)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b132543840ee51ad59edbc96f96482fc846b7129","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     prashkre \u003cprashkre@in.ibm.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2017-07-19 23:41:14 +0530"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"WIP: filter users and groups in ldap"},{"line_number":8,"context_line":"Closes-Bug: #1704205"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Change-Id: I424813785b7a355514ef42f1e4c6384b8a78b256"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"1f1a1f67_2add39df","line":7,"updated":"2017-07-19 18:19:04.000000000","message":"Could use a new line after the title here.\n\n  WIP: filter users and groups in ldap\n\n  Closes-Bug: #1704205","commit_id":"c66e287a8bae8f6de195b2baeb91eb748dc2b193"}],"keystone/identity/backends/ldap/common.py":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"589a983f9ad553f3af24a61be12cc0e27ebb47e9","unresolved":false,"context_lines":[{"line_number":1386,"context_line":"        query \u003d (u\u0027(\u0026(%(id_attr)s\u003d%(id)s)\u0027"},{"line_number":1387,"context_line":"                 u\u0027%(filter)s\u0027"},{"line_number":1388,"context_line":"                 u\u0027(objectClass\u003d%(object_class)s)\u0027"},{"line_number":1389,"context_line":"                 u\u0027(!(!(%(name_attr)s\u003d*))))\u0027"},{"line_number":1390,"context_line":"                 % {\u0027id_attr\u0027: self.id_attr,"},{"line_number":1391,"context_line":"                    \u0027id\u0027: ldap.filter.escape_filter_chars("},{"line_number":1392,"context_line":"                        six.text_type(object_id)),"}],"source_content_type":"text/x-python","patch_set":2,"id":"1f1a1f67_f9fb7d44","line":1389,"updated":"2017-07-20 14:41:49.000000000","message":"I\u0027d like to see a comment explaining this for future readers of the code. E.g. \"enforce that the name attribute has a value\"","commit_id":"be78ed294e6d2471cbc9e4962478a419e41bd1ed"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4805c07d58bdbcef635e99c1a60dba05475ddd73","unresolved":false,"context_lines":[{"line_number":1383,"context_line":"        return values"},{"line_number":1384,"context_line":""},{"line_number":1385,"context_line":"    def _ldap_get(self, object_id, ldap_filter\u003dNone):"},{"line_number":1386,"context_line":"        # (prashkre): name_attr is added in ldap search query to enforce that"},{"line_number":1387,"context_line":"        # ldap name attribute has a value."},{"line_number":1388,"context_line":"        # for e.g. In ldap configuration, if user_name_attribute \u003d personName,"},{"line_number":1389,"context_line":"        # then query will find user only if \u0027personName\u0027 attribute is set"}],"source_content_type":"text/x-python","patch_set":3,"id":"1f1a1f67_cbae9997","line":1386,"updated":"2017-07-20 22:38:04.000000000","message":"We can add something to this comment that says this should be functionally tested once keystone has support for functional tests in the gate (like we do with federation).","commit_id":"6cc06bff11d44825de50d5d46433ec99f3c1d002"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"c2f93e4ebf975d74334b5f329be6f724d9f18b3b","unresolved":false,"context_lines":[{"line_number":1383,"context_line":"        return values"},{"line_number":1384,"context_line":""},{"line_number":1385,"context_line":"    def _ldap_get(self, object_id, ldap_filter\u003dNone):"},{"line_number":1386,"context_line":"        # (prashkre): name_attr is added in ldap search query to enforce that"},{"line_number":1387,"context_line":"        # ldap name attribute has a value."},{"line_number":1388,"context_line":"        # for e.g. In ldap configuration, if user_name_attribute \u003d personName,"},{"line_number":1389,"context_line":"        # then query will find user only if \u0027personName\u0027 attribute is set"}],"source_content_type":"text/x-python","patch_set":3,"id":"1f1a1f67_4ba84976","line":1386,"in_reply_to":"1f1a1f67_cbae9997","updated":"2017-07-20 22:41:46.000000000","message":"yep, totally... something like `TODO(prashkre): add functional testing for missing name_attr`","commit_id":"6cc06bff11d44825de50d5d46433ec99f3c1d002"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9a45979fa1272912fa3faf72534383794362890e","unresolved":false,"context_lines":[{"line_number":1387,"context_line":"        # ldap name attribute has a value."},{"line_number":1388,"context_line":"        # for e.g. In ldap configuration, if user_name_attribute \u003d personName,"},{"line_number":1389,"context_line":"        # then query will find user only if \u0027personName\u0027 attribute is set"},{"line_number":1390,"context_line":"        # with some value on user."},{"line_number":1391,"context_line":"        query \u003d (u\u0027(\u0026(%(id_attr)s\u003d%(id)s)\u0027"},{"line_number":1392,"context_line":"                 u\u0027%(filter)s\u0027"},{"line_number":1393,"context_line":"                 u\u0027(objectClass\u003d%(object_class)s)\u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"1f1a1f67_973fa8b4","line":1390,"updated":"2017-07-20 19:52:37.000000000","message":"In other words - this keeps keystone from having to deal with entities that don\u0027t have names (filtering but done in LDAP).","commit_id":"6cc06bff11d44825de50d5d46433ec99f3c1d002"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"e8439e1a6b81df626e2bf8aa1286c3f5cd99d73c","unresolved":false,"context_lines":[{"line_number":1385,"context_line":"    def _ldap_get(self, object_id, ldap_filter\u003dNone):"},{"line_number":1386,"context_line":"        # TODO(prashkre): add functional testing for missing name_attr."