)]}'
{"keystone/auth/plugins/saml2.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"ae801ab7faf542bec515405491b5217cf6dbd8eb","unresolved":false,"context_lines":[{"line_number":27,"context_line":"LOG \u003d log.getLogger(__name__)"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"@dependency.requires(\u0027token_api\u0027, \u0027federation_api\u0027, \u0027identity_api\u0027)"},{"line_number":31,"context_line":"class Saml2(auth.AuthMethodHandler):"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    method \u003d \u0027saml2\u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2Bv0%3D","line":30,"updated":"2014-03-10 22:17:45.000000000","message":"these should be in alphabetical order.","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"24e6d12d6b457de7f949f37410ab1f20600a8386","unresolved":false,"context_lines":[{"line_number":27,"context_line":"LOG \u003d log.getLogger(__name__)"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"@dependency.requires(\u0027token_api\u0027, \u0027federation_api\u0027, \u0027identity_api\u0027)"},{"line_number":31,"context_line":"class Saml2(auth.AuthMethodHandler):"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    method \u003d \u0027saml2\u0027"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2BR0%3D","line":30,"in_reply_to":"AAAAVn%2F%2B%2Bv0%3D","updated":"2014-03-11 09:35:42.000000000","message":"Done","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"937844d05f64ea4987747c205f1af96b1ff017fe","unresolved":false,"context_lines":[{"line_number":58,"context_line":"    def _handle_scoped_token(self, auth_payload):"},{"line_number":59,"context_line":"        token_ref \u003d self.token_api.get_token(auth_payload[\u0027id\u0027])"},{"line_number":60,"context_line":"        self._validate_expiration(token_ref)"},{"line_number":61,"context_line":"        group_ids \u003d [group[\u0027id\u0027] for group in"},{"line_number":62,"context_line":"                     token_ref[\u0027user\u0027][federation.GROUPS]]"},{"line_number":63,"context_line":"        group_ids \u003d self._validate_groups(group_ids)"},{"line_number":64,"context_line":"        return {"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B9mU%3D","line":61,"updated":"2014-03-11 01:26:02.000000000","message":"I think validating the calls at the unscoped level is probbaly good enough, no need to re-validate them here.\n\nA group could be deleted, but how often do we expect that to happen? Or is that being too optimistic?","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"24e6d12d6b457de7f949f37410ab1f20600a8386","unresolved":false,"context_lines":[{"line_number":58,"context_line":"    def _handle_scoped_token(self, auth_payload):"},{"line_number":59,"context_line":"        token_ref \u003d self.token_api.get_token(auth_payload[\u0027id\u0027])"},{"line_number":60,"context_line":"        self._validate_expiration(token_ref)"},{"line_number":61,"context_line":"        group_ids \u003d [group[\u0027id\u0027] for group in"},{"line_number":62,"context_line":"                     token_ref[\u0027user\u0027][federation.GROUPS]]"},{"line_number":63,"context_line":"        group_ids \u003d self._validate_groups(group_ids)"},{"line_number":64,"context_line":"        return {"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B7L0%3D","line":61,"in_reply_to":"AAAAVn%2F%2B9mU%3D","updated":"2014-03-11 09:35:42.000000000","message":"You are right, but I think we should also check the groups here and be able to warn cloud admins. Imagine situation where GROUP_X exists, an unscoped federated token is issued, GROUP_X is now deleted and somebody scopes the token to a project tied only to the GROUP_X. This action will be denied, and without re-validating groups (and what\u0027s more important logging the fact that something\u0027s wrong) 99% of admins will get really confused especially given the fact that logs are \u0027clean\u0027. In other words this re-validation here is not for making the solution safer, but rather being able to give some verbose information to the user.\nAny comments on that?","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"70994558dda20c82851aee1a715f677fdaf2056a","unresolved":false,"context_lines":[{"line_number":91,"context_line":"            raise exception.Unauthorized(_(\u0027Federation token is expired\u0027))"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def _validate_groups(self, group_ids):"},{"line_number":94,"context_line":"        if not group_ids:"},{"line_number":95,"context_line":"            raise exception.Unauthorized(_(\u0027No groups provided\u0027))"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"        for group_id in group_ids:"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAVn%2F%2B2O4%3D","line":94,"updated":"2014-03-11 19:11:12.000000000","message":"So you have to have groups with a scoped token?","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"af215ea65aaa0321806970cf289908f03fde5793","unresolved":false,"context_lines":[{"line_number":91,"context_line":"            raise exception.Unauthorized(_(\u0027Federation token is expired\u0027))"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def _validate_groups(self, group_ids):"},{"line_number":94,"context_line":"        if not group_ids:"},{"line_number":95,"context_line":"            raise exception.Unauthorized(_(\u0027No groups provided\u0027))"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"        for group_id in group_ids:"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAWH%2F%2F%2FKc%3D","line":94,"in_reply_to":"AAAAVn%2F%2B17c%3D","updated":"2014-03-12 14:43:27.000000000","message":"Yeah, that makes sense. Thanks.","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"886c92914c7ad637d25b92aa96f0b9cedb202bab","unresolved":false,"context_lines":[{"line_number":91,"context_line":"            