)]}'
{"keystone/common/context.py":[{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"fe4ed90288e03afeeef4e1cf206eacd77383e4bc","unresolved":false,"context_lines":[{"line_number":55,"context_line":"        return super(RequestContext, cls).from_environ(environ, **kwargs)"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    def to_policy_values(self):"},{"line_number":58,"context_line":"        \"\"\"Add keystone-specific policy values to policy reprensetation."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"        This method converts generic policy values to a dictionary form using"},{"line_number":61,"context_line":"        the base implementation from oslo_context.context.RequestContext."}],"source_content_type":"text/x-python","patch_set":17,"id":"3f79a3b5_359f3c65","line":58,"updated":"2018-10-23 03:04:14.000000000","message":"typo representation","commit_id":"a18abf3daa89862f85f0ed48065126824bf7f3ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1731470914660da69168f854b3b62cf26417848a","unresolved":false,"context_lines":[{"line_number":55,"context_line":"        return super(RequestContext, cls).from_environ(environ, **kwargs)"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    def to_policy_values(self):"},{"line_number":58,"context_line":"        \"\"\"Add keystone-specific policy values to policy reprensetation."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"        This method converts generic policy values to a dictionary form using"},{"line_number":61,"context_line":"        the base implementation from oslo_context.context.RequestContext."}],"source_content_type":"text/x-python","patch_set":17,"id":"3f79a3b5_87ace236","line":58,"in_reply_to":"3f79a3b5_359f3c65","updated":"2018-10-23 09:41:48.000000000","message":"Done","commit_id":"a18abf3daa89862f85f0ed48065126824bf7f3ac"},{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"fe4ed90288e03afeeef4e1cf206eacd77383e4bc","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"        This method converts generic policy values to a dictionary form using"},{"line_number":61,"context_line":"        the base implementation from oslo_context.context.RequestContext."},{"line_number":62,"context_line":"        Afterwords it is going to pull keystone-specific values off the context"},{"line_number":63,"context_line":"        and represent them as items in the policy values dictionary. This is"},{"line_number":64,"context_line":"        because keystone uses default policies that rely on these values, so we"},{"line_number":65,"context_line":"        need to gaurantee they are present during policy enforcement if they"}],"source_content_type":"text/x-python","patch_set":17,"id":"3f79a3b5_f5a8e48b","line":62,"updated":"2018-10-23 03:04:14.000000000","message":"afterwards??","commit_id":"a18abf3daa89862f85f0ed48065126824bf7f3ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1731470914660da69168f854b3b62cf26417848a","unresolved":false,"context_lines":[{"line_number":59,"context_line":""},{"line_number":60,"context_line":"        This method converts generic policy values to a dictionary form using"},{"line_number":61,"context_line":"        the base implementation from oslo_context.context.RequestContext."},{"line_number":62,"context_line":"        Afterwords it is going to pull keystone-specific values off the context"},{"line_number":63,"context_line":"        and represent them as items in the policy values dictionary. This is"},{"line_number":64,"context_line":"        because keystone uses default policies that rely on these values, so we"},{"line_number":65,"context_line":"        need to gaurantee they are present during policy enforcement if they"}],"source_content_type":"text/x-python","patch_set":17,"id":"3f79a3b5_a7a79e51","line":62,"in_reply_to":"3f79a3b5_f5a8e48b","updated":"2018-10-23 09:41:48.000000000","message":"Done","commit_id":"a18abf3daa89862f85f0ed48065126824bf7f3ac"},{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"c05db5b9586459b7b9e52b10e24068b38103d230","unresolved":false,"context_lines":[{"line_number":63,"context_line":"        # function into keystone.api"},{"line_number":64,"context_line":"        values \u003d super(RequestContext, self).to_policy_values()"},{"line_number":65,"context_line":"        values[\u0027token\u0027] \u003d self.token_reference[\u0027token\u0027]"},{"line_number":66,"context_line":"        