)]}'
{"doc/source/admin/token-provider.rst":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87c83a332adc654198745887faa47aba5702ddbd","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":".. warning::"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"    Fernet tokens are both bearer tokens. They must be protected from"},{"line_number":33,"context_line":"    unnecessary disclosure to prevent unauthorized access."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3fa0c359_fecdd9b6","line":32,"range":{"start_line":32,"start_character":22,"end_line":32,"end_character":26},"updated":"2018-02-12 17:06:32.000000000","message":"NIT: remove \"both\"","commit_id":"b9ab960b0ef11b65f843e0eefba9668611cc4aad"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"97bcafa561700e631da4fe761053b660092ffc5e","unresolved":false,"context_lines":[{"line_number":29,"context_line":""},{"line_number":30,"context_line":".. warning::"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"    Fernet tokens are both bearer tokens. They must be protected from"},{"line_number":33,"context_line":"    unnecessary disclosure to prevent unauthorized access."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3fa0c359_7e6789b8","line":32,"range":{"start_line":32,"start_character":22,"end_line":32,"end_character":26},"in_reply_to":"3fa0c359_fecdd9b6","updated":"2018-02-12 17:07:42.000000000","message":"Done","commit_id":"b9ab960b0ef11b65f843e0eefba9668611cc4aad"}],"keystone/token/persistence/__init__.py":[{"author":{"_account_id":13861,"name":"yatin","email":"ykarel@redhat.com","username":"yatinkarel"},"change_message_id":"159f0c3c7899e666532898b18e442cc26564e2cd","unresolved":false,"context_lines":[{"line_number":13,"context_line":"from keystone.token.persistence.core import *  # noqa"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"__all__ \u003d (\u0027PersistenceManager\u0027, \u0027TokenDriverBase\u0027)"}],"source_content_type":"text/x-python","patch_set":5,"id":"bf659307_3bb43835","side":"PARENT","line":16,"updated":"2018-03-27 10:11:21.000000000","message":"This is used here:-https://github.com/openstack/keystone/blob/master/keystone/cmd/cli.py#L889, any plan to clean up it?","commit_id":"e0981acd9ede31f29c83e6e6811fe5803289b450"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fb896a2cb0862cdf4999c16189bc27979dcbf0b0","unresolved":false,"context_lines":[{"line_number":13,"context_line":"from keystone.token.persistence.core import *  # noqa"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"__all__ \u003d (\u0027PersistenceManager\u0027, \u0027TokenDriverBase\u0027)"}],"source_content_type":"text/x-python","patch_set":5,"id":"bf659307_dcdac815","side":"PARENT","line":16,"in_reply_to":"bf659307_3bb43835","updated":"2018-03-27 17:20:08.000000000","message":"Sure - I proposed a patch [0].\n\n[0] https://review.openstack.org/#/c/556889/","commit_id":"e0981acd9ede31f29c83e6e6811fe5803289b450"}],"keystone/token/provider.py":[{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"55cb870050a3b7af3468de2433b9efba2197dd35","unresolved":false,"context_lines":[{"line_number":209,"context_line":"            app_cred_id\u003dapp_cred_id, include_catalog\u003dinclude_catalog,"},{"line_number":210,"context_line":"            parent_audit_id\u003dparent_audit_id)"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"        if self._needs_persistence:"},{"line_number":213,"context_line":"            data \u003d dict(key\u003dtoken_id,"},{"line_number":214,"context_line":"                        id\u003dtoken_id,"},{"line_number":215,"context_line":"                        expires\u003dtoken_data[\u0027token\u0027][\u0027expires_at\u0027],"}],"source_content_type":"text/x-python","patch_set":2,"id":"3fa0c359_26c913ab","line":212,"range":{"start_line":212,"start_character":16,"end_line":212,"end_character":34},"updated":"2018-02-11 03:45:34.000000000","message":"And remove this property as well?","commit_id":"da2ecf51c8dc727413a850369a9fd30a2ba1d227"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"386f270011d21f2c6bf44bdee3fac5a3143527ef","unresolved":false,"context_lines":[{"line_number":209,"context_line":"            app_cred_id\u003dapp_cred_id, include_catalog\u003dinclude_catalog,"},{"line_number":210,"context_line":"            parent_audit_id\u003dparent_audit_id)"},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"        if self._needs_persistence:"},{"line_number":213,"context_line":"            data \u003d dict(key\u003dtoken_id,"},{"line_number":214,"context_line":"                        id\u003dtoken_id,"},{"line_number":215,"context_line":"                        expires\u003dtoken_data[\u0027token\u0027][\u0027expires_at\u0027],"}],"source_content_type":"text/x-python","patch_set":2,"id":"3fa0c359_ed71b5a9","line":212,"range":{"start_line":212,"start_character":16,"end_line":212,"end_character":34},"in_reply_to":"3fa0c359_26c913ab","updated":"2018-02-12 15:30:24.000000000","message":"We might be able to remove that in a separate patch, since it\u0027s just an interface that gets set by each provider. I do think that in a subsequent patch, we will want to remove this logic in favor of having custom providers handle the storage bits if they need it. That way the manager doesn\u0027t need a hook to check persistence properties of the provider being used.