raise exception.Unauthorized(_(\u0027Federation token is expired\u0027))"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def _validate_groups(self, group_ids):"},{"line_number":94,"context_line":"        if not group_ids:"},{"line_number":95,"context_line":"            raise exception.Unauthorized(_(\u0027No groups provided\u0027))"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"        for group_id in group_ids:"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAVn%2F%2B17c%3D","line":94,"in_reply_to":"AAAAVn%2F%2B2O4%3D","updated":"2014-03-11 22:08:46.000000000","message":"if you don\u0027t have any groups (e.g. because no rules matched your saml2 assertion) you can end up with empty groups list. Empty groups implies empty roles, which basically mean you are not able to access anything and this IMHO leads to the conclusion that user is not authorized to access the cloud. That\u0027s the reason I am raising this exception quite early. Does it make sense?","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b04239014a17d060c1cb118620f5cbdbb4d7906","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def _validate_groups(self, group_ids):"},{"line_number":94,"context_line":"        if not group_ids:"},{"line_number":95,"context_line":"            raise exception.Unauthorized(_(\u0027No groups provided\u0027))"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"        for group_id in group_ids:"},{"line_number":98,"context_line":"            try:"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAVn%2F%2B2MI%3D","line":95,"updated":"2014-03-11 19:10:19.000000000","message":"suggest change this to: \"Unable to find any valid groups\", and mention the mapping id","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d540560650fdb3f854a01860b071a673c8ace694","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def _validate_groups(self, group_ids):"},{"line_number":94,"context_line":"        if not group_ids:"},{"line_number":95,"context_line":"            raise exception.Unauthorized(_(\u0027No groups provided\u0027))"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"        for group_id in group_ids:"},{"line_number":98,"context_line":"            try:"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAVn%2F%2B1%2Fg%3D","line":95,"in_reply_to":"AAAAVn%2F%2B2MI%3D","updated":"2014-03-11 19:37:32.000000000","message":"++ this is more along the lines of not having the resource rather than not having authorization to do something, which *could* misleading to the user.","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"96395fd2865de5422e1ded1e0942b37539439ec9","unresolved":false,"context_lines":[{"line_number":92,"context_line":""},{"line_number":93,"context_line":"    def _validate_groups(self, group_ids):"},{"line_number":94,"context_line":"        if not group_ids:"},{"line_number":95,"context_line":"            raise exception.Unauthorized(_(\u0027No groups provided\u0027))"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"        for group_id in group_ids:"},{"line_number":98,"context_line":"            try:"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAVn%2F%2BxmA%3D","line":95,"in_reply_to":"AAAAVn%2F%2B2MI%3D","updated":"2014-03-12 14:58:46.000000000","message":"Done","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"00671b78b5fc6e9bff2cb379dbd82644fdbedb88","unresolved":false,"context_lines":[{"line_number":99,"context_line":"                self.identity_api.get_group(group_id)"},{"line_number":100,"context_line":"            except exception.GroupNotFound:"},{"line_number":101,"context_line":"                raise exception.UnexpectedError(_(\u0027Missing \u0027"},{"line_number":102,"context_line":"                                                  \u0027group in the backend\u0027))"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAVn%2F%2B2PI%3D","line":102,"updated":"2014-03-11 19:04:38.000000000","message":"This needs more information, like which group. It would also be useful to know which mapping was used.","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"96395fd2865de5422e1ded1e0942b37539439ec9","unresolved":false,"context_lines":[{"line_number":99,"context_line":"                self.identity_api.get_group(group_id)"},{"line_number":100,"context_line":"            except exception.GroupNotFound:"},{"line_number":101,"context_line":"                raise exception.UnexpectedError(_(\u0027Missing \u0027"},{"line_number":102,"context_line":"                                                  \u0027group in the backend\u0027))"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAVn%2F%2Bxl8%3D","line":102,"in_reply_to":"AAAAVn%2F%2B2PI%3D","updated":"2014-03-12 14:58:46.000000000","message":"Done","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"}],"keystone/identity/backends/kvs.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"ae801ab7faf542bec515405491b5217cf6dbd8eb","unresolved":false,"context_lines":[{"line_number":292,"context_line":"        self.db.set(\u0027group_list\u0027, list(group_list))"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"    def check_groups_presence(self, group_ids, discard_missing_groups\u003dFalse):"},{"line_number":295,"context_line":"        raise exception.NotImplemented()"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2Btg%3D","line":295,"updated":"2014-03-10 22:17:45.000000000","message":"Why not implement this?","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"ac11bf1e1b80520e056e6544ffab3ea4face28dc","unresolved":false,"context_lines":[{"line_number":291,"context_line":"        group_list.remove(group_id)"},{"line_number":292,"context_line":"        self.db.set(\u0027group_list\u0027, list(group_list))"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"    def check_groups_presence(self, group_ids):"},{"line_number":295,"context_line":"        raise exception.NotImplemented()"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAVn%2F%2B66Y%3D","line":294,"updated":"2014-03-11 09:37:10.000000000","message":"copy from last patchset: implement.","commit_id":"59b8ab944df3fd967136b7a34a5d4c0785e6d749"}],"keystone/identity/backends/ldap.