values[\u0027domain_id\u0027] \u003d self.domain_id if self.domain_id else None"},{"line_number":67,"context_line":"        return values"}],"source_content_type":"text/x-python","patch_set":24,"id":"3f79a3b5_b253fedc","line":66,"updated":"2018-11-27 09:37:59.000000000","message":"So seems some key-values are missing. https://github.com/openstack/keystone/blob/master/keystone/server/flask/request_processing/middleware/auth_context.py#L422-L430","commit_id":"0dc5c4edabd5cb0455ffe1c4f8cf8369f64b2197"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9afcd8b819e7998799f5fb02ea2ba4e18ed180fc","unresolved":false,"context_lines":[{"line_number":63,"context_line":"        # function into keystone.api"},{"line_number":64,"context_line":"        values \u003d super(RequestContext, self).to_policy_values()"},{"line_number":65,"context_line":"        values[\u0027token\u0027] \u003d self.token_reference[\u0027token\u0027]"},{"line_number":66,"context_line":"        values[\u0027domain_id\u0027] \u003d self.domain_id if self.domain_id else None"},{"line_number":67,"context_line":"        return values"}],"source_content_type":"text/x-python","patch_set":24,"id":"3f79a3b5_4dd52fb7","line":66,"in_reply_to":"3f79a3b5_b253fedc","updated":"2018-11-27 10:35:37.000000000","message":"Weird - I tried doing something like this locally [0], but I got a bunch of failures.\n\nI think part of the problem is that we used to rely on a dictionary representation of auth_context, which we got from calling to_policy_values on the context object. The failures could be related to the fact that we sometimes think we working with a dictionary instead of just using the context object that is available to us?\n\nI can dig into this a bit more and see if I can address it in a follow up patch.\n\n[0] https://pasted.tech/pastes/ad5d2bc37b1a965020e0d943c1e444028be04e1a.raw","commit_id":"0dc5c4edabd5cb0455ffe1c4f8cf8369f64b2197"}],"keystone/common/rbac_enforcer/enforcer.py":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ddbf0ed3b0b2dec86f252dcc77bdcfd0133db403","unresolved":false,"context_lines":[{"line_number":91,"context_line":"        # needs reworking of how we handle the context in oslo.policy. Until"},{"line_number":92,"context_line":"        # this is reworked, it is not possible to merge the token render"},{"line_number":93,"context_line":"        # function into keystone.api"},{"line_number":94,"context_line":"        if \u0027token\u0027 in credentials:"},{"line_number":95,"context_line":"            token_ref \u003d render_token.render_token_response_from_model("},{"line_number":96,"context_line":"                credentials[\u0027token\u0027]"},{"line_number":97,"context_line":"            )"},{"line_number":98,"context_line":"            credentials_copy \u003d copy.deepcopy(credentials)"},{"line_number":99,"context_line":"            credentials_copy[\u0027token\u0027] \u003d token_ref"},{"line_number":100,"context_line":"            credentials \u003d credentials_copy"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"        try:"},{"line_number":103,"context_line":"            return self._enforcer.enforce("}],"source_content_type":"text/x-python","patch_set":18,"id":"3f79a3b5_64c16f81","side":"PARENT","line":100,"range":{"start_line":94,"start_character":8,"end_line":100,"end_character":42},"updated":"2018-10-23 23:35:02.000000000","message":"Removing this might break some deployer\u0027s custom policy files because they can rely on token.x in the first part of the policy string (e.g. token.user.id) even if they should not. As long as we are reasonably sure this is not going to be a problem, we can remove this. \n\nIf this is removed keystone.common.render_token should be moved under keystone.api","commit_id":"5d2ee12f119eca54cf4487b1040062feb01c68a3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"f5affb26d922ccbe379b645b5f44219c9c7db914","unresolved":false,"context_lines":[{"line_number":91,"context_line":"        # needs reworking of how we handle the context in oslo.policy. Until"},{"line_number":92,"context_line":"        # this is reworked, it is not possible to merge the token render"},{"line_number":93,"context_line":"        # function into keystone.api"},{"line_number":94,"context_line":"        if \u0027token\u0027 in credentials:"},{"line_number":95,"context_line":"            token_ref \u003d