)]}'
{"keystone/common/password_hashing.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"f00c39cb84ae744c1bf80ccb8801a85c91140142","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    except KeyError:"},{"line_number":51,"context_line":"        raise ValueError("},{"line_number":52,"context_line":"            _(\u0027Unsupported password hashing algorithm: %s\u0027) %"},{"line_number":53,"context_line":"            CONF.identity.password_hash_algorithm)"},{"line_number":54,"context_line":""},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"def verify_length_and_trunc_password(password):"}],"source_content_type":"text/x-python","patch_set":11,"id":"9a30ddce_deedb38c","line":53,"range":{"start_line":53,"start_character":12,"end_line":53,"end_character":50},"updated":"2017-03-07 18:59:55.000000000","message":"This will be fixed to pull the hash-ident out vs. leaning on the password.hash_algo config, this is an incorrect error.\n\nfixed in either followup or subsequent patchset.","commit_id":"b333ab75d7c8e7f4c80da13bd1f912e87603fc53"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6a641255b0aa68fd07377e4d0848ba6020fc6f56","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from itertools import chain"},{"line_number":17,"context_line":"from oslo_log import log"},{"line_number":18,"context_line":"import passlib.hash"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_8ba3a09e","line":16,"updated":"2017-03-27 17:38:03.000000000","message":"module imports, this imports a class.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":13,"context_line":"#    License for the specific language governing permissions and limitations"},{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from itertools import chain"},{"line_number":17,"context_line":"from oslo_log import log"},{"line_number":18,"context_line":"import passlib.hash"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_e3bfb3a7","line":16,"in_reply_to":"ffe62b97_8ba3a09e","updated":"2017-03-28 20:40:19.000000000","message":"We should fix hacking then. If hacking isn\u0027t detecting this as a non-module import, we should correct that. Having reviewers needing to do this/quibble about imports is incorrect.\n\nI can change it but will say we need to fix hacking as well. If hacking does not explicitly block importing classes, then we should stop requiring that.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6a641255b0aa68fd07377e4d0848ba6020fc6f56","unresolved":false,"context_lines":[{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from itertools import chain"},{"line_number":17,"context_line":"from oslo_log import log"},{"line_number":18,"context_line":"import passlib.hash"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"import keystone.conf"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_abb544cf","line":17,"updated":"2017-03-27 17:38:03.000000000","message":"New section for third-party imports","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":14,"context_line":"#    under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"from itertools import chain"},{"line_number":17,"context_line":"from oslo_log import log"},{"line_number":18,"context_line":"import passlib.hash"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"import keystone.conf"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_a3e3ebd8","line":17,"in_reply_to":"ffe62b97_abb544cf","updated":"2017-03-28 20:40:19.000000000","message":"This was a typo, it should be a space above oslo.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6a641255b0aa68fd07377e4d0848ba6020fc6f56","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"import keystone.conf"},{"line_number":21,"context_line":"from keystone import exception"},{"line_number":22,"context_line":"from keystone.i18n import _LW, _"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"CONF \u003d keystone.conf.CONF"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_8bd160fe","line":22,"updated":"2017-03-27 17:38:03.000000000","message":"_LW can be removed. Debug translations are going away soon https://review.openstack.org/#/c/447864/","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e849634f76eb046c5c784d18cb578bcb07452612","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    prefix: module for module, prefix in chain("},{"line_number":42,"context_line":"        *[zip([mod] * len(getattr(mod, \u0027ident_values\u0027, (mod.ident,))),"},{"line_number":43,"context_line":"              getattr(mod, \u0027ident_values\u0027, (mod.ident,)))"},{"line_number":44,"context_line":"          for mod in SUPPORTED_HASHERS])}"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"def _get_hasher_from_ident(hashed):"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_31e11a00","line":44,"updated":"2017-03-23 21:56:43.000000000","message":"Based on this - could we write some sort of `keystone-manage password-hash` script that told operators how many or which users have yet to change their password? That might be a handy tool for operators as they orchestrate the change.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"a824556dfe2ae04b88b32b99834389ec7afcfc6d","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    prefix: module for module, prefix in chain("},{"line_number":42,"context_line":"        *[zip([mod] * len(getattr(mod, \u0027ident_values\u0027, (mod.ident,))),"},{"line_number":43,"context_line":"              getattr(mod, \u0027ident_values\u0027, (mod.ident,)))"},{"line_number":44,"context_line":"          for mod in SUPPORTED_HASHERS])}"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"def _get_hasher_from_ident(hashed):"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_9c27ddb7","line":44,"in_reply_to":"ffe62b97_31e11a00","updated":"2017-03-23 22:24:58.000000000","message":"++ this would be useful to know who has or has not followed the mandate to reset their passwords.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"2307fde3a47ea73cdb5992e898368506ce9afa7a","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    prefix: module for module, prefix in chain("},{"line_number":42,"context_line":"        *[zip([mod] * len(getattr(mod, \u0027ident_values\u0027, (mod.ident,))),"},{"line_number":43,"context_line":"              getattr(mod, \u0027ident_values\u0027, (mod.ident,)))"},{"line_number":44,"context_line":"          for mod in SUPPORTED_HASHERS])}"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"def _get_hasher_from_ident(hashed):"}],"source_content_type":"text/x-python","patch_set":13,"id":"5ff73747_c58a8068","line":44,"in_reply_to":"ffe62b97_8325875e","updated":"2017-04-28 02:56:56.000000000","message":"+1 agreeded out of scope but a follow on providing this functionality would be excellent, especially from an operator perspective.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":41,"context_line":"    prefix: module for module, prefix in chain("},{"line_number":42,"context_line":"        *[zip([mod] * len(getattr(mod, \u0027ident_values\u0027, (mod.ident,))),"},{"line_number":43,"context_line":"              getattr(mod, \u0027ident_values\u0027, (mod.ident,)))"},{"line_number":44,"context_line":"          for mod in SUPPORTED_HASHERS])}"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"def _get_hasher_from_ident(hashed):"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_8325875e","line":44,"in_reply_to":"ffe62b97_9c27ddb7","updated":"2017-03-28 20:40:19.000000000","message":"I would consider that out of scope of this patch, but worth doing in a separate (additional) patchset after this one.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6a641255b0aa68fd07377e4d0848ba6020fc6f56","unresolved":false,"context_lines":[{"line_number":61,"context_line":"            if CONF.strict_password_check:"},{"line_number":62,"context_line":"                raise exception.PasswordVerificationError(size\u003dmax_length)"},{"line_number":63,"context_line":"            else:"},{"line_number":64,"context_line":"                msg \u003d _LW(\"Truncating user password to %d characters.\")"},{"line_number":65,"context_line":"                LOG.warning(msg, max_length)"},{"line_number":66,"context_line":"                return password[:max_length]"},{"line_number":67,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_8b2840e2","line":64,"updated":"2017-03-27 17:38:03.000000000","message":"No need to translate the log message here.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":61,"context_line":"            if CONF.strict_password_check:"},{"line_number":62,"context_line":"                raise exception.PasswordVerificationError(size\u003dmax_length)"},{"line_number":63,"context_line":"            else:"},{"line_number":64,"context_line":"                msg \u003d _LW(\"Truncating user password to %d characters.\")"},{"line_number":65,"context_line":"                LOG.warning(msg, max_length)"},{"line_number":66,"context_line":"                return password[:max_length]"},{"line_number":67,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_8357c7ca","line":64,"in_reply_to":"ffe62b97_8b2840e2","updated":"2017-03-28 20:40:19.000000000","message":"This was copied from utils. Code was not changed. Can change it in one fell swoop if desired (this comment applies to any other _LW\u0027s/_LEs/etc.