},{"line_number":1387,"context_line":""},{"line_number":1388,"context_line":"        # name_attr is added in ldap search query to enforce that ldap"},{"line_number":1389,"context_line":"        # name attribute has a value. This keeps keystone away from entities"},{"line_number":1390,"context_line":"        # that don\u0027t have names."},{"line_number":1391,"context_line":"        # for e.g. In ldap configuration, if user_name_attribute \u003d personName,"}],"source_content_type":"text/x-python","patch_set":4,"id":"1f1a1f67_eb381e3e","line":1388,"updated":"2017-07-21 13:07:42.000000000","message":"I think you\u0027re supposed to prefix this with \"NOTE(prashkre)\".","commit_id":"5c5e157af49e36a0e00c8a40ed6c4b5bf1e89283"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"27fdfedfe655d7230171a0998362fbe15655c078","unresolved":false,"context_lines":[{"line_number":1389,"context_line":"    # then it will ignore ldap users who don\u0027t have \u0027personName\u0027 attribute"},{"line_number":1390,"context_line":"    # value set on user."},{"line_number":1391,"context_line":"    def _filter_ldap_result_by_attr(self, ldap_result, ldap_attr_name\u003dNone):"},{"line_number":1392,"context_line":"        attr \u003d None"},{"line_number":1393,"context_line":"        if ldap_attr_name:"},{"line_number":1394,"context_line":"            attr \u003d self.attribute_mapping.get(ldap_attr_name)"},{"line_number":1395,"context_line":"        if attr is None:"},{"line_number":1396,"context_line":"            return ldap_result"},{"line_number":1397,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1398,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"},{"line_number":1399,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_8e040c7d","line":1396,"range":{"start_line":1392,"start_character":0,"end_line":1396,"end_character":30},"updated":"2017-07-24 14:09:05.000000000","message":"better:\n\n        if not ldap_attr_name:\n            return ldap_result\n        attr \u003d self.attribute_mapping.get(ldap_attr_name)","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"5a8374e739d87d474a17a488d59fa56712e742d7","unresolved":false,"context_lines":[{"line_number":1389,"context_line":"    # then it will ignore ldap users who don\u0027t have \u0027personName\u0027 attribute"},{"line_number":1390,"context_line":"    # value set on user."},{"line_number":1391,"context_line":"    def _filter_ldap_result_by_attr(self, ldap_result, ldap_attr_name\u003dNone):"},{"line_number":1392,"context_line":"        attr \u003d None"},{"line_number":1393,"context_line":"        if ldap_attr_name:"},{"line_number":1394,"context_line":"            attr \u003d self.attribute_mapping.get(ldap_attr_name)"},{"line_number":1395,"context_line":"        if attr is None:"},{"line_number":1396,"context_line":"            return ldap_result"},{"line_number":1397,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1398,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"},{"line_number":1399,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_a43fefd4","line":1396,"range":{"start_line":1392,"start_character":0,"end_line":1396,"end_character":30},"in_reply_to":"ff346bd7_8e040c7d","updated":"2017-07-24 14:20:14.000000000","message":"Honestly, rather than check for none I would make attr_name a required parameter. Since the entire point of the function is to filter_results_by_attr.","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"6b28e224c7825479f73a6df83f9ac2261aadbf86","unresolved":false,"context_lines":[{"line_number":1389,"context_line":"    # then it will ignore ldap users who don\u0027t have \u0027personName\u0027 attribute"},{"line_number":1390,"context_line":"    # value set on user."},{"line_number":1391,"context_line":"    def _filter_ldap_result_by_attr(self, ldap_result, ldap_attr_name\u003dNone):"},{"line_number":1392,"context_line":"        attr \u003d None"},{"line_number":1393,"context_line":"        if ldap_attr_name:"},{"line_number":1394,"context_line":"            attr \u003d self.attribute_mapping.get(ldap_attr_name)"},{"line_number":1395,"context_line":"        if attr is None:"},{"line_number":1396,"context_line":"            return ldap_result"},{"line_number":1397,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1398,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"},{"line_number":1399,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_31945837","line":1396,"range":{"start_line":1392,"start_character":0,"end_line":1396,"end_character":30},"in_reply_to":"ff346bd7_8e040c7d","updated":"2017-07-24 19:23:14.000000000","message":"Thanks Matt for your comment. Fixed it in new patch.","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"6b28e224c7825479f73a6df83f9ac2261aadbf86","unresolved":false,"context_lines":[{"line_number":1389,"context_line":"    # then it will ignore ldap users who don\u0027t have \u0027personName\u0027 attribute"},{"line_number":1390,"context_line":"    # value set on user."