to some official documentation somewhere on how to do this. I found that as I tested this patch locally that it can be pretty easy to lockout my admin user. For example, if I do the following\n\n - authenticate as an admin, do some arbitrary operations\n - set change_password_after_first_use \u003d true and restart keystone\n - do an `openstack user password set` to reset my password\n\nIf I do any other operation in the third step - i might lose my token and be unable to change my password. The following is another interesting case I noticed:\n\n - authenticate as an admin\n - set change_password_after_first_use \u003d true and restart keystone\n - do an `openstack user password set` to reset my password\n - authenticate normally \n - set change_password_after_first_use \u003d false and restart keystone\n - authenticate normally because the setting is off\n - re-enable change_password_after_first_use and restart keystone\n - I can authenticate repeatedly with my old password \n\nThe last bit seems strange because after toggling the configuration option on and off, it doesn\u0027t seem to reject my password even though I would expect it to after re-enabling the setting. I bring up the documentation bits because a user will have one of two different ways to reset their password after a deployment enables this setting. First they could use either of the following procedures:\n\n - deployment enables change_password_after_first_use\n - user must know when this happens, and the first command they use is `openstack user password set`\n\nOr\n\n - deployment enables change_password_after_first_use\n - user must know when this happens, and the first command they use is `openstack token issue`\n - grab the token from the last request  and change password using something like curl or pass it to openstackclient directly bypassing initial authentication.","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"a490110495dd67bf1a251b9b3611510acb1d6fd5","unresolved":false,"context_lines":[{"line_number":140,"context_line":"and reset passwords for existings users, will expire after the first use and no"},{"line_number":141,"context_line":"longer be valid for authentication. This feature is disabled by default. This"},{"line_number":142,"context_line":"feature depends on the `sql` backend for the `[identity] driver`. Note: this"},{"line_number":143,"context_line":"feature would require all existing users to meet the new standard. Therefore,"},{"line_number":144,"context_line":"enabling this feature should be carefully considered and planned."},{"line_number":145,"context_line":"\"\"\"))"},{"line_number":146,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_f3a6f151","line":143,"in_reply_to":"ba5201f7_42b914e9","updated":"2017-01-04 16:15:54.000000000","message":"The first case, in my mind, is expected behavior. If you don\u0027t want the admin password to expire, then add it to the ignore list.\n\nFor the second case, toggling the config option off and on, if your last password change was a admin reset, then you should be required to change your password. If that is not the case, then it is a bug. When you say you can repeatedly auth with your old password, was your last password change self-service?","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"8ae12ccc1be89659ff7586c3aac34bf24bc2bfdf","unresolved":false,"context_lines":[{"line_number":140,"context_line":"and reset passwords for existings users, will expire after the first use and no"},{"line_number":141,"context_line":"longer be valid for authentication. This feature is disabled by default. This"},{"line_number":142,"context_line":"feature depends on the `sql` backend for the `[identity] driver`. Note: this"},{"line_number":143,"context_line":"feature would require all existing users to meet the new standard. Therefore,"},{"line_number":144,"context_line":"enabling this feature should be carefully considered and planned."},{"line_number":145,"context_line":"\"\"\"))"},{"line_number":146,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_550b168e","line":143,"in_reply_to":"ba5201f7_f3a6f151","updated":"2017-01-06 18:14:27.000000000","message":"Reworded this somewhat to make it more clear and pointing to documentation.","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2c5982ebc943a9eb00c417ee6b2a996b52053e7f","unresolved":false,"context_lines":[{"line_number":141,"context_line":"longer be valid for authentication. This feature is disabled by default. This"},{"line_number":142,"context_line":"feature depends on the `sql` backend for the `[identity] driver`. Note: this"},{"line_number":143,"context_line":"feature would require all existing users to meet the new standard. Therefore,"},{"line_number":144,"context_line":"enabling this feature should be carefully considered and planned."},{"line_number":145,"context_line":"\"\"\"))"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_81205df9","line":144,"updated":"2016-12-29 17:07:44.000000000","message":"Note that uses in the `password_expires_ignore_user_ids` list won\u0027t be affected by this change (according to the logic in this patch).","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"a490110495dd67bf1a251b9b3611510acb1d6fd5","unresolved":false,"context_lines":[{"line_number":141,"context_line":"longer be valid for authentication. This feature is disabled by default. This"},{"line_number":142,"context_line":"feature depends on the `sql` backend for the `[identity] driver`. Note: this"},{"line_number":143,"context_line":"feature would require all existing users to meet the new standard. Therefore,"},{"line_number":144,"context_line":"enabling this feature should be carefully considered and planned."},{"line_number":145,"context_line":"\"\"\"))"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":""}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_33679926","line":144,"in_reply_to":"ba5201f7_81205df9","updated":"2017-01-04 16:15:54.000000000","message":"++","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":135,"context_line":"    \u0027change_password_after_first_use\u0027,"},{"line_number":136,"context_line":"    default\u003dFalse,"},{"line_number":137,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":138,"context_line":"This feature would require users to change their password for first time use"},{"line_number":139,"context_line":"and upon an admnistrative password reset. Therefore, passwords for new and"},{"line_number":140,"context_line":"existing users that were not created via the change password API"},{"line_number":141,"context_line":"(self-service), will expire after the first authentication and no longer be"}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_8302bb6d","line":138,"updated":"2017-01-20 22:18:28.000000000","message":"s/This feature would require/Enabling this option requires/\n\ns/for first time use/upon first use/","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":137,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":138,"context_line":"This feature would require users to change their password for first time use"},{"line_number":139,"context_line":"and upon an admnistrative password reset. Therefore, passwords for new and"},{"line_number":140,"context_line":"existing users that were not created via the change password API"},{"line_number":141,"context_line":"(self-service), will expire after the first authentication and no longer be"},{"line_number":142,"context_line":"valid. This feature is disabled by default. This feature depends on the `sql`"},{"line_number":143,"context_line":"backend for the `[identity] driver`. Note: prior to enabling this feature,"}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_2313c7b9","line":140,"updated":"2017-01-20 22:18:28.000000000","message":"\"the change password API (self-service)\" is a little \"inside baseball\" for keystoners -- use terminology that operators will understand instead.