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6a641255b0aa68fd07377e4d0848ba6020fc6f56","unresolved":false,"context_lines":[{"line_number":66,"context_line":"                return password[:max_length]"},{"line_number":67,"context_line":"        else:"},{"line_number":68,"context_line":"            return password"},{"line_number":69,"context_line":"    except TypeError:"},{"line_number":70,"context_line":"        raise exception.ValidationError(attribute\u003d\u0027string\u0027, target\u003d\u0027password\u0027)"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_6b517c62","line":69,"updated":"2017-03-27 17:38:03.000000000","message":"Are expecting something passed in that isn\u0027t a string?","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":66,"context_line":"                return password[:max_length]"},{"line_number":67,"context_line":"        else:"},{"line_number":68,"context_line":"            return password"},{"line_number":69,"context_line":"    except TypeError:"},{"line_number":70,"context_line":"        raise exception.ValidationError(attribute\u003d\u0027string\u0027, target\u003d\u0027password\u0027)"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_63ade399","line":69,"in_reply_to":"ffe62b97_6b517c62","updated":"2017-03-28 20:40:19.000000000","message":"Copied from utils. I didn\u0027t want to change logic / exceptions in this case (anything used in utils that didn\u0027t need to be updated specifically was not)","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd1bcb3d2929e7c26faf4bdf8b1c6ba75a361b0a","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    return dict(user, password\u003dhash_password(password))"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"def hash_password_compat(password):"},{"line_number":97,"context_line":"    password_utf8 \u003d verify_length_and_trunc_password(password).encode(\u0027utf-8\u0027)"},{"line_number":98,"context_line":"    return passlib.hash.sha512_crypt.using(rounds\u003dCONF.crypt_strength).hash("},{"line_number":99,"context_line":"        password_utf8)"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_ebc74145","line":96,"updated":"2017-03-23 21:17:20.000000000","message":"Does it make sense to wrap this in a deprecated utility?","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6a641255b0aa68fd07377e4d0848ba6020fc6f56","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    params \u003d {}"},{"line_number":106,"context_line":"    password_utf8 \u003d verify_length_and_trunc_password(password).encode(\u0027utf-8\u0027)"},{"line_number":107,"context_line":"    conf_hasher \u003d CONF.identity.password_hash_algorithm"},{"line_number":108,"context_line":"    for h in SUPPORTED_HASHERS:"},{"line_number":109,"context_line":"        if conf_hasher \u003d\u003d h.name:"},{"line_number":110,"context_line":"            hasher \u003d h"},{"line_number":111,"context_line":"            break"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_2b8ed4cf","line":108,"updated":"2017-03-27 17:38:03.000000000","message":"Why isn\u0027t SUPPORTED_HASHERS a dict so that we don\u0027t have to do this logic for every hash?","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    params \u003d {}"},{"line_number":106,"context_line":"    password_utf8 \u003d verify_length_and_trunc_password(password).encode(\u0027utf-8\u0027)"},{"line_number":107,"context_line":"    conf_hasher \u003d CONF.identity.password_hash_algorithm"},{"line_number":108,"context_line":"    for h in SUPPORTED_HASHERS:"},{"line_number":109,"context_line":"        if conf_hasher \u003d\u003d h.name:"},{"line_number":110,"context_line":"            hasher \u003d h"},{"line_number":111,"context_line":"            break"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_e3e0d328","line":108,"in_reply_to":"ffe62b97_2b8ed4cf","updated":"2017-03-28 20:40:19.000000000","message":"For the stupidest of stupid reasons:\n\nTo ensure nothing can \"add\" to the set. We could make it a dict, but we don\u0027t have a FrozenDict and I was trying to avoid creating a new class.\n\nI really want to be sure that code doesn\u0027t accidentally mutate the data at runtime. It\u0027s suspenders and a belt for the cost of a small iteration\n\nHappy to make it a dict if that is really desired.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd1bcb3d2929e7c26faf4bdf8b1c6ba75a361b0a","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"        return hasher.using(**params).hash(password_utf8)"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"    raise RuntimeError("},{"line_number":129,"context_line":"        _(\u0027Password Hash Algorithm %s not found\u0027) %"},{"line_number":130,"context_line":"        CONF.identity.password_hash_algorithm)"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_eb686122","line":128,"updated":"2017-03-23 21:17:20.000000000","message":"This could be moved up to line 111 after the break. We could then make this exception specific to support and bump it up a couple lines.\n\n  _(\u0027Password Hash Algorithm %s not supported\u0027)\n\nThat way operators have a little more information to go on (is the hasher value empty or did I specify an unsupported hasher).","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6a641255b0aa68fd07377e4d0848ba6020fc6f56","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"        return hasher.using(**params).hash(password_utf8)"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"    raise RuntimeError("},{"line_number":129,"context_line":"        _(\u0027Password Hash Algorithm %s not found\u0027) %"},{"line_number":130,"context_line":"        CONF.identity.password_hash_algorithm)"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_eb346cfd","line":128,"in_reply_to":"ffe62b97_eb686122","updated":"2017-03-27 17:38:03.000000000","message":"++","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"        return hasher.using(**params).hash(password_utf8)"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"    raise RuntimeError("},{"line_number":129,"context_line":"        _(\u0027Password Hash Algorithm %s not found\u0027) %"},{"line_number":130,"context_line":"        CONF.identity.password_hash_algorithm)"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_e31573e6","line":128,"in_reply_to":"ffe62b97_eb686122","updated":"2017-03-28 20:40:19.000000000","message":"This error is already indicating explicitly what was configured in keystone conf. This","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fc55f835e526f12302e3c96d20ceda1d872362c","unresolved":false,"context_lines":[{"line_number":64,"context_line":"            if CONF.strict_password_check:"},{"line_number":65,"context_line":"                raise exception.PasswordVerificationError(size\u003dmax_length)"},{"line_number":66,"context_line":"            else:"},{"line_number":67,"context_line":"                msg \u003d \"Truncating user password to %d characters.\""},{"line_number":68,"context_line":"                LOG.warning(msg, max_length)"},{"line_number":69,"context_line":"                return password[:max_length]"},{"line_number":70,"context_line":"        else:"},{"line_number":71,"context_line":"            return password"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_5c762640","line":68,"range":{"start_line":67,"start_character":16,"end_line":68,"end_character":44},"updated":"2017-04-29 15:58:01.000000000","message":"I realize that this is just carried over from utils and this isn\u0027t he place to fix it, but since I\u0027m noticing it...I\u0027m concerned this unnecessarily leaks user information: I don\u0027t trust my cloud administrator with my password, and I don\u0027t want them to know how long it is either. Could the warning just be omitted?","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e315328c37bd8e622cc828d4a4752108e3ed8eb8","unresolved":false,"context_lines":[{"line_number":64,"context_line":"            if CONF.strict_password_check:"},{"line_number":65,"context_line":"                raise exception.PasswordVerificationError(size\u003dmax_length)"},{"line_number":66,"context_line":"            else:"},{"line_number":67,"context_line":"                msg \u003d \"Truncating user password to %d characters.\""},{"line_number":68,"context_line":"                LOG.warning(msg, max_length)"},{"line_number":69,"context_line":"                return password[:max_length]"},{"line_number":70,"context_line":"        else:"},{"line_number":71,"context_line":"            return password"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_d27c5f73","line":68,"range":{"start_line":67,"start_character":16,"end_line":68,"end_character":44},"in_reply_to":"5ff73747_5c762640","updated":"2017-04-29 21:44:31.000000000","message":"This was originally communicated to the cloud admin to indicate if folks were using longer passwords than allowed. We could eliminate the warn.","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fc55f835e526f12302e3c96d20ceda1d872362c","unresolved":false,"context_lines":[{"line_number":66,"context_line":"            else:"},{"line_number":67,"context_line":"                msg \u003d \"Truncating user password to %d characters.