)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Improve external auth (REMOTE_USER) plugin support"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":" - Introduce a new plugin (ExternalDeprecatedGrizzly) to mimic the"},{"line_number":10,"context_line":"   behaviour of the external authentication in Grizzly."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":" - In ExternalDefault, do not split REMOTE_USER by \"@\". Since this will"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"AAAATn%2F%2F47I%3D","line":9,"updated":"2013-10-25 16:56:37.000000000","message":"change ExternalDeprecatedGrizzly to external.DeprecatedGrizzly","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Improve external auth (REMOTE_USER) plugin support"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":" - Introduce a new plugin (ExternalDeprecatedGrizzly) to mimic the"},{"line_number":10,"context_line":"   behaviour of the external authentication in Grizzly."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":" - In ExternalDefault, do not split REMOTE_USER by \"@\". Since this will"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"AAAATn%2F%2F1fw%3D","line":9,"in_reply_to":"AAAATn%2F%2F47I%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":9,"context_line":" - Introduce a new plugin (ExternalDeprecatedGrizzly) to mimic the"},{"line_number":10,"context_line":"   behaviour of the external authentication in Grizzly."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":" - In ExternalDefault, do not split REMOTE_USER by \"@\". Since this will"},{"line_number":13,"context_line":"   cause errors for remote users containing an \"@\"."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"   When using the ExternalDefault plugin, the current code splits the"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"AAAATn%2F%2F47E%3D","line":12,"updated":"2013-10-25 16:56:37.000000000","message":"change to Default","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":9,"context_line":" - Introduce a new plugin (ExternalDeprecatedGrizzly) to mimic the"},{"line_number":10,"context_line":"   behaviour of the external authentication in Grizzly."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":" - In ExternalDefault, do not split REMOTE_USER by \"@\". Since this will"},{"line_number":13,"context_line":"   cause errors for remote users containing an \"@\"."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"   When using the ExternalDefault plugin, the current code splits the"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"AAAATn%2F%2F1fs%3D","line":12,"in_reply_to":"AAAATn%2F%2F47E%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":12,"context_line":" - In ExternalDefault, do not split REMOTE_USER by \"@\". Since this will"},{"line_number":13,"context_line":"   cause errors for remote users containing an \"@\"."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"   When using the ExternalDefault plugin, the current code splits the"},{"line_number":16,"context_line":"   REMOTE_USER variable by the \"@\". This is ok if we are using domains"},{"line_number":17,"context_line":"   (i.e. ExternalDomain) since any WSGI middleware must append the"},{"line_number":18,"context_line":"   domain to the username. However, in ExternalDefault the code also"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"AAAATn%2F%2F46o%3D","line":15,"updated":"2013-10-25 16:56:37.000000000","message":"change \"ExternalDefault\" to \"Default\"","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":12,"context_line":" - In ExternalDefault, do not split REMOTE_USER by \"@\". Since this will"},{"line_number":13,"context_line":"   cause errors for remote users containing an \"@\"."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"   When using the ExternalDefault plugin, the current code splits the"},{"line_number":16,"context_line":"   REMOTE_USER variable by the \"@\". This is ok if we are using domains"},{"line_number":17,"context_line":"   (i.e. ExternalDomain) since any WSGI middleware must append the"},{"line_number":18,"context_line":"   domain to the username. However, in ExternalDefault the code also"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"AAAATn%2F%2F1fo%3D","line":15,"in_reply_to":"AAAATn%2F%2F46o%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"   When using the ExternalDefault plugin, the current code splits the"},{"line_number":16,"context_line":"   REMOTE_USER variable by the \"@\". This is ok if we are using domains"},{"line_number":17,"context_line":"   (i.e. ExternalDomain) since any WSGI middleware must append the"},{"line_number":18,"context_line":"   domain to the username. However, in ExternalDefault the code also"},{"line_number":19,"context_line":"   splits the domain by the \"@\", even though there should be no domain"},{"line_number":20,"context_line":"   there. ExternalDefault should not split the username at all even if"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"AAAATn%2F%2F46c%3D","line":17,"updated":"2013-10-25 16:56:37.000000000","message":"change to external.Domain","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"   When using the ExternalDefault plugin, the current code splits the"},{"line_number":16,"context_line":"   REMOTE_USER variable by the \"@\". This is ok if we are using domains"},{"line_number":17,"context_line":"   (i.e. ExternalDomain) since any WSGI middleware must append the"},{"line_number":18,"context_line":"   domain to the username. However, in ExternalDefault the code also"},{"line_number":19,"context_line":"   splits the domain by the \"@\", even though there should be no domain"},{"line_number":20,"context_line":"   there. ExternalDefault should not split the username at all even if"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"AAAATn%2F%2F1fk%3D","line":17,"in_reply_to":"AAAATn%2F%2F46c%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":19,"context_line":"   splits the domain by the \"@\", even though there should be no domain"},{"line_number":20,"context_line":"   there. ExternalDefault should not split the username at all even if"},{"line_number":21,"context_line":"   it contains an \"@\"."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Partial-Bug: #1211233"},{"line_number":24,"context_line":"DocImpact: Document the three plugins and also reflect the semantics of"},{"line_number":25,"context_line":"the REMOTE_USER variable for the WSGI filters."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"AAAATn%2F%2F46I%3D","line":22,"updated":"2013-10-25 16:56:37.000000000","message":"When I see a list of changes that indicates that the commit should be split up - https://wiki.openstack.org/wiki/GitCommitMessages#Things_to_avoid_when_creating_commits","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":19,"context_line":"   splits the domain by the \"@\", even though there should be no domain"},{"line_number":20,"context_line":"   there. ExternalDefault should not split the username at all even if"},{"line_number":21,"context_line":"   it contains an \"@\"."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Partial-Bug: #1211233"},{"line_number":24,"context_line":"DocImpact: Document the three plugins and also reflect the semantics of"},{"line_number":25,"context_line":"the REMOTE_USER variable for the WSGI filters."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":14,"id":"AAAATn%2F%2F1fg%3D","line":22,"in_reply_to":"AAAATn%2F%2F46I%3D","updated":"2013-10-28 10:16:53.000000000","message":"I know, but the only thing that could be split up is the \"DeprecatedGrizzly\", and I didn\u0027t want to make a separate change for a deprecated thing... However, I\u0027ve no problem in splitting it up if you think it is necessary.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63f66949fc41e28d15fedc47ea6a76fd6a674912","unresolved":false,"context_lines":[{"line_number":18,"context_line":"it contains an \"@\"."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Partial-Bug: #1211233"},{"line_number":21,"context_line":"DocImpact: Document the three plugins and also reflect the semantics of"},{"line_number":22,"context_line":"the REMOTE_USER variable for the WSGI filters."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Change-Id: I1b2521a526fa976146dfe2fcf4d4c1851416d8ae"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":23,"id":"AAAATn%2F%2BiVQ%3D","line":21,"updated":"2013-11-24 22:57:31.000000000","message":"there\u0027s 2 plugins.","commit_id":"e1f45358aaf16aed011f5f849d9d9bfa99dfba3a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"20cafc23330a4671aa9db6c40f63a7da844e0986","unresolved":false,"context_lines":[{"line_number":26,"context_line":"- In external.DefaultDomain, we cannot split REMOTE_USER by \"@\". This split"},{"line_number":27,"context_line":"  will cause errors for remote users containing an \"@\" (not only"},{"line_number":28,"context_line":"  emails, but also X.509 subjects, etc). The external.DefaultDomain plugin"},{"line_number":29,"context_line":"  considres the REMOTE_USER variable as the username, and the configured"},{"line_number":30,"context_line":"  defualt domain as the domain"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"- In external.Domain we should not split also the REMOTE_USER by \"@\". A"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":27,"id":"AAAAUH%2F%2F5fs%3D","line":29,"updated":"2014-01-07 03:24:14.000000000","message":"considers?","commit_id":"9be692b419b77d967e1234960ab348d1806550f0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"20cafc23330a4671aa9db6c40f63a7da844e0986","unresolved":false,"context_lines":[{"line_number":27,"context_line":"  will cause errors for remote users containing an \"@\" (not only"},{"line_number":28,"context_line":"  emails, but also X.509 subjects, etc). The external.DefaultDomain plugin"},{"line_number":29,"context_line":"  considres the REMOTE_USER variable as the username, and the configured"},{"line_number":30,"context_line":"  defualt domain as the domain"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"- In external.Domain we should not split also the REMOTE_USER by \"@\". A"},{"line_number":33,"context_line":"  new environment variable (REMOTE_DOMAIN) is introduced, so that any"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":27,"id":"AAAAUH%2F%2F5fE%3D","line":30,"updated":"2014-01-07 03:24:14.000000000","message":"default*","commit_id":"9be692b419b77d967e1234960ab348d1806550f0"}],"doc/source/configuration.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d10f1f57502746d90c5db09d56ed4f73477be5b9","unresolved":false,"context_lines":[{"line_number":129,"context_line":"Keystone provides three authentication methods by default. ``password`` handles password"},{"line_number":130,"context_line":"authentication and ``token`` handles token authentication.  ``external`` is used in conjunction"},{"line_number":131,"context_line":"with authentication performed by a container web server that sets the ``REMOTE_USER``"},{"line_number":132,"context_line":"environment variable. For more details, check :doc:`External Authentication \u003cexternal-auth\u003e`"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"How to Implement an Authentication Plugin"},{"line_number":135,"context_line":"^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^"}],"source_content_type":"text/x-rst","patch_set":28,"id":"AAAAUH%2F%2Fkpg%3D","line":132,"updated":"2014-01-10 21:52:01.000000000","message":"missing a period","commit_id":"316438ae58ad28189360b85ec6618e8bddd674b0"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d10f1f57502746d90c5db09d56ed4f73477be5b9","unresolved":false,"context_lines":[{"line_number":174,"context_line":"The ``REMOTE_USER`` environment variable is only set from a containing webserver.  However,"},{"line_number":175,"context_line":"to ensure that a user must go through other authentication mechanisms, even if this variable"},{"line_number":176,"context_line":"is set, remove ``external`` from the list of plugins specified in ``methods``.  This effectively"},{"line_number":177,"context_line":"disables external authentication.  For more details, check :doc:`External Authentication \u003cexternal-auth\u003e`"},{"line_number":178,"context_line":""},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"Token Provider"}],"source_content_type":"text/x-rst","patch_set":28,"id":"AAAAUH%2F%2Fkpc%3D","line":177,"updated":"2014-01-10 21:52:01.000000000","message":"missing a period","commit_id":"316438ae58ad28189360b85ec6618e8bddd674b0"}],"doc/source/external-auth.rst":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":13,"context_line":"V3 Configuration"},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"In Keystone V2 API, there was no way to disable external authentication. In the"},{"line_number":17,"context_line":"V3 API, in order to activate the external authentication mechanism in Keystone"},{"line_number":18,"context_line":"you have to explicitly set in the list of enabled authentication methods::"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAATH%2F%2FV7w%3D","line":16,"updated":"2013-10-17 15:09:42.000000000","message":"It\u0027s not really the API, is it? Suggest \"Pre-Havana Keystone\"","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":13,"context_line":"V3 Configuration"},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"In Keystone V2 API, there was no way to disable external authentication. In the"},{"line_number":17,"context_line":"V3 API, in order to activate the external authentication mechanism in Keystone"},{"line_number":18,"context_line":"you have to explicitly set in the list of enabled authentication methods::"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAATH%2F%2FVfk%3D","line":16,"in_reply_to":"AAAATH%2F%2FV7w%3D","updated":"2013-10-18 08:03:08.000000000","message":"It is specific to V3. V2 uses a different controller and approach: https://github.com/openstack/keystone/blob/master/keystone/token/controllers.py#L89","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"In Keystone V2 API, there was no way to disable external authentication. In the"},{"line_number":17,"context_line":"V3 API, in order to activate the external authentication mechanism in Keystone"},{"line_number":18,"context_line":"you have to explicitly set in the list of enabled authentication methods::"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    [auth]"}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAATH%2F%2FV7s%3D","line":17,"updated":"2013-10-17 15:09:42.000000000","message":"change to \"In the Havana release\"","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"In Keystone V2 API, there was no way to disable external authentication. In the"},{"line_number":17,"context_line":"V3 API, in order to activate the external authentication mechanism in Keystone"},{"line_number":18,"context_line":"you have to explicitly set in the list of enabled authentication methods::"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    [auth]"},{"line_number":21,"context_line":"    methods \u003d password, token, external"}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAATH%2F%2FV7U%3D","line":18,"updated":"2013-10-17 15:09:42.000000000","message":"change \"set in\" to \"add `external` to\"","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"In Keystone V2 API, there was no way to disable external authentication. In the"},{"line_number":17,"context_line":"V3 API, in order to activate the external authentication mechanism in Keystone"},{"line_number":18,"context_line":"you have to explicitly set in the list of enabled authentication methods::"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    [auth]"},{"line_number":21,"context_line":"    methods \u003d password, token, external"}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAATH%2F%2FVfc%3D","line":18,"in_reply_to":"AAAATH%2F%2FV7U%3D","updated":"2013-10-18 08:03:08.000000000","message":"Done","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":20,"context_line":"    [auth]"},{"line_number":21,"context_line":"    methods \u003d password, token, external"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Afterwards you have to choose the plugin that you actually want to use. So far"},{"line_number":24,"context_line":"there are three plugins available:"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"* ``keystone.auth.plugins.ExternalDeprecatedGrizzly``: This plugin mimics the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAATH%2F%2FV7I%3D","line":23,"updated":"2013-10-17 15:09:42.000000000","message":"remove \"So far\"","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":26,"context_line":"* ``keystone.auth.plugins.ExternalDeprecatedGrizzly``: This plugin mimics the"},{"line_number":27,"context_line":"  external authentication behaviour of the Grizzly release.  