)]}'
{"keystone/exception.py":[{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"99309c79f1908a46cf776672cc8c492e09f41a7a","unresolved":false,"context_lines":[{"line_number":600,"context_line":""},{"line_number":601,"context_line":""},{"line_number":602,"context_line":"class LDAPInvalidCredentialsError(UnexpectedError):"},{"line_number":603,"context_line":"    message_format \u003d _(\u0027Unable to authenticate against LDAP server - \u0027"},{"line_number":604,"context_line":"                       \u0027Invalid Credentials\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"5f201791_3bac368b","line":603,"range":{"start_line":603,"start_character":55,"end_line":603,"end_character":66},"updated":"2017-06-21 15:44:26.000000000","message":"Not sure if we want to let the user know that it\u0027s authenticating against an LDAP server specifically? Otherwise I think we could go with maybe a more generic message about what backend is being used.","commit_id":"379b3005b851325f35e0a38938e76295afc3a44f"}],"keystone/identity/backends/ldap/common.py":[{"author":{"_account_id":20466,"name":"Tin Lam","email":"tin@lam.wtf","username":"tinlam"},"change_message_id":"c261e4d0714a6aea2005570369368174d814c527","unresolved":false,"context_lines":[{"line_number":1250,"context_line":"            return conn"},{"line_number":1251,"context_line":"        except ldap.INVALID_CREDENTIALS:"},{"line_number":1252,"context_line":"            msg \u003d self.LDAP_URL + \u0027 - Invalid Credentials\u0027"},{"line_number":1253,"context_line":"            raise exception.LDAPServerConnectionError("},{"line_number":1254,"context_line":"                url\u003dmsg)"},{"line_number":1255,"context_line":"        except ldap.SERVER_DOWN:"},{"line_number":1256,"context_line":"            raise exception.LDAPServerConnectionError("},{"line_number":1257,"context_line":"                url\u003dself.LDAP_URL)"}],"source_content_type":"text/x-python","patch_set":2,"id":"5f201791_6cd0c8f8","line":1254,"range":{"start_line":1253,"start_character":28,"end_line":1254,"end_character":23},"updated":"2017-06-21 05:44:58.000000000","message":"Perhaps we can create a new exception with different message format.  \"self.LDAP_URL + \u0027 - Invalid Credentials\u0027\" isn\u0027t a valid url.","commit_id":"40e2ecbfdd7ad73dcef4f4ca9ee49571c21ff57a"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"412e58fc068f228159bdf1c1a7c7069372fff36a","unresolved":false,"context_lines":[{"line_number":1251,"context_line":"        except ldap.INVALID_CREDENTIALS:"},{"line_number":1252,"context_line":"            msg \u003d self.LDAP_URL + \u0027 - Invalid Credentials\u0027"},{"line_number":1253,"context_line":"            raise exception.LDAPServerConnectionError("},{"line_number":1254,"context_line":"                url\u003dmsg)"},{"line_number":1255,"context_line":"        except ldap.SERVER_DOWN:"},{"line_number":1256,"context_line":"            raise exception.LDAPServerConnectionError("},{"line_number":1257,"context_line":"                url\u003dself.LDAP_URL)"}],"source_content_type":"text/x-python","patch_set":2,"id":"5f201791_3b91d69a","line":1254,"in_reply_to":"5f201791_22a9ab7a","updated":"2017-06-21 15:34:15.000000000","message":"I was reusing [0] which shouldn\u0027t expose the LDAP url to the user, but we can create an exception specifically for this situation with a better message for the user.\n\n[0] https://github.com/openstack/keystone/blob/master/keystone/exception.py#L597","commit_id":"40e2ecbfdd7ad73dcef4f4ca9ee49571c21ff57a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2238e0b3159e557440f38a81db1ec86c602783ab","unresolved":false,"context_lines":[{"line_number":1251,"context_line":"        except ldap.INVALID_CREDENTIALS:"},{"line_number":1252,"context_line":"            msg \u003d self.LDAP_URL + \u0027 - Invalid Credentials\u0027"},{"line_number":1253,"context_line":"            raise exception.LDAPServerConnectionError("},{"line_number":1254,"context_line":"                url\u003dmsg)"},{"line_number":1255,"context_line":"        except ldap.SERVER_DOWN:"},{"line_number":1256,"context_line":"            raise exception.LDAPServerConnectionError("},{"line_number":1257,"context_line":"                url\u003dself.LDAP_URL)"}],"source_content_type":"text/x-python","patch_set":2,"id":"5f201791_22a9ab7a","line":1254,"in_reply_to":"5f201791_45915f52","updated":"2017-06-21 14:21:07.000000000","message":"Every time we get to this point, we\u0027ll be advertising that self.LDAP_URL is wrong. That seems a bit misleading since the exception excepts ldap.INVALID_CREDENTIALS. If the exception we\u0027re catching from ldap means something other than that, we should update with a comment.\n\nAs I read this, it seems like I\u0027m going to get some Invalid URL exception when I supply wrong credentials. Also, should we be exposing the LDAP url to the user? Can we relay that information in a more opaque but useful way?","commit_id":"40e2ecbfdd7ad73dcef4f4ca9ee49571c21ff57a"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"50a04ebe819b3d0c50a9a2b0307c6364f776aa3c","unresolved":false,"context_lines":[{"line_number":1250,"context_line":"            return conn"},{"line_number":1251,"context_line":"        except ldap.INVALID_CREDENTIALS:"},{"line_number":1252,"context_line":"            msg \u003d self.LDAP_URL + \u0027 - Invalid Credentials\u0027"},{"line_number":1253,"context_line":"            raise exception.LDAPServerConnectionError("},{"line_number":1254,"context_line":"                url\u003dmsg)"},{"line_number":1255,"context_line":"        except ldap.SERVER_DOWN:"},{"line_number":1256,"context_line":"            raise exception.LDAPServerConnectionError("},{"line_number":1257,"context_line":"                url\u003dself.LDAP_URL)"}],"source_content_type":"text/x-python","patch_set":2,"id":"5f201791_45915f52","line":1254,"range":{"start_line":1253,"start_character":28,"end_line":1254,"end_character":23},"in_reply_to":"5f201791_6cd0c8f8","updated":"2017-06-21 07:56:54.000000000","message":"I agree...given that we are doing the work to give ourselves a better message, let\u0027s make it nice!","commit_id":"40e2ecbfdd7ad73dcef4f4ca9ee49571c21ff57a"}],"releasenotes/notes/invalid-ldap-credential-exception-c0e6dbc524de2b56.yaml":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a721bf8d57aa4e4840de3bab7253b65b76abbc88","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    This catches the ldap.INVALID_CREDENTIALS exception thrown when"},{"line_number":5,"context_line":"    trying to connect to an LDAP backend with an invalid username"},{"line_number":6,"context_line":"    or password, and emits a message back to the user instead of"},{"line_number":7,"context_line":"    the default 500 error message."}],"source_content_type":"text/x-yaml","patch_set":9,"id":"3f1d235d_970d6992","line":4,"updated":"2017-06-29 21:10:46.000000000","message":"This could be linked to the bug report like the example we have in the docs [0] under the Release Notes section. It could also be as simple as \"We mask invalid credentials for LDAP backends the same way we do for SQL.\"\n\n[0] https://docs.openstack.org/developer/keystone/devref/development_best_practices.html","commit_id":"d67b7afc921d19c0db81523731a2d01443dbaa75"}]}