\""},{"line_number":68,"context_line":"                LOG.warning(msg, max_length)"},{"line_number":69,"context_line":"                return password[:max_length]"},{"line_number":70,"context_line":"        else:"},{"line_number":71,"context_line":"            return password"},{"line_number":72,"context_line":"    except TypeError:"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_dc97d639","line":69,"range":{"start_line":69,"start_character":23,"end_line":69,"end_character":44},"updated":"2017-04-29 15:58:01.000000000","message":"Also realize this is just a carryover but is simple truncation the best option? What about running a preliminary hash instead, as suggested here: https://crypto.stackexchange.com/questions/24993/is-there-a-way-to-use-bcrypt-with-passwords-longer-than-72-bytes-securely\n\nCould we use this function for hash_password_compat and using something better for the new hash_password?","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e315328c37bd8e622cc828d4a4752108e3ed8eb8","unresolved":false,"context_lines":[{"line_number":66,"context_line":"            else:"},{"line_number":67,"context_line":"                msg \u003d \"Truncating user password to %d characters.\""},{"line_number":68,"context_line":"                LOG.warning(msg, max_length)"},{"line_number":69,"context_line":"                return password[:max_length]"},{"line_number":70,"context_line":"        else:"},{"line_number":71,"context_line":"            return password"},{"line_number":72,"context_line":"    except TypeError:"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_328b8368","line":69,"range":{"start_line":69,"start_character":23,"end_line":69,"end_character":44},"in_reply_to":"5ff73747_dc97d639","updated":"2017-04-29 21:44:31.000000000","message":"Sure. we can examine that / happy to add it as a quick followup (required to land at the same time[ish] as this patch), or have you/someone else do that bit.","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fc55f835e526f12302e3c96d20ceda1d872362c","unresolved":false,"context_lines":[{"line_number":96,"context_line":"    return dict(user, password\u003dhash_password(password))"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"def hash_password_compat(password):"},{"line_number":100,"context_line":"    password_utf8 \u003d verify_length_and_trunc_password(password).encode(\u0027utf-8\u0027)"},{"line_number":101,"context_line":"    return passlib.hash.sha512_crypt.using(rounds\u003dCONF.crypt_strength).hash("},{"line_number":102,"context_line":"        password_utf8)"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_5cc4e63f","line":99,"updated":"2017-04-29 15:58:01.000000000","message":"This needs a docstring","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e315328c37bd8e622cc828d4a4752108e3ed8eb8","unresolved":false,"context_lines":[{"line_number":96,"context_line":"    return dict(user, password\u003dhash_password(password))"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"def hash_password_compat(password):"},{"line_number":100,"context_line":"    password_utf8 \u003d verify_length_and_trunc_password(password).encode(\u0027utf-8\u0027)"},{"line_number":101,"context_line":"    return passlib.hash.sha512_crypt.using(rounds\u003dCONF.crypt_strength).hash("},{"line_number":102,"context_line":"        password_utf8)"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_d2f1ff02","line":99,"in_reply_to":"5ff73747_5cc4e63f","updated":"2017-04-29 21:44:31.000000000","message":"Sure, can be done as a followup.","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fc55f835e526f12302e3c96d20ceda1d872362c","unresolved":false,"context_lines":[{"line_number":112,"context_line":"    if hasher is None:"},{"line_number":113,"context_line":"        raise RuntimeError("},{"line_number":114,"context_line":"            _(\u0027Password Hash Algorithm %s not found\u0027) %"},{"line_number":115,"context_line":"            CONF.identity.password_hash_algorithm)"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    if CONF.identity.password_hash_rounds:"},{"line_number":118,"context_line":"        params[\u0027rounds\u0027] \u003d CONF.identity.password_hash_rounds"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_3cbfdaaa","line":115,"range":{"start_line":115,"start_character":12,"end_line":115,"end_character":49},"updated":"2017-04-29 15:58:01.000000000","message":"Could use the variable you already defined for this, conf_hasher","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e315328c37bd8e622cc828d4a4752108e3ed8eb8","unresolved":false,"context_lines":[{"line_number":112,"context_line":"    if hasher is None:"},{"line_number":113,"context_line":"        raise RuntimeError("},{"line_number":114,"context_line":"            _(\u0027Password Hash Algorithm %s not found\u0027) %"},{"line_number":115,"context_line":"            CONF.identity.password_hash_algorithm)"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    if CONF.identity.password_hash_rounds:"},{"line_number":118,"context_line":"        params[\u0027rounds\u0027] \u003d CONF.identity.password_hash_rounds"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_f2ee3b20","line":115,"range":{"start_line":115,"start_character":12,"end_line":115,"end_character":49},"in_reply_to":"5ff73747_3cbfdaaa","updated":"2017-04-29 21:44:31.000000000","message":"Sure","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ee2c0efb1207477aecd0d0b465b06039db06581","unresolved":false,"context_lines":[{"line_number":31,"context_line":"                               passlib.hash.pbkdf2_sha512,"},{"line_number":32,"context_line":"                               passlib.hash.sha512_crypt])"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"_HASHER_NAME_MAP \u003d {hasher.name: hasher for hasher in SUPPORTED_HASHERS}"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"# NOTE(notmorgan): Build the list of prefixes. This comprehension builds"}],"source_content_type":"text/x-python","patch_set":17,"id":"ff0f0b1f_cd72f449","line":34,"updated":"2017-05-19 17:38:05.000000000","message":"Nice - thanks for doing this.","commit_id":"8ad765e0230ceeb5ca7c36ec3ed6d25c57b22c9d"}],"keystone/common/sql/expand_repo/versions/023_expand_add_second_password_column_for_expanded_hash_sizes.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6a641255b0aa68fd07377e4d0848ba6020fc6f56","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    meta.bind \u003d migrate_engine"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    # NOTE(notmorgan): To support the full range of scrypt and pbkfd password"},{"line_number":21,"context_line":"    # hash lengths, this should be closer to varchar(1500) instead of"},{"line_number":22,"context_line":"    # varchar(255)."},{"line_number":23,"context_line":"    password_hash \u003d sql.Column(\u0027password_hash\u0027, sql.String(255), nullable\u003dTrue)"},{"line_number":24,"context_line":"    password_table \u003d sql.Table(\u0027password\u0027, meta, autoload\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_8b0e0039","line":21,"updated":"2017-03-27 17:38:03.000000000","message":"Why are we only doing 255 then?","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    meta.bind \u003d migrate_engine"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    # NOTE(notmorgan): To support the full range of scrypt and pbkfd password"},{"line_number":21,"context_line":"    # hash lengths, this should be closer to varchar(1500) instead of"},{"line_number":22,"context_line":"    # varchar(255)."},{"line_number":23,"context_line":"    password_hash \u003d sql.Column(\u0027password_hash\u0027, sql.String(255), nullable\u003dTrue)"},{"line_number":24,"context_line":"    password_table \u003d sql.Table(\u0027password\u0027, meta, autoload\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_23cfdb56","line":21,"in_reply_to":"ffe62b97_8b0e0039","updated":"2017-03-28 20:40:19.000000000","message":"Because people get cranky about extra bytes being used in MySQL columns to store the varchar. We could also just use a textcolumn *shrug*.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fc55f835e526f12302e3c96d20ceda1d872362c","unresolved":false,"context_lines":[{"line_number":17,"context_line":"    meta \u003d sql.MetaData()"},{"line_number":18,"context_line":"    meta.bind \u003d migrate_engine"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    # NOTE(notmorgan): To support the full range of scrypt and pbkfd password"},{"line_number":21,"context_line":"    # hash lengths, this should be closer to varchar(1500) instead of"},{"line_number":22,"context_line":"    # varchar(255)."},{"line_number":23,"context_line":"    password_hash \u003d sql.Column(\u0027password_hash\u0027, sql.String(255), nullable\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_1ce09ecc","line":20,"range":{"start_line":20,"start_character":63,"end_line":20,"end_character":68},"updated":"2017-04-29 15:58:01.000000000","message":"typo, pbkdf","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e315328c37bd8e622cc828d4a4752108e3ed8eb8","unresolved":false,"context_lines":[{"line_number":17,"context_line":"    meta \u003d sql.MetaData()"},{"line_number":18,"context_line":"    meta.bind \u003d migrate_engine"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    # NOTE(notmorgan): To support the full range of scrypt and pbkfd password"},{"line_number":21,"context_line":"    # hash lengths, this should be closer to varchar(1500) instead of"},{"line_number":22,"context_line":"    # varchar(255)."},{"line_number":23,"context_line":"    password_hash \u003d sql.Column(\u0027password_hash\u0027, sql.String(255), nullable\u003dTrue)"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_f2899b74","line":20,"range":{"start_line":20,"start_character":63,"end_line":20,"end_character":68},"in_reply_to":"5ff73747_1ce09ecc","updated":"2017-04-29 21:44:31.000000000","message":"Fair enough, can be fixed in a followup, since it\u0027s a comment.","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"}],"keystone/common/utils.