It tries to get"},{"line_number":28,"context_line":"  the ``user_id`` from the auth info, assuming external authentication"},{"line_number":29,"context_line":"  has check to make sure user is the same as the one specify"},{"line_number":30,"context_line":"  in the identity backend. Note that this behaviour is deprecated, and you"},{"line_number":31,"context_line":"  should switch to ``keystone.auth.plugins.ExternalDefault`` or"},{"line_number":32,"context_line":"  ``keystone.auth.plugins.ExternalDomain``."}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAATH%2F%2FV7E%3D","line":29,"updated":"2013-10-17 15:09:42.000000000","message":"change \"has check\" to \"has checked\"\n\nchange \"make sure user\" to \"make sure the user\" \n\nchange \"the one specify\" to \"the one specified\"","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":26,"context_line":"* ``keystone.auth.plugins.ExternalDeprecatedGrizzly``: This plugin mimics the"},{"line_number":27,"context_line":"  external authentication behaviour of the Grizzly release.  It tries to get"},{"line_number":28,"context_line":"  the ``user_id`` from the auth info, assuming external authentication"},{"line_number":29,"context_line":"  has check to make sure user is the same as the one specify"},{"line_number":30,"context_line":"  in the identity backend. Note that this behaviour is deprecated, and you"},{"line_number":31,"context_line":"  should switch to ``keystone.auth.plugins.ExternalDefault`` or"},{"line_number":32,"context_line":"  ``keystone.auth.plugins.ExternalDomain``."}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAATH%2F%2FVf0%3D","line":29,"in_reply_to":"AAAATH%2F%2FV7E%3D","updated":"2013-10-18 08:03:08.000000000","message":"Arg, too much copy and paste.\n\nDone.","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":35,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"},{"line_number":36,"context_line":"  variable will be considered as the username."},{"line_number":37,"context_line":"* ``keystone.auth.plugins.ExternalDomain``: This plugin will split the"},{"line_number":38,"context_line":"  ``REMOTE_USER`` by the rightmost ``@``. The first part will be considered the"},{"line_number":39,"context_line":"  as the username, whereas the second one will be the domain."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"To configure the plugin that should be used, add it in the ``external`` option"}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAATH%2F%2FV5o%3D","line":38,"updated":"2013-10-17 15:09:42.000000000","message":"change \"considered the\" to \"considered\" (remove the)","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":35,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"},{"line_number":36,"context_line":"  variable will be considered as the username."},{"line_number":37,"context_line":"* ``keystone.auth.plugins.ExternalDomain``: This plugin will split the"},{"line_number":38,"context_line":"  ``REMOTE_USER`` by the rightmost ``@``. The first part will be considered the"},{"line_number":39,"context_line":"  as the username, whereas the second one will be the domain."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"To configure the plugin that should be used, add it in the ``external`` option"}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAATH%2F%2FVfU%3D","line":38,"in_reply_to":"AAAATH%2F%2FV5o%3D","updated":"2013-10-18 08:03:08.000000000","message":"Done","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"In pre-Havana Keystone, there was no way to disable external authentication. In"},{"line_number":17,"context_line":"the Havana release, in order to activate the external authentication mechanism in"},{"line_number":18,"context_line":"Keystone you have to explicitly add `external` to the list of enabled authentication"},{"line_number":19,"context_line":"methods::"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    [auth]"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F45M%3D","line":18,"updated":"2013-10-25 16:56:37.000000000","message":"suggest change \"you have to explicitly add `external` to the list of enabled authentication\" to \"`external` must be in the list of enabled authentication methods\"\n\nyou don\u0027t really have to add it explicitly since the default includes external.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"In pre-Havana Keystone, there was no way to disable external authentication. In"},{"line_number":17,"context_line":"the Havana release, in order to activate the external authentication mechanism in"},{"line_number":18,"context_line":"Keystone you have to explicitly add `external` to the list of enabled authentication"},{"line_number":19,"context_line":"methods::"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    [auth]"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1eI%3D","line":18,"in_reply_to":"AAAATn%2F%2F45M%3D","updated":"2013-10-28 10:16:53.000000000","message":"Yes, indeed.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":19,"context_line":"methods::"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    [auth]"},{"line_number":22,"context_line":"    methods \u003d password, token, external"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Afterwards you have to choose the plugin that you actually want to use. There are"},{"line_number":25,"context_line":"three plugins available:"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F45s%3D","line":22,"updated":"2013-10-25 16:56:37.000000000","message":"suggest change to methods \u003d external,password,token to match the order in keystone.conf.sample: https://github.com/openstack/keystone/blob/master/etc/keystone.conf.sample#L420","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":19,"context_line":"methods::"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    [auth]"},{"line_number":22,"context_line":"    methods \u003d password, token, external"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Afterwards you have to choose the plugin that you actually want to use. There are"},{"line_number":25,"context_line":"three plugins available:"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1eU%3D","line":22,"in_reply_to":"AAAATn%2F%2F45s%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    [auth]"},{"line_number":22,"context_line":"    methods \u003d password, token, external"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Afterwards you have to choose the plugin that you actually want to use. There are"},{"line_number":25,"context_line":"three plugins available:"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* ``keystone.auth.plugins.ExternalDeprecatedGrizzly``: This plugin mimics the"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F448%3D","line":24,"updated":"2013-10-25 16:56:37.000000000","message":"Suggest remove first sentence.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    [auth]"},{"line_number":22,"context_line":"    methods \u003d password, token, external"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Afterwards you have to choose the plugin that you actually want to use. There are"},{"line_number":25,"context_line":"three plugins available:"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* ``keystone.auth.plugins.ExternalDeprecatedGrizzly``: This plugin mimics the"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1eA%3D","line":24,"in_reply_to":"AAAATn%2F%2F448%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    methods \u003d password, token, external"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Afterwards you have to choose the plugin that you actually want to use. There are"},{"line_number":25,"context_line":"three plugins available:"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* ``keystone.auth.plugins.ExternalDeprecatedGrizzly``: This plugin mimics the"},{"line_number":28,"context_line":"  external authentication behaviour of the Grizzly release.  It tries to get"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F44w%3D","line":25,"updated":"2013-10-25 16:56:37.000000000","message":"suggest change to \"There are three external authentication method plugins provided by Keystone:\"","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    methods \u003d password, token, external"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Afterwards you have to choose the plugin that you actually want to use. There are"},{"line_number":25,"context_line":"three plugins available:"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* ``keystone.auth.plugins.ExternalDeprecatedGrizzly``: This plugin mimics the"},{"line_number":28,"context_line":"  external authentication behaviour of the Grizzly release.  It tries to get"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1d4%3D","line":25,"in_reply_to":"AAAATn%2F%2F44w%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Afterwards you have to choose the plugin that you actually want to use. There are"},{"line_number":25,"context_line":"three plugins available:"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* ``keystone.auth.plugins.ExternalDeprecatedGrizzly``: This plugin mimics the"},{"line_number":28,"context_line":"  external authentication behaviour of the Grizzly release.  It tries to get"},{"line_number":29,"context_line":"  the ``user_id`` from the auth info, assuming external authentication"},{"line_number":30,"context_line":"  has checked to make sure the user is the same as the one specified"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F48Y%3D","line":27,"updated":"2013-10-25 16:56:37.000000000","message":"this should be keystone.auth.plugins.external.DeprecatedGrizzly ?","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Afterwards you have to choose the plugin that you actually want to use. There are"},{"line_number":25,"context_line":"three plugins available:"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* ``keystone.auth.plugins.ExternalDeprecatedGrizzly``: This plugin mimics the"},{"line_number":28,"context_line":"  external authentication behaviour of the Grizzly release.  It tries to get"},{"line_number":29,"context_line":"  the ``user_id`` from the auth info, assuming external authentication"},{"line_number":30,"context_line":"  has checked to make sure the user is the same as the one specified"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1d0%3D","line":27,"in_reply_to":"AAAATn%2F%2F48Y%3D","updated":"2013-10-28 10:16:53.000000000","message":"Arg! yes :-(","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":29,"context_line":"  the ``user_id`` from the auth info, assuming external authentication"},{"line_number":30,"context_line":"  has checked to make sure the user is the same as the one specified"},{"line_number":31,"context_line":"  in the identity backend. Note that this behaviour is deprecated, and you"},{"line_number":32,"context_line":"  should switch to ``keystone.auth.plugins.ExternalDefault`` or"},{"line_number":33,"context_line":"  ``keystone.auth.plugins.ExternalDomain``."},{"line_number":34,"context_line":"* ``keystone.auth.plugins.ExternalDefault``: This plugin won\u0027t take into account"},{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F48U%3D","line":32,"updated":"2013-10-25 16:56:37.000000000","message":"this should be keystone.auth.plugins.external.Default ?","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":29,"context_line":"  the ``user_id`` from the auth info, assuming external authentication"},{"line_number":30,"context_line":"  has checked to make sure the user is the same as the one specified"},{"line_number":31,"context_line":"  in the identity backend. Note that this behaviour is deprecated, and you"},{"line_number":32,"context_line":"  should switch to ``keystone.auth.plugins.ExternalDefault`` or"},{"line_number":33,"context_line":"  ``keystone.auth.plugins.ExternalDomain``."},{"line_number":34,"context_line":"* ``keystone.auth.plugins.ExternalDefault``: This plugin won\u0027t take into account"},{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1ds%3D","line":32,"in_reply_to":"AAAATn%2F%2F48U%3D","updated":"2013-10-28 10:16:53.000000000","message":"Same as above.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":30,"context_line":"  has checked to make sure the user is the same as the one specified"},{"line_number":31,"context_line":"  in the identity backend. Note that this behaviour is deprecated, and you"},{"line_number":32,"context_line":"  should switch to ``keystone.auth.plugins.ExternalDefault`` or"},{"line_number":33,"context_line":"  ``keystone.auth.plugins.ExternalDomain``."},{"line_number":34,"context_line":"* ``keystone.auth.plugins.ExternalDefault``: This plugin won\u0027t take into account"},{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":36,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F48Q%3D","line":33,"updated":"2013-10-25 16:56:37.000000000","message":"this should be keystone.auth.plugins.external.Domain ?","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":30,"context_line":"  has checked to make sure the user is the same as the one specified"},{"line_number":31,"context_line":"  in the identity backend. Note that this behaviour is deprecated, and you"},{"line_number":32,"context_line":"  should switch to ``keystone.auth.plugins.ExternalDefault`` or"},{"line_number":33,"context_line":"  ``keystone.auth.plugins.ExternalDomain``."},{"line_number":34,"context_line":"* ``keystone.auth.plugins.ExternalDefault``: This plugin won\u0027t take into account"},{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":36,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1dk%3D","line":33,"in_reply_to":"AAAATn%2F%2F48Q%3D","updated":"2013-10-28 10:16:53.000000000","message":"Same as above.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  in the identity backend. Note that this behaviour is deprecated, and you"},{"line_number":32,"context_line":"  should switch to ``keystone.auth.plugins.ExternalDefault`` or"},{"line_number":33,"context_line":"  ``keystone.auth.plugins.ExternalDomain``."},{"line_number":34,"context_line":"* ``keystone.auth.plugins.ExternalDefault``: This plugin won\u0027t take into account"},{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":36,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"},{"line_number":37,"context_line":"  variable will be considered as the username."}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F48E%3D","line":34,"updated":"2013-10-25 16:56:37.000000000","message":"this should be keystone.auth.plugins.external.Default ?\n\nSuggest list this one first since it\u0027s the default.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  in the identity backend. Note that this behaviour is deprecated, and you"},{"line_number":32,"context_line":"  should switch to ``keystone.auth.plugins.ExternalDefault`` or"},{"line_number":33,"context_line":"  ``keystone.auth.plugins.ExternalDomain``."