\n\nAlso, \"new and existing users\" is just \"all users\", right?","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e76ffe7a497faee45e20ae7168572aca060e9579","unresolved":false,"context_lines":[{"line_number":138,"context_line":"This feature would require users to change their password for first time use"},{"line_number":139,"context_line":"and upon an admnistrative password reset. Therefore, passwords for new and"},{"line_number":140,"context_line":"existing users that were not created via the change password API"},{"line_number":141,"context_line":"(self-service), will expire after the first authentication and no longer be"},{"line_number":142,"context_line":"valid. This feature is disabled by default. This feature depends on the `sql`"},{"line_number":143,"context_line":"backend for the `[identity] driver`. Note: prior to enabling this feature,"},{"line_number":144,"context_line":"service users should be added to the `password_expires_ignore_user_ids` list"}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_689b2cca","line":141,"updated":"2017-01-19 22:54:46.000000000","message":"nit: \"not created via the self-service change password API, will ... \"","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":139,"context_line":"and upon an admnistrative password reset. Therefore, passwords for new and"},{"line_number":140,"context_line":"existing users that were not created via the change password API"},{"line_number":141,"context_line":"(self-service), will expire after the first authentication and no longer be"},{"line_number":142,"context_line":"valid. This feature is disabled by default. This feature depends on the `sql`"},{"line_number":143,"context_line":"backend for the `[identity] driver`. Note: prior to enabling this feature,"},{"line_number":144,"context_line":"service users should be added to the `password_expires_ignore_user_ids` list"},{"line_number":145,"context_line":"in order to disable this security requirement for service accounts. In addtion,"}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_03740bfb","line":142,"updated":"2017-01-20 22:18:28.000000000","message":"\"depends on\" -\u003e \"is only applicable with/when using/whatever\"","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":141,"context_line":"(self-service), will expire after the first authentication and no longer be"},{"line_number":142,"context_line":"valid. This feature is disabled by default. This feature depends on the `sql`"},{"line_number":143,"context_line":"backend for the `[identity] driver`. Note: prior to enabling this feature,"},{"line_number":144,"context_line":"service users should be added to the `password_expires_ignore_user_ids` list"},{"line_number":145,"context_line":"in order to disable this security requirement for service accounts. In addtion,"},{"line_number":146,"context_line":"enabling this feature should be carefully considered and planned for. Please"},{"line_number":147,"context_line":"review the following documentation before enabling this feature:"}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_4399b31e","line":144,"updated":"2017-01-20 22:18:28.000000000","message":"\"service users should\" -\u003e \"users may be\"","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":142,"context_line":"valid. This feature is disabled by default. This feature depends on the `sql`"},{"line_number":143,"context_line":"backend for the `[identity] driver`. Note: prior to enabling this feature,"},{"line_number":144,"context_line":"service users should be added to the `password_expires_ignore_user_ids` list"},{"line_number":145,"context_line":"in order to disable this security requirement for service accounts. In addtion,"},{"line_number":146,"context_line":"enabling this feature should be carefully considered and planned for. Please"},{"line_number":147,"context_line":"review the following documentation before enabling this feature:"},{"line_number":148,"context_line":"http://docs.openstack.org/developer/keystone/security_compliance.html"}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_c3acc337","line":145,"updated":"2017-01-20 22:18:28.000000000","message":"Remove \"for service accounts\" (it\u0027s redundant with the first part of the sentence, even after the above edit.","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":145,"context_line":"in order to disable this security requirement for service accounts. In addtion,"},{"line_number":146,"context_line":"enabling this feature should be carefully considered and planned for. Please"},{"line_number":147,"context_line":"review the following documentation before enabling this feature:"},{"line_number":148,"context_line":"http://docs.openstack.org/developer/keystone/security_compliance.html"},{"line_number":149,"context_line":"\"\"\"))"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":""}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_a37897c5","line":148,"updated":"2017-01-20 22:18:28.000000000","message":"That link is sort of relevant to the entire group of options. Is it possible to add documentation for the entire config group/section that would appear at the top, rather than attached to a specific option?","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":161,"context_line":"    minimum_password_age,"},{"line_number":162,"context_line":"    password_regex,"},{"line_number":163,"context_line":"    password_regex_description,"},{"line_number":164,"context_line":"    change_password_after_first_use"},{"line_number":165,"context_line":"]"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":""}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_037ecbad","line":164,"updated":"2017-01-20 22:18:28.000000000","message":"The order of options matters as this is also the order in which they are rendered in documentation. I feel like this belongs with \"minimum password age\", as they\u0027re both kinda sort of related options.","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ab61a391bd8ac14ac711739d978bdb7d290003ea","unresolved":false,"context_lines":[{"line_number":161,"context_line":"    minimum_password_age,"},{"line_number":162,"context_line":"    password_regex,"},{"line_number":163,"context_line":"    password_regex_description,"},{"line_number":164,"context_line":"    change_password_after_first_use"},{"line_number":165,"context_line":"]"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":""}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_a097a446","line":164,"in_reply_to":"5a3905b3_037ecbad","updated":"2017-01-21 05:21:46.000000000","message":"Done","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"}],"keystone/exception.py":[{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"257b91d489fe5f9d3218e1488e3a23347d17aec2","unresolved":false,"context_lines":[{"line_number":241,"context_line":""},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"class ChangePasswordRequired(Unauthorized):"},{"line_number":244,"context_line":"    message_format \u003d _(\"The password must be changed for user: %(user_id)s. \""},{"line_number":245,"context_line":"                       \"Thus, the new_password attribute must be included in \""},{"line_number":246,"context_line":"                       \"the request for password authentication.