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6a641255b0aa68fd07377e4d0848ba6020fc6f56","unresolved":false,"context_lines":[{"line_number":37,"context_line":"from keystone.common import password_hashing"},{"line_number":38,"context_line":"import keystone.conf"},{"line_number":39,"context_line":"from keystone import exception"},{"line_number":40,"context_line":"from keystone.i18n import _, _LE"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"CONF \u003d keystone.conf.CONF"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_2e182273","line":40,"updated":"2017-03-27 17:38:03.000000000","message":"This line will conflict with the patch I referred to earlier.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":37,"context_line":"from keystone.common import password_hashing"},{"line_number":38,"context_line":"import keystone.conf"},{"line_number":39,"context_line":"from keystone import exception"},{"line_number":40,"context_line":"from keystone.i18n import _, _LE"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"CONF \u003d keystone.conf.CONF"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_c3070f82","line":40,"in_reply_to":"ffe62b97_2e182273","updated":"2017-03-28 20:40:19.000000000","message":"Conflicts can be resolved with a rebase or update depending on when/whichever lands first.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ee2c0efb1207477aecd0d0b465b06039db06581","unresolved":false,"context_lines":[{"line_number":53,"context_line":"# used for ID transformation."},{"line_number":54,"context_line":"RESOURCE_ID_NAMESPACE \u003d uuid.UUID(\u00274332ecab-770b-4288-a680-b9aca3b1b153\u0027)"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"# Compatibilty for password hashing functions."},{"line_number":57,"context_line":"verify_length_and_trunc_password \u003d password_hashing.verify_length_and_trunc_password  # noqa"},{"line_number":58,"context_line":"hash_password \u003d password_hashing.hash_password"},{"line_number":59,"context_line":"hash_user_password \u003d password_hashing.hash_user_password"}],"source_content_type":"text/x-python","patch_set":17,"id":"ff0f0b1f_cd5e7411","line":56,"updated":"2017-05-19 17:38:05.000000000","message":"Note - we could refactor this at some point in the future to reference the variable in common directly.","commit_id":"8ad765e0230ceeb5ca7c36ec3ed6d25c57b22c9d"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e5349ecd46b7221f852f837634bce567c3a0087d","unresolved":false,"context_lines":[{"line_number":53,"context_line":"# used for ID transformation."},{"line_number":54,"context_line":"RESOURCE_ID_NAMESPACE \u003d uuid.UUID(\u00274332ecab-770b-4288-a680-b9aca3b1b153\u0027)"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"# Compatibilty for password hashing functions."},{"line_number":57,"context_line":"verify_length_and_trunc_password \u003d password_hashing.verify_length_and_trunc_password  # noqa"},{"line_number":58,"context_line":"hash_password \u003d password_hashing.hash_password"},{"line_number":59,"context_line":"hash_user_password \u003d password_hashing.hash_user_password"}],"source_content_type":"text/x-python","patch_set":17,"id":"ff0f0b1f_50443b1b","line":56,"in_reply_to":"ff0f0b1f_cd5e7411","updated":"2017-05-19 18:04:40.000000000","message":"I think all cases are referencing the new location, but I wanted to be 100% safe here.","commit_id":"8ad765e0230ceeb5ca7c36ec3ed6d25c57b22c9d"}],"keystone/conf/default.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd1bcb3d2929e7c26faf4bdf8b1c6ba75a361b0a","unresolved":false,"context_lines":[{"line_number":121,"context_line":"    default\u003d10000,"},{"line_number":122,"context_line":"    min\u003d1000,"},{"line_number":123,"context_line":"    max\u003d100000,"},{"line_number":124,"context_line":"    deprecated_since\u003dversionutils.deprecated.PIKE,"},{"line_number":125,"context_line":"    deprecated_reason\u003dutils.fmt(\"\"\""},{"line_number":126,"context_line":"sha512_crypt is insufficient for password hashes, use of bcrypt, pbkfd2_sha512"},{"line_number":127,"context_line":"and scrypt are now supported. Options are located in the [identity] config"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_a88dbf7c","line":124,"updated":"2017-03-23 21:17:20.000000000","message":"Do we need `deprecated_for_removal` here, too?","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":121,"context_line":"    default\u003d10000,"},{"line_number":122,"context_line":"    min\u003d1000,"},{"line_number":123,"context_line":"    max\u003d100000,"},{"line_number":124,"context_line":"    deprecated_since\u003dversionutils.deprecated.PIKE,"},{"line_number":125,"context_line":"    deprecated_reason\u003dutils.fmt(\"\"\""},{"line_number":126,"context_line":"sha512_crypt is insufficient for password hashes, use of bcrypt, pbkfd2_sha512"},{"line_number":127,"context_line":"and scrypt are now supported. Options are located in the [identity] config"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_a331ab5c","line":124,"in_reply_to":"ffe62b97_a88dbf7c","updated":"2017-03-28 20:40:19.000000000","message":"Possibly?","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"}],"keystone/conf/identity.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ad47332a8991c8c8ab4f3b1fc20d7623a880b18a","unresolved":false,"context_lines":[{"line_number":117,"context_line":"\"\"\"))"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"password_hash_rounds \u003d cfg.IntOpt("},{"line_number":120,"context_line":"    \u0027password_hash_rounds\u0027,"},{"line_number":121,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":122,"context_line":"This option represents a trade off between security and performance. Higher"},{"line_number":123,"context_line":"values lead to slower performance, but higher security. Changing this option"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba2be162_f0744d9d","line":120,"updated":"2017-03-01 22:00:52.000000000","message":"If the default hash algorithm is going to be bcrypt, we can safely default this to 12. We need to be explicit in each description how these options are related though.","commit_id":"ce274256830e45bf8db4e14886b114ef0ef3fe45"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5515c1255a2b909fff86791323dbc7d1b890af31","unresolved":false,"context_lines":[{"line_number":117,"context_line":"\"\"\"))"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"password_hash_rounds \u003d cfg.IntOpt("},{"line_number":120,"context_line":"    \u0027password_hash_rounds\u0027,"},{"line_number":121,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":122,"context_line":"This option represents a trade off between security and performance. Higher"},{"line_number":123,"context_line":"values lead to slower performance, but higher security. Changing this option"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba2be162_86691bc1","line":120,"in_reply_to":"ba2be162_f0744d9d","updated":"2017-03-01 22:08:33.000000000","message":"This is reused, and each backend uses a different default. 12 is default for bcrypt,\n16 is for scrypt, and both of those are invalid for pbkdf2_sha512. Basically, we are letting passlib dictate the specifics but the help text is being used to communicate what the defaults are (which are different) dpeending on the selection.\n\nDefaulting to 12 would make scrypt less secure when used w/o adjusting the rounds and would prevent pdkfd2 from working at all w/o changing this option.","commit_id":"ce274256830e45bf8db4e14886b114ef0ef3fe45"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ad47332a8991c8c8ab4f3b1fc20d7623a880b18a","unresolved":false,"context_lines":[{"line_number":154,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":155,"context_line":"Optional block size to pass to scrypt hash function (the ``r`` parameter)."},{"line_number":156,"context_line":"Useful for tuning scrypt to optimal performance for your CPU architecture."},{"line_number":157,"context_line":"Defaults to 8."},{"line_number":158,"context_line":"\"\"\"))"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"scrypt_paralellism \u003d cfg.IntOpt("}],"source_content_type":"text/x-python","patch_set":9,"id":"ba2be162_70977d90","line":157,"updated":"2017-03-01 22:00:52.000000000","message":"Should we not have a default specified in the method signature?","commit_id":"ce274256830e45bf8db4e14886b114ef0ef3fe45"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"802e06fe11dc399da0975426e37d321275c78476","unresolved":false,"context_lines":[{"line_number":154,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":155,"context_line":"Optional block size to pass to scrypt hash function (the ``r`` parameter)."},{"line_number":156,"context_line":"Useful for tuning scrypt to optimal performance for your CPU architecture."},{"line_number":157,"context_line":"Defaults to 8."},{"line_number":158,"context_line":"\"\"\"))"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"scrypt_paralellism \u003d cfg.IntOpt("}],"source_content_type":"text/x-python","patch_set":9,"id":"ba2be162_c691539b","line":157,"in_reply_to":"ba2be162_70977d90","updated":"2017-03-01 22:10:55.000000000","message":"This option is there for tuning purposes, 99% of deployments will never touch this. This might need to be min of 1.\n\nI\u0027m letting people who want to use scrypt have access to the more in depth features it provides (depending on the TMTO the deployer wants).","commit_id":"ce274256830e45bf8db4e14886b114ef0ef3fe45"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd1bcb3d2929e7c26faf4bdf8b1c6ba75a361b0a","unresolved":false,"context_lines":[{"line_number":127,"context_line":""},{"line_number":128,"context_line":"The default for bcrypt is 12, must be between 4 and 31, inclusive."