\n\nAll in all, yes I think we can remove this hook. All take a shot at refactoring those interfaces in a subsequent patch.","commit_id":"da2ecf51c8dc727413a850369a9fd30a2ba1d227"},{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"55cb870050a3b7af3468de2433b9efba2197dd35","unresolved":false,"context_lines":[{"line_number":267,"context_line":"        self.invalidate_individual_token_cache(token_id)"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"    def list_revoked_tokens(self):"},{"line_number":270,"context_line":"        return self._persistence.list_revoked_tokens()"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    # FIXME(lbragstad): This callback doesn\u0027t have anything to do with"},{"line_number":273,"context_line":"    # persistence anymore now that the sql token driver has been removed. We"}],"source_content_type":"text/x-python","patch_set":2,"id":"3fa0c359_6685db59","line":270,"range":{"start_line":270,"start_character":20,"end_line":270,"end_character":32},"updated":"2018-02-11 03:45:34.000000000","message":"Here should be refactored as well. After this patch. revocation list API \"GET /auth/tokens/OS-PKI/revoked\" will return 500 error due to \"Provider object has no attribute _persistence\".\n\nI wonder that if we can remove this API as well.","commit_id":"da2ecf51c8dc727413a850369a9fd30a2ba1d227"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"03f944088451e18cb6c2aff0765bbe7e3165b252","unresolved":false,"context_lines":[{"line_number":267,"context_line":"        self.invalidate_individual_token_cache(token_id)"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"    def list_revoked_tokens(self):"},{"line_number":270,"context_line":"        return self._persistence.list_revoked_tokens()"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    # FIXME(lbragstad): This callback doesn\u0027t have anything to do with"},{"line_number":273,"context_line":"    # persistence anymore now that the sql token driver has been removed. We"}],"source_content_type":"text/x-python","patch_set":2,"id":"3fa0c359_337cda81","line":270,"range":{"start_line":270,"start_character":20,"end_line":270,"end_character":32},"in_reply_to":"3fa0c359_4ae52f37","updated":"2018-02-12 16:29:54.000000000","message":"I just confirmed the diff above [2]. When an empty list is returned, I can generate a valid response. Then I used python-keysotneclient/common/cms.py to verify it [0].\n\n[0] http://paste.openstack.org/raw/670196/","commit_id":"da2ecf51c8dc727413a850369a9fd30a2ba1d227"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"386f270011d21f2c6bf44bdee3fac5a3143527ef","unresolved":false,"context_lines":[{"line_number":267,"context_line":"        self.invalidate_individual_token_cache(token_id)"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"    def list_revoked_tokens(self):"},{"line_number":270,"context_line":"        return self._persistence.list_revoked_tokens()"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    # FIXME(lbragstad): This callback doesn\u0027t have anything to do with"},{"line_number":273,"context_line":"    # persistence anymore now that the sql token driver has been removed. We"}],"source_content_type":"text/x-python","patch_set":2,"id":"3fa0c359_4ae52f37","line":270,"range":{"start_line":270,"start_character":20,"end_line":270,"end_character":32},"in_reply_to":"3fa0c359_6685db59","updated":"2018-02-12 15:30:24.000000000","message":"Yeah - that\u0027s a good question. I tested this out manually and it does throw a 500 with this patch. I retested with master and it still throws a 500 because I didn\u0027t have any certificates setup for PKI. I checked out the change before that refactor happened and ran `keystone-manage pki_setup` [0]. Once I had the certificates installed, I got the intended response from the API [1]. I think what we can do instead is to return an empty list instead of calling to get a list of revoked tokens from the backend. Or, we could make the logic conditional. If the provider supports fetching revoked tokens, then we can call it and expect a list. If not, then we return an empty list.\n\nWhen I removed this logic and replaced it with an empty list [2], the API response was the same as when it called the _persistence backend for a list of revoked tokens.\n\n[0] https://github.com/openstack/keystone/commit/928d23db022157ae24d49eb9b7772cc0e07345a4#diff-41c8207a4e9c66c80ef1576614634992\n[1] http://paste.openstack.org/raw/670054/\n[2] http://paste.openstack.org/raw/670097/","commit_id":"da2ecf51c8dc727413a850369a9fd30a2ba1d227"}]}