\")"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"class AuthPluginException(Unauthorized):"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a74a57a_dc486f8a","line":246,"range":{"start_line":244,"start_character":23,"end_line":246,"end_character":65},"updated":"2016-11-30 15:11:46.000000000","message":"Could this be changed a bit to mention the \"first time\" use of the password?","commit_id":"0f08a44893b58025c8adea1b0994b50ce2f5f1ea"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"a8a87404d6bc29663a1eb665bbb7732d2484b931","unresolved":false,"context_lines":[{"line_number":241,"context_line":""},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"class ChangePasswordRequired(Unauthorized):"},{"line_number":244,"context_line":"    message_format \u003d _(\"The password must be changed for user: %(user_id)s. \""},{"line_number":245,"context_line":"                       \"Thus, the new_password attribute must be included in \""},{"line_number":246,"context_line":"                       \"the request for password authentication.\")"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"class AuthPluginException(Unauthorized):"}],"source_content_type":"text/x-python","patch_set":5,"id":"5a74a57a_a6b39d09","line":246,"range":{"start_line":244,"start_character":23,"end_line":246,"end_character":65},"in_reply_to":"5a74a57a_dc486f8a","updated":"2016-11-30 15:42:54.000000000","message":"Yeah, good point.","commit_id":"0f08a44893b58025c8adea1b0994b50ce2f5f1ea"}],"keystone/identity/backends/sql.py":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"e14c8bf2e250f48950aa47677059145826d6d528","unresolved":false,"context_lines":[{"line_number":68,"context_line":"        elif user_ref.password_is_expired:"},{"line_number":69,"context_line":"            raise exception.PasswordExpired(user_id\u003duser_id)"},{"line_number":70,"context_line":"        # record successful auth if security compliance features are enabled"},{"line_number":71,"context_line":"        if (CONF.security_compliance.change_password_required_after_reset or"},{"line_number":72,"context_line":"                user_ref.local_user.failed_auth_count):"},{"line_number":73,"context_line":"            self._record_successful_auth(user_id)"},{"line_number":74,"context_line":"        return base.filter_user(user_ref.to_dict())"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"1a6eadb0_a64a7824","line":72,"range":{"start_line":71,"start_character":12,"end_line":72,"end_character":53},"updated":"2016-12-14 19:14:20.000000000","message":"if change_password_required_after_reset is set and failed_auth_count is not, we\u0027ll still be resetting the failed_auth_count for that user (since both of them call the same method), which is not needed. and vice-versa\n\nI suggest creating a separate if statement for this. This would also remove the need of checking CONF.security_compliance.change_password_required_after_reset again on L129","commit_id":"a2e3013ce85cce441d63a14b69b026298702e3ce"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"f520ea6fb853fea71d4df7b1aba6f8c7392b3c8b","unresolved":false,"context_lines":[{"line_number":68,"context_line":"        elif user_ref.password_is_expired:"},{"line_number":69,"context_line":"            raise exception.PasswordExpired(user_id\u003duser_id)"},{"line_number":70,"context_line":"        # record successful auth if security compliance features are enabled"},{"line_number":71,"context_line":"        if (CONF.security_compliance.change_password_required_after_reset or"},{"line_number":72,"context_line":"                user_ref.local_user.failed_auth_count):"},{"line_number":73,"context_line":"            self._record_successful_auth(user_id)"},{"line_number":74,"context_line":"        return base.filter_user(user_ref.to_dict())"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-python","patch_set":10,"id":"1a6eadb0_2514959e","line":72,"range":{"start_line":71,"start_character":12,"end_line":72,"end_character":53},"in_reply_to":"1a6eadb0_a64a7824","updated":"2016-12-14 23:51:10.000000000","message":"Good point, I was just trying not perform 2 database writes. I\u0027ve refactored it so that I\u0027m not doing both if not needed.","commit_id":"a2e3013ce85cce441d63a14b69b026298702e3ce"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"06c5ca6f5b85b57158f66c97da95f25a8119639f","unresolved":false,"context_lines":[{"line_number":131,"context_line":""},{"line_number":132,"context_line":"    def _change_password_required(self, user):"},{"line_number":133,"context_line":"        # return true if admin reset (not self-service) and past first-use"},{"line_number":134,"context_line":"        if (user.password_ref and not user.password_ref.self_service and"},{"line_number":135,"context_line":"                user.local_user.last_auth_at and"},{"line_number":136,"context_line":"                user.local_user.last_auth_at \u003e user.password_ref.created_at):"},{"line_number":137,"context_line":"            return True"},{"line_number":138,"context_line":"        return False"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"1a6eadb0_334aff26","line":136,"range":{"start_line":134,"start_character":11,"end_line":136,"end_character":75},"updated":"2016-12-15 13:34:24.000000000","message":"so is \"user.local_user.last_auth_at\" *equals to* \"user.password_ref.created_at\" in the first use ? that should be the reason we are checking with the \u003e operator to know it\u0027s the second use (then should be expired).\n\n\n(nit) the method could\u0027ve just returned all the expression as well","commit_id":"62a51baa88df4eb69ead75fb4495b68adf0b1a37"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"8ba1469ada53e02408274f79e8eb6dfef9cd26a0","unresolved":false,"context_lines":[{"line_number":131,"context_line":""},{"line_number":132,"context_line":"    def _change_password_required(self, user):"},{"line_number":133,"context_line":"        # return true if admin reset (not self-service) and past first-use"},{"line_number":134,"context_line":"        if (user.password_ref and not user.password_ref.self_service and"},{"line_number":135,"context_line":"                user.local_user.last_auth_at and"},{"line_number":136,"context_line":"                user.local_user.last_auth_at \u003e user.password_ref.created_at):"},{"line_number":137,"context_line":"            return True"},{"line_number":138,"context_line":"        return False"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"1a6eadb0_bfc24ee7","line":136,"range":{"start_line":134,"start_character":11,"end_line":136,"end_character":75},"in_reply_to":"1a6eadb0_334aff26","updated":"2016-12-15 14:43:20.000000000","message":"We\u0027ve talked on IRC.\n\nnot user.password_ref.self_service makes sure the password was reset by an admin. the create_at is also reset.\n\nuser.local_user.last_auth_at \u003e user.password_ref.created_at makes sure this is the first auth after the admin reset.","commit_id":"62a51baa88df4eb69ead75fb4495b68adf0b1a37"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"750afe203d266a11cca255b852f1d7132d0b1806","unresolved":false,"context_lines":[{"line_number":67,"context_line":"            raise exception.UserDisabled(user_id\u003duser_id)"},{"line_number":68,"context_line":"        elif user_ref.password_is_expired:"},{"line_number":69,"context_line":"            raise exception.PasswordExpired(user_id\u003duser_id)"},{"line_number":70,"context_line":"        self._record_successful_auth("},{"line_number":71,"context_line":"            user_id, user_ref.local_user.failed_auth_count)"},{"line_number":72,"context_line":"        return base.filter_user(user_ref.to_dict())"},{"line_number":73,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"1a6eadb0_27f514ec","line":70,"updated":"2016-12-16 23:40:46.000000000","message":"nit: insert a new line to separate this block from the conditional branches above.","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d8932373a7094efb60fcc95a7c3212f9116f41bb","unresolved":false,"context_lines":[{"line_number":67,"context_line":"            raise exception.UserDisabled(user_id\u003duser_id)"},{"line_number":68,"context_line":"        elif user_ref.password_is_expired:"},{"line_number":69,"context_line":"            raise exception.PasswordExpired(user_id\u003duser_id)"},{"line_number":70,"context_line":"        self._record_successful_auth("},{"line_number":71,"context_line":"            user_id, user_ref.local_user.failed_auth_count)"},{"line_number":72,"context_line":"        return base.filter_user(user_ref.to_dict())"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    def _is_account_locked(self, user_id, user_ref):"}],"source_content_type":"text/x-python","patch_set":16,"id":"1a6eadb0_476e39ca","line":71,"range":{"start_line":70,"start_character":8,"end_line":71,"end_character":59},"updated":"2016-12-20 04:57:06.000000000","message":"it\u0027ll look cleaner if you do another elif here, like so:\n\n  elif (CONF.security_compliance.change_password_required_after_reset or failed_auth_count):\n    self._record_successful_auth(...)