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"The default for scrypt is 16, must be within ``range(1,32)``."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"The default for pbkdf_sha512 is 60000, must be within ``range(1,1\u003c\u003c32)``"},{"line_number":133,"context_line":""}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_08738b82","line":130,"updated":"2017-03-23 21:17:20.000000000","message":"nit: By conventions, it looks like all other literals in the module use single backticks instead of double.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd1bcb3d2929e7c26faf4bdf8b1c6ba75a361b0a","unresolved":false,"context_lines":[{"line_number":161,"context_line":"    \u0027scrypt_parallelism\u0027,"},{"line_number":162,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":163,"context_line":"Optional parallelism to pass to scrypt hash function (the ``p`` parameter)."},{"line_number":164,"context_line":"Defaults to 1."},{"line_number":165,"context_line":"\"\"\"))"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"# TODO(notmorgan): remove this option in Q release."}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_e8e2a701","line":164,"updated":"2017-03-23 21:17:20.000000000","message":"I assume these two options (`scrypt_paralellism` and `scrypt_block_size`) are both only valid if `password_hash_algorithm\u003dscrypt`.\n\nThat might be a good thing to add to both of these (like how we specifically denote that certain PCI configuration options only work if sql is the identity driver).","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd1bcb3d2929e7c26faf4bdf8b1c6ba75a361b0a","unresolved":false,"context_lines":[{"line_number":164,"context_line":"Defaults to 1."},{"line_number":165,"context_line":"\"\"\"))"},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"# TODO(notmorgan): remove this option in Q release."},{"line_number":168,"context_line":"rolling_upgrade_password_hash_compat \u003d cfg.BoolOpt("},{"line_number":169,"context_line":"    \u0027rolling_upgrade_password_hash_compat\u0027,"},{"line_number":170,"context_line":"    default\u003dFalse,"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_68c0d751","line":167,"updated":"2017-03-23 21:17:20.000000000","message":"There should be anything stopping us from deprecating this immediately, using the oslo.config tooling.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fc55f835e526f12302e3c96d20ceda1d872362c","unresolved":false,"context_lines":[{"line_number":130,"context_line":""},{"line_number":131,"context_line":"The default for scrypt is 16, must be within `range(1,32)`."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"The default for pbkdf_sha512 is 60000, must be within `range(1,1\u003c\u003c32)`"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"WARNING: If using scrypt, increasing this value increases BOTH time AND"},{"line_number":136,"context_line":"memory requirements to hash a password."}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_9cd38e04","line":133,"updated":"2017-04-29 15:58:01.000000000","message":"Why not say \"must be between x and y, inclusive\" as in the bcrypt description? They should be consistent with each other and not use pythonisms","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e315328c37bd8e622cc828d4a4752108e3ed8eb8","unresolved":false,"context_lines":[{"line_number":130,"context_line":""},{"line_number":131,"context_line":"The default for scrypt is 16, must be within `range(1,32)`."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"The default for pbkdf_sha512 is 60000, must be within `range(1,1\u003c\u003c32)`"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"WARNING: If using scrypt, increasing this value increases BOTH time AND"},{"line_number":136,"context_line":"memory requirements to hash a password."}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_32b2634a","line":133,"in_reply_to":"5ff73747_9cd38e04","updated":"2017-04-29 21:44:31.000000000","message":"This could be done, this was lifted from passlib and \n\n\"must be between 1 and 4294967295 inclusive seemed harder to read. Happy to change in a future patch.","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ee2c0efb1207477aecd0d0b465b06039db06581","unresolved":false,"context_lines":[{"line_number":179,"context_line":"insecure than bcrypt, pbkdf2, and scrypt. This option should be set to"},{"line_number":180,"context_line":"`False` except in the case of performing a rolling upgrade where some"},{"line_number":181,"context_line":"Keystone servers may not know how to verify non-sha512_crypt based password"},{"line_number":182,"context_line":"hashes."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"This option will be removed in the Queens release and is only to support"},{"line_number":185,"context_line":"rolling upgrades from Ocata release to Pike release."}],"source_content_type":"text/x-python","patch_set":17,"id":"ff0f0b1f_8d319ca5","line":182,"updated":"2017-05-19 17:38:05.000000000","message":"So - just to be clear. The work flow would be:\n\n - start upgrading to Pike\n - ensure this is set to true for all Pike nodes\n - after all nodes are running Pike, set this back to False\n\nright?","commit_id":"8ad765e0230ceeb5ca7c36ec3ed6d25c57b22c9d"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"961ac338178a4b134734e4627c846b0d0cfc1bd9","unresolved":false,"context_lines":[{"line_number":179,"context_line":"insecure than bcrypt, pbkdf2, and scrypt. This option should be set to"},{"line_number":180,"context_line":"`False` except in the case of performing a rolling upgrade where some"},{"line_number":181,"context_line":"Keystone servers may not know how to verify non-sha512_crypt based password"},{"line_number":182,"context_line":"hashes."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"This option will be removed in the Queens release and is only to support"},{"line_number":185,"context_line":"rolling upgrades from Ocata release to Pike release."}],"source_content_type":"text/x-python","patch_set":17,"id":"ff0f0b1f_d0e16b2c","line":182,"in_reply_to":"ff0f0b1f_8d319ca5","updated":"2017-05-19 18:03:39.000000000","message":"Correct. This is only ever used in the rolling upgrade model where you might have Ocata and Pike nodes running at the same time.","commit_id":"8ad765e0230ceeb5ca7c36ec3ed6d25c57b22c9d"}],"keystone/identity/backends/sql.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ad47332a8991c8c8ab4f3b1fc20d7623a880b18a","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    @sql.handle_conflicts(conflict_type\u003d\u0027user\u0027)"},{"line_number":127,"context_line":"    def create_user(self, user_id, user):"},{"line_number":128,"context_line":"        user \u003d utils.hash_user_password(user)"},{"line_number":129,"context_line":"        with sql.session_for_write() as session:"},{"line_number":130,"context_line":"            user_ref \u003d model.User.from_dict(user)"},{"line_number":131,"context_line":"            if self._change_password_required(user_ref):"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba2be162_f037edad","side":"PARENT","line":128,"updated":"2017-03-01 22:00:52.000000000","message":"Is this no longer needed?","commit_id":"6fde9ef943afc0e32bd4092af87ea46824dcd515"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5515c1255a2b909fff86791323dbc7d1b890af31","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    @sql.handle_conflicts(conflict_type\u003d\u0027user\u0027)"},{"line_number":127,"context_line":"    def create_user(self, user_id, user):"},{"line_number":128,"context_line":"        user \u003d utils.hash_user_password(user)"},{"line_number":129,"context_line":"        with sql.session_for_write() as session:"},{"line_number":130,"context_line":"            user_ref \u003d model.User.from_dict(user)"},{"line_number":131,"context_line":"            if self._change_password_required(user_ref):"}],"source_content_type":"text/x-python","patch_set":9,"id":"ba2be162_c6ba3323","side":"PARENT","line":128,"in_reply_to":"ba2be162_f037edad","updated":"2017-03-01 22:08:33.000000000","message":"Nope, the code that does hashing has been pushing into the sql model itself. \n\nThe logic is in the setter for the @hybrid_property on the User_ref.password","commit_id":"6fde9ef943afc0e32bd4092af87ea46824dcd515"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd1bcb3d2929e7c26faf4bdf8b1c6ba75a361b0a","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    @sql.handle_conflicts(conflict_type\u003d\u0027user\u0027)"},{"line_number":127,"context_line":"    def create_user(self, user_id, user):"},{"line_number":128,"context_line":"        user \u003d utils.hash_user_password(user)"},{"line_number":129,"context_line":"        with sql.session_for_write() as session:"},{"line_number":130,"context_line":"            user_ref \u003d model.User.from_dict(user)"},{"line_number":131,"context_line":"            if self._change_password_required(user_ref):"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_ab9a596b","side":"PARENT","line":128,"updated":"2017-03-23 21:17:20.000000000","message":"I\u0027m trying to piece together where this is happening now.","commit_id":"1ec73f3b97337bc3d98f34734abded8639fcffc9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"    @sql.handle_conflicts(conflict_type\u003d\u0027user\u0027)"},{"line_number":127,"context_line":"    def create_user(self, user_id, user):"},{"line_number":128,"context_line":"        