},{"line_number":34,"context_line":"* ``keystone.auth.plugins.ExternalDefault``: This plugin won\u0027t take into account"},{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":36,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"},{"line_number":37,"context_line":"  variable will be considered as the username."}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1dg%3D","line":34,"in_reply_to":"AAAATn%2F%2F48E%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":33,"context_line":"  ``keystone.auth.plugins.ExternalDomain``."},{"line_number":34,"context_line":"* ``keystone.auth.plugins.ExternalDefault``: This plugin won\u0027t take into account"},{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":36,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"},{"line_number":37,"context_line":"  variable will be considered as the username."},{"line_number":38,"context_line":"* ``keystone.auth.plugins.ExternalDomain``: This plugin will split the"},{"line_number":39,"context_line":"  ``REMOTE_USER`` by the rightmost ``@``. The first part will be considered"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F47w%3D","line":36,"updated":"2013-10-25 16:56:37.000000000","message":"change \"rely on\" to \"always use\"","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":33,"context_line":"  ``keystone.auth.plugins.ExternalDomain``."},{"line_number":34,"context_line":"* ``keystone.auth.plugins.ExternalDefault``: This plugin won\u0027t take into account"},{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":36,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"},{"line_number":37,"context_line":"  variable will be considered as the username."},{"line_number":38,"context_line":"* ``keystone.auth.plugins.ExternalDomain``: This plugin will split the"},{"line_number":39,"context_line":"  ``REMOTE_USER`` by the rightmost ``@``. The first part will be considered"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1dY%3D","line":36,"in_reply_to":"AAAATn%2F%2F47w%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":34,"context_line":"* ``keystone.auth.plugins.ExternalDefault``: This plugin won\u0027t take into account"},{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":36,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"},{"line_number":37,"context_line":"  variable will be considered as the username."},{"line_number":38,"context_line":"* ``keystone.auth.plugins.ExternalDomain``: This plugin will split the"},{"line_number":39,"context_line":"  ``REMOTE_USER`` by the rightmost ``@``. The first part will be considered"},{"line_number":40,"context_line":"  as the username, whereas the second one will be the domain."}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F47o%3D","line":37,"updated":"2013-10-25 16:56:37.000000000","message":"change \"will be considered as\" to \"is\"","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":34,"context_line":"* ``keystone.auth.plugins.ExternalDefault``: This plugin won\u0027t take into account"},{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":36,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"},{"line_number":37,"context_line":"  variable will be considered as the username."},{"line_number":38,"context_line":"* ``keystone.auth.plugins.ExternalDomain``: This plugin will split the"},{"line_number":39,"context_line":"  ``REMOTE_USER`` by the rightmost ``@``. The first part will be considered"},{"line_number":40,"context_line":"  as the username, whereas the second one will be the domain."}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1dU%3D","line":37,"in_reply_to":"AAAATn%2F%2F47o%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":36,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"},{"line_number":37,"context_line":"  variable will be considered as the username."},{"line_number":38,"context_line":"* ``keystone.auth.plugins.ExternalDomain``: This plugin will split the"},{"line_number":39,"context_line":"  ``REMOTE_USER`` by the rightmost ``@``. The first part will be considered"},{"line_number":40,"context_line":"  as the username, whereas the second one will be the domain."},{"line_number":41,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F47k%3D","line":38,"updated":"2013-10-25 16:56:37.000000000","message":"this should be keystone.auth.plugins.external.Domain ?","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":35,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":36,"context_line":"  to Keystone and will rely on the configured default domain. The ``REMOTE_USER``"},{"line_number":37,"context_line":"  variable will be considered as the username."},{"line_number":38,"context_line":"* ``keystone.auth.plugins.ExternalDomain``: This plugin will split the"},{"line_number":39,"context_line":"  ``REMOTE_USER`` by the rightmost ``@``. The first part will be considered"},{"line_number":40,"context_line":"  as the username, whereas the second one will be the domain."},{"line_number":41,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1cs%3D","line":38,"in_reply_to":"AAAATn%2F%2F47k%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  variable will be considered as the username."},{"line_number":38,"context_line":"* ``keystone.auth.plugins.ExternalDomain``: This plugin will split the"},{"line_number":39,"context_line":"  ``REMOTE_USER`` by the rightmost ``@``. The first part will be considered"},{"line_number":40,"context_line":"  as the username, whereas the second one will be the domain."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"To configure the plugin that should be used, add it in the ``external`` option"},{"line_number":43,"context_line":"in the ``auth`` section of your configuration file::"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F43s%3D","line":40,"updated":"2013-10-25 16:56:37.000000000","message":"suggest change this to say something like\n\n The REMOTE_USER variable is formatted like \u003cusername\u003e@\u003cdomain\u003e.\n Where \u003cusername\u003e is the name of the user and\n \u003cdomain\u003e is the name of the domain the user is in.\n The domain is required.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  variable will be considered as the username."},{"line_number":38,"context_line":"* ``keystone.auth.plugins.ExternalDomain``: This plugin will split the"},{"line_number":39,"context_line":"  ``REMOTE_USER`` by the rightmost ``@``. The first part will be considered"},{"line_number":40,"context_line":"  as the username, whereas the second one will be the domain."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"To configure the plugin that should be used, add it in the ``external`` option"},{"line_number":43,"context_line":"in the ``auth`` section of your configuration file::"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1cw%3D","line":40,"in_reply_to":"AAAATn%2F%2F43s%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":43,"context_line":"in the ``auth`` section of your configuration file::"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    [auth]"},{"line_number":46,"context_line":"    external \u003d keystone.auth.plugins.ExternalDefault"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Using HTTPD authentication"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F43c%3D","line":46,"updated":"2013-10-25 16:56:37.000000000","message":"should be keystone.auth.plugins.external.Default","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":43,"context_line":"in the ``auth`` section of your configuration file::"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    [auth]"},{"line_number":46,"context_line":"    external \u003d keystone.auth.plugins.ExternalDefault"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Using HTTPD authentication"}],"source_content_type":"text/x-rst","patch_set":14,"id":"AAAATn%2F%2F1c0%3D","line":46,"in_reply_to":"AAAATn%2F%2F43c%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"5d0bbfec6f4bc6d4f3ffac8d31f2a159b97d9d83","unresolved":false,"context_lines":[{"line_number":6,"context_line":"When Keystone is executed in :doc:`HTTPD \u003capache-httpd\u003e` it is possible to"},{"line_number":7,"context_line":"use external authentication methods different from the authentication"},{"line_number":8,"context_line":"provided by the identity store backend or the different authentication plugins."},{"line_number":9,"context_line":"For example, this makes possible to use a SQL identity backend together with"},{"line_number":10,"context_line":"X.509 authentication, Kerberos, etc. instead of using the username/password"},{"line_number":11,"context_line":"combination."},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"AAAATn%2F%2FpEM%3D","line":9,"updated":"2013-10-31 01:09:57.000000000","message":"makes it possible","commit_id":"dbeb1d3895f58fb6fddd89127b6361e9c88b3a0f"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"8d34cc0c0f1192b6d1d6ecfe48dc61435f67758d","unresolved":false,"context_lines":[{"line_number":6,"context_line":"When Keystone is executed in :doc:`HTTPD \u003capache-httpd\u003e` it is possible to"},{"line_number":7,"context_line":"use external authentication methods different from the authentication"},{"line_number":8,"context_line":"provided by the identity store backend or the different authentication plugins."},{"line_number":9,"context_line":"For example, this makes possible to use a SQL identity backend together with"},{"line_number":10,"context_line":"X.509 authentication, Kerberos, etc. instead of using the username/password"},{"line_number":11,"context_line":"combination."},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"AAAATn%2F%2FoEs%3D","line":9,"in_reply_to":"AAAATn%2F%2FpEM%3D","updated":"2013-10-31 08:38:01.000000000","message":"Done","commit_id":"dbeb1d3895f58fb6fddd89127b6361e9c88b3a0f"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"5d0bbfec6f4bc6d4f3ffac8d31f2a159b97d9d83","unresolved":false,"context_lines":[{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"In pre-Havana Keystone, there was no way to disable external authentication. In"},{"line_number":17,"context_line":"the Havana release, in order to activate the external authentication mechanism in"},{"line_number":18,"context_line":"Keystone `external` must be in the list of enabled authentication"},{"line_number":19,"context_line":"methods::"},{"line_number":20,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"AAAATn%2F%2FpDs%3D","line":17,"updated":"2013-10-31 01:09:57.000000000","message":"This isn\u0027t really correct. When using the V3 API you can configure external authentication but this isn\u0027t the same as saying the Havana release. When using the v2 api which is still available, and unfortunately probably the more widely used in Havana, you are still unable to configure external authentication.\n\nAlso as Havana is released now, everything that is documented below here that you are adding like DeprecatedGrizzly won\u0027t be available till icehouse.","commit_id":"dbeb1d3895f58fb6fddd89127b6361e9c88b3a0f"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"8d34cc0c0f1192b6d1d6ecfe48dc61435f67758d","unresolved":false,"context_lines":[{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"In pre-Havana Keystone, there was no way to disable external authentication. In"},{"line_number":17,"context_line":"the Havana release, in order to activate the external authentication mechanism in"},{"line_number":18,"context_line":"Keystone `external` must be in the list of enabled authentication"},{"line_number":19,"context_line":"methods::"},{"line_number":20,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"AAAATn%2F%2FoD0%3D","line":17,"in_reply_to":"AAAATn%2F%2FpDs%3D","updated":"2013-10-31 08:38:01.000000000","message":"Indeed, this was like this in my original submission for the documentation (https://review.openstack.org/#/c/50362/5/doc/source/external-auth.rst)\n\nAs for the second paragraph, the implementation for V3 that exists right now is unusable with usernames containing an \"@\" (X509 cert subjects, emails, LDAP dns, etc) so maybe this should be backported to Havana.","commit_id":"dbeb1d3895f58fb6fddd89127b6361e9c88b3a0f"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"5d0bbfec6f4bc6d4f3ffac8d31f2a159b97d9d83","unresolved":false,"context_lines":[{"line_number":26,"context_line":"* ``keystone.auth.plugins.external.Default``: This plugin won\u0027t take into account"},{"line_number":27,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":28,"context_line":"  to Keystone and will always use the configured default domain. The ``REMOTE_USER``"},{"line_number":29,"context_line":"  variable is the username."},{"line_number":30,"context_line":"* ``keystone.auth.plugins.external.DeprecatedGrizzly``: This plugin mimics the"},{"line_number":31,"context_line":"  external authentication behaviour of the Grizzly release.  It tries to get"},{"line_number":32,"context_line":"  the ``user_id`` from the auth info, assuming external authentication"}],"source_content_type":"text/x-rst","patch_set":17,"id":"AAAATn%2F%2FpDk%3D","line":29,"updated":"2013-10-31 01:09:57.000000000","message":"you should explain what REMOTE_USER is before mentioning it all through here.","commit_id":"dbeb1d3895f58fb6fddd89127b6361e9c88b3a0f"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"8d34cc0c0f1192b6d1d6ecfe48dc61435f67758d","unresolved":false,"context_lines":[{"line_number":26,"context_line":"* ``keystone.auth.plugins.external.Default``: This plugin won\u0027t take into account"},{"line_number":27,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":28,"context_line":"  to Keystone and will always use the configured default domain. The ``REMOTE_USER``"},{"line_number":29,"context_line":"  variable is the username."},{"line_number":30,"context_line":"* ``keystone.auth.plugins.external.DeprecatedGrizzly``: This plugin mimics the"},{"line_number":31,"context_line":"  external authentication behaviour of the Grizzly release.  It tries to get"},{"line_number":32,"context_line":"  the ``user_id`` from the auth info, assuming external authentication"}],"source_content_type":"text/x-rst","patch_set":17,"id":"AAAATn%2F%2FoDs%3D","line":29,"in_reply_to":"AAAATn%2F%2FpDk%3D","updated":"2013-10-31 08:38:01.000000000","message":"I do agree.","commit_id":"dbeb1d3895f58fb6fddd89127b6361e9c88b3a0f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"302a6dd3bf8cc90bd9b3e9d85bb7713f7b9719ff","unresolved":false,"context_lines":[{"line_number":13,"context_line":"When a web server is in charge of authentication, it is normally possible to set"},{"line_number":14,"context_line":"the ``REMOTE_USER`` environment variable so that it can be used in the"},{"line_number":15,"context_line":"underlying application. Keystone can be configured to use that environment"},{"line_number":16,"context_line":"variable if set, so that the authentication is leverated to the http server."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Configuration"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"AAAATn%2F%2Fl2k%3D","line":16,"updated":"2013-10-31 18:47:47.000000000","message":"\"Leverated\" sounds a lot like a real word, but I don\u0027t think it is. \"handled by\" would suffice, I think","commit_id":"55d023119cfbc17b070549e87a71349c4ebeb59d"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"65cb24839932c62c3fa740a23b3252c62ecac2bf","unresolved":false,"context_lines":[{"line_number":13,"context_line":"When a web server is in charge of authentication, it is normally possible to set"},{"line_number":14,"context_line":"the ``REMOTE_USER`` environment variable so that it can be used in the"},{"line_number":15,"context_line":"underlying application. Keystone can be configured to use that environment"},{"line_number":16,"context_line":"variable if set, so that the authentication is leverated to the http server."