\n\nthis will also result in getting rid of the immediate condition on line 118 that samuel pointed out.","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"750afe203d266a11cca255b852f1d7132d0b1806","unresolved":false,"context_lines":[{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    def _record_successful_auth(self, user_id, failed_auth_count):"},{"line_number":117,"context_line":"        # skip db write if security compliance features are not enabled"},{"line_number":118,"context_line":"        if not(CONF.security_compliance.change_password_required_after_reset or"},{"line_number":119,"context_line":"                failed_auth_count):"},{"line_number":120,"context_line":"            return"},{"line_number":121,"context_line":"        with sql.session_for_write() as session:"},{"line_number":122,"context_line":"            user_ref \u003d session.query(model.User).get(user_id)"},{"line_number":123,"context_line":"            if failed_auth_count:"}],"source_content_type":"text/x-python","patch_set":16,"id":"1a6eadb0_474e903b","line":120,"range":{"start_line":118,"start_character":0,"end_line":120,"end_character":18},"updated":"2016-12-16 23:40:46.000000000","message":"I\u0027d prefer to have this outside the method, so we only call something called \"_record_successful_auth\" if possible (as it was before)","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"263c039478b0d4ff2f48ae1329ac2c7352ed596b","unresolved":false,"context_lines":[{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    def _record_successful_auth(self, user_id, failed_auth_count):"},{"line_number":117,"context_line":"        # skip db write if security compliance features are not enabled"},{"line_number":118,"context_line":"        if not(CONF.security_compliance.change_password_required_after_reset or"},{"line_number":119,"context_line":"                failed_auth_count):"},{"line_number":120,"context_line":"            return"},{"line_number":121,"context_line":"        with sql.session_for_write() as session:"},{"line_number":122,"context_line":"            user_ref \u003d session.query(model.User).get(user_id)"},{"line_number":123,"context_line":"            if failed_auth_count:"}],"source_content_type":"text/x-python","patch_set":16,"id":"1a6eadb0_379c1569","line":120,"range":{"start_line":118,"start_character":0,"end_line":120,"end_character":18},"in_reply_to":"1a6eadb0_474e903b","updated":"2016-12-19 23:03:24.000000000","message":"I prefer it as, just made the authenticate() method a little cleaner to me. But I could go either way.","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"750afe203d266a11cca255b852f1d7132d0b1806","unresolved":false,"context_lines":[{"line_number":120,"context_line":"            return"},{"line_number":121,"context_line":"        with sql.session_for_write() as session:"},{"line_number":122,"context_line":"            user_ref \u003d session.query(model.User).get(user_id)"},{"line_number":123,"context_line":"            if failed_auth_count:"},{"line_number":124,"context_line":"                user_ref.local_user.failed_auth_count \u003d 0"},{"line_number":125,"context_line":"                user_ref.local_user.failed_auth_at \u003d None"},{"line_number":126,"context_line":"            if CONF.security_compliance.change_password_required_after_reset:"},{"line_number":127,"context_line":"                now \u003d datetime.datetime.utcnow()"},{"line_number":128,"context_line":"                user_ref.local_user.last_auth_at \u003d now"}],"source_content_type":"text/x-python","patch_set":16,"id":"1a6eadb0_c72e2042","line":125,"range":{"start_line":123,"start_character":0,"end_line":125,"end_character":57},"updated":"2016-12-16 23:40:46.000000000","message":"I\u0027d continue to keep this in a different method, what do you think?","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"263c039478b0d4ff2f48ae1329ac2c7352ed596b","unresolved":false,"context_lines":[{"line_number":120,"context_line":"            return"},{"line_number":121,"context_line":"        with sql.session_for_write() as session:"},{"line_number":122,"context_line":"            user_ref \u003d session.query(model.User).get(user_id)"},{"line_number":123,"context_line":"            if failed_auth_count:"},{"line_number":124,"context_line":"                user_ref.local_user.failed_auth_count \u003d 0"},{"line_number":125,"context_line":"                user_ref.local_user.failed_auth_at \u003d None"},{"line_number":126,"context_line":"            if CONF.security_compliance.change_password_required_after_reset:"},{"line_number":127,"context_line":"                now \u003d datetime.datetime.utcnow()"},{"line_number":128,"context_line":"                user_ref.local_user.last_auth_at \u003d now"}],"source_content_type":"text/x-python","patch_set":16,"id":"1a6eadb0_37c5f55a","line":125,"range":{"start_line":123,"start_character":0,"end_line":125,"end_character":57},"in_reply_to":"1a6eadb0_c72e2042","updated":"2016-12-19 23:03:24.000000000","message":"I think I started with this being broken up, but wanted to consolidate and do a single database write (as opposed to 2 database writes).","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"750afe203d266a11cca255b852f1d7132d0b1806","unresolved":false,"context_lines":[{"line_number":131,"context_line":""},{"line_number":132,"context_line":"    def _change_password_required(self, user):"},{"line_number":133,"context_line":"        # return true if admin reset (not self-service) and past first-use"},{"line_number":134,"context_line":"        if (user.password_ref and not user.password_ref.self_service and"},{"line_number":135,"context_line":"                user.local_user.last_auth_at and"},{"line_number":136,"context_line":"                user.local_user.last_auth_at \u003e user.password_ref.created_at):"},{"line_number":137,"context_line":"            return True"},{"line_number":138,"context_line":"        return False"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"1a6eadb0_c7a380b0","line":136,"range":{"start_line":134,"start_character":11,"end_line":136,"end_character":77},"updated":"2016-12-16 23:40:46.000000000","message":"nit: maybe create an inner function called \"is_password_first_use\", or something like that.","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"5ad73d3ed778823867157e2b8ae4aac4ffdf0124","unresolved":false,"context_lines":[{"line_number":131,"context_line":""},{"line_number":132,"context_line":"    def _change_password_required(self, user):"},{"line_number":133,"context_line":"        # return true if admin reset (not self-service) and past first-use"},{"line_number":134,"context_line":"        if (user.password_ref and not user.password_ref.self_service and"},{"line_number":135,"context_line":"                user.local_user.last_auth_at and"},{"line_number":136,"context_line":"                user.local_user.last_auth_at \u003e user.password_ref.created_at):"},{"line_number":137,"context_line":"            return True"},{"line_number":138,"context_line":"        return False"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"1a6eadb0_bb49efb9","line":136,"range":{"start_line":134,"start_character":11,"end_line":136,"end_character":77},"in_reply_to":"1a6eadb0_978169fe","updated":"2016-12-19 23:57:12.000000000","message":"just return the whole check.