},{"line_number":1391,"context_line":"    def _filter_ldap_result_by_attr(self, ldap_result, ldap_attr_name\u003dNone):"},{"line_number":1392,"context_line":"        attr \u003d None"},{"line_number":1393,"context_line":"        if ldap_attr_name:"},{"line_number":1394,"context_line":"            attr \u003d self.attribute_mapping.get(ldap_attr_name)"},{"line_number":1395,"context_line":"        if attr is None:"},{"line_number":1396,"context_line":"            return ldap_result"},{"line_number":1397,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1398,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"},{"line_number":1399,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_318fb82b","line":1396,"range":{"start_line":1392,"start_character":0,"end_line":1396,"end_character":30},"in_reply_to":"ff346bd7_a43fefd4","updated":"2017-07-24 19:23:14.000000000","message":"Thanks knikolla for your comment. Fixed it in new patch.","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"27fdfedfe655d7230171a0998362fbe15655c078","unresolved":false,"context_lines":[{"line_number":1397,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1398,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"},{"line_number":1399,"context_line":""},{"line_number":1400,"context_line":"    # TODO(prashkre): add functional testing for missing name attibute"},{"line_number":1401,"context_line":"    # on ldap entities."},{"line_number":1402,"context_line":"    def _ldap_get(self, object_id, ldap_filter\u003dNone):"},{"line_number":1403,"context_line":"        query \u003d (u\u0027(\u0026(%(id_attr)s\u003d%(id)s)\u0027"}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_84a2ab99","line":1400,"updated":"2017-07-24 14:09:05.000000000","message":"I would probably move this down next to where we call _filter_ldap_result_by_attr","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"6b28e224c7825479f73a6df83f9ac2261aadbf86","unresolved":false,"context_lines":[{"line_number":1397,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1398,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"},{"line_number":1399,"context_line":""},{"line_number":1400,"context_line":"    # TODO(prashkre): add functional testing for missing name attibute"},{"line_number":1401,"context_line":"    # on ldap entities."},{"line_number":1402,"context_line":"    def _ldap_get(self, object_id, ldap_filter\u003dNone):"},{"line_number":1403,"context_line":"        query \u003d (u\u0027(\u0026(%(id_attr)s\u003d%(id)s)\u0027"}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_f1eb70ad","line":1400,"in_reply_to":"ff346bd7_84a2ab99","updated":"2017-07-24 19:23:14.000000000","message":"Done","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"27fdfedfe655d7230171a0998362fbe15655c078","unresolved":false,"context_lines":[{"line_number":1421,"context_line":"                return None"},{"line_number":1422,"context_line":""},{"line_number":1423,"context_line":"        # NOTE(prashkre): Filter ldap search result to keep keystone away"},{"line_number":1424,"context_line":"        # from entities that don\u0027t have names."},{"line_number":1425,"context_line":"        try:"},{"line_number":1426,"context_line":"            return self._filter_ldap_result_by_attr(res, \u0027name\u0027)[0]"},{"line_number":1427,"context_line":"        except IndexError:"}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_cecb341c","line":1424,"updated":"2017-07-24 14:09:05.000000000","message":"NOTE should explain why we\u0027re doing it this way instead of in the query (i.e. performance).","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"6b28e224c7825479f73a6df83f9ac2261aadbf86","unresolved":false,"context_lines":[{"line_number":1421,"context_line":"                return None"},{"line_number":1422,"context_line":""},{"line_number":1423,"context_line":"        # NOTE(prashkre): Filter ldap search result to keep keystone away"},{"line_number":1424,"context_line":"        # from entities that don\u0027t have names."},{"line_number":1425,"context_line":"        try:"},{"line_number":1426,"context_line":"            return self._filter_ldap_result_by_attr(res, \u0027name\u0027)[0]"},{"line_number":1427,"context_line":"        except IndexError:"}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_d1d06cfa","line":1424,"in_reply_to":"ff346bd7_cecb341c","updated":"2017-07-24 19:23:14.000000000","message":"Done","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"27fdfedfe655d7230171a0998362fbe15655c078","unresolved":false,"context_lines":[{"line_number":1423,"context_line":"        # NOTE(prashkre): Filter ldap search result to keep keystone away"},{"line_number":1424,"context_line":"        # from entities that don\u0027t have names."},{"line_number":1425,"context_line":"        try:"},{"line_number":1426,"context_line":"            return self._filter_ldap_result_by_attr(res, \u0027name\u0027)[0]"},{"line_number":1427,"context_line":"        except IndexError:"},{"line_number":1428,"context_line":"            return None"},{"line_number":1429,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_2e21a0fc","line":1426,"updated":"2017-07-24 14:09:05.000000000","message":"since we\u0027re only returning the first entry (I\u0027m talking about the [0]) we could improve the efficiency here by only calling _filter_ldap_result_by_attr with {res[0]} instead of with the whole res","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"5a8374e739d87d474a17a488d59fa56712e742d7","unresolved":false,"context_lines":[{"line_number":1423,"context_line":"        # NOTE(prashkre): Filter ldap search result to keep keystone away"},{"line_number":1424,"context_line":"        # from entities that don\u0027t have names."},{"line_number":1425,"context_line":"        try:"},{"line_number":1426,"context_line":"            return self._filter_ldap_result_by_attr(res, \u0027name\u0027)[0]"},{"line_number":1427,"context_line":"        except IndexError:"},{"line_number":1428,"context_line":"            return None"},{"line_number":1429,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_640a2727","line":1426,"in_reply_to":"ff346bd7_2e21a0fc","updated":"2017-07-24 14:20:14.000000000","message":"++","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"6b28e224c7825479f73a6df83f9ac2261aadbf86","unresolved":false,"context_lines":[{"line_number":1423,"context_line":"        # NOTE(prashkre): Filter ldap search result to keep keystone away"},{"line_number":1424,"context_line":"        # from entities that don\u0027t have names."