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Configuration"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":18,"id":"AAAATn%2F%2Fc5U%3D","line":16,"in_reply_to":"AAAATn%2F%2Fl2k%3D","updated":"2013-11-05 22:36:53.000000000","message":"You\u0027re totally right (my intention was \"leveraged\" though).","commit_id":"55d023119cfbc17b070549e87a71349c4ebeb59d"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"302a6dd3bf8cc90bd9b3e9d85bb7713f7b9719ff","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Configuration"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"In In Keystone V2 API, there is no way to disable external authentication. In"},{"line_number":22,"context_line":"the V3 API in order to activate the external authentication mechanism, the"},{"line_number":23,"context_line":"``external`` method must be in the list of enabled authentication methods (by"},{"line_number":24,"context_line":"default it is enabled)::"}],"source_content_type":"text/x-rst","patch_set":18,"id":"AAAATn%2F%2Fl2U%3D","line":21,"updated":"2013-10-31 18:47:47.000000000","message":"Remove duplicated \"In\"\n\nReplace \"Keystone API\" with \"Identity API\"","commit_id":"55d023119cfbc17b070549e87a71349c4ebeb59d"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"302a6dd3bf8cc90bd9b3e9d85bb7713f7b9719ff","unresolved":false,"context_lines":[{"line_number":24,"context_line":"default it is enabled)::"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    [auth]"},{"line_number":27,"context_line":"    methods \u003d external, password, token"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"To configure the plugin that should be used, add it in the ``external`` option"},{"line_number":30,"context_line":"in the ``auth`` section of your configuration file::"}],"source_content_type":"text/x-rst","patch_set":18,"id":"AAAATn%2F%2Fl2A%3D","line":27,"updated":"2013-10-31 18:47:47.000000000","message":"Is this actually the default or just the sample? Either way, refer to how to configure it, don\u0027t duplicate keystone.config","commit_id":"55d023119cfbc17b070549e87a71349c4ebeb59d"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"65cb24839932c62c3fa740a23b3252c62ecac2bf","unresolved":false,"context_lines":[{"line_number":24,"context_line":"default it is enabled)::"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"    [auth]"},{"line_number":27,"context_line":"    methods \u003d external, password, token"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"To configure the plugin that should be used, add it in the ``external`` option"},{"line_number":30,"context_line":"in the ``auth`` section of your configuration file::"}],"source_content_type":"text/x-rst","patch_set":18,"id":"AAAATn%2F%2Fc5Q%3D","line":27,"in_reply_to":"AAAATn%2F%2Fl2A%3D","updated":"2013-11-05 22:36:53.000000000","message":"Done","commit_id":"55d023119cfbc17b070549e87a71349c4ebeb59d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18794e3b6a9605cd7d5a1b2fadcdb4e33bf4167c","unresolved":false,"context_lines":[{"line_number":6,"context_line":"When Keystone is executed in a web server like :doc:`Apache HTTPD \u003capache-httpd\u003e`"},{"line_number":7,"context_line":"it is possible to use external authentication methods different from the"},{"line_number":8,"context_line":"authentication provided by the identity store backend or the different"},{"line_number":9,"context_line":"authentication plugins. For example, this makes possible to use a SQL identity"},{"line_number":10,"context_line":"backend together with X.509 authentication, Kerberos, etc. instead of using the"},{"line_number":11,"context_line":"username/password combination."},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"AAAATn%2F%2FOZA%3D","line":9,"updated":"2013-11-12 16:47:36.000000000","message":"s/a/an","commit_id":"64efbbb170ff0737ad36213a2fb4969496b1bc81"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"5708d3d36b4289d621e485088a5fcc98c349825c","unresolved":false,"context_lines":[{"line_number":6,"context_line":"When Keystone is executed in a web server like :doc:`Apache HTTPD \u003capache-httpd\u003e`"},{"line_number":7,"context_line":"it is possible to use external authentication methods different from the"},{"line_number":8,"context_line":"authentication provided by the identity store backend or the different"},{"line_number":9,"context_line":"authentication plugins. For example, this makes possible to use a SQL identity"},{"line_number":10,"context_line":"backend together with X.509 authentication, Kerberos, etc. instead of using the"},{"line_number":11,"context_line":"username/password combination."},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"AAAATn%2F%2FLj4%3D","line":9,"in_reply_to":"AAAATn%2F%2FOZA%3D","updated":"2013-11-13 09:27:37.000000000","message":"Done","commit_id":"64efbbb170ff0737ad36213a2fb4969496b1bc81"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18794e3b6a9605cd7d5a1b2fadcdb4e33bf4167c","unresolved":false,"context_lines":[{"line_number":21,"context_line":"In V2 Identity API, there is no way to disable external authentication. In"},{"line_number":22,"context_line":"the V3 API in order to activate the external authentication mechanism, the"},{"line_number":23,"context_line":"``external`` method must be in the list of enabled authentication methods. By"},{"line_number":24,"context_line":"default it is enabled, so if you don\u0027t want to use external authentication, "},{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used, set the ``external`` option again"}],"source_content_type":"text/x-rst","patch_set":19,"id":"AAAATn%2F%2FOZo%3D","line":24,"updated":"2013-11-12 16:47:36.000000000","message":"Remove trailing whitespace","commit_id":"64efbbb170ff0737ad36213a2fb4969496b1bc81"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"5708d3d36b4289d621e485088a5fcc98c349825c","unresolved":false,"context_lines":[{"line_number":21,"context_line":"In V2 Identity API, there is no way to disable external authentication. In"},{"line_number":22,"context_line":"the V3 API in order to activate the external authentication mechanism, the"},{"line_number":23,"context_line":"``external`` method must be in the list of enabled authentication methods. By"},{"line_number":24,"context_line":"default it is enabled, so if you don\u0027t want to use external authentication, "},{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used, set the ``external`` option again"}],"source_content_type":"text/x-rst","patch_set":19,"id":"AAAATn%2F%2FLj8%3D","line":24,"in_reply_to":"AAAATn%2F%2FOZo%3D","updated":"2013-11-13 09:27:37.000000000","message":"Done","commit_id":"64efbbb170ff0737ad36213a2fb4969496b1bc81"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18794e3b6a9605cd7d5a1b2fadcdb4e33bf4167c","unresolved":false,"context_lines":[{"line_number":22,"context_line":"the V3 API in order to activate the external authentication mechanism, the"},{"line_number":23,"context_line":"``external`` method must be in the list of enabled authentication methods. By"},{"line_number":24,"context_line":"default it is enabled, so if you don\u0027t want to use external authentication, "},{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used, set the ``external`` option again"},{"line_number":28,"context_line":"in the ``auth`` section. There are three external authentication method plugins"}],"source_content_type":"text/x-rst","patch_set":19,"id":"AAAATn%2F%2FOYM%3D","line":25,"updated":"2013-11-12 16:47:36.000000000","message":"(NIT): Add an example of what removing should look like here? Or a snipped of \u0027methods\u0027 without external authentication enable but other enabled.","commit_id":"64efbbb170ff0737ad36213a2fb4969496b1bc81"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"5708d3d36b4289d621e485088a5fcc98c349825c","unresolved":false,"context_lines":[{"line_number":22,"context_line":"the V3 API in order to activate the external authentication mechanism, the"},{"line_number":23,"context_line":"``external`` method must be in the list of enabled authentication methods. By"},{"line_number":24,"context_line":"default it is enabled, so if you don\u0027t want to use external authentication, "},{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used, set the ``external`` option again"},{"line_number":28,"context_line":"in the ``auth`` section. There are three external authentication method plugins"}],"source_content_type":"text/x-rst","patch_set":19,"id":"AAAATn%2F%2FLjw%3D","line":25,"in_reply_to":"AAAATn%2F%2FOYM%3D","updated":"2013-11-13 09:27:37.000000000","message":"I\u0027ve removed the examples as per Dolph suggestion in patchset 18.","commit_id":"64efbbb170ff0737ad36213a2fb4969496b1bc81"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8ba70ec4138d2ce9c66355b5d6250d7e9f14f9c5","unresolved":false,"context_lines":[{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used, set the ``external`` option again"},{"line_number":28,"context_line":"in the ``auth`` section. There are three external authentication method plugins"},{"line_number":29,"context_line":"provided by Keystone:"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"* ``keystone.auth.plugins.external.Default``: This plugin won\u0027t take into account"}],"source_content_type":"text/x-rst","patch_set":21,"id":"AAAATn%2F%2B4cM%3D","line":28,"updated":"2013-11-19 01:03:11.000000000","message":"change \"three\" to \"two\"","commit_id":"27de643676bc36f469d502b8fca0971a51dc16a8"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"a8854f9d1ea4254e0ccf737705e74c24c1df7a68","unresolved":false,"context_lines":[{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used, set the ``external`` option again"},{"line_number":28,"context_line":"in the ``auth`` section. There are three external authentication method plugins"},{"line_number":29,"context_line":"provided by Keystone:"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"* ``keystone.auth.plugins.external.Default``: This plugin won\u0027t take into account"}],"source_content_type":"text/x-rst","patch_set":21,"id":"AAAATn%2F%2B3O0%3D","line":28,"in_reply_to":"AAAATn%2F%2B4cM%3D","updated":"2013-11-19 08:34:44.000000000","message":"Done","commit_id":"27de643676bc36f469d502b8fca0971a51dc16a8"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"be291f5d7db10e731700d2e120e7184e3226b2f4","unresolved":false,"context_lines":[{"line_number":24,"context_line":"default it is enabled, so if you don\u0027t want to use external authentication,"},{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used, set the ``external`` option again"},{"line_number":28,"context_line":"in the ``auth`` section. There are two external authentication method plugins"},{"line_number":29,"context_line":"provided by Keystone:"},{"line_number":30,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"AAAATn%2F%2Bpjw%3D","line":27,"updated":"2013-11-22 01:07:17.000000000","message":"(grammar nit) remove the ,","commit_id":"90f29d05d5456f05089bb319a2c4cae528aafa90"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"cad591f795e3b740b82c8315c92eb4233f563d51","unresolved":false,"context_lines":[{"line_number":24,"context_line":"default it is enabled, so if you don\u0027t want to use external authentication,"},{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used, set the ``external`` option again"},{"line_number":28,"context_line":"in the ``auth`` section. There are two external authentication method plugins"},{"line_number":29,"context_line":"provided by Keystone:"},{"line_number":30,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"AAAATn%2F%2Bob4%3D","line":27,"in_reply_to":"AAAATn%2F%2Bpjw%3D","updated":"2013-11-22 08:26:47.000000000","message":"Done","commit_id":"90f29d05d5456f05089bb319a2c4cae528aafa90"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4323ec805de6670e6aa2009027ed4006e2eab7e5","unresolved":false,"context_lines":[{"line_number":7,"context_line":"it is possible to use external authentication methods different from the"},{"line_number":8,"context_line":"authentication provided by the identity store backend or the different"},{"line_number":9,"context_line":"authentication plugins. For example, this makes possible to use an SQL identity"},{"line_number":10,"context_line":"backend together with X.509 authentication, Kerberos, etc. instead of using the"},{"line_number":11,"context_line":"username/password combination."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"When a web server is in charge of authentication, it is normally possible to set"}],"source_content_type":"text/x-rst","patch_set":27,"id":"AAAAUH%2F%2F8Vo%3D","line":10,"updated":"2014-01-06 13:26:28.000000000","message":"(nit) avoid using \"etc.\" in docs","commit_id":"9be692b419b77d967e1234960ab348d1806550f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"afd79ddf71b6159c119d6b0266d15dc5b1cf355a","unresolved":false,"context_lines":[{"line_number":22,"context_line":"the V3 API in order to activate the external authentication mechanism, the"},{"line_number":23,"context_line":"``external`` method must be in the list of enabled authentication methods. By"},{"line_number":24,"context_line":"default it is enabled, so if you don\u0027t want to use external authentication,"},{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used set the ``external`` option again"},{"line_number":28,"context_line":"in the ``auth`` section. There are two external authentication method plugins"}],"source_content_type":"text/x-rst","patch_set":27,"id":"AAAAUH%2F%2F7Yc%3D","line":25,"updated":"2014-01-06 17:26:55.000000000","message":"``[auth]`` section of the configuration file.","commit_id":"9be692b419b77d967e1234960ab348d1806550f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"afd79ddf71b6159c119d6b0266d15dc5b1cf355a","unresolved":false,"context_lines":[{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used set the ``external`` option again"},{"line_number":28,"context_line":"in the ``auth`` section. There are two external authentication method plugins"},{"line_number":29,"context_line":"provided by Keystone:"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"* ``keystone.auth.plugins.external.Default``: This plugin won\u0027t take into account"}],"source_content_type":"text/x-rst","patch_set":27,"id":"AAAAUH%2F%2F7X0%3D","line":28,"updated":"2014-01-06 17:26:55.000000000","message":"same as above","commit_id":"9be692b419b77d967e1234960ab348d1806550f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"afd79ddf71b6159c119d6b0266d15dc5b1cf355a","unresolved":false,"context_lines":[{"line_number":31,"context_line":"* ``keystone.auth.plugins.external.Default``: This plugin won\u0027t take into account"},{"line_number":32,"context_line":"  the domain information that the external authentication method may pass down"},{"line_number":33,"context_line":"  to Keystone and will always use the configured default domain. The ``REMOTE_USER``"},{"line_number":34,"context_line":"  variable is the username."},{"line_number":35,"context_line":"* ``keystone.auth.plugins.external.Domain``: This plugin expects that the"},{"line_number":36,"context_line":"  ``REMOTE_DOMAIN`` variable contains the domain for the user. If this variable"},{"line_number":37,"context_line":"  is not present, the configured default domain will be used. The"}],"source_content_type":"text/x-rst","patch_set":27,"id":"AAAAUH%2F%2F7XE%3D","line":34,"updated":"2014-01-06 17:26:55.000000000","message":"What happen if REMOTE_DOMAIN env var is set?","commit_id":"9be692b419b77d967e1234960ab348d1806550f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"afd79ddf71b6159c119d6b0266d15dc5b1cf355a","unresolved":false,"context_lines":[{"line_number":35,"context_line":"* ``keystone.auth.plugins.external.Domain``: This plugin expects that the"},{"line_number":36,"context_line":"  ``REMOTE_DOMAIN`` variable contains the domain for the user. If this variable"},{"line_number":37,"context_line":"  is not present, the configured default domain will be used. The"},{"line_number":38,"context_line":"  ``REMOTE_USER`` variable is the username."