\n\nreturn user.password_ref and not user.password_ref.self_service and\n                user.local_user.last_auth_at and\n                user.local_user.last_auth_at \u003e user.password_ref.created_at","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"e6e00e30759e0954ebe9dad082029c8633354710","unresolved":false,"context_lines":[{"line_number":131,"context_line":""},{"line_number":132,"context_line":"    def _change_password_required(self, user):"},{"line_number":133,"context_line":"        # return true if admin reset (not self-service) and past first-use"},{"line_number":134,"context_line":"        if (user.password_ref and not user.password_ref.self_service and"},{"line_number":135,"context_line":"                user.local_user.last_auth_at and"},{"line_number":136,"context_line":"                user.local_user.last_auth_at \u003e user.password_ref.created_at):"},{"line_number":137,"context_line":"            return True"},{"line_number":138,"context_line":"        return False"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"1a6eadb0_fef0b568","line":136,"range":{"start_line":134,"start_character":11,"end_line":136,"end_character":77},"in_reply_to":"1a6eadb0_bb49efb9","updated":"2016-12-20 00:54:34.000000000","message":"Forgot Samuel, you mention that before. Missed it. However, I\u0027m okay with it as is.","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"263c039478b0d4ff2f48ae1329ac2c7352ed596b","unresolved":false,"context_lines":[{"line_number":131,"context_line":""},{"line_number":132,"context_line":"    def _change_password_required(self, user):"},{"line_number":133,"context_line":"        # return true if admin reset (not self-service) and past first-use"},{"line_number":134,"context_line":"        if (user.password_ref and not user.password_ref.self_service and"},{"line_number":135,"context_line":"                user.local_user.last_auth_at and"},{"line_number":136,"context_line":"                user.local_user.last_auth_at \u003e user.password_ref.created_at):"},{"line_number":137,"context_line":"            return True"},{"line_number":138,"context_line":"        return False"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"1a6eadb0_978169fe","line":136,"range":{"start_line":134,"start_character":11,"end_line":136,"end_character":77},"in_reply_to":"1a6eadb0_c7a380b0","updated":"2016-12-19 23:03:24.000000000","message":"++","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ba707e59f6615a0a4a8003067f806ae9ad1c52d9","unresolved":false,"context_lines":[{"line_number":131,"context_line":""},{"line_number":132,"context_line":"    def _change_password_required(self, user):"},{"line_number":133,"context_line":"        # return true if admin reset (not self-service) and past first-use"},{"line_number":134,"context_line":"        if (user.password_ref and not user.password_ref.self_service and"},{"line_number":135,"context_line":"                user.local_user.last_auth_at and"},{"line_number":136,"context_line":"                user.local_user.last_auth_at \u003e user.password_ref.created_at):"},{"line_number":137,"context_line":"            return True"},{"line_number":138,"context_line":"        return False"},{"line_number":139,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"1a6eadb0_4a7f2366","line":136,"range":{"start_line":134,"start_character":11,"end_line":136,"end_character":77},"in_reply_to":"1a6eadb0_fef0b568","updated":"2016-12-20 02:46:30.000000000","message":"yeah, I am okay with this too, just in the case we were doing that separate method I was saying it was not needed","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"14a7ce9dc9380d4d11db345fcf3e1f6e9792b07e","unresolved":false,"context_lines":[{"line_number":123,"context_line":"            user_ref.password_ref.expires_at \u003d datetime.datetime.utcnow()"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"    def _change_password_required(self, user):"},{"line_number":126,"context_line":"        ignore_list \u003d CONF.security_compliance.password_expires_ignore_user_ids"},{"line_number":127,"context_line":"        return ("},{"line_number":128,"context_line":"            CONF.security_compliance.change_password_after_first_use and"},{"line_number":129,"context_line":"            user[\u0027id\u0027] not in ignore_list and"}],"source_content_type":"text/x-python","patch_set":31,"id":"5a3905b3_83e0f2fb","line":126,"range":{"start_line":126,"start_character":21,"end_line":126,"end_character":79},"updated":"2017-01-21 07:03:35.000000000","message":"This is a bad design. This should not be a list of UIDs, it should be an attribute on the user. This requires a restart of keystone once a user_id is generated to apply as an ignored user.\n\nPlease stop designing options like this. I know this is a late -1 but... -1","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"af16db76671b903f39e7a727e09009b8c66151d9","unresolved":false,"context_lines":[{"line_number":123,"context_line":"            user_ref.password_ref.expires_at \u003d datetime.datetime.utcnow()"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"    def _change_password_required(self, user):"},{"line_number":126,"context_line":"        ignore_list \u003d CONF.security_compliance.password_expires_ignore_user_ids"},{"line_number":127,"context_line":"        return ("},{"line_number":128,"context_line":"            CONF.security_compliance.change_password_after_first_use and"},{"line_number":129,"context_line":"            user[\u0027id\u0027] not in ignore_list and"}],"source_content_type":"text/x-python","patch_set":31,"id":"5a3905b3_83ae3296","line":126,"range":{"start_line":126,"start_character":21,"end_line":126,"end_character":79},"in_reply_to":"5a3905b3_23bc9edb","updated":"2017-01-21 07:10:57.000000000","message":"Nevermind my second comment, I\u0027m just blind and can\u0027t read at 11pm at night.","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"164f384a673fd2c5e3b208ae255696c98b28a781","unresolved":false,"context_lines":[{"line_number":123,"context_line":"            user_ref.password_ref.expires_at \u003d datetime.datetime.utcnow()"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"    def _change_password_required(self, user):"},{"line_number":126,"context_line":"        ignore_list \u003d CONF.security_compliance.password_expires_ignore_user_ids"},{"line_number":127,"context_line":"        return ("},{"line_number":128,"context_line":"            CONF.security_compliance.change_password_after_first_use and"},{"line_number":129,"context_line":"            user[\u0027id\u0027] not in ignore_list and"}],"source_content_type":"text/x-python","patch_set":31,"id":"5a3905b3_23bc9edb","line":126,"range":{"start_line":126,"start_character":21,"end_line":126,"end_character":79},"in_reply_to":"5a3905b3_83e0f2fb","updated":"2017-01-21 07:09:01.000000000","message":"This option is also not defined afaict, meaning this is also not tested properly if it passes CI.","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"b90b14ca2533d55bd94ea93e42dbb720903aca85","unresolved":false,"context_lines":[{"line_number":123,"context_line":"            