},{"line_number":1425,"context_line":"        try:"},{"line_number":1426,"context_line":"            return self._filter_ldap_result_by_attr(res, \u0027name\u0027)[0]"},{"line_number":1427,"context_line":"        except IndexError:"},{"line_number":1428,"context_line":"            return None"},{"line_number":1429,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_71d780ef","line":1426,"in_reply_to":"ff346bd7_2e21a0fc","updated":"2017-07-24 19:23:14.000000000","message":"Since ldap search query has id_attr, ldap search result(res) is expected to have only one user object which is in res[0\n\nAnother reason why I have passed whole result(res) instead of res[0] \u003d\u003d\u003e result(res) is of type \u003clist\u003e containing list of user tuple objects i.e. res[0] is of type \u003ctuple\u003e. So if we pass res[0] instead of res then _filter_ldap_result_by_attr() method needs to filter user objects based on its ldap_result argument type. So I felt passing whole result(res) would be better to avoid unnecessary logic based on ldap_result argument type in _filter_ldap_result_by_attr().","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"27fdfedfe655d7230171a0998362fbe15655c078","unresolved":false,"context_lines":[{"line_number":1441,"context_line":"            except ldap.NO_SUCH_OBJECT:"},{"line_number":1442,"context_line":"                return []"},{"line_number":1443,"context_line":""},{"line_number":1444,"context_line":"    # TODO(prashkre): add functional testing for missing name attibute"},{"line_number":1445,"context_line":"    # on ldap entities."},{"line_number":1446,"context_line":"    @driver_hints.truncated"},{"line_number":1447,"context_line":"    def _ldap_get_all(self, hints, ldap_filter\u003dNone):"}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_24a9bf7a","line":1444,"updated":"2017-07-24 14:09:05.000000000","message":"I would probably move this down next to where we call _filter_ldap_result_by_attr","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"6b28e224c7825479f73a6df83f9ac2261aadbf86","unresolved":false,"context_lines":[{"line_number":1441,"context_line":"            except ldap.NO_SUCH_OBJECT:"},{"line_number":1442,"context_line":"                return []"},{"line_number":1443,"context_line":""},{"line_number":1444,"context_line":"    # TODO(prashkre): add functional testing for missing name attibute"},{"line_number":1445,"context_line":"    # on ldap entities."},{"line_number":1446,"context_line":"    @driver_hints.truncated"},{"line_number":1447,"context_line":"    def _ldap_get_all(self, hints, ldap_filter\u003dNone):"}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_e35ba32b","line":1444,"in_reply_to":"ff346bd7_24a9bf7a","updated":"2017-07-24 19:23:14.000000000","message":"Done","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"27fdfedfe655d7230171a0998362fbe15655c078","unresolved":false,"context_lines":[{"line_number":1460,"context_line":"                                         query,"},{"line_number":1461,"context_line":"                                         attrs,"},{"line_number":1462,"context_line":"                                         sizelimit)"},{"line_number":1463,"context_line":"            # NOTE(prashkre): Filter ldap search result to keep keystone away"},{"line_number":1464,"context_line":"            # from entities that don\u0027t have names."},{"line_number":1465,"context_line":"            return self._filter_ldap_result_by_attr(res, \u0027name\u0027)"},{"line_number":1466,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_84d06bf9","line":1463,"updated":"2017-07-24 14:09:05.000000000","message":"NOTE should explain why we\u0027re doing it this way instead of in the query (i.e. performance).","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"6b28e224c7825479f73a6df83f9ac2261aadbf86","unresolved":false,"context_lines":[{"line_number":1460,"context_line":"                                         query,"},{"line_number":1461,"context_line":"                                         attrs,"},{"line_number":1462,"context_line":"                                         sizelimit)"},{"line_number":1463,"context_line":"            # NOTE(prashkre): Filter ldap search result to keep keystone away"},{"line_number":1464,"context_line":"            # from entities that don\u0027t have names."},{"line_number":1465,"context_line":"            return self._filter_ldap_result_by_attr(res, \u0027name\u0027)"},{"line_number":1466,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_834a9752","line":1463,"in_reply_to":"ff346bd7_84d06bf9","updated":"2017-07-24 19:23:14.000000000","message":"Done","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"27fdfedfe655d7230171a0998362fbe15655c078","unresolved":false,"context_lines":[{"line_number":1471,"context_line":"                                    query,"},{"line_number":1472,"context_line":"                                    attrs)"},{"line_number":1473,"context_line":""},{"line_number":1474,"context_line":"                # NOTE(prashkre): Filter ldap search result to keep keystone"},{"line_number":1475,"context_line":"                # away from entities that don\u0027t have names."