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Using HTTPD authentication"},{"line_number":41,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":27,"id":"AAAAUH%2F%2F7XQ%3D","line":38,"updated":"2014-01-06 17:26:55.000000000","message":"So the only difference between the two plugins is the REMOTE_DOMAIN env var? Then why do we need two plugins as REMOTE_DOMAIN is *optional*? Can we just have one plugin? If REMOTE_DOMAIN is present, use it. Otherwise, use the default domain.","commit_id":"9be692b419b77d967e1234960ab348d1806550f0"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d10f1f57502746d90c5db09d56ed4f73477be5b9","unresolved":false,"context_lines":[{"line_number":7,"context_line":"it is possible to use external authentication methods different from the"},{"line_number":8,"context_line":"authentication provided by the identity store backend or the different"},{"line_number":9,"context_line":"authentication plugins. For example, this makes possible to use an SQL identity"},{"line_number":10,"context_line":"backend together with X.509 authentication, Kerberos, etc. instead of using the"},{"line_number":11,"context_line":"username/password combination."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"When a web server is in charge of authentication, it is normally possible to set"}],"source_content_type":"text/x-rst","patch_set":28,"id":"AAAAUH%2F%2FkpM%3D","line":10,"updated":"2014-01-10 21:52:01.000000000","message":"avoid using etc in docs","commit_id":"316438ae58ad28189360b85ec6618e8bddd674b0"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d10f1f57502746d90c5db09d56ed4f73477be5b9","unresolved":false,"context_lines":[{"line_number":22,"context_line":"the V3 API in order to activate the external authentication mechanism, the"},{"line_number":23,"context_line":"``external`` method must be in the list of enabled authentication methods. By"},{"line_number":24,"context_line":"default it is enabled, so if you don\u0027t want to use external authentication,"},{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used set the ``external`` option again"},{"line_number":28,"context_line":"in the ``auth`` section. There are two external authentication method plugins"}],"source_content_type":"text/x-rst","patch_set":28,"id":"AAAAUH%2F%2FkpA%3D","line":25,"updated":"2014-01-10 21:52:01.000000000","message":"per guang: use ``[auth]`` here","commit_id":"316438ae58ad28189360b85ec6618e8bddd674b0"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d10f1f57502746d90c5db09d56ed4f73477be5b9","unresolved":false,"context_lines":[{"line_number":25,"context_line":"remove it from the ``methods`` option in the ``auth`` section."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"To configure the plugin that should be used set the ``external`` option again"},{"line_number":28,"context_line":"in the ``auth`` section. There are two external authentication method plugins"},{"line_number":29,"context_line":"provided by Keystone:"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"* ``keystone.auth.plugins.external.Default``: This plugin won\u0027t take into account"}],"source_content_type":"text/x-rst","patch_set":28,"id":"AAAAUH%2F%2Fko4%3D","line":28,"updated":"2014-01-10 21:52:01.000000000","message":"same","commit_id":"316438ae58ad28189360b85ec6618e8bddd674b0"}],"keystone/auth/plugins/external.py":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"1f63059367e726f77ab5cdd51b180c90569b9dfd","unresolved":false,"context_lines":[{"line_number":36,"context_line":"            msg \u003d _(\u0027No authenticated user\u0027)"},{"line_number":37,"context_line":"            raise exception.Unauthorized(msg)"},{"line_number":38,"context_line":"        try:"},{"line_number":39,"context_line":"            username \u003d REMOTE_USER"},{"line_number":40,"context_line":"            domain_id \u003d CONF.identity.default_domain_id"},{"line_number":41,"context_line":"            user_ref \u003d auth_info.identity_api.get_user_by_name(username,"},{"line_number":42,"context_line":"                                                               domain_id)"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATH%2F%2Fx6g%3D","line":39,"updated":"2013-10-09 22:09:21.000000000","message":"can we make this configurable? i.e.\n\nif CONF.auth_external.domain_aware:\n  # do the split\nelse:\n  # do not split","commit_id":"5b7de3338e61dc64431401ed4557f8410294ff6a"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"0e2ad23a91168bfe975eb3e65b3f09338585e1e0","unresolved":false,"context_lines":[{"line_number":36,"context_line":"            msg \u003d _(\u0027No authenticated user\u0027)"},{"line_number":37,"context_line":"            raise exception.Unauthorized(msg)"},{"line_number":38,"context_line":"        try:"},{"line_number":39,"context_line":"            username \u003d REMOTE_USER"},{"line_number":40,"context_line":"            domain_id \u003d CONF.identity.default_domain_id"},{"line_number":41,"context_line":"            user_ref \u003d auth_info.identity_api.get_user_by_name(username,"},{"line_number":42,"context_line":"                                                               domain_id)"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATH%2F%2FsFc%3D","line":39,"in_reply_to":"AAAATH%2F%2FtB8%3D","updated":"2013-10-11 06:46:57.000000000","message":"@gyee, @Brant, yes, this is handled with the \"external\" config option (see https://github.com/openstack/keystone/blob/master/keystone/common/config.py#L252 )","commit_id":"5b7de3338e61dc64431401ed4557f8410294ff6a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8eb37890f0ef4fe05c18e354e2a172867d2dfcce","unresolved":false,"context_lines":[{"line_number":36,"context_line":"            msg \u003d _(\u0027No authenticated user\u0027)"},{"line_number":37,"context_line":"            raise exception.Unauthorized(msg)"},{"line_number":38,"context_line":"        try:"},{"line_number":39,"context_line":"            username \u003d REMOTE_USER"},{"line_number":40,"context_line":"            domain_id \u003d CONF.identity.default_domain_id"},{"line_number":41,"context_line":"            user_ref \u003d auth_info.identity_api.get_user_by_name(username,"},{"line_number":42,"context_line":"                                                               domain_id)"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATH%2F%2FtB8%3D","line":39,"in_reply_to":"AAAATH%2F%2Fx6g%3D","updated":"2013-10-10 23:27:05.000000000","message":"@gyee - I think this is handled by switching to the ExternalDomain implementation (see line 69)","commit_id":"5b7de3338e61dc64431401ed4557f8410294ff6a"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"00bc8ed6530ba46ad62828299b605ee4ad9d75b6","unresolved":false,"context_lines":[{"line_number":59,"context_line":"        pass"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"class ExternalDeprecatedGrizzly(ExternalBase):"},{"line_number":63,"context_line":"    def _authenticate(self, REMOTE_USER, auth_info):"},{"line_number":64,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2Fj3U%3D","line":62,"updated":"2013-10-14 14:55:50.000000000","message":"Should this be the default?  That way people upgrading from Grizzly to Havana would get the same functionality unless they wanted to explicitly change it?","commit_id":"5d90266f4f7fa03c1378f45a9956cece105bfae7"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"8a2c7179a1626672416d7ac098effd04bfabeb16","unresolved":false,"context_lines":[{"line_number":59,"context_line":"        pass"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"class ExternalDeprecatedGrizzly(ExternalBase):"},{"line_number":63,"context_line":"    def _authenticate(self, REMOTE_USER, auth_info):"},{"line_number":64,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend"},{"line_number":65,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2Fgto%3D","line":62,"in_reply_to":"AAAATH%2F%2Fj3U%3D","updated":"2013-10-15 07:35:04.000000000","message":"Yes, this was one of my doubts","commit_id":"5d90266f4f7fa03c1378f45a9956cece105bfae7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e376b80ecf5c67ab9c84f46f7d9652dabb964abd","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        # in \"identity\"."},{"line_number":74,"context_line":"        if \u0027password\u0027 in auth_info.get_method_names():"},{"line_number":75,"context_line":"            user_info \u003d auth_info.get_method_data(\u0027password\u0027)"},{"line_number":76,"context_line":"            user_ref \u003d auth_info.lookup_user(user_info[\u0027user\u0027])"},{"line_number":77,"context_line":"            return user_ref"},{"line_number":78,"context_line":"        else:"},{"line_number":79,"context_line":"            msg \u003d _(\u0027Unable to lookup user %s\u0027) % (REMOTE_USER)"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2FjrY%3D","line":76,"updated":"2013-10-14 15:26:40.000000000","message":"do we want to double check to make sure username agrees with REMOTE_USER so there\u0027s no potential security problem?\n\nif user_ref[\u0027name\u0027] !\u003d REMOTE_USER:\n    # we may have a potential problem","commit_id":"5d90266f4f7fa03c1378f45a9956cece105bfae7"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"8a2c7179a1626672416d7ac098effd04bfabeb16","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        # in \"identity\"."},{"line_number":74,"context_line":"        if \u0027password\u0027 in auth_info.get_method_names():"},{"line_number":75,"context_line":"            user_info \u003d auth_info.get_method_data(\u0027password\u0027)"},{"line_number":76,"context_line":"            user_ref \u003d auth_info.lookup_user(user_info[\u0027user\u0027])"},{"line_number":77,"context_line":"            return user_ref"},{"line_number":78,"context_line":"        else:"},{"line_number":79,"context_line":"            msg \u003d _(\u0027Unable to lookup user %s\u0027) % (REMOTE_USER)"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAATH%2F%2Fgtw%3D","line":76,"in_reply_to":"AAAATH%2F%2FjrY%3D","updated":"2013-10-15 07:35:04.000000000","message":"Good point","commit_id":"5d90266f4f7fa03c1378f45a9956cece105bfae7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":63,"context_line":"        pass"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"class ExternalDeprecatedGrizzly(ExternalBase):"},{"line_number":67,"context_line":"    def _authenticate(self, REMOTE_USER, auth_info):"},{"line_number":68,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend"},{"line_number":69,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FV24%3D","line":66,"updated":"2013-10-17 15:09:42.000000000","message":"Seems strange to add something new that\u0027s deprecated.","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":63,"context_line":"        pass"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"class ExternalDeprecatedGrizzly(ExternalBase):"},{"line_number":67,"context_line":"    def _authenticate(self, REMOTE_USER, auth_info):"},{"line_number":68,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend"},{"line_number":69,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FVe0%3D","line":66,"in_reply_to":"AAAATH%2F%2FV24%3D","updated":"2013-10-18 08:03:08.000000000","message":"Yes. However, in the other reviews it was suggested to add also this plugin to preserve the old grizzly behaviour. Without it, external authentication won\u0027t work as expected for Grizzly users.","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"class ExternalDeprecatedGrizzly(ExternalBase):"},{"line_number":67,"context_line":"    def _authenticate(self, REMOTE_USER, auth_info):"},{"line_number":68,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"        Mimic thge bahaviour of external authentication and REMOTE_USER in"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FVzQ%3D","line":67,"updated":"2013-10-17 15:09:42.000000000","message":"Variables should be all uppercase according to PEP8. Change to remote_user\n\napplies elsewhere.","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"class ExternalDeprecatedGrizzly(ExternalBase):"},{"line_number":67,"context_line":"    def _authenticate(self, REMOTE_USER, auth_info):"},{"line_number":68,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"        Mimic thge bahaviour of external authentication and REMOTE_USER in"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FVZA%3D","line":67,"in_reply_to":"AAAATH%2F%2FVzQ%3D","updated":"2013-10-18 08:03:08.000000000","message":"Done","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    def _authenticate(self, REMOTE_USER, auth_info):"},{"line_number":68,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"        Mimic thge bahaviour of external authentication and REMOTE_USER in"},{"line_number":71,"context_line":"        the Grizzly release."},{"line_number":72,"context_line":"        \"\"\""},{"line_number":73,"context_line":"        # FIXME(gyee): REMOTE_USER is not good enough since we are"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FV4w%3D","line":70,"updated":"2013-10-17 15:09:42.000000000","message":"change \"thge\" to \"the\"\n\nchange \"bahaviour\" to \"behavior\"","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    def _authenticate(self, REMOTE_USER, auth_info):"},{"line_number":68,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"        Mimic thge bahaviour of external authentication and REMOTE_USER in"},{"line_number":71,"context_line":"        the Grizzly release."},{"line_number":72,"context_line":"        \"\"\""},{"line_number":73,"context_line":"        # FIXME(gyee): REMOTE_USER is not good enough since we are"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FVYY%3D","line":70,"in_reply_to":"AAAATH%2F%2FV4w%3D","updated":"2013-10-18 08:03:08.000000000","message":"Done","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        # FIXME(gyee): REMOTE_USER is not good enough since we are"},{"line_number":74,"context_line":"        # requiring domain_id to do user lookup now. Try to get"},{"line_number":75,"context_line":"        # the user_id from auth_info for now, assuming external auth"},{"line_number":76,"context_line":"        # has check to make sure user is the same as the one specify"},{"line_number":77,"context_line":"        # in \"identity\"."},{"line_number":78,"context_line":"        if \u0027password\u0027 in auth_info.get_method_names():"},{"line_number":79,"context_line":"            user_info \u003d auth_info.get_method_data(\u0027password\u0027)"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FV4k%3D","line":76,"updated":"2013-10-17 15:09:42.000000000","message":"change \"has check\" to \"has checked\"\n\nchange \"make sure user\" to \"make sure the user\"\n\nchange \"one specify\" to \"one specified\"","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":73,"context_line":"        # FIXME(gyee): REMOTE_USER is not good enough since we are"},{"line_number":74,"context_line":"        # requiring domain_id to do user lookup now. Try to get"},{"line_number":75,"context_line":"        # the user_id from auth_info for now, assuming external auth"},{"line_number":76,"context_line":"        # has check to make sure user is the same as the one specify"},{"line_number":77,"context_line":"        # in \"identity\"."