user \u003d utils.hash_user_password(user)"},{"line_number":129,"context_line":"        with sql.session_for_write() as session:"},{"line_number":130,"context_line":"            user_ref \u003d model.User.from_dict(user)"},{"line_number":131,"context_line":"            if self._change_password_required(user_ref):"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_6385e3ce","side":"PARENT","line":128,"in_reply_to":"ffe62b97_ab9a596b","updated":"2017-03-28 20:40:19.000000000","message":"In the SQL model.","commit_id":"1ec73f3b97337bc3d98f34734abded8639fcffc9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd1bcb3d2929e7c26faf4bdf8b1c6ba75a361b0a","unresolved":false,"context_lines":[{"line_number":221,"context_line":"            resource_options.resource_options_ref_to_mapper("},{"line_number":222,"context_line":"                user_ref, model.UserOption)"},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"            if \u0027password\u0027 in user:"},{"line_number":225,"context_line":"                user_ref.password \u003d user[\u0027password\u0027]"},{"line_number":226,"context_line":"                if self._change_password_required(user_ref):"},{"line_number":227,"context_line":"                    expires_now \u003d datetime.datetime.utcnow()"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_88b79bd9","line":224,"updated":"2017-03-23 21:17:20.000000000","message":"AFAICT this is only changing for the sake of readability?","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":221,"context_line":"            resource_options.resource_options_ref_to_mapper("},{"line_number":222,"context_line":"                user_ref, model.UserOption)"},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"            if \u0027password\u0027 in user:"},{"line_number":225,"context_line":"                user_ref.password \u003d user[\u0027password\u0027]"},{"line_number":226,"context_line":"                if self._change_password_required(user_ref):"},{"line_number":227,"context_line":"                    expires_now \u003d datetime.datetime.utcnow()"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_83cea72a","line":224,"in_reply_to":"ffe62b97_0e2f9e3f","updated":"2017-03-28 20:40:19.000000000","message":"No not a mistake. The password hashing is done in the SQL model now, not independently in a separate function. This prevents any \"Set password\" that is not hashed, meaning plain-text, in the DB and consolidates how we hash the password.\n\nchange_password_required is specific to saying \"hey this password was administratively changed and must be changed before next login\". See (above, copied here for visibility):\n\n    def _change_password_required(self, user):\n        if not CONF.security_compliance.change_password_upon_first_use:\n            return False\n        ignore_option \u003d user.get_resource_option(\n            options.IGNORE_CHANGE_PASSWORD_OPT.option_id)\n        return not (ignore_option and ignore_option.option_value is True)","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"6a641255b0aa68fd07377e4d0848ba6020fc6f56","unresolved":false,"context_lines":[{"line_number":221,"context_line":"            resource_options.resource_options_ref_to_mapper("},{"line_number":222,"context_line":"                user_ref, model.UserOption)"},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"            if \u0027password\u0027 in user:"},{"line_number":225,"context_line":"                user_ref.password \u003d user[\u0027password\u0027]"},{"line_number":226,"context_line":"                if self._change_password_required(user_ref):"},{"line_number":227,"context_line":"                    expires_now \u003d datetime.datetime.utcnow()"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_0e2f9e3f","line":224,"in_reply_to":"ffe62b97_88b79bd9","updated":"2017-03-27 17:38:03.000000000","message":"It\u0027s additionally setting the password on the user_ref before checking if a change is required. is this a mistake?","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"}],"keystone/identity/backends/sql_model.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"067bd39723c3ae830514b5356ed2684fd3139654","unresolved":false,"context_lines":[{"line_number":169,"context_line":"        new_password_ref.expires_at \u003d self._get_password_expires_at(now)"},{"line_number":170,"context_line":"        self.local_user.passwords.append(new_password_ref)"},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"    def _password_expiry_exempt(self):"},{"line_number":173,"context_line":"        # Get the IGNORE_PASSWORD_EXPIRY_OPT value from the user\u0027s"},{"line_number":174,"context_line":"        # option_mapper."},{"line_number":175,"context_line":"        return getattr("}],"source_content_type":"text/x-python","patch_set":11,"id":"9a30ddce_4932eff2","line":172,"range":{"start_line":172,"start_character":8,"end_line":172,"end_character":30},"updated":"2017-03-07 19:02:36.000000000","message":"This could be @property for easier use.","commit_id":"b333ab75d7c8e7f4c80da13bd1f912e87603fc53"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"a824556dfe2ae04b88b32b99834389ec7afcfc6d","unresolved":false,"context_lines":[{"line_number":159,"context_line":"            # different systems) to unauthorized parties."},{"line_number":160,"context_line":"            hashed_passwd \u003d password_hashing.hash_password(value)"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"            # TODO(notmorgan): Remove this compat code in Q release."},{"line_number":163,"context_line":"            if CONF.identity.rolling_upgrade_password_hash_compat:"},{"line_number":164,"context_line":"                hashed_compat \u003d password_hashing.hash_password_compat(value)"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"        new_password_ref.password_hash \u003d hashed_passwd"},{"line_number":167,"context_line":"        new_password_ref.password \u003d hashed_compat"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_5c083527","line":164,"range":{"start_line":162,"start_character":0,"end_line":164,"end_character":76},"updated":"2017-03-23 22:24:58.000000000","message":"Could this be removed in R instead of Q? Asking because I\u0027m under the impression that we\u0027re going to have to force all users of a given cloud to reset their passwords and in some of my environments I\u0027ve hundreds, if not thousands of users which means coordinating a mass (forced) password reset for all users across all clouds and that may be a tough pill to swallow when trying to get it done for all deployments within a single cycle.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":159,"context_line":"            # different systems) to unauthorized parties."},{"line_number":160,"context_line":"            hashed_passwd \u003d password_hashing.hash_password(value)"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"            # TODO(notmorgan): Remove this compat code in Q release."},{"line_number":163,"context_line":"            if CONF.identity.rolling_upgrade_password_hash_compat:"},{"line_number":164,"context_line":"                hashed_compat \u003d password_hashing.hash_password_compat(value)"},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"        new_password_ref.password_hash \u003d hashed_passwd"},{"line_number":167,"context_line":"        new_password_ref.password \u003d hashed_compat"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_235ebb43","line":164,"range":{"start_line":162,"start_character":0,"end_line":164,"end_character":76},"in_reply_to":"ffe62b97_5c083527","updated":"2017-03-28 20:40:19.000000000","message":"Users with old passwords will still be able to validate their passwords, even if they have not changed.\n\nThis option is only telling keystone to continue placing the old password with the less-secure hashing in the DB. The old-hash column (password_ref.password) is only used by Keystones that predate Pike. This option is only needed if you are running Pike Keystones and Pre-Pike keystones in a rolling-upgrade.\n\nSo, I am assuming we are only supporting running Pike with Ocata keystones during a rolling upgrade, not a Queens Keystone and an Ocata keystone on the same DB backend.\n\n\nTL;DR: This is only used during rolling upgrades. User passwords that have not been changed will still validate. That is a core design of this code: do not break users if a password is not changed (that is an operator choice).","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fc55f835e526f12302e3c96d20ceda1d872362c","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    def password(self):"},{"line_number":106,"context_line":"        \"\"\"Return the current password.\"\"\""},{"line_number":107,"context_line":"        if self.password_ref:"},{"line_number":108,"context_line":"            if self.password_ref.password_hash is not None:"},{"line_number":109,"context_line":"                return self.password_ref.password_hash"},{"line_number":110,"context_line":"            else:"},{"line_number":111,"context_line":"                return self.password_ref.password"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_1c2e5efa","line":108,"range":{"start_line":108,"start_character":46,"end_line":108,"end_character":58},"updated":"2017-04-29 15:58:01.000000000","message":"Could probably just \u0027if self.password_ref.password_hash:\u0027","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e315328c37bd8e622cc828d4a4752108e3ed8eb8","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    def password(self):"},{"line_number":106,"context_line":"        \"\"\"Return the current password.