},{"line_number":1476,"context_line":"                return self._filter_ldap_result_by_attr(res, \u0027name\u0027)"},{"line_number":1477,"context_line":"            except ldap.NO_SUCH_OBJECT:"}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_8912c657","line":1474,"updated":"2017-07-24 14:09:05.000000000","message":"this doesn\u0027t really need to be inside the try block, and we could remove duplication with lines 1463-5 by moving the with block into a new else block and then only doing this once after the if/else","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"6b28e224c7825479f73a6df83f9ac2261aadbf86","unresolved":false,"context_lines":[{"line_number":1471,"context_line":"                                    query,"},{"line_number":1472,"context_line":"                                    attrs)"},{"line_number":1473,"context_line":""},{"line_number":1474,"context_line":"                # NOTE(prashkre): Filter ldap search result to keep keystone"},{"line_number":1475,"context_line":"                # away from entities that don\u0027t have names."},{"line_number":1476,"context_line":"                return self._filter_ldap_result_by_attr(res, \u0027name\u0027)"},{"line_number":1477,"context_line":"            except ldap.NO_SUCH_OBJECT:"}],"source_content_type":"text/x-python","patch_set":6,"id":"ff346bd7_6347b34d","line":1474,"in_reply_to":"ff346bd7_8912c657","updated":"2017-07-24 19:23:14.000000000","message":"Done","commit_id":"b1a03e22fec0e155e87ed5bac2eff895822c10fe"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"e88f8fa2ade6a5cdcef17310902d0aa55847e735","unresolved":false,"context_lines":[{"line_number":1424,"context_line":"        # search query but the repsonse time of the query is pretty slow when"},{"line_number":1425,"context_line":"        # compared to explicit filtering by \u0027name\u0027 through ldap result."},{"line_number":1426,"context_line":"        try:"},{"line_number":1427,"context_line":"            return self._filter_ldap_result_by_attr(res, \u0027name\u0027)[0]"},{"line_number":1428,"context_line":"        except IndexError:"},{"line_number":1429,"context_line":"            return None"},{"line_number":1430,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"ff346bd7_432eef43","line":1427,"updated":"2017-07-24 19:22:08.000000000","message":"Matthew had a good point in the prior patchset about only sending a list with the first item to the function. So you should be doing self._filter_ldap_result_by_attr(res[:1], \u0027name\u0027)","commit_id":"8d7606055464124d51db6d66628bdb76ac6b86f3"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"3f47e27ef809634443c38a40a8722002d206b08f","unresolved":false,"context_lines":[{"line_number":1424,"context_line":"        # search query but the repsonse time of the query is pretty slow when"},{"line_number":1425,"context_line":"        # compared to explicit filtering by \u0027name\u0027 through ldap result."},{"line_number":1426,"context_line":"        try:"},{"line_number":1427,"context_line":"            return self._filter_ldap_result_by_attr(res, \u0027name\u0027)[0]"},{"line_number":1428,"context_line":"        except IndexError:"},{"line_number":1429,"context_line":"            return None"},{"line_number":1430,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"ff346bd7_a3aebb2b","line":1427,"in_reply_to":"ff346bd7_432eef43","updated":"2017-07-24 19:40:55.000000000","message":"Thanks knikolla. Fixed it new patch. Sorry, I perceived Matthew previous comment in a different way and left it as it was.","commit_id":"8d7606055464124d51db6d66628bdb76ac6b86f3"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"51a684f5e541bd2a6d1e4086ad66955598e727d4","unresolved":false,"context_lines":[{"line_number":1390,"context_line":"    # value set on user."},{"line_number":1391,"context_line":"    def _filter_ldap_result_by_attr(self, ldap_result, ldap_attr_name):"},{"line_number":1392,"context_line":"        attr \u003d self.attribute_mapping.get(ldap_attr_name)"},{"line_number":1393,"context_line":"        if not attr:"},{"line_number":1394,"context_line":"            return ldap_result"},{"line_number":1395,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1396,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"}],"source_content_type":"text/x-python","patch_set":9,"id":"ff346bd7_8224345f","line":1393,"range":{"start_line":1393,"start_character":15,"end_line":1393,"end_character":19},"updated":"2017-07-28 13:59:56.000000000","message":"so if the attribute is unkown, we ignore the filtering and return the entity as is?","commit_id":"c7b536d40fc7ee30ce54011fe0ff5a846eff3300"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"a1ba20fc81cfdaa011a6118e2db0458d9e8eafd4","unresolved":false,"context_lines":[{"line_number":1390,"context_line":"    # value set on user."},{"line_number":1391,"context_line":"    def _filter_ldap_result_by_attr(self, ldap_result, ldap_attr_name):"},{"line_number":1392,"context_line":"        attr \u003d self.attribute_mapping.get(ldap_attr_name)"},{"line_number":1393,"context_line":"        if not attr:"},{"line_number":1394,"context_line":"            return ldap_result"},{"line_number":1395,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1396,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"}],"source_content_type":"text/x-python","patch_set":9,"id":"df3967d1_a7e6da15","line":1393,"range":{"start_line":1393,"start_character":15,"end_line":1393,"end_character":19},"in_reply_to":"df3967d1_408298ca","updated":"2017-07-31 11:06:54.000000000","message":"Sorry Matthew, it won\u0027t result in stack trace instead it will return empty list because in the conditional statement if obj[1].get(attr) and obj[1].get(attr)[0] \u003e\u003e obj[1].get(attr) would always be None because in the situation we discussed above, attr was None. So, I think we need to choose between raising an exception to have ldap attribute value needed or return the ldap_result as it is.","commit_id":"c7b536d40fc7ee30ce54011fe0ff5a846eff3300"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"f0c5153776b864ab72426abe864936951ba95380","unresolved":false,"context_lines":[{"line_number":1390,"context_line":"    # value set on user."