},{"line_number":78,"context_line":"        if \u0027password\u0027 in auth_info.get_method_names():"},{"line_number":79,"context_line":"            user_info \u003d auth_info.get_method_data(\u0027password\u0027)"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FVYI%3D","line":76,"in_reply_to":"AAAATH%2F%2FV4k%3D","updated":"2013-10-18 08:03:08.000000000","message":"Done","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":84,"context_line":"                                                     \"name\": user_ref[\u0027name\u0027]}"},{"line_number":85,"context_line":"                LOG.warning(msg)"},{"line_number":86,"context_line":"                msg \u003d _(\u0027Unable to lookup user %s\u0027) % (REMOTE_USER)"},{"line_number":87,"context_line":"                raise exception.Unauthorized(msg)"},{"line_number":88,"context_line":"            return user_ref"},{"line_number":89,"context_line":"        else:"},{"line_number":90,"context_line":"            msg \u003d _(\u0027Unable to lookup user %s\u0027) % (REMOTE_USER)"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FV3w%3D","line":87,"updated":"2013-10-17 15:09:42.000000000","message":"might as well just raise Exception here since the caller converts it to Unauthorized anyways.","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":84,"context_line":"                                                     \"name\": user_ref[\u0027name\u0027]}"},{"line_number":85,"context_line":"                LOG.warning(msg)"},{"line_number":86,"context_line":"                msg \u003d _(\u0027Unable to lookup user %s\u0027) % (REMOTE_USER)"},{"line_number":87,"context_line":"                raise exception.Unauthorized(msg)"},{"line_number":88,"context_line":"            return user_ref"},{"line_number":89,"context_line":"        else:"},{"line_number":90,"context_line":"            msg \u003d _(\u0027Unable to lookup user %s\u0027) % (REMOTE_USER)"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FS8o%3D","line":87,"in_reply_to":"AAAATH%2F%2FV3w%3D","updated":"2013-10-18 08:03:08.000000000","message":"Done","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":88,"context_line":"            return user_ref"},{"line_number":89,"context_line":"        else:"},{"line_number":90,"context_line":"            msg \u003d _(\u0027Unable to lookup user %s\u0027) % (REMOTE_USER)"},{"line_number":91,"context_line":"            raise exception.Unauthorized(msg)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"class ExternalDefault(ExternalBase):"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FV3s%3D","line":91,"updated":"2013-10-17 15:09:42.000000000","message":"might as well just raise Exception here since the caller converts it to Unauthorized anyways.","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":88,"context_line":"            return user_ref"},{"line_number":89,"context_line":"        else:"},{"line_number":90,"context_line":"            msg \u003d _(\u0027Unable to lookup user %s\u0027) % (REMOTE_USER)"},{"line_number":91,"context_line":"            raise exception.Unauthorized(msg)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"class ExternalDefault(ExternalBase):"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FS8g%3D","line":91,"in_reply_to":"AAAATH%2F%2FV3s%3D","updated":"2013-10-18 08:03:08.000000000","message":"Done","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    def _authenticate(self, REMOTE_USER, auth_info):"},{"line_number":96,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend.\"\"\""},{"line_number":97,"context_line":"        domain_id \u003d CONF.identity.default_domain_id"},{"line_number":98,"context_line":"        user_ref \u003d auth_info.identity_api.get_user_by_name(REMOTE_USER,"},{"line_number":99,"context_line":"                                                           domain_id)"},{"line_number":100,"context_line":"        return user_ref"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FV0E%3D","line":98,"updated":"2013-10-17 15:09:42.000000000","message":"this change is going to break anybody that changed their code to work with ExternalDefault as it was shipped with Havana. Not sure that we can change it.","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":95,"context_line":"    def _authenticate(self, REMOTE_USER, auth_info):"},{"line_number":96,"context_line":"        \"\"\"Use REMOTE_USER to look up the user in the identity backend.\"\"\""},{"line_number":97,"context_line":"        domain_id \u003d CONF.identity.default_domain_id"},{"line_number":98,"context_line":"        user_ref \u003d auth_info.identity_api.get_user_by_name(REMOTE_USER,"},{"line_number":99,"context_line":"                                                           domain_id)"},{"line_number":100,"context_line":"        return user_ref"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FVcw%3D","line":98,"in_reply_to":"AAAATH%2F%2FV0E%3D","updated":"2013-10-18 08:03:08.000000000","message":"Yes, you\u0027re right to an extent.\n\nWithout this change somebody with users containing an \"@\" in their usernames (emails, X.509 cert DNs) and not using domains (i.e. relying on the default domain) won\u0027t be able to use external authentication at all, since the usernames will be wrong.\n\nIf we decide to split REMOTE_USER by the \"@\" anyway we should: 1) force the external plugins to append a \"@domain\" (even if domain is empty\" to the REMOTE_USER and 2) behave the same way ExternalDomain does (i.e. getting the rightmost \"@\") but discarding the domain information in favor of the default domain.\n\nFor example, with the havana code this valid DN: \"/DC\u003dfoo/O\u003dbar/CN\u003dBazonk Smith (bazonk@example.org)\" will be translated into \"/DC\u003dfoo/O\u003dbar/CN\u003dBazonk Smith (bazonk\"","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":87,"context_line":"                raise Exception(msg)"},{"line_number":88,"context_line":"            return user_ref"},{"line_number":89,"context_line":"        else:"},{"line_number":90,"context_line":"            msg \u003d _(\u0027Unable to lookup user %s\u0027) % (remote_user)"},{"line_number":91,"context_line":"            raise Exception(msg)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"AAAATn%2F%2F43A%3D","line":90,"updated":"2013-10-25 16:56:37.000000000","message":"suggest add a remediation to this message -- \"The \u0027password\u0027 method must be defined in methods\"\n\nOr should LOG.warning like at 85?\n\nAlso, is there a test for this case?","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":87,"context_line":"                raise Exception(msg)"},{"line_number":88,"context_line":"            return user_ref"},{"line_number":89,"context_line":"        else:"},{"line_number":90,"context_line":"            msg \u003d _(\u0027Unable to lookup user %s\u0027) % (remote_user)"},{"line_number":91,"context_line":"            raise Exception(msg)"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":""}],"source_content_type":"text/x-python","patch_set":14,"id":"AAAATn%2F%2F1fM%3D","line":90,"in_reply_to":"AAAATn%2F%2F43A%3D","updated":"2013-10-28 10:16:53.000000000","message":"I will change the message, but I think that the exception should be raised anyway: this was the behavior in Grizzly.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18794e3b6a9605cd7d5a1b2fadcdb4e33bf4167c","unresolved":false,"context_lines":[{"line_number":77,"context_line":"        Mimic the behaviour of external authentication and remote_user in"},{"line_number":78,"context_line":"        the Grizzly release."},{"line_number":79,"context_line":"        \"\"\""},{"line_number":80,"context_line":"        # FIXME(gyee): remote_user is not good enough since we are"},{"line_number":81,"context_line":"        # requiring domain_id to do user lookup now. Try to get"},{"line_number":82,"context_line":"        # the user_id from auth_info for now, assuming external auth"},{"line_number":83,"context_line":"        # has checked to make sure the user is the same as the one specified"}],"source_content_type":"text/x-python","patch_set":19,"id":"AAAATn%2F%2FOT0%3D","line":80,"updated":"2013-11-12 16:47:36.000000000","message":"update gyee to aloga?","commit_id":"64efbbb170ff0737ad36213a2fb4969496b1bc81"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"5708d3d36b4289d621e485088a5fcc98c349825c","unresolved":false,"context_lines":[{"line_number":77,"context_line":"        Mimic the behaviour of external authentication and remote_user in"},{"line_number":78,"context_line":"        the Grizzly release."},{"line_number":79,"context_line":"        \"\"\""},{"line_number":80,"context_line":"        # FIXME(gyee): remote_user is not good enough since we are"},{"line_number":81,"context_line":"        # requiring domain_id to do user lookup now. Try to get"},{"line_number":82,"context_line":"        # the user_id from auth_info for now, assuming external auth"},{"line_number":83,"context_line":"        # has checked to make sure the user is the same as the one specified"}],"source_content_type":"text/x-python","patch_set":19,"id":"AAAATn%2F%2FLlo%3D","line":80,"in_reply_to":"AAAATn%2F%2FOT0%3D","updated":"2013-11-13 09:27:37.000000000","message":"Done","commit_id":"64efbbb170ff0737ad36213a2fb4969496b1bc81"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d131f1e8502c7caf386249a2b3138cfe6f3bf311","unresolved":false,"context_lines":[{"line_number":77,"context_line":"        Mimic the behaviour of external authentication and remote_user in"},{"line_number":78,"context_line":"        the Grizzly release."},{"line_number":79,"context_line":"        \"\"\""},{"line_number":80,"context_line":"        # FIXME(aloga): remote_user is not good enough since we are"},{"line_number":81,"context_line":"        # requiring domain_id to do user lookup now. Try to get"},{"line_number":82,"context_line":"        # the user_id from auth_info for now, assuming external auth"},{"line_number":83,"context_line":"        # has checked to make sure the user is the same as the one specified"}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FI2g%3D","line":80,"updated":"2013-11-13 23:18:11.000000000","message":"is there a bug filed for this FIXME? If not, file a bug and put the ID here.","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"3694cf4c06a7502f4bd42b1302de863b5ada7173","unresolved":false,"context_lines":[{"line_number":77,"context_line":"        Mimic the behaviour of external authentication and remote_user in"},{"line_number":78,"context_line":"        the Grizzly release."},{"line_number":79,"context_line":"        \"\"\""},{"line_number":80,"context_line":"        # FIXME(aloga): remote_user is not good enough since we are"},{"line_number":81,"context_line":"        # requiring domain_id to do user lookup now. Try to get"},{"line_number":82,"context_line":"        # the user_id from auth_info for now, assuming external auth"},{"line_number":83,"context_line":"        # has checked to make sure the user is the same as the one specified"}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2B7HA%3D","line":80,"in_reply_to":"AAAATn%2F%2FEB0%3D","updated":"2013-11-18 14:56:01.000000000","message":"Done in https://review.openstack.org/#/c/56950/","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d5a9f28f93ea06c42751826b11032e14de423dba","unresolved":false,"context_lines":[{"line_number":77,"context_line":"        Mimic the behaviour of external authentication and remote_user in"},{"line_number":78,"context_line":"        the Grizzly release."},{"line_number":79,"context_line":"        \"\"\""},{"line_number":80,"context_line":"        # FIXME(aloga): remote_user is not good enough since we are"},{"line_number":81,"context_line":"        # requiring domain_id to do user lookup now. Try to get"},{"line_number":82,"context_line":"        # the user_id from auth_info for now, assuming external auth"},{"line_number":83,"context_line":"        # has checked to make sure the user is the same as the one specified"}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FEB0%3D","line":80,"in_reply_to":"AAAATn%2F%2FGmc%3D","updated":"2013-11-14 23:46:22.000000000","message":"suggest put it in a separate commit and we can consider it there. The rest of the changes look good.","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"6624b1254caaebc1a17cd7aefca7b5e0cb4567b4","unresolved":false,"context_lines":[{"line_number":77,"context_line":"        Mimic the behaviour of external authentication and remote_user in"},{"line_number":78,"context_line":"        the Grizzly release."},{"line_number":79,"context_line":"        \"\"\""},{"line_number":80,"context_line":"        # FIXME(aloga): remote_user is not good enough since we are"},{"line_number":81,"context_line":"        # requiring domain_id to do user lookup now. Try to get"},{"line_number":82,"context_line":"        # the user_id from auth_info for now, assuming external auth"},{"line_number":83,"context_line":"        # has checked to make sure the user is the same as the one specified"}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FGmc%3D","line":80,"in_reply_to":"AAAATn%2F%2FI2g%3D","updated":"2013-11-14 11:57:35.000000000","message":"No, there is not such a bug.\n\nHowever, I am not sure about the inclusion of this code here. I added it just for the case it will enter in Havana. This plugin mimics the Grizzly behaviour for external (cherry picked from [1]) but this code is not anymore in Havana (so the support a-la-Grizzly is broken). I am now not sure if it is worth to include it here again or drop it.\n\n[1] https://github.com/openstack/keystone/blob/stable/grizzly/keystone/auth/controllers.py#L323","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d131f1e8502c7caf386249a2b3138cfe6f3bf311","unresolved":false,"context_lines":[{"line_number":82,"context_line":"        # the user_id from auth_info for now, assuming external auth"},{"line_number":83,"context_line":"        # has checked to make sure the user is the same as the one specified"},{"line_number":84,"context_line":"        # in \"identity\"."},{"line_number":85,"context_line":"        if \u0027password\u0027 in auth_info.get_method_names():"},{"line_number":86,"context_line":"            user_info \u003d auth_info.get_method_data(\u0027password\u0027)"},{"line_number":87,"context_line":"            user_ref \u003d auth_info.lookup_user(user_info[\u0027user\u0027])"},{"line_number":88,"context_line":"            if remote_user !\u003d user_ref[\u0027name\u0027]:"}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FI2M%3D","line":85,"updated":"2013-11-13 23:18:11.000000000","message":"suggest do\n\n if \u0027password\u0027 not in auth_info.get_method_names():\n    msg \u003d ...\n    raise Exception(msg)\n\nthen can unindent 9 lines.","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d131f1e8502c7caf386249a2b3138cfe6f3bf311","unresolved":false,"context_lines":[{"line_number":86,"context_line":"            user_info \u003d auth_info.get_method_data(\u0027password\u0027)"},{"line_number":87,"context_line":"            user_ref \u003d auth_info.lookup_user(user_info[\u0027user\u0027])"},{"line_number":88,"context_line":"            if remote_user !\u003d user_ref[\u0027name\u0027]:"},{"line_number":89,"context_line":"                msg \u003d _(\u0027remote_user does not match supplied credentials \u0027"},{"line_number":90,"context_line":"                        \u0027%(remote)s !\u003d %(name)s\u0027) % {\"remote\": remote_user,"},{"line_number":91,"context_line":"                                                     \"name\": user_ref[\u0027name\u0027]}"},{"line_number":92,"context_line":"                LOG.warning(msg)"}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FI2E%3D","line":89,"updated":"2013-11-13 23:18:11.000000000","message":"Suggest change \"remote_user\" to \"REMOTE_USER\", since it\u0027s the REMOTE_USER environment variable that the user will be more familiar with.\n\nHow about this?\n\n The user in the REMOTE_USER WSGI environment doesn\u0027t match\n the user supplied in the password credentials of the request.","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d131f1e8502c7caf386249a2b3138cfe6f3bf311","unresolved":false,"context_lines":[{"line_number":90,"context_line":"                        \u0027%(remote)s !