user_ref.password_ref.expires_at \u003d datetime.datetime.utcnow()"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"    def _change_password_required(self, user):"},{"line_number":126,"context_line":"        ignore_list \u003d CONF.security_compliance.password_expires_ignore_user_ids"},{"line_number":127,"context_line":"        return ("},{"line_number":128,"context_line":"            CONF.security_compliance.change_password_after_first_use and"},{"line_number":129,"context_line":"            user[\u0027id\u0027] not in ignore_list and"}],"source_content_type":"text/x-python","patch_set":31,"id":"5a3905b3_5f65f6b2","line":126,"range":{"start_line":126,"start_character":21,"end_line":126,"end_character":79},"in_reply_to":"5a3905b3_83e0f2fb","updated":"2017-01-21 20:26:15.000000000","message":"While agree with you that there are better design options for this, the password_expires_ignore_user_ids config setting was already in place; not introduce with this patch:\nhttps://github.com/openstack/keystone/blob/master/keystone/conf/security_compliance.py#L78","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"20c55e3b323cd432353c948779f852921ef63d93","unresolved":false,"context_lines":[{"line_number":127,"context_line":"        return ("},{"line_number":128,"context_line":"            CONF.security_compliance.change_password_after_first_use and"},{"line_number":129,"context_line":"            user[\u0027id\u0027] not in ignore_list and"},{"line_number":130,"context_line":"            user.password_ref and"},{"line_number":131,"context_line":"            not user.password_ref.self_service)"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":31,"id":"5a3905b3_6138ecd3","line":130,"updated":"2017-01-24 15:00:33.000000000","message":"Is it actually possible to not have a user.password_ref if you\u0027ve gotten this far in the flow?","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"56c6901b0621cb2345dc3c0d5789dd1affb466df","unresolved":false,"context_lines":[{"line_number":127,"context_line":"        return ("},{"line_number":128,"context_line":"            CONF.security_compliance.change_password_after_first_use and"},{"line_number":129,"context_line":"            user[\u0027id\u0027] not in ignore_list and"},{"line_number":130,"context_line":"            user.password_ref and"},{"line_number":131,"context_line":"            not user.password_ref.self_service)"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":31,"id":"5a3905b3_22dc1474","line":130,"in_reply_to":"5a3905b3_41577057","updated":"2017-01-24 19:41:53.000000000","message":"maybe add a comment about the required things in order to have this returning true?","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"9e58b075018b886083cdf80aa02a5a54fe47e82a","unresolved":false,"context_lines":[{"line_number":127,"context_line":"        return ("},{"line_number":128,"context_line":"            CONF.security_compliance.change_password_after_first_use and"},{"line_number":129,"context_line":"            user[\u0027id\u0027] not in ignore_list and"},{"line_number":130,"context_line":"            user.password_ref and"},{"line_number":131,"context_line":"            not user.password_ref.self_service)"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"    # user crud"}],"source_content_type":"text/x-python","patch_set":31,"id":"5a3905b3_41577057","line":130,"in_reply_to":"5a3905b3_6138ecd3","updated":"2017-01-24 15:10:09.000000000","message":"Users don\u0027t have to have a password defined, correct?","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"}],"keystone/identity/core.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2c5982ebc943a9eb00c417ee6b2a996b52053e7f","unresolved":false,"context_lines":[{"line_number":1284,"context_line":"    def change_password(self, request, user_id, original_password,"},{"line_number":1285,"context_line":"                        new_password):"},{"line_number":1286,"context_line":""},{"line_number":1287,"context_line":"        # Authenticate() will raise an AssertionError if authentication fails."},{"line_number":1288,"context_line":"        # And we are only authenticating to validate the old password, so we"},{"line_number":1289,"context_line":"        # can ignore if the password is expired for the next authentication."},{"line_number":1290,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_416d9531","line":1287,"updated":"2016-12-29 17:07:44.000000000","message":"nit: Authentication* only because the upper case A doesn\u0027t match the method signature it\u0027s referring to, but I appreciate the switch to complete sentences :)","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"8ae12ccc1be89659ff7586c3aac34bf24bc2bfdf","unresolved":false,"context_lines":[{"line_number":1284,"context_line":"    def change_password(self, request, user_id, original_password,"},{"line_number":1285,"context_line":"                        new_password):"},{"line_number":1286,"context_line":""},{"line_number":1287,"context_line":"        # Authenticate() will raise an AssertionError if authentication fails."},{"line_number":1288,"context_line":"        # And we are only authenticating to validate the old password, so we"},{"line_number":1289,"context_line":"        # can ignore if the password is expired for the next authentication."},{"line_number":1290,"context_line":"        try:"}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_d53e2627","line":1287,"in_reply_to":"ba5201f7_416d9531","updated":"2017-01-06 18:14:27.000000000","message":"Done","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":1291,"context_line":"        try:"},{"line_number":1292,"context_line":"            self.authenticate(request, user_id, original_password)"},{"line_number":1293,"context_line":"        except exception.PasswordExpired:"},{"line_number":1294,"context_line":"            pass"},{"line_number":1295,"context_line":""},{"line_number":1296,"context_line":"        domain_id, driver, entity_id \u003d ("},{"line_number":1297,"context_line":"            self._get_domain_driver_and_entity_id(user_id))"}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_e330df03","line":1294,"updated":"2017-01-20 22:18:28.000000000","message":"This is an interesting behavior... I assume this design decision was discussed and documented somewhere? Personally, if my password is truly expired, I\u0027d expect an administrator to have to intervene to reset it for me. I wouldn\u0027t expect a self-service password change to work, as I\u0027d expect to be completely locked out.","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ab61a391bd8ac14ac711739d978bdb7d290003ea","unresolved":false,"context_lines":[{"line_number":1291,"context_line":"        try:"},{"line_number":1292,"context_line":"            self.authenticate(request, user_id, original_password)"},{"line_number":1293,"context_line":"        except exception.PasswordExpired:"},{"line_number":1294,"context_line":"            pass"},{"line_number":1295,"context_line":""},{"line_number":1296,"context_line":"        domain_id, driver, entity_id \u003d ("},{"line_number":1297,"context_line":"            self._get_domain_driver_and_entity_id(user_id))"}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_009b1873","line":1294,"in_reply_to":"5a3905b3_e330df03","updated":"2017-01-21 05:21:46.000000000","message":"no, gage had a patch to override this behaviour, see https://github.com/openstack/keystone/commit/3ae73b67522bf388a0fdcecceb662831d853a313\n\ni don\u0027t want to bother an admin if 50000 people are locked out","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"466db4aaac6fc77927ea07bc90061dde8834c9b7","unresolved":false,"context_lines":[{"line_number":1286,"context_line":"                        new_password, initiator\u003dNone):"},{"line_number":1287,"context_line":""},{"line_number":1288,"context_line":"        # authenticate() will raise an AssertionError if authentication fails."