},{"line_number":1391,"context_line":"    def _filter_ldap_result_by_attr(self, ldap_result, ldap_attr_name):"},{"line_number":1392,"context_line":"        attr \u003d self.attribute_mapping.get(ldap_attr_name)"},{"line_number":1393,"context_line":"        if not attr:"},{"line_number":1394,"context_line":"            return ldap_result"},{"line_number":1395,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1396,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"}],"source_content_type":"text/x-python","patch_set":9,"id":"df3967d1_408298ca","line":1393,"range":{"start_line":1393,"start_character":15,"end_line":1393,"end_character":19},"in_reply_to":"df3967d1_8005207d","updated":"2017-07-28 20:06:52.000000000","message":"I imagine that if you do nothing (i.e., just remove the \"if not attr\" block) it will blow up a couple lines lower and a) the admin should see a nice stack trace in the logs and b) an API caller would get an HTTP 500. And that sounds about right to me.","commit_id":"c7b536d40fc7ee30ce54011fe0ff5a846eff3300"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"25edad966f80a863064328da853b660a173a229b","unresolved":false,"context_lines":[{"line_number":1390,"context_line":"    # value set on user."},{"line_number":1391,"context_line":"    def _filter_ldap_result_by_attr(self, ldap_result, ldap_attr_name):"},{"line_number":1392,"context_line":"        attr \u003d self.attribute_mapping.get(ldap_attr_name)"},{"line_number":1393,"context_line":"        if not attr:"},{"line_number":1394,"context_line":"            return ldap_result"},{"line_number":1395,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1396,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"}],"source_content_type":"text/x-python","patch_set":9,"id":"df3967d1_cfcb301c","line":1393,"range":{"start_line":1393,"start_character":15,"end_line":1393,"end_character":19},"in_reply_to":"df3967d1_a7e6da15","updated":"2017-07-31 14:07:57.000000000","message":"you could replace \"attr \u003d self.attribute_mapping.get(ldap_attr_name)\" with \"attr \u003d self.attribute_mapping[ldap_attr_name]\" and that will raise an exception if ldap_attr_name isn\u0027t part of the mapping.","commit_id":"c7b536d40fc7ee30ce54011fe0ff5a846eff3300"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"03586ee46ee34452d3b377dcf1c6cd80c8aee9f4","unresolved":false,"context_lines":[{"line_number":1390,"context_line":"    # value set on user."},{"line_number":1391,"context_line":"    def _filter_ldap_result_by_attr(self, ldap_result, ldap_attr_name):"},{"line_number":1392,"context_line":"        attr \u003d self.attribute_mapping.get(ldap_attr_name)"},{"line_number":1393,"context_line":"        if not attr:"},{"line_number":1394,"context_line":"            return ldap_result"},{"line_number":1395,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1396,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"}],"source_content_type":"text/x-python","patch_set":9,"id":"df3967d1_c49f8e4e","line":1393,"range":{"start_line":1393,"start_character":15,"end_line":1393,"end_character":19},"in_reply_to":"df3967d1_cfcb301c","updated":"2017-07-31 18:54:26.000000000","message":"\"attr \u003d self.attribute_mapping[ldap_attr_name]\" will fix the case where _filter_ldap_result_by_attr is invoked with ldap_attr_name that isn\u0027t in self.attribute_mapping.\n\nBut it won\u0027t fix the case of below ldap configuration where \"group_name_attribute \u003d None\". \n\n[ldap]\ngroup_id_attribute \u003d cn\ngroup_name_attribute \u003d None\ngroup_desc_attribute \u003d fakedesc\n\nlets assume, _filter_ldap_result_by_attr is invoked with ldap_attr_name \u003d \"name\", at [0] and [1]  self.attribute_mapping was set with {\"name\": \"None\", \u0027description\u0027: \u0027fakedesc\u0027} from ldap config, then attr \u003d self.attribute_mapping[ldap_attr_name] will assign value of \"None\"(type\u003cstr\u003e) but won\u0027t raise any exception. So to handle such case explicitly checking for \"None\" or empty string and raising an exception.\n\n\n[0]\nhttps://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap/common.py#L1155\n[1]\nhttps://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap/core.py#L362","commit_id":"c7b536d40fc7ee30ce54011fe0ff5a846eff3300"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"3489041706ad1362694e836ae6207d09a3cddcb0","unresolved":false,"context_lines":[{"line_number":1390,"context_line":"    # value set on user."},{"line_number":1391,"context_line":"    def _filter_ldap_result_by_attr(self, ldap_result, ldap_attr_name):"},{"line_number":1392,"context_line":"        attr \u003d self.attribute_mapping.get(ldap_attr_name)"},{"line_number":1393,"context_line":"        if not attr:"},{"line_number":1394,"context_line":"            return ldap_result"},{"line_number":1395,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1396,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"}],"source_content_type":"text/x-python","patch_set":9,"id":"ff346bd7_9d581931","line":1393,"range":{"start_line":1393,"start_character":15,"end_line":1393,"end_character":19},"in_reply_to":"ff346bd7_8224345f","updated":"2017-07-28 14:23:11.000000000","message":"yeah, that doesn\u0027t seem right... prashkre, it seems like the caller messed up if they specified an ldap_attr_name that isn\u0027t valid in attribute_mapping, right? Is there a valid case where the caller should be allowed to specify an ldap_attr_name that doesn\u0027t exist in attribute_mapping? If not, we should raise an exception and make them fix that. Maybe just remove the \"if not attr\" check entirely?