\u003d %(name)s\u0027) % {\"remote\": remote_user,"},{"line_number":91,"context_line":"                                                     \"name\": user_ref[\u0027name\u0027]}"},{"line_number":92,"context_line":"                LOG.warning(msg)"},{"line_number":93,"context_line":"                msg \u003d _(\u0027Unable to lookup user %s\u0027) % (remote_user)"},{"line_number":94,"context_line":"                raise Exception(msg)"},{"line_number":95,"context_line":"            return user_ref"},{"line_number":96,"context_line":"        else:"}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FI1I%3D","line":93,"updated":"2013-11-13 23:18:11.000000000","message":"why change the message?","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d131f1e8502c7caf386249a2b3138cfe6f3bf311","unresolved":false,"context_lines":[{"line_number":95,"context_line":"            return user_ref"},{"line_number":96,"context_line":"        else:"},{"line_number":97,"context_line":"            msg \u003d _(\"The \u0027password\u0027 method must be defined in methods \""},{"line_number":98,"context_line":"                    \"for external.DeprecatedGrizzly\")"},{"line_number":99,"context_line":"            raise Exception(msg)"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FI04%3D","line":98,"updated":"2013-11-13 23:18:11.000000000","message":"change \"for external.DeprecatedGrizzly\" to \"for the external.DeprecatedGrizzly external authentication method\"","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d131f1e8502c7caf386249a2b3138cfe6f3bf311","unresolved":false,"context_lines":[{"line_number":131,"context_line":""},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"# NOTE(aloga): ExternalDefault and External have been renamed to Default and"},{"line_number":134,"context_line":"# Domain so they are deprecated"},{"line_number":135,"context_line":"class ExternalDefault(Default):"},{"line_number":136,"context_line":"    \"\"\"Deprecated. Please use keystone.auth.external.Default instead.\"\"\""},{"line_number":137,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FI0o%3D","line":134,"updated":"2013-11-13 23:18:11.000000000","message":"suggest remove this comment since the code below makes it obvious.","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"7d42dc0b912dd9f72aafbf5c474ceb0888f38106","unresolved":false,"context_lines":[{"line_number":131,"context_line":""},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"# NOTE(aloga): ExternalDefault and External have been renamed to Default and"},{"line_number":134,"context_line":"# Domain so they are deprecated"},{"line_number":135,"context_line":"class ExternalDefault(Default):"},{"line_number":136,"context_line":"    \"\"\"Deprecated. Please use keystone.auth.external.Default instead.\"\"\""},{"line_number":137,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FFdQ%3D","line":134,"in_reply_to":"AAAATn%2F%2FI0o%3D","updated":"2013-11-18 14:41:20.000000000","message":"I do agree.","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"be291f5d7db10e731700d2e120e7184e3226b2f4","unresolved":false,"context_lines":[{"line_number":68,"context_line":"class Default(Base):"},{"line_number":69,"context_line":"    def _authenticate(self, remote_user, auth_info):"},{"line_number":70,"context_line":"        \"\"\"Use remote_user to look up the user in the identity backend.\"\"\""},{"line_number":71,"context_line":"        domain_id \u003d CONF.identity.default_domain_id"},{"line_number":72,"context_line":"        user_ref \u003d auth_info.identity_api.get_user_by_name(remote_user,"},{"line_number":73,"context_line":"                                                           domain_id)"},{"line_number":74,"context_line":"        return user_ref"}],"source_content_type":"text/x-python","patch_set":22,"id":"AAAATn%2F%2Bpjs%3D","line":71,"updated":"2013-11-22 01:07:17.000000000","message":"I don\u0027t think these previous 2 lines can be removed. It\u0027s not backwards-compatible.","commit_id":"90f29d05d5456f05089bb319a2c4cae528aafa90"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"cad591f795e3b740b82c8315c92eb4233f563d51","unresolved":false,"context_lines":[{"line_number":68,"context_line":"class Default(Base):"},{"line_number":69,"context_line":"    def _authenticate(self, remote_user, auth_info):"},{"line_number":70,"context_line":"        \"\"\"Use remote_user to look up the user in the identity backend.\"\"\""},{"line_number":71,"context_line":"        domain_id \u003d CONF.identity.default_domain_id"},{"line_number":72,"context_line":"        user_ref \u003d auth_info.identity_api.get_user_by_name(remote_user,"},{"line_number":73,"context_line":"                                                           domain_id)"},{"line_number":74,"context_line":"        return user_ref"}],"source_content_type":"text/x-python","patch_set":22,"id":"AAAATn%2F%2Boak%3D","line":71,"in_reply_to":"AAAATn%2F%2Bpjs%3D","updated":"2013-11-22 08:26:47.000000000","message":"Hi Brant. It is not backwards compatible, but being backwards compatible means being unusable.\n\nA remote user containing an \"@\" (think on LDAP dns, X509 certificates or anything where the email would be used) will be completely wrong: it will be splitted and only the leftmost part would be considered. IMO we sould not split it since we are using the default domain here, and the REMOTE_USER should be considered as is.","commit_id":"90f29d05d5456f05089bb319a2c4cae528aafa90"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63f66949fc41e28d15fedc47ea6a76fd6a674912","unresolved":false,"context_lines":[{"line_number":68,"context_line":"class Default(Base):"},{"line_number":69,"context_line":"    def _authenticate(self, remote_user, auth_info):"},{"line_number":70,"context_line":"        \"\"\"Use remote_user to look up the user in the identity backend.\"\"\""},{"line_number":71,"context_line":"        domain_id \u003d CONF.identity.default_domain_id"},{"line_number":72,"context_line":"        user_ref \u003d auth_info.identity_api.get_user_by_name(remote_user,"},{"line_number":73,"context_line":"                                                           domain_id)"},{"line_number":74,"context_line":"        return user_ref"}],"source_content_type":"text/x-python","patch_set":23,"id":"AAAATn%2F%2BiVM%3D","line":71,"updated":"2013-11-24 22:57:31.000000000","message":"\u003c we can\u0027t change this behavior because then it\u0027s not backwards compatible.","commit_id":"e1f45358aaf16aed011f5f849d9d9bfa99dfba3a"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"135a4bd594536db6f5c57316cd179ae1a4597789","unresolved":false,"context_lines":[{"line_number":68,"context_line":"class Default(Base):"},{"line_number":69,"context_line":"    def _authenticate(self, remote_user, auth_info):"},{"line_number":70,"context_line":"        \"\"\"Use remote_user to look up the user in the identity backend.\"\"\""},{"line_number":71,"context_line":"        domain_id \u003d CONF.identity.default_domain_id"},{"line_number":72,"context_line":"        user_ref \u003d auth_info.identity_api.get_user_by_name(remote_user,"},{"line_number":73,"context_line":"                                                           domain_id)"},{"line_number":74,"context_line":"        return user_ref"}],"source_content_type":"text/x-python","patch_set":23,"id":"AAAATn%2F%2BWU0%3D","line":71,"in_reply_to":"AAAATn%2F%2BiVM%3D","updated":"2013-11-27 03:04:59.000000000","message":"Brant See the bug report:  REMOTE_USER should have already been split.  This is a second split, and will break fo people that are using, say, an email address in the user_id","commit_id":"e1f45358aaf16aed011f5f849d9d9bfa99dfba3a"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"155e7d6e110636d0c84bcceb7b09b98217a09cdb","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"from keystone import auth"},{"line_number":24,"context_line":"from keystone.common import config"},{"line_number":25,"context_line":"from keystone.common import utils"},{"line_number":26,"context_line":"from keystone import exception"},{"line_number":27,"context_line":"from keystone.openstack.common import log as logging"},{"line_number":28,"context_line":""}],"source_content_type":"text/x-python","patch_set":26,"id":"AAAATn%2F9egU%3D","line":25,"updated":"2013-12-11 04:57:58.000000000","message":"Change this to be the following and arrange it alphabetically:\n\n  from keystone.openstack.common import versionutils","commit_id":"b6a6e81b311960c456280745ac867727ad35a72f"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"155e7d6e110636d0c84bcceb7b09b98217a09cdb","unresolved":false,"context_lines":[{"line_number":133,"context_line":"class ExternalDefault(LegacyDefaultDomain):"},{"line_number":134,"context_line":"    \"\"\"Deprecated. Please use keystone.auth.external.LegacyDefault instead.\"\"\""},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"    @utils.deprecated(as_of\u003dutils.deprecated.ICEHOUSE,"},{"line_number":137,"context_line":"                      in_favor_of\u003d\u0027keystone.auth.external.LegacyDefaultDomain\u0027,"},{"line_number":138,"context_line":"                      remove_in\u003d+1)"},{"line_number":139,"context_line":"    def __init__(self):"}],"source_content_type":"text/x-python","patch_set":26,"id":"AAAATn%2F9ego%3D","line":136,"updated":"2013-12-11 04:57:58.000000000","message":"Can you change this to use the deprecated decorator from keystone.openstack.common.versionutils?","commit_id":"b6a6e81b311960c456280745ac867727ad35a72f"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"155e7d6e110636d0c84bcceb7b09b98217a09cdb","unresolved":false,"context_lines":[{"line_number":143,"context_line":"class ExternalDomain(LegacyDomain):"},{"line_number":144,"context_line":"    \"\"\"Deprecated. Please use keystone.auth.external.LegacyDomain instead.\"\"\""},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"    @utils.deprecated(as_of\u003dutils.deprecated.ICEHOUSE,"},{"line_number":147,"context_line":"                      in_favor_of\u003d\u0027keystone.auth.external.LegacyDomain\u0027,"},{"line_number":148,"context_line":"                      remove_in\u003d+1)"},{"line_number":149,"context_line":"    def __init__(self):"}],"source_content_type":"text/x-python","patch_set":26,"id":"AAAATn%2F9egk%3D","line":146,"updated":"2013-12-11 04:57:58.000000000","message":"Same as above.","commit_id":"b6a6e81b311960c456280745ac867727ad35a72f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d10f1f57502746d90c5db09d56ed4f73477be5b9","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"class LegacyDefaultDomain(Base):"},{"line_number":123,"context_line":"    \"\"\"Deprecated. Please use keystone.auth.external.DefaultDomain instead.\"\"\""},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"    @versionutils.deprecated("},{"line_number":126,"context_line":"        as_of\u003dversionutils.deprecated.ICEHOUSE,"}],"source_content_type":"text/x-python","patch_set":28,"id":"AAAAUH%2F%2Fk7k%3D","line":123,"updated":"2014-01-10 21:52:01.000000000","message":"i\u0027d really like to see a doc here with a link to the bug being fixed (which would explain the bug receiving continued support here)","commit_id":"316438ae58ad28189360b85ec6618e8bddd674b0"}],"keystone/common/config.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":251,"context_line":"        #deals with REMOTE_USER authentication"},{"line_number":252,"context_line":"        cfg.StrOpt(\u0027external\u0027,"},{"line_number":253,"context_line":"                   default\u003d(\u0027keystone.auth.plugins.external.\u0027"},{"line_number":254,"context_line":"                            \u0027ExternalDeprecatedGrizzly\u0027))],"},{"line_number":255,"context_line":"    \u0027paste_deploy\u0027: ["},{"line_number":256,"context_line":"        cfg.StrOpt(\u0027config_file\u0027, default\u003dNone)],"},{"line_number":257,"context_line":"    \u0027memcache\u0027: ["}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FVzA%3D","line":254,"updated":"2013-10-17 15:09:42.000000000","message":"Why would the default be something that\u0027s deprecated?","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":251,"context_line":"        #deals with REMOTE_USER authentication"},{"line_number":252,"context_line":"        cfg.StrOpt(\u0027external\u0027,"},{"line_number":253,"context_line":"                   default\u003d(\u0027keystone.auth.plugins.external.\u0027"},{"line_number":254,"context_line":"                            \u0027ExternalDeprecatedGrizzly\u0027))],"},{"line_number":255,"context_line":"    \u0027paste_deploy\u0027: ["},{"line_number":256,"context_line":"        cfg.StrOpt(\u0027config_file\u0027, default\u003dNone)],"},{"line_number":257,"context_line":"    \u0027memcache\u0027: ["}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FVX0%3D","line":254,"in_reply_to":"AAAATH%2F%2FVzA%3D","updated":"2013-10-18 08:03:08.000000000","message":"ISee other comments in the reviews (\"I think we should make this havana rc potential if there is time and make the depreciated version the default....\"). IMO it should be set to \"Default\" and put a warning in the release notes.","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":251,"context_line":"        #deals with REMOTE_USER authentication"},{"line_number":252,"context_line":"        cfg.StrOpt(\u0027external\u0027,"},{"line_number":253,"context_line":"                   default\u003d(\u0027keystone.auth.plugins.external.\u0027"},{"line_number":254,"context_line":"                            \u0027Default\u0027))],"},{"line_number":255,"context_line":"    \u0027paste_deploy\u0027: ["},{"line_number":256,"context_line":"        cfg.StrOpt(\u0027config_file\u0027, default\u003dNone)],"},{"line_number":257,"context_line":"    \u0027memcache\u0027: ["}],"source_content_type":"text/x-python","patch_set":14,"id":"AAAATn%2F%2F424%3D","line":254,"updated":"2013-10-25 16:56:37.000000000","message":"why this change? revert it.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":251,"context_line":"        #deals with REMOTE_USER authentication"},{"line_number":252,"context_line":"        cfg.StrOpt(\u0027external\u0027,"},{"line_number":253,"context_line":"                   default\u003d(\u0027keystone.auth.plugins.external.\u0027"},{"line_number":254,"context_line":"                            \u0027Default\u0027))],"},{"line_number":255,"context_line":"    \u0027paste_deploy\u0027: ["},{"line_number":256,"context_line":"        cfg.StrOpt(\u0027config_file\u0027, default\u003dNone)],"},{"line_number":257,"context_line":"    \u0027memcache\u0027: ["}],"source_content_type":"text/x-python","patch_set":14,"id":"AAAATn%2F%2F1gk%3D","line":254,"in_reply_to":"AAAATn%2F%2F424%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"}],"keystone/tests/auth_plugin_external_default.conf":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[auth]"},{"line_number":2,"context_line":"methods \u003d external, password, token"},{"line_number":3,"context_line":"external \u003d keystone.auth.plugins.external.Default"}],"source_content_type":"text/plain","patch_set":14,"id":"AAAATn%2F%2F42k%3D","line":2,"updated":"2013-10-25 16:56:37.000000000","message":"seems like this is the default so don\u0027t need to override.