render_token.render_token_response_from_model("},{"line_number":96,"context_line":"                credentials[\u0027token\u0027]"},{"line_number":97,"context_line":"            )"},{"line_number":98,"context_line":"            credentials_copy \u003d copy.deepcopy(credentials)"},{"line_number":99,"context_line":"            credentials_copy[\u0027token\u0027] \u003d token_ref"},{"line_number":100,"context_line":"            credentials \u003d credentials_copy"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"        try:"},{"line_number":103,"context_line":"            return self._enforcer.enforce("}],"source_content_type":"text/x-python","patch_set":18,"id":"3f79a3b5_c7763340","side":"PARENT","line":100,"range":{"start_line":94,"start_character":8,"end_line":100,"end_character":42},"in_reply_to":"3f79a3b5_53298986","updated":"2018-10-24 16:55:21.000000000","message":"This is very deliberate. Right now we do explicitly have a fully rendered JSON blob (then normalized to the dot-notation) token in the credentials dict. This change means the credentials dict is no longer holding an explicitly expanded token. This really can break custom policy files if someone is using token.x.x in the first part of the policy check string, it will break.\n\nI am fine with this change, just make sure we\u0027re being VERY explicit in the release note for the alternative.","commit_id":"5d2ee12f119eca54cf4487b1040062feb01c68a3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d12bb94b93b89a6f8d35430a0776b35157dcf7ee","unresolved":false,"context_lines":[{"line_number":91,"context_line":"        # needs reworking of how we handle the context in oslo.policy. Until"},{"line_number":92,"context_line":"        # this is reworked, it is not possible to merge the token render"},{"line_number":93,"context_line":"        # function into keystone.api"},{"line_number":94,"context_line":"        if \u0027token\u0027 in credentials:"},{"line_number":95,"context_line":"            token_ref \u003d render_token.render_token_response_from_model("},{"line_number":96,"context_line":"                credentials[\u0027token\u0027]"},{"line_number":97,"context_line":"            )"},{"line_number":98,"context_line":"            credentials_copy \u003d copy.deepcopy(credentials)"},{"line_number":99,"context_line":"            credentials_copy[\u0027token\u0027] \u003d token_ref"},{"line_number":100,"context_line":"            credentials \u003d credentials_copy"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"        try:"},{"line_number":103,"context_line":"            return self._enforcer.enforce("}],"source_content_type":"text/x-python","patch_set":18,"id":"3f79a3b5_53298986","side":"PARENT","line":100,"range":{"start_line":94,"start_character":8,"end_line":100,"end_character":42},"in_reply_to":"3f79a3b5_64c16f81","updated":"2018-10-24 14:24:21.000000000","message":"I don\u0027t think we\u0027re necessarily removing it, we\u0027re just setting this using context instead. The token is validated in middleware and put on the request_context as a variable. Then in keystone/common/context.py, we\u0027re overriding the to_policy_values() to specifically pull the token reference off the context object and put it in the policy dict.","commit_id":"5d2ee12f119eca54cf4487b1040062feb01c68a3"}],"keystone/server/flask/request_processing/middleware/auth_context.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7a0bd09df46ec155add7e34db26fec9e4e308215","unresolved":false,"context_lines":[{"line_number":233,"context_line":"                \u0027domain_id\u0027: request_context._domain_id,"},{"line_number":234,"context_line":"                \u0027domain_name\u0027: request_context.domain_name,"},{"line_number":235,"context_line":"                \u0027group_ids\u0027: request_context.group_ids,"},{"line_number":236,"context_line":"                \u0027token\u0027: token"},{"line_number":237,"context_line":"            }"},{"line_number":238,"context_line":"            auth_context.update(additional)"},{"line_number":239,"context_line":""}],"source_content_type":"text/x-python","patch_set":18,"id":"3f79a3b5_33808d49","line":236,"range":{"start_line":236,"start_character":16,"end_line":236,"end_character":30},"updated":"2018-10-24 14:25:59.000000000","message":"This might not be needed anymore.","commit_id":"c716ded0f5a11049e08db86ce1c5297efee76d8d"}]}