\n\nIf there is a valid case for ldap_attr_name not existing in attribute_mapping, we need more information about what that is in order to decide what the best way to handle it is.","commit_id":"c7b536d40fc7ee30ce54011fe0ff5a846eff3300"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"c68e221b30d76057cb2102ec68e461512c3659df","unresolved":false,"context_lines":[{"line_number":1390,"context_line":"    # value set on user."},{"line_number":1391,"context_line":"    def _filter_ldap_result_by_attr(self, ldap_result, ldap_attr_name):"},{"line_number":1392,"context_line":"        attr \u003d self.attribute_mapping.get(ldap_attr_name)"},{"line_number":1393,"context_line":"        if not attr:"},{"line_number":1394,"context_line":"            return ldap_result"},{"line_number":1395,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1396,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"}],"source_content_type":"text/x-python","patch_set":9,"id":"df3967d1_8005207d","line":1393,"range":{"start_line":1393,"start_character":15,"end_line":1393,"end_character":19},"in_reply_to":"ff346bd7_9d581931","updated":"2017-07-28 19:55:17.000000000","message":"yes, it is the mess up that caller creates when attribute specified is not in attribute_mapping at [0] and [1]. I don\u0027t see any scenario where caller can specify attribute not in attribute_mapping but there is one such situation we need to consider in ldap configuration[2], where attribute value itself is None i.e. user_name_attribute \u003d None with ldap_attr_name \u003d \"name\".\n\nIn such situation, ldap query searches users/groups based on {user/group}_id_attribute and how do we process further? Do we ignore filtering by returning the result as it is now or raise an exception to correct the ldap configuration?\n\n\n[0]\nhttps://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap/core.py#L243\n\n[1]\nhttps://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap/core.py#L362\n\n[2]\n[ldap] \nurl \u003d ldap://9.9.9.9\nuser_name_attribute \u003d None\nuser_id_attribute \u003d uid\nuser_mail_attribute \u003d None","commit_id":"c7b536d40fc7ee30ce54011fe0ff5a846eff3300"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"51a684f5e541bd2a6d1e4086ad66955598e727d4","unresolved":false,"context_lines":[{"line_number":1393,"context_line":"        if not attr:"},{"line_number":1394,"context_line":"            return ldap_result"},{"line_number":1395,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1396,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"},{"line_number":1397,"context_line":""},{"line_number":1398,"context_line":"    def _ldap_get(self, object_id, ldap_filter\u003dNone):"},{"line_number":1399,"context_line":"        query \u003d (u\u0027(\u0026(%(id_attr)s\u003d%(id)s)\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"ff346bd7_22fc68b3","line":1396,"range":{"start_line":1396,"start_character":40,"end_line":1396,"end_character":59},"updated":"2017-07-28 13:59:56.000000000","message":"this is checking on the value of the attribute, correct?\n\nIs the result of obj[1].get(attr) a tuple? What are the values in that tuple?","commit_id":"c7b536d40fc7ee30ce54011fe0ff5a846eff3300"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"f0c5153776b864ab72426abe864936951ba95380","unresolved":false,"context_lines":[{"line_number":1393,"context_line":"        if not attr:"},{"line_number":1394,"context_line":"            return ldap_result"},{"line_number":1395,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1396,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"},{"line_number":1397,"context_line":""},{"line_number":1398,"context_line":"    def _ldap_get(self, object_id, ldap_filter\u003dNone):"},{"line_number":1399,"context_line":"        query \u003d (u\u0027(\u0026(%(id_attr)s\u003d%(id)s)\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"df3967d1_c091e8f3","line":1396,"range":{"start_line":1396,"start_character":40,"end_line":1396,"end_character":59},"in_reply_to":"df3967d1_ba9df567","updated":"2017-07-28 20:06:52.000000000","message":"yep, sounds right. LDAP will let you specify the same attribute multiple times, which is why values are always lists. Checking obj[1].get(attr)[0] in addition to obj[1].get(attr) would only be in case someone specified the name attribute twice, and the first time gave it an empty-string as a value... I don\u0027t know if that\u0027s possible or not, but I guess it doesn\u0027t hurt to handle it.","commit_id":"c7b536d40fc7ee30ce54011fe0ff5a846eff3300"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"c68e221b30d76057cb2102ec68e461512c3659df","unresolved":false,"context_lines":[{"line_number":1393,"context_line":"        if not attr:"},{"line_number":1394,"context_line":"            return ldap_result"},{"line_number":1395,"context_line":"        return [obj for obj in ldap_result"},{"line_number":1396,"context_line":"                if obj[1].get(attr) and obj[1].get(attr)[0]]"},{"line_number":1397,"context_line":""},{"line_number":1398,"context_line":"    def _ldap_get(self, object_id, ldap_filter\u003dNone):"},{"line_number":1399,"context_line":"        query \u003d (u\u0027(\u0026(%(id_attr)s\u003d%(id)s)\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"df3967d1_ba9df567","line":1396,"range":{"start_line":1396,"start_character":40,"end_line":1396,"end_character":59},"in_reply_to":"ff346bd7_22fc68b3","updated":"2017-07-28 19:55:17.000000000","message":"Lets consider the ldap configuration as shown in [1]\n\none example of obj is (u\u0027uid\u003dfakeUid,c\u003dfake,ou\u003dfakedomain,o\u003dfakeorg\u0027, {\u0027identity\u0027: [u\u0027fakename\u0027], \u0027mail\u0027: [u\u0027fake@fakeorg.org\u0027], \u0027uid\u0027: [u\u0027fakeUid\u0027]}) where ldap_result is a list of type \u003ctuple\u003e,\n\nSince _filter_ldap_result_by_attr() method is being called with ldap_attr_name \u003d \"name\", from [0] and [1] attr is being set with value \"identity\" from self.attribute_mapping\n\n\nSo,\nobj[1].get(attr) is [u\u0027fakename\u0027], which is a list and in if conditional statement, it checks for list is empty or None.\n\nobj[1].get(attr)[0] is fakename, which is a string and in if conditional statement, it checks for empty string or None.\n\n\n[0] https://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap/common.py#L1155\nhttps://github.com/openstack/keystone/blob/master/keystone/identity/backends/ldap/core.py#L243\n\n[1]\n[ldap]\nurl \u003d ldap://9.9.9.9\nuser_name_attribute \u003d identity\nuser_id_attribute \u003d uid\nuser_mail_attribute \u003d mail","commit_id":"c7b536d40fc7ee30ce54011fe0ff5a846eff3300"}],"releasenotes/notes/bug-1704205-bc0570feeb3ec5c4.yaml":[{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"8189064e78052b3074b2624219f24ee447fdfb51","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    [`bug 1652012 \u003chttps://bugs.launchpad.net/keystone/+bug/1704205\u003e`_]"},{"line_number":5,"context_line":"    With ldap as identity backend driver, when some users/groups configured"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f1a1f67_269f6db5","line":2,"range":{"start_line":2,"start_character":0,"end_line":2,"end_character":8},"updated":"2017-07-21 13:17:35.000000000","message":"should be fix, not feature","commit_id":"5c5e157af49e36a0e00c8a40ed6c4b5bf1e89283"},{"author":{"_account_id":10608,"name":"Matthew Edmonds","email":"edmondsw@us.ibm.com","username":"edmondsw"},"change_message_id":"e8439e1a6b81df626e2bf8aa1286c3f5cd99d73c","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    [`bug 1652012 \u003chttps://bugs.launchpad.net/keystone/+bug/1704205\u003e`_]"},{"line_number":5,"context_line":"    With ldap as identity backend driver, when some users/groups configured"},{"line_number":6,"context_line":"    without name attributes then identity API\u0027s(like GET effective"},{"line_number":7,"context_line":"    role-assignments with user_names) that are dealing with name attribues"},{"line_number":8,"context_line":"    are running into an error state. To avoid such cases, changes are made"},{"line_number":9,"context_line":"    to ignore users and groups who have missing ldap user_name_attribute"},{"line_number":10,"context_line":"    and group_name_attribute respectively. This keeps keystone from having"},{"line_number":11,"context_line":"    to deal with entities that don\u0027t have names."}],"source_content_type":"text/x-yaml","patch_set":4,"id":"1f1a1f67_ab90e64f","line":11,"range":{"start_line":5,"start_character":0,"end_line":11,"end_character":48},"updated":"2017-07-21 13:07:42.000000000","message":"there are some grammatical and other issues here... Rather than list them all, I\u0027d suggest the following replacement:\n\nAll users and groups are required to have a name. Prior to this fix, Keystone was not properly enforcing this for LDAP users and groups. Keystone will now ignore users and groups that do not have a value for the LDAP attribute which Keystone has been configured to use for that entity\u0027s name.","commit_id":"5c5e157af49e36a0e00c8a40ed6c4b5bf1e89283"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"cc3f645521edd6240b3868ff9873f35f697185d4","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    [`bug 1652012 \u003chttps://bugs.launchpad.net/keystone/+bug/1704205\u003e`_]"},{"line_number":5,"context_line":"    All users and groups are required to have a name. Prior to this fix,"},{"line_number":6,"context_line":"    Keystone was not properly enforcing this for LDAP users and groups."},{"line_number":7,"context_line":"    Keystone will now ignore users and groups that do not have a value for"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"ff346bd7_b2216350","line":4,"updated":"2017-07-24 22:20:20.000000000","message":"This is pointing to the wrong bug I think, which is causing the failure.","commit_id":"a72873939abc11163536eafdd8b26881befdedfa"},{"author":{"_account_id":24005,"name":"prashkre","email":"prashkre@in.ibm.com","username":"prashkre"},"change_message_id":"08d208f49e457b4ee826e694fc1a419a0a0c32f3","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"fixes:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    [`bug 1652012 \u003chttps://bugs.launchpad.net/keystone/+bug/1704205\u003e`_]"},{"line_number":5,"context_line":"    All users and groups are required to have a name. Prior to this fix,"},{"line_number":6,"context_line":"    Keystone was not properly enforcing this for LDAP users and groups."},{"line_number":7,"context_line":"    Keystone will now ignore users and groups that do not have a value for"}],"source_content_type":"text/x-yaml","patch_set":8,"id":"ff346bd7_340e7532","line":4,"in_reply_to":"ff346bd7_b2216350","updated":"2017-07-25 07:03:36.000000000","message":"lbragstad: Thank you for pointing this. Fixed it in the patch 9.","commit_id":"a72873939abc11163536eafdd8b26881befdedfa"}]}