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[auth]"},{"line_number":2,"context_line":"methods \u003d external, password, token"},{"line_number":3,"context_line":"external \u003d keystone.auth.plugins.external.Default"}],"source_content_type":"text/plain","patch_set":14,"id":"AAAATn%2F%2F1e0%3D","line":2,"in_reply_to":"AAAATn%2F%2F42k%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"}],"keystone/tests/auth_plugin_external_deprecated.conf":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[auth]"},{"line_number":2,"context_line":"methods \u003d external, password, token"},{"line_number":3,"context_line":"external \u003d keystone.auth.plugins.external.DeprecatedGrizzly"}],"source_content_type":"text/plain","patch_set":14,"id":"AAAATn%2F%2F42g%3D","line":2,"updated":"2013-10-25 16:56:37.000000000","message":"Seems like the default should work.","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[auth]"},{"line_number":2,"context_line":"methods \u003d external, password, token"},{"line_number":3,"context_line":"external \u003d keystone.auth.plugins.external.DeprecatedGrizzly"}],"source_content_type":"text/plain","patch_set":14,"id":"AAAATn%2F%2F1eg%3D","line":2,"in_reply_to":"AAAATn%2F%2F42g%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8ba70ec4138d2ce9c66355b5d6250d7e9f14f9c5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[auth]"},{"line_number":2,"context_line":"external \u003d keystone.auth.plugins.external.DeprecatedGrizzly"}],"source_content_type":"text/plain","patch_set":21,"id":"AAAATn%2F%2B4b4%3D","line":2,"updated":"2013-11-19 01:03:11.000000000","message":"remove this file?","commit_id":"27de643676bc36f469d502b8fca0971a51dc16a8"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"a8854f9d1ea4254e0ccf737705e74c24c1df7a68","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[auth]"},{"line_number":2,"context_line":"external \u003d keystone.auth.plugins.external.DeprecatedGrizzly"}],"source_content_type":"text/plain","patch_set":21,"id":"AAAATn%2F%2B3Oo%3D","line":2,"in_reply_to":"AAAATn%2F%2B4b4%3D","updated":"2013-11-19 08:34:44.000000000","message":"Yes, this should be in the child commit. Sorry.","commit_id":"27de643676bc36f469d502b8fca0971a51dc16a8"}],"keystone/tests/auth_plugin_external_domain.conf":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8ba70ec4138d2ce9c66355b5d6250d7e9f14f9c5","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[auth]"},{"line_number":2,"context_line":"external \u003d keystone.auth.plugins.external.Domain"}],"source_content_type":"text/plain","patch_set":21,"id":"AAAATn%2F%2B4Y0%3D","line":2,"updated":"2013-11-19 01:03:11.000000000","message":"suggest revert the change on the previous line since it\u0027s not really relevant to this patch.","commit_id":"27de643676bc36f469d502b8fca0971a51dc16a8"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"a8854f9d1ea4254e0ccf737705e74c24c1df7a68","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[auth]"},{"line_number":2,"context_line":"external \u003d keystone.auth.plugins.external.Domain"}],"source_content_type":"text/plain","patch_set":21,"id":"AAAATn%2F%2B3NM%3D","line":2,"in_reply_to":"AAAATn%2F%2B4Y0%3D","updated":"2013-11-19 08:34:44.000000000","message":"Done","commit_id":"27de643676bc36f469d502b8fca0971a51dc16a8"}],"keystone/tests/test_v3_auth.py":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"57e88c52a064a3892af8c8667007bf42185d3c33","unresolved":false,"context_lines":[{"line_number":1617,"context_line":"            password\u003duuid.uuid4().hex)"},{"line_number":1618,"context_line":"        self.post(\u0027/auth/tokens\u0027, body\u003dauth_data, expected_status\u003d401)"},{"line_number":1619,"context_line":""},{"line_number":1620,"context_line":"    def test_remote_user_with_default_domain(self):"},{"line_number":1621,"context_line":"        api \u003d auth.controllers.Auth()"},{"line_number":1622,"context_line":"        auth_data \u003d self.build_authentication_request()[\u0027auth\u0027]"},{"line_number":1623,"context_line":"        # Now test to make sure the user name can, itself, contain the"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAATH%2F%2F1lE%3D","line":1620,"updated":"2013-10-09 06:55:15.000000000","message":"This test looks pretty similar to test_remote_user_no_realm(), except that you are testing for support of the \u0027@\u0027 char.  Fine to have a separate test, but perhaps the method name should distinguish better between the intent of the two tests.","commit_id":"5b7de3338e61dc64431401ed4557f8410294ff6a"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":1092,"context_line":"    content_type \u003d \u0027json\u0027"},{"line_number":1093,"context_line":""},{"line_number":1094,"context_line":"    def config_files(self):"},{"line_number":1095,"context_line":"        list \u003d self._config_file_list[:]"},{"line_number":1096,"context_line":"        list.append(\u0027auth_plugin_external_deprecated.conf\u0027)"},{"line_number":1097,"context_line":"        return list"},{"line_number":1098,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FVvo%3D","line":1095,"updated":"2013-10-17 15:09:42.000000000","message":"change the name so doesn\u0027t mask the list builtin. Change to config_files or something.","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"d34bb132ad77cf6f2d614a9e3db748d75a10b143","unresolved":false,"context_lines":[{"line_number":1092,"context_line":"    content_type \u003d \u0027json\u0027"},{"line_number":1093,"context_line":""},{"line_number":1094,"context_line":"    def config_files(self):"},{"line_number":1095,"context_line":"        list \u003d self._config_file_list[:]"},{"line_number":1096,"context_line":"        list.append(\u0027auth_plugin_external_deprecated.conf\u0027)"},{"line_number":1097,"context_line":"        return list"},{"line_number":1098,"context_line":""}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FS7M%3D","line":1095,"in_reply_to":"AAAATH%2F%2FVvo%3D","updated":"2013-10-18 08:03:08.000000000","message":"It is like that since it is a copy from the other tests\u0027s structure. Should I adjust it in the other tests also?","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"63e767317ed5326dd2052abe07ba7bd5fc76a232","unresolved":false,"context_lines":[{"line_number":1176,"context_line":"class TestAuthJSON(test_v3.RestfulTestCase):"},{"line_number":1177,"context_line":"    content_type \u003d \u0027json\u0027"},{"line_number":1178,"context_line":""},{"line_number":1179,"context_line":"    def config_files(self):"},{"line_number":1180,"context_line":"        list \u003d self._config_file_list[:]"},{"line_number":1181,"context_line":"        list.append(\u0027auth_plugin_external_default.conf\u0027)"},{"line_number":1182,"context_line":"        return list"}],"source_content_type":"text/x-python","patch_set":9,"id":"AAAATH%2F%2FVvk%3D","line":1179,"updated":"2013-10-17 15:09:42.000000000","message":"change the name so doesn\u0027t mask the list builtin. Change to config_files or something.","commit_id":"748233dcd6f1599add837e826db99e391e194f7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"150670ade93408ae0408ec999f11bf01a02cb80b","unresolved":false,"context_lines":[{"line_number":1114,"context_line":"        api \u003d auth.controllers.Auth()"},{"line_number":1115,"context_line":"        context \u003d {\u0027REMOTE_USER\u0027: self.user[\u0027name\u0027]}"},{"line_number":1116,"context_line":"        auth_info \u003d auth.controllers.AuthInfo(None, auth_data)"},{"line_number":1117,"context_line":"        auth_context \u003d {\u0027extras\u0027: {}, \u0027method_names\u0027: []}"},{"line_number":1118,"context_line":"        self.assertRaises(exception.Unauthorized,"},{"line_number":1119,"context_line":"                          api.authenticate,"},{"line_number":1120,"context_line":"                          context,"}],"source_content_type":"text/x-python","patch_set":14,"id":"AAAATn%2F%2F42c%3D","line":1117,"updated":"2013-10-25 16:56:37.000000000","message":"there\u0027s a lot of duplicated code here that should be consolidated into a function, see lines 1100-1107","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"368aa33f1763a57247ee946b7251eaea93664023","unresolved":false,"context_lines":[{"line_number":1114,"context_line":"        api \u003d auth.controllers.Auth()"},{"line_number":1115,"context_line":"        context \u003d {\u0027REMOTE_USER\u0027: self.user[\u0027name\u0027]}"},{"line_number":1116,"context_line":"        auth_info \u003d auth.controllers.AuthInfo(None, auth_data)"},{"line_number":1117,"context_line":"        auth_context \u003d {\u0027extras\u0027: {}, \u0027method_names\u0027: []}"},{"line_number":1118,"context_line":"        self.assertRaises(exception.Unauthorized,"},{"line_number":1119,"context_line":"                          api.authenticate,"},{"line_number":1120,"context_line":"                          context,"}],"source_content_type":"text/x-python","patch_set":14,"id":"AAAATn%2F%2F1gI%3D","line":1117,"in_reply_to":"AAAATn%2F%2F42c%3D","updated":"2013-10-28 10:16:53.000000000","message":"Done in https://review.openstack.org/#/c/54080/","commit_id":"ea30f0a74bf732215cee33435ceba6d67482979e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d131f1e8502c7caf386249a2b3138cfe6f3bf311","unresolved":false,"context_lines":[{"line_number":1150,"context_line":""},{"line_number":1151,"context_line":"    def test_remote_user_and_no_password(self):"},{"line_number":1152,"context_line":"        # REMOTE_USER without password fails in GrizzlyDeprecated"},{"line_number":1153,"context_line":"        api \u003d auth.controllers.Auth()"},{"line_number":1154,"context_line":"        context, auth_info, auth_context \u003d self.build_external_auth_request("},{"line_number":1155,"context_line":"            self.default_domain_user[\u0027name\u0027])"},{"line_number":1156,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FI0A%3D","line":1153,"updated":"2013-11-13 23:18:11.000000000","message":"could make api a member then don\u0027t have to duplicate this line in every test.","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"7d42dc0b912dd9f72aafbf5c474ceb0888f38106","unresolved":false,"context_lines":[{"line_number":1150,"context_line":""},{"line_number":1151,"context_line":"    def test_remote_user_and_no_password(self):"},{"line_number":1152,"context_line":"        # REMOTE_USER without password fails in GrizzlyDeprecated"},{"line_number":1153,"context_line":"        api \u003d auth.controllers.Auth()"},{"line_number":1154,"context_line":"        context, auth_info, auth_context \u003d self.build_external_auth_request("},{"line_number":1155,"context_line":"            self.default_domain_user[\u0027name\u0027])"},{"line_number":1156,"context_line":""}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FFds%3D","line":1153,"in_reply_to":"AAAATn%2F%2FI0A%3D","updated":"2013-11-18 14:41:20.000000000","message":"Yes, indeed. I will do it in a separate patch, since there are a lot of them in these tests.","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d131f1e8502c7caf386249a2b3138cfe6f3bf311","unresolved":false,"context_lines":[{"line_number":1715,"context_line":"                          api.authenticate,"},{"line_number":1716,"context_line":"                          context,"},{"line_number":1717,"context_line":"                          auth_info,"},{"line_number":1718,"context_line":"                          auth_context)"},{"line_number":1719,"context_line":""},{"line_number":1720,"context_line":"    def test_remote_user_and_explicit_external(self):"},{"line_number":1721,"context_line":"        #both REMOTE_USER and password methods must pass."}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FIy8%3D","line":1718,"updated":"2013-11-13 23:18:11.000000000","message":"why was a test removed? Can it be modified instead?","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"7d42dc0b912dd9f72aafbf5c474ceb0888f38106","unresolved":false,"context_lines":[{"line_number":1715,"context_line":"                          api.authenticate,"},{"line_number":1716,"context_line":"                          context,"},{"line_number":1717,"context_line":"                          auth_info,"},{"line_number":1718,"context_line":"                          auth_context)"},{"line_number":1719,"context_line":""},{"line_number":1720,"context_line":"    def test_remote_user_and_explicit_external(self):"},{"line_number":1721,"context_line":"        #both REMOTE_USER and password methods must pass."}],"source_content_type":"text/x-python","patch_set":20,"id":"AAAATn%2F%2FFdk%3D","line":1718,"in_reply_to":"AAAATn%2F%2FIy8%3D","updated":"2013-11-18 14:41:20.000000000","message":"My fault. I removed it accidentally.","commit_id":"07acacaa588a766990b5d2faf1f49fb1baa687fe"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8ba70ec4138d2ce9c66355b5d6250d7e9f14f9c5","unresolved":false,"context_lines":[{"line_number":1102,"context_line":"    def config_files(self):"},{"line_number":1103,"context_line":"        cfg_list \u003d self._config_file_list[:]"},{"line_number":1104,"context_line":"        cfg_list.append(tests.testsdir(\u0027auth_plugin_external_domain.conf\u0027))"},{"line_number":1105,"context_line":"        return cfg_list"},{"line_number":1106,"context_line":""},{"line_number":1107,"context_line":"    def test_remote_user_with_realm(self):"},{"line_number":1108,"context_line":"        api \u003d auth.controllers.Auth()"}],"source_content_type":"text/x-python","patch_set":21,"id":"AAAATn%2F%2B4ag%3D","line":1105,"updated":"2013-11-19 01:03:11.000000000","message":"suggest revert this change since it\u0027s irrelevant to this patch.","commit_id":"27de643676bc36f469d502b8fca0971a51dc16a8"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"a8854f9d1ea4254e0ccf737705e74c24c1df7a68","unresolved":false,"context_lines":[{"line_number":1102,"context_line":"    def config_files(self):"},{"line_number":1103,"context_line":"        cfg_list \u003d self._config_file_list[:]"},{"line_number":1104,"context_line":"        cfg_list.append(tests.testsdir(\u0027auth_plugin_external_domain.conf\u0027))"},{"line_number":1105,"context_line":"        return cfg_list"},{"line_number":1106,"context_line":""},{"line_number":1107,"context_line":"    def test_remote_user_with_realm(self):"},{"line_number":1108,"context_line":"        api \u003d auth.controllers.Auth()"}],"source_content_type":"text/x-python","patch_set":21,"id":"AAAATn%2F%2B3OM%3D","line":1105,"in_reply_to":"AAAATn%2F%2B4ag%3D","updated":"2013-11-19 08:34:44.000000000","message":"This is here due to a wrong rebase. I\u0027ll rebase again so that it is fixed","commit_id":"27de643676bc36f469d502b8fca0971a51dc16a8"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"8ba70ec4138d2ce9c66355b5d6250d7e9f14f9c5","unresolved":false,"context_lines":[{"line_number":1637,"context_line":"        user \u003d {\u0027name\u0027: \u0027myname@mydivision\u0027}"},{"line_number":1638,"context_line":"        self.identity_api.update_user(self.default_domain_user[\u0027id\u0027], user)"},{"line_number":1639,"context_line":"        context, auth_info, auth_context \u003d self.build_external_auth_request("},{"line_number":1640,"context_line":"            user[\"name\"])"},{"line_number":1641,"context_line":"        api.authenticate(context, auth_info, auth_context)"},{"line_number":1642,"context_line":"        self.assertEqual(auth_context[\u0027user_id\u0027],"},{"line_number":1643,"context_line":"                         self.default_domain_user[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":21,"id":"AAAATn%2F%2B4ZM%3D","line":1640,"updated":"2013-11-19 01:03:11.000000000","message":"rather than copy and paste, suggest define a local function to call.","commit_id":"27de643676bc36f469d502b8fca0971a51dc16a8"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"a8854f9d1ea4254e0ccf737705e74c24c1df7a68","unresolved":false,"context_lines":[{"line_number":1637,"context_line":"        user \u003d {\u0027name\u0027: \u0027myname@mydivision\u0027}"},{"line_number":1638,"context_line":"        self.identity_api.update_user(self.default_domain_user[\u0027id\u0027], user)"},{"line_number":1639,"context_line":"        context, auth_info, auth_context \u003d self.build_external_auth_request("},{"line_number":1640,"context_line":"            user[\"name\"])"},{"line_number":1641,"context_line":"        api.authenticate(context, auth_info, auth_context)"},{"line_number":1642,"context_line":"        self.assertEqual(auth_context[\u0027user_id\u0027],"},{"line_number":1643,"context_line":"                         self.default_domain_user[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":21,"id":"AAAATn%2F%2B3No%3D","line":1640,"in_reply_to":"AAAATn%2F%2B4ZM%3D","updated":"2013-11-19 08:34:44.000000000","message":"After this patch I will review all the external auth related plugins, so if it is OK with you I\u0027ll fix it there.","commit_id":"27de643676bc36f469d502b8fca0971a51dc16a8"}]}