\"\"\""},{"line_number":107,"context_line":"        if self.password_ref:"},{"line_number":108,"context_line":"            if self.password_ref.password_hash is not None:"},{"line_number":109,"context_line":"                return self.password_ref.password_hash"},{"line_number":110,"context_line":"            else:"},{"line_number":111,"context_line":"                return self.password_ref.password"}],"source_content_type":"text/x-python","patch_set":15,"id":"5ff73747_d2a33fff","line":108,"range":{"start_line":108,"start_character":46,"end_line":108,"end_character":58},"in_reply_to":"5ff73747_1c2e5efa","updated":"2017-04-29 21:44:31.000000000","message":"Possibly, but I didn\u0027t want to ignore possibly \"is_zero\" evaluating types that have a magic to-str/bytes capability.\n\nNone is really the only thing we should explicitly not be setting.","commit_id":"451d66d685e6c9b3a34b700c5a65258866795b9c"}],"keystone/tests/unit/identity/test_backend_sql.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd1bcb3d2929e7c26faf4bdf8b1c6ba75a361b0a","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    def config_overrides(self):"},{"line_number":36,"context_line":"        super(UserPasswordHashingTestsNoCompat, self).config_overrides()"},{"line_number":37,"context_line":"        self.config_fixture.config(group\u003d\u0027identity\u0027,"},{"line_number":38,"context_line":"                                   password_hash_algorithm\u003d\u0027scrypt\u0027)"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    def test_password_hashing_compat_not_set_used(self):"},{"line_number":41,"context_line":"        with sql.session_for_read() as session:"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_a8e01f98","line":38,"updated":"2017-03-23 21:17:20.000000000","message":"Should we do these with the other algorithms we support?","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    def config_overrides(self):"},{"line_number":36,"context_line":"        super(UserPasswordHashingTestsNoCompat, self).config_overrides()"},{"line_number":37,"context_line":"        self.config_fixture.config(group\u003d\u0027identity\u0027,"},{"line_number":38,"context_line":"                                   password_hash_algorithm\u003d\u0027scrypt\u0027)"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"    def test_password_hashing_compat_not_set_used(self):"},{"line_number":41,"context_line":"        with sql.session_for_read() as session:"}],"source_content_type":"text/x-python","patch_set":13,"id":"ffe62b97_63160358","line":38,"in_reply_to":"ffe62b97_a8e01f98","updated":"2017-03-28 20:40:19.000000000","message":"We could. This is just verifying that the compat hash is not generated. It would be a different test case if we want to test all password hashing options we have.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"}],"releasenotes/notes/bug_1543048_and_1668503-7ead4e15faaab778.yaml":[{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"a824556dfe2ae04b88b32b99834389ec7afcfc6d","unresolved":false,"context_lines":[{"line_number":13,"context_line":"      `bcrypt` as the hashing algorithm. All passwords will continue to"},{"line_number":14,"context_line":"      function with the old sha512_crypt hash, but new password hashes"},{"line_number":15,"context_line":"      will be bcrypt."},{"line_number":16,"context_line":"upgrade:"},{"line_number":17,"context_line":"  - |"},{"line_number":18,"context_line":"    * If performing rolling upgrades, set"},{"line_number":19,"context_line":"      `[identity] rolling_upgrade_password_hash_compat` to `True`. This will"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"ffe62b97_515b7e86","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":7},"updated":"2017-03-23 22:24:58.000000000","message":"I think it may be worth while to spell out to folks that ALL users of the cloud will be forced to reset their passwords in order to ensure strong hashing within the PIKE cycle and that will need to be done before folks are able to upgrade to R. \n\nThis is assuming I\u0027m understanding the PR correctly.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":13,"context_line":"      `bcrypt` as the hashing algorithm. All passwords will continue to"},{"line_number":14,"context_line":"      function with the old sha512_crypt hash, but new password hashes"},{"line_number":15,"context_line":"      will be bcrypt."},{"line_number":16,"context_line":"upgrade:"},{"line_number":17,"context_line":"  - |"},{"line_number":18,"context_line":"    * If performing rolling upgrades, set"},{"line_number":19,"context_line":"      `[identity] rolling_upgrade_password_hash_compat` to `True`. This will"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"ffe62b97_0305f713","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":7},"in_reply_to":"ffe62b97_515b7e86","updated":"2017-03-28 20:40:19.000000000","message":"User passwords that are not set after this code lands will continue to validate, just using the less secure hash. Passwords that are set after this code has landed (Pike) will use the new hash(ing).\n\nWe do not want to break users. The core of this code is to ensure users are not broken even if they do not change their passwords. If we were to go with a hard break, the patchset would have been much, much, much smaller.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd1bcb3d2929e7c26faf4bdf8b1c6ba75a361b0a","unresolved":false,"context_lines":[{"line_number":19,"context_line":"      `[identity] rolling_upgrade_password_hash_compat` to `True`. This will"},{"line_number":20,"context_line":"      instruct keystone to continue to hash passwords in a manner that older"},{"line_number":21,"context_line":"      (pre Pike release) keystones can still verify passwords. Once all"},{"line_number":22,"context_line":"      upgrades are complete, ensure this option is set back to `False`."},{"line_number":23,"context_line":"deprecations:"},{"line_number":24,"context_line":"  - |"},{"line_number":25,"context_line":"    * `[DEFAULT] crypt_strength` is deprecated in favor of"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"ffe62b97_ab5019d6","line":22,"updated":"2017-03-23 21:17:20.000000000","message":"From an operator perspective what happens if I don\u0027t do this last step? Is this a timing thing? Do I have to switch this back within X amount of time after I run my contract phase?","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5e831115fbc8765f18de0fbbfbab41d296940ae3","unresolved":false,"context_lines":[{"line_number":19,"context_line":"      `[identity] rolling_upgrade_password_hash_compat` to `True`. This will"},{"line_number":20,"context_line":"      instruct keystone to continue to hash passwords in a manner that older"},{"line_number":21,"context_line":"      (pre Pike release) keystones can still verify passwords. Once all"},{"line_number":22,"context_line":"      upgrades are complete, ensure this option is set back to `False`."},{"line_number":23,"context_line":"deprecations:"},{"line_number":24,"context_line":"  - |"},{"line_number":25,"context_line":"    * `[DEFAULT] crypt_strength` is deprecated in favor of"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"ffe62b97_f679682f","line":22,"in_reply_to":"ffe62b97_ab5019d6","updated":"2017-03-23 21:31:02.000000000","message":"This has to be switched back to False after a deployment is running all Pike code and an admin has forced all users to reset their passwords, right?","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"8f783d316d9b778c18c656a32546edd54a2febff","unresolved":false,"context_lines":[{"line_number":19,"context_line":"      `[identity] rolling_upgrade_password_hash_compat` to `True`. This will"},{"line_number":20,"context_line":"      instruct keystone to continue to hash passwords in a manner that older"},{"line_number":21,"context_line":"      (pre Pike release) keystones can still verify passwords. Once all"},{"line_number":22,"context_line":"      upgrades are complete, ensure this option is set back to `False`."},{"line_number":23,"context_line":"deprecations:"},{"line_number":24,"context_line":"  - |"},{"line_number":25,"context_line":"    * `[DEFAULT] crypt_strength` is deprecated in favor of"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"ffe62b97_e6ea21d6","line":22,"in_reply_to":"ffe62b97_e616a149","updated":"2017-03-28 20:49:32.000000000","message":"In fact... we don\u0027t even have the contract migration implemented since we can\u0027t eliminate the column until Q (with a data migration as well) without breaking code.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":19,"context_line":"      `[identity] rolling_upgrade_password_hash_compat` to `True`. This will"},{"line_number":20,"context_line":"      instruct keystone to continue to hash passwords in a manner that older"},{"line_number":21,"context_line":"      (pre Pike release) keystones can still verify passwords. Once all"},{"line_number":22,"context_line":"      upgrades are complete, ensure this option is set back to `False`."},{"line_number":23,"context_line":"deprecations:"},{"line_number":24,"context_line":"  - |"},{"line_number":25,"context_line":"    * `[DEFAULT] crypt_strength` is deprecated in favor of"}],"source_content_type":"text/x-yaml","patch_set":13,"id":"ffe62b97_e616a149","line":22,"in_reply_to":"ffe62b97_f679682f","updated":"2017-03-28 20:40:19.000000000","message":"Not even after all users have been forced to do a password change. Simply after all keystones are running pike code.