},{"line_number":1289,"context_line":"        # We are only authenticating to validate the old password, so we can"},{"line_number":1290,"context_line":"        # ignore if the password is expired for the next authentication."},{"line_number":1291,"context_line":"        try:"},{"line_number":1292,"context_line":"            self.authenticate(request, user_id, original_password)"},{"line_number":1293,"context_line":"        except exception.PasswordExpired:"}],"source_content_type":"text/x-python","patch_set":31,"id":"5a3905b3_23065e86","line":1290,"range":{"start_line":1289,"start_character":0,"end_line":1290,"end_character":72},"updated":"2017-01-21 07:28:50.000000000","message":"NIT: Unrelated change (this should have been in the self-service password change on expired review.","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"}],"keystone/tests/unit/identity/test_backend_sql.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2c5982ebc943a9eb00c417ee6b2a996b52053e7f","unresolved":false,"context_lines":[{"line_number":665,"context_line":"                                       user_id\u003duser_id,"},{"line_number":666,"context_line":"                                       password\u003dpassword)"},{"line_number":667,"context_line":""},{"line_number":668,"context_line":"    def test_user_can_auth_and_change_password(self):"},{"line_number":669,"context_line":"        self.identity_api.authenticate(self.make_request(),"},{"line_number":670,"context_line":"                                       user_id\u003dself.user[\u0027id\u0027],"},{"line_number":671,"context_line":"                                       password\u003dself.initial_password)"}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_21d6d1c5","line":668,"updated":"2016-12-29 17:07:44.000000000","message":"So - this *doesn\u0027t* fail because the password change was initiated by the user, right? If the password change is forced by an administrator, then the assertion on line 677 would fail?","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"a490110495dd67bf1a251b9b3611510acb1d6fd5","unresolved":false,"context_lines":[{"line_number":665,"context_line":"                                       user_id\u003duser_id,"},{"line_number":666,"context_line":"                                       password\u003dpassword)"},{"line_number":667,"context_line":""},{"line_number":668,"context_line":"    def test_user_can_auth_and_change_password(self):"},{"line_number":669,"context_line":"        self.identity_api.authenticate(self.make_request(),"},{"line_number":670,"context_line":"                                       user_id\u003dself.user[\u0027id\u0027],"},{"line_number":671,"context_line":"                                       password\u003dself.initial_password)"}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_1600c300","line":668,"in_reply_to":"ba5201f7_21d6d1c5","updated":"2017-01-04 16:15:54.000000000","message":"This is after user create, so admin created the password. The user authenticates; if the user does not change their password, then line 677 would fail, because the next time they auth, the password would be expired. Does that make sense?","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":723,"context_line":"        self.identity_api.update_user(self.user[\u0027id\u0027], self.user)"},{"line_number":724,"context_line":"        # user id should be ignored for this check"},{"line_number":725,"context_line":"        self.assertPasswordDoesNotExpireAtNextAuth(self.user[\u0027id\u0027],"},{"line_number":726,"context_line":"                                                   admin_password)"}],"source_content_type":"text/x-python","patch_set":28,"id":"5a3905b3_83163b53","line":726,"updated":"2017-01-20 22:18:28.000000000","message":"Good tests all around!","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"20c55e3b323cd432353c948779f852921ef63d93","unresolved":false,"context_lines":[{"line_number":683,"context_line":"        self.user[\u0027password\u0027] \u003d admin_password"},{"line_number":684,"context_line":"        self.identity_api.update_user(self.user[\u0027id\u0027], self.user)"},{"line_number":685,"context_line":"        # first auth"},{"line_number":686,"context_line":"        self.identity_api.authenticate(self.make_request(),"},{"line_number":687,"context_line":"                                       user_id\u003dself.user[\u0027id\u0027],"},{"line_number":688,"context_line":"                                       password\u003dadmin_password)"},{"line_number":689,"context_line":"        # self-service password change"}],"source_content_type":"text/x-python","patch_set":31,"id":"5a3905b3_21f504ec","line":686,"updated":"2017-01-24 15:00:33.000000000","message":"At this point is the user required to change their password?","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"9e58b075018b886083cdf80aa02a5a54fe47e82a","unresolved":false,"context_lines":[{"line_number":683,"context_line":"        self.user[\u0027password\u0027] \u003d admin_password"},{"line_number":684,"context_line":"        self.identity_api.update_user(self.user[\u0027id\u0027], self.user)"},{"line_number":685,"context_line":"        # first auth"},{"line_number":686,"context_line":"        self.identity_api.authenticate(self.make_request(),"},{"line_number":687,"context_line":"                                       user_id\u003dself.user[\u0027id\u0027],"},{"line_number":688,"context_line":"                                       password\u003dadmin_password)"},{"line_number":689,"context_line":"        # self-service password change"}],"source_content_type":"text/x-python","patch_set":31,"id":"5a3905b3_81fb1846","line":686,"in_reply_to":"5a3905b3_21f504ec","updated":"2017-01-24 15:10:09.000000000","message":"Yes, at first auth.","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"60c8690370dc0580bf2c056706fe35315c3fea6d","unresolved":false,"context_lines":[{"line_number":683,"context_line":"        self.user[\u0027password\u0027] \u003d admin_password"},{"line_number":684,"context_line":"        self.identity_api.update_user(self.user[\u0027id\u0027], self.user)"},{"line_number":685,"context_line":"        # first auth"},{"line_number":686,"context_line":"        self.identity_api.authenticate(self.make_request(),"},{"line_number":687,"context_line":"                                       user_id\u003dself.user[\u0027id\u0027],"},{"line_number":688,"context_line":"                                       password\u003dadmin_password)"},{"line_number":689,"context_line":"        # self-service password change"}],"source_content_type":"text/x-python","patch_set":31,"id":"5a3905b3_7319a121","line":686,"in_reply_to":"5a3905b3_81fb1846","updated":"2017-01-24 15:47:12.000000000","message":"The current implementation is that they must changed is after the first auth or at the seconds auth, depending on how you look at it. The first auth is unfortunately successful.","commit_id":"1c131389eeb054947f50d28cc249cf67dcaa2f39"}],"keystone/tests/unit/test_v3_identity.