)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6d68f854df88f06f39e972f11348d7c323d79e10","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Move ec2 credential policies to DocumentedRuleDefault"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"A new policy class was introduce that requires"},{"line_number":10,"context_line":"additional parameters when defining policy objects."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"This patch switches our ec2 credential policy object to"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"ffe62b97_0686f3b9","line":9,"updated":"2017-03-29 19:13:45.000000000","message":"nit: introduced","commit_id":"0a18e2a7b53b17252ab12afd3e467c1d8e646a87"}],"keystone/common/policies/ec2_credential.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"6d68f854df88f06f39e972f11348d7c323d79e10","unresolved":false,"context_lines":[{"line_number":25,"context_line":"    policy.DocumentedRuleDefault("},{"line_number":26,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_list_credentials\u0027,"},{"line_number":27,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_OWNER,"},{"line_number":28,"context_line":"        description\u003d\u0027List ec2 credential.\u0027,"},{"line_number":29,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/v3/users/{user_id}/credentials/OS-EC2\u0027,"},{"line_number":30,"context_line":"                     \u0027method\u0027: \u0027GET\u0027}]),"},{"line_number":31,"context_line":"    policy.DocumentedRuleDefault("}],"source_content_type":"text/x-python","patch_set":4,"id":"ffe62b97_e6fb0f44","line":28,"updated":"2017-03-29 19:13:45.000000000","message":"nit: credentials","commit_id":"0a18e2a7b53b17252ab12afd3e467c1d8e646a87"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"33cce6ae6fb07635f1403e7b41fc56877733aced","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    policy.RuleDefault("},{"line_number":28,"context_line":"        name\u003dbase.IDENTITY % \u0027ec2_delete_credential\u0027,"},{"line_number":29,"context_line":"        check_str\u003dbase.RULE_ADMIN_OR_CREDENTIAL_OWNER),"},{"line_number":30,"context_line":"]"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"def list_rules():"}],"source_content_type":"text/x-python","patch_set":5,"id":"ffe62b97_a1f5f158","side":"PARENT","line":30,"updated":"2017-03-29 19:34:44.000000000","message":"It appears this is missing authenticate:\n\nhttps://github.com/openstack/keystone/blob/36da6f0c8660968e1ddacab274bace3abd78c0cb/keystone/contrib/ec2/routers.py#L65-L69","commit_id":"9034755743875de39363dbdcd35477e82e37ea1b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"09bffbc213e821233b48ee911d70bbd36edb3cf9","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        check_str\u003d\u0027\u0027,"},{"line_number":47,"context_line":"        description\u003d\u0027Authenticate ec2 credential.\u0027,"},{"line_number":48,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/ec2tokens\u0027,"},{"line_number":49,"context_line":"                     \u0027method\u0027: \u0027POST\u0027}])"},{"line_number":50,"context_line":"]"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"7ffa3b31_515e6644","line":49,"updated":"2017-04-19 14:51:20.000000000","message":"So this is what you were asking me about the other day?! I\u0027ll do some double checking here because using the \u0027\u0027 technically means that the token sent with the request has to be valid in order to pass policy checks. That might not be the case if there isn\u0027t a token sent in the request or if the user is authenticating with a username and password. Let me do some double checking here just to make sure I didn\u0027t mislead you :)","commit_id":"977c8a8a19257077e096e6a3c1674d12cdb6ea54"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2c216f48f9152e268a3a4a3a8f4d2c9263eaaf97","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        check_str\u003d\u0027\u0027,"},{"line_number":47,"context_line":"        description\u003d\u0027Authenticate ec2 credential.\u0027,"},{"line_number":48,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/ec2tokens\u0027,"},{"line_number":49,"context_line":"                     \u0027method\u0027: \u0027POST\u0027}])"},{"line_number":50,"context_line":"]"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"5f201791_3a14074e","line":49,"in_reply_to":"5f201791_fa21ef4e","updated":"2017-06-22 19:27:12.000000000","message":"Done","commit_id":"977c8a8a19257077e096e6a3c1674d12cdb6ea54"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"af241418f3bfd6631d7e4976867cac265782f8e9","unresolved":false,"context_lines":[{"line_number":46,"context_line":"        check_str\u003d\u0027\u0027,"},{"line_number":47,"context_line":"        description\u003d\u0027Authenticate ec2 credential.\u0027,"},{"line_number":48,"context_line":"        operations\u003d[{\u0027path\u0027: \u0027/ec2tokens\u0027,"},{"line_number":49,"context_line":"                     \u0027method\u0027: \u0027POST\u0027}])"},{"line_number":50,"context_line":"]"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"5f201791_fa21ef4e","line":49,"in_reply_to":"7ffa3b31_515e6644","updated":"2017-06-22 19:06:16.000000000","message":"It doesn\u0027t look like these are protected via policy, just like normal authentication flows [0]. We need another patch set that removes this from the generated policy.\n\n[0] https://github.com/openstack/keystone/blob/f992b1ce42d6d553146f538f7874fa40f1934cd8/keystone/contrib/ec2/controllers.py#L387","commit_id":"977c8a8a19257077e096e6a3c1674d12cdb6ea54"}]}