\n\nOld passwords will continue to validate, full stop. \n\nWe cannot break users because a password wasn\u0027t reset. \n\nAn operator may require a password change, but that is on them, we do not have any such requirements in code.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dd1bcb3d2929e7c26faf4bdf8b1c6ba75a361b0a","unresolved":false,"context_lines":[{"line_number":38,"context_line":"      recommended passwords be changed after upgrade to Pike. The risk of"},{"line_number":39,"context_line":"      password hash exposure is limited, but for the best possible"},{"line_number":40,"context_line":"      protection against cracking the hash it is recommended passwords be"},{"line_number":41,"context_line":"      changed after upgrade. The password change will then result in a more"},{"line_number":42,"context_line":"      secure hash (bcrypt by default) being used to store the password in the"},{"line_number":43,"context_line":"      DB."}],"source_content_type":"text/x-yaml","patch_set":13,"id":"ffe62b97_4b274d66","line":41,"updated":"2017-03-23 21:17:20.000000000","message":"Might be worth noting here that administrators can force users to upgrade their passwords, which eludes to one possible way administrators can go about making that change happen.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"a824556dfe2ae04b88b32b99834389ec7afcfc6d","unresolved":false,"context_lines":[{"line_number":26,"context_line":"      `[identity] password_hash_rounds`. Note that `[DEFAULT] crypt_strength`"},{"line_number":27,"context_line":"      is still used when `[identity] rolling_upgrade_password_hash_compat` is"},{"line_number":28,"context_line":"      set to `True`."},{"line_number":29,"context_line":"security:"},{"line_number":30,"context_line":"  - |"},{"line_number":31,"context_line":"    * The use of `sha512_crypt` is considered inadequate for password hashing"},{"line_number":32,"context_line":"      in an application like Keystone. The use of bcrypt or scrypt is"},{"line_number":33,"context_line":"      recommended to ensure protection against password cracking utilities if"},{"line_number":34,"context_line":"      the hashes are exposed. This is due to Time-Complexity requirements for"},{"line_number":35,"context_line":"      computing the hashes in light of modern hardware (CPU, GPU, ASIC, FPGA,"},{"line_number":36,"context_line":"      etc). Keystone has moved to bcrypt as a default and no longer hashes"},{"line_number":37,"context_line":"      new passwords (and password changes) with sha512_crypt. It is"},{"line_number":38,"context_line":"      recommended passwords be changed after upgrade to Pike. The risk of"},{"line_number":39,"context_line":"      password hash exposure is limited, but for the best possible"},{"line_number":40,"context_line":"      protection against cracking the hash it is recommended passwords be"},{"line_number":41,"context_line":"      changed after upgrade. The password change will then result in a more"},{"line_number":42,"context_line":"      secure hash (bcrypt by default) being used to store the password in the"},{"line_number":43,"context_line":"      DB."}],"source_content_type":"text/x-yaml","patch_set":13,"id":"ffe62b97_9ce8fd16","line":43,"range":{"start_line":29,"start_character":0,"end_line":43,"end_character":9},"updated":"2017-03-23 22:24:58.000000000","message":"I\u0027d also like to have this, or something like it, sent out as some form of a security advisory. When I force my users to reset their passwords they\u0027re going to ask why. Having an OSSA security advisory published to https://security.openstack.org/ossalist.html (or something similar) would likely make a lot of those questions go away while also providing my Product and C-Type folks a reason as to why we\u0027re forcing our users to do this.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d1fd264726d84fd404711caf2ee9031471ce529e","unresolved":false,"context_lines":[{"line_number":26,"context_line":"      `[identity] password_hash_rounds`. Note that `[DEFAULT] crypt_strength`"},{"line_number":27,"context_line":"      is still used when `[identity] rolling_upgrade_password_hash_compat` is"},{"line_number":28,"context_line":"      set to `True`."},{"line_number":29,"context_line":"security:"},{"line_number":30,"context_line":"  - |"},{"line_number":31,"context_line":"    * The use of `sha512_crypt` is considered inadequate for password hashing"},{"line_number":32,"context_line":"      in an application like Keystone. The use of bcrypt or scrypt is"},{"line_number":33,"context_line":"      recommended to ensure protection against password cracking utilities if"},{"line_number":34,"context_line":"      the hashes are exposed. This is due to Time-Complexity requirements for"},{"line_number":35,"context_line":"      computing the hashes in light of modern hardware (CPU, GPU, ASIC, FPGA,"},{"line_number":36,"context_line":"      etc). Keystone has moved to bcrypt as a default and no longer hashes"},{"line_number":37,"context_line":"      new passwords (and password changes) with sha512_crypt. It is"},{"line_number":38,"context_line":"      recommended passwords be changed after upgrade to Pike. The risk of"},{"line_number":39,"context_line":"      password hash exposure is limited, but for the best possible"},{"line_number":40,"context_line":"      protection against cracking the hash it is recommended passwords be"},{"line_number":41,"context_line":"      changed after upgrade. The password change will then result in a more"},{"line_number":42,"context_line":"      secure hash (bcrypt by default) being used to store the password in the"},{"line_number":43,"context_line":"      DB."}],"source_content_type":"text/x-yaml","patch_set":13,"id":"ffe62b97_c69cbdc1","line":43,"range":{"start_line":29,"start_character":0,"end_line":43,"end_character":9},"in_reply_to":"ffe62b97_9ce8fd16","updated":"2017-03-28 20:40:19.000000000","message":"We can work to have an OSSN published. This cannot be an OSSA, as it will not be backported.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":7353,"name":"Kevin Carter","email":"kevin@cloudnull.com","username":"cloudnull"},"change_message_id":"2307fde3a47ea73cdb5992e898368506ce9afa7a","unresolved":false,"context_lines":[{"line_number":26,"context_line":"      `[identity] password_hash_rounds`. Note that `[DEFAULT] crypt_strength`"},{"line_number":27,"context_line":"      is still used when `[identity] rolling_upgrade_password_hash_compat` is"},{"line_number":28,"context_line":"      set to `True`."},{"line_number":29,"context_line":"security:"},{"line_number":30,"context_line":"  - |"},{"line_number":31,"context_line":"    * The use of `sha512_crypt` is considered inadequate for password hashing"},{"line_number":32,"context_line":"      in an application like Keystone. The use of bcrypt or scrypt is"},{"line_number":33,"context_line":"      recommended to ensure protection against password cracking utilities if"},{"line_number":34,"context_line":"      the hashes are exposed. This is due to Time-Complexity requirements for"},{"line_number":35,"context_line":"      computing the hashes in light of modern hardware (CPU, GPU, ASIC, FPGA,"},{"line_number":36,"context_line":"      etc). Keystone has moved to bcrypt as a default and no longer hashes"},{"line_number":37,"context_line":"      new passwords (and password changes) with sha512_crypt. It is"},{"line_number":38,"context_line":"      recommended passwords be changed after upgrade to Pike. The risk of"},{"line_number":39,"context_line":"      password hash exposure is limited, but for the best possible"},{"line_number":40,"context_line":"      protection against cracking the hash it is recommended passwords be"},{"line_number":41,"context_line":"      changed after upgrade. The password change will then result in a more"},{"line_number":42,"context_line":"      secure hash (bcrypt by default) being used to store the password in the"},{"line_number":43,"context_line":"      DB."}],"source_content_type":"text/x-yaml","patch_set":13,"id":"5ff73747_65de0c6e","line":43,"range":{"start_line":29,"start_character":0,"end_line":43,"end_character":9},"in_reply_to":"ffe62b97_c69cbdc1","updated":"2017-04-28 02:56:56.000000000","message":"+1 an OSSN would be greatly appreciated and more than enough. If there\u0027s anything I can help with to get that, published I\u0027d be happy to lend a hand.","commit_id":"c283a0fcd4b57d165c5479ca04da1e014b2ab4c9"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9ee2c0efb1207477aecd0d0b465b06039db06581","unresolved":false,"context_lines":[{"line_number":19,"context_line":"      `[identity] rolling_upgrade_password_hash_compat` to `True`. This will"},{"line_number":20,"context_line":"      instruct keystone to continue to hash passwords in a manner that older"},{"line_number":21,"context_line":"      (pre Pike release) keystones can still verify passwords. Once all"},{"line_number":22,"context_line":"      upgrades are complete, ensure this option is set back to `False`."},{"line_number":23,"context_line":"deprecations:"},{"line_number":24,"context_line":"  - |"},{"line_number":25,"context_line":"    * `[DEFAULT] crypt_strength` is deprecated in favor of"}],"source_content_type":"text/x-yaml","patch_set":17,"id":"ff0f0b1f_8da4fcba","line":22,"updated":"2017-05-19 17:38:05.000000000","message":"++ sweet - this answers my question. Nice note!","commit_id":"8ad765e0230ceeb5ca7c36ec3ed6d25c57b22c9d"}]}