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2c5982ebc943a9eb00c417ee6b2a996b52053e7f","unresolved":false,"context_lines":[{"line_number":903,"context_line":"            user_password \u003d {\u0027password\u0027: reset_password}"},{"line_number":904,"context_line":"            self.identity_api.update_user(self.user_ref[\u0027id\u0027], user_password)"},{"line_number":905,"context_line":""},{"line_number":906,"context_line":"            # wait one second to avoid race conditions with fernet"},{"line_number":907,"context_line":"            frozen_datetime.tick(delta\u003ddatetime.timedelta(seconds\u003d1))"},{"line_number":908,"context_line":""},{"line_number":909,"context_line":"            # authenticate with admin reset password"}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_e1c049e3","line":906,"updated":"2016-12-29 17:07:44.000000000","message":"race conditions with fernet and revocation events (which is important here because we\u0027re creating one with the password change).","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"a490110495dd67bf1a251b9b3611510acb1d6fd5","unresolved":false,"context_lines":[{"line_number":903,"context_line":"            user_password \u003d {\u0027password\u0027: reset_password}"},{"line_number":904,"context_line":"            self.identity_api.update_user(self.user_ref[\u0027id\u0027], user_password)"},{"line_number":905,"context_line":""},{"line_number":906,"context_line":"            # wait one second to avoid race conditions with fernet"},{"line_number":907,"context_line":"            frozen_datetime.tick(delta\u003ddatetime.timedelta(seconds\u003d1))"},{"line_number":908,"context_line":""},{"line_number":909,"context_line":"            # authenticate with admin reset password"}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_760d8f36","line":906,"in_reply_to":"ba5201f7_e1c049e3","updated":"2017-01-04 16:15:54.000000000","message":"++","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"8ae12ccc1be89659ff7586c3aac34bf24bc2bfdf","unresolved":false,"context_lines":[{"line_number":903,"context_line":"            user_password \u003d {\u0027password\u0027: reset_password}"},{"line_number":904,"context_line":"            self.identity_api.update_user(self.user_ref[\u0027id\u0027], user_password)"},{"line_number":905,"context_line":""},{"line_number":906,"context_line":"            # wait one second to avoid race conditions with fernet"},{"line_number":907,"context_line":"            frozen_datetime.tick(delta\u003ddatetime.timedelta(seconds\u003d1))"},{"line_number":908,"context_line":""},{"line_number":909,"context_line":"            # authenticate with admin reset password"}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_27a9097c","line":906,"in_reply_to":"ba5201f7_e1c049e3","updated":"2017-01-06 18:14:27.000000000","message":"Done","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2c5982ebc943a9eb00c417ee6b2a996b52053e7f","unresolved":false,"context_lines":[{"line_number":937,"context_line":"            new_password \u003d uuid.uuid4().hex"},{"line_number":938,"context_line":"            self.change_password(password\u003dnew_password,"},{"line_number":939,"context_line":"                                 original_password\u003dreset_password,"},{"line_number":940,"context_line":"                                 expected_status\u003dhttp_client.NO_CONTENT)"},{"line_number":941,"context_line":""},{"line_number":942,"context_line":""},{"line_number":943,"context_line":"class PasswordValidationTestCase(UserSelfServiceChangingPasswordsTestCase):"}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_61ad3931","line":940,"updated":"2016-12-29 17:07:44.000000000","message":"We can add another authentication here to ensure that the new password works after the first use.","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"8ae12ccc1be89659ff7586c3aac34bf24bc2bfdf","unresolved":false,"context_lines":[{"line_number":937,"context_line":"            new_password \u003d uuid.uuid4().hex"},{"line_number":938,"context_line":"            self.change_password(password\u003dnew_password,"},{"line_number":939,"context_line":"                                 original_password\u003dreset_password,"},{"line_number":940,"context_line":"                                 expected_status\u003dhttp_client.NO_CONTENT)"},{"line_number":941,"context_line":""},{"line_number":942,"context_line":""},{"line_number":943,"context_line":"class PasswordValidationTestCase(UserSelfServiceChangingPasswordsTestCase):"}],"source_content_type":"text/x-python","patch_set":24,"id":"ba5201f7_87fc7573","line":940,"in_reply_to":"ba5201f7_61ad3931","updated":"2017-01-06 18:14:27.000000000","message":"Done","commit_id":"60c40da5a62481ddb0f17aa7ed171a15b86b3dcd"}],"releasenotes/notes/pci-force-password-change-after-reset-8ec5a74af242b547.yaml":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d8932373a7094efb60fcc95a7c3212f9116f41bb","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":16,"id":"1a6eadb0_07ffe101","updated":"2016-12-20 04:57:06.000000000","message":"i finally don\u0027t have to edit a release note \\o/\n\nmy persistence is paying off","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4ad61664e062c14df8372eaddb468e1ec60abc69","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - \u003e"},{"line_number":4,"context_line":"    [`bug 1645487 \u003chttps://bugs.launchpad.net/keystone/+bug/1645487\u003e`_]"},{"line_number":5,"context_line":"    Added a new PCI-DSS feature that will require users to immediately change"},{"line_number":6,"context_line":"    their password upon first use after an administrative password reset. The"},{"line_number":7,"context_line":"    new feature can be enabled by setting `[security_compliance]"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1a6eadb0_5c81b64c","line":4,"updated":"2016-12-19 22:18:09.000000000","message":"Bug*","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4ad61664e062c14df8372eaddb468e1ec60abc69","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - \u003e"},{"line_number":4,"context_line":"    [`bug 1645487 \u003chttps://bugs.launchpad.net/keystone/+bug/1645487\u003e`_]"},{"line_number":5,"context_line":"    Added a new PCI-DSS feature that will require users to immediately change"},{"line_number":6,"context_line":"    their password upon first use after an administrative password reset. The"},{"line_number":7,"context_line":"    new feature can be enabled by setting `[security_compliance]"},{"line_number":8,"context_line":"    change_password_required_after_reset` in `keystone.conf`."}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1a6eadb0_7c867266","line":5,"updated":"2016-12-19 22:18:09.000000000","message":"added*","commit_id":"db16cdccb0fbc4d6997c0fd044768af00b33e22b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"def8a427b559f797cfa43bbed77fba3ee51dc841","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    `[security_compliance] change_password_required_after_reset` in"},{"line_number":9,"context_line":"    `keystone.conf`. Note: this feature would require all existing users to"},{"line_number":10,"context_line":"    meet the new standard. Therefore, enabling this feature should be carefully"},{"line_number":11,"context_line":"    considered and planned."}],"source_content_type":"text/x-yaml","patch_set":28,"id":"5a3905b3_f6197f7a","line":11,"updated":"2017-01-20 22:18:28.000000000","message":"I liked \"coordinated\" from the other doc.","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ab61a391bd8ac14ac711739d978bdb7d290003ea","unresolved":false,"context_lines":[{"line_number":8,"context_line":"    `[security_compliance] change_password_required_after_reset` in"},{"line_number":9,"context_line":"    `keystone.conf`. Note: this feature would require all existing users to"},{"line_number":10,"context_line":"    meet the new standard. Therefore, enabling this feature should be carefully"},{"line_number":11,"context_line":"    considered and planned."}],"source_content_type":"text/x-yaml","patch_set":28,"id":"5a3905b3_00723849","line":11,"in_reply_to":"5a3905b3_f6197f7a","updated":"2017-01-21 05:21:46.000000000","message":"Done","commit_id":"2aab0cd239ee2d01c567b201d5443b33b5d9e696"}]}