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"ae801ab7faf542bec515405491b5217cf6dbd8eb","unresolved":false,"context_lines":[{"line_number":181,"context_line":"        return found"},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"    def check_groups_presence(self, group_ids, discard_missing_groups\u003dFalse):"},{"line_number":184,"context_line":"        raise exception.NotImplemented()"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"# TODO(termie): turn this into a data object and move logic to driver"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2Btc%3D","line":184,"updated":"2014-03-10 22:17:45.000000000","message":"this needs to be implemented.","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"ac11bf1e1b80520e056e6544ffab3ea4face28dc","unresolved":false,"context_lines":[{"line_number":180,"context_line":"                break"},{"line_number":181,"context_line":"        return found"},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"    def check_groups_presence(self, group_ids):"},{"line_number":184,"context_line":"        raise exception.NotImplemented()"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAVn%2F%2B66U%3D","line":183,"updated":"2014-03-11 09:37:10.000000000","message":"copy from the last patchset: implement.","commit_id":"59b8ab944df3fd967136b7a34a5d4c0785e6d749"}],"keystone/identity/backends/sql.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"ae801ab7faf542bec515405491b5217cf6dbd8eb","unresolved":false,"context_lines":[{"line_number":312,"context_line":""},{"line_number":313,"context_line":"        session \u003d sql.get_session()"},{"line_number":314,"context_line":"        with session.begin():"},{"line_number":315,"context_line":"            query \u003d session.query(Group)"},{"line_number":316,"context_line":"            query \u003d query.filter(Group.id.in_(group_ids))"},{"line_number":317,"context_line":"            group_ids_backend \u003d [group.id for group in query.all()]"},{"line_number":318,"context_line":"        all_groups_present \u003d bool(group_ids_backend \u003d\u003d group_ids)"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2Bs4%3D","line":315,"updated":"2014-03-10 22:17:45.000000000","message":"should be able to indicate here that only the id is needed in the result.","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"24e6d12d6b457de7f949f37410ab1f20600a8386","unresolved":false,"context_lines":[{"line_number":312,"context_line":""},{"line_number":313,"context_line":"        session \u003d sql.get_session()"},{"line_number":314,"context_line":"        with session.begin():"},{"line_number":315,"context_line":"            query \u003d session.query(Group)"},{"line_number":316,"context_line":"            query \u003d query.filter(Group.id.in_(group_ids))"},{"line_number":317,"context_line":"            group_ids_backend \u003d [group.id for group in query.all()]"},{"line_number":318,"context_line":"        all_groups_present \u003d bool(group_ids_backend \u003d\u003d group_ids)"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B980%3D","line":315,"in_reply_to":"AAAAVn%2F%2B%2Bs4%3D","updated":"2014-03-11 09:35:42.000000000","message":"Done","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f2d89605a699da305076c59b7040dce533a7dfaa","unresolved":false,"context_lines":[{"line_number":315,"context_line":"            query \u003d session.query(Group)"},{"line_number":316,"context_line":"            query \u003d query.filter(Group.id.in_(group_ids))"},{"line_number":317,"context_line":"            group_ids_backend \u003d [group.id for group in query.all()]"},{"line_number":318,"context_line":"        all_groups_present \u003d bool(group_ids_backend \u003d\u003d group_ids)"},{"line_number":319,"context_line":""},{"line_number":320,"context_line":"        if discard_missing_groups:"},{"line_number":321,"context_line":"            group_ids_result \u003d group_ids_backend"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2Br8%3D","line":318,"updated":"2014-03-10 22:18:54.000000000","message":"I think this is broken because you are not guaranteed order or the groups returned right? Could you do a len() check instead?","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"ae801ab7faf542bec515405491b5217cf6dbd8eb","unresolved":false,"context_lines":[{"line_number":315,"context_line":"            query \u003d session.query(Group)"},{"line_number":316,"context_line":"            query \u003d query.filter(Group.id.in_(group_ids))"},{"line_number":317,"context_line":"            group_ids_backend \u003d [group.id for group in query.all()]"},{"line_number":318,"context_line":"        all_groups_present \u003d bool(group_ids_backend \u003d\u003d group_ids)"},{"line_number":319,"context_line":""},{"line_number":320,"context_line":"        if discard_missing_groups:"},{"line_number":321,"context_line":"            group_ids_result \u003d group_ids_backend"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2Br4%3D","line":318,"updated":"2014-03-10 22:17:45.000000000","message":"shouldn\u0027t need to convert to a bool... what else would it be?","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"24e6d12d6b457de7f949f37410ab1f20600a8386","unresolved":false,"context_lines":[{"line_number":315,"context_line":"            query \u003d session.query(Group)"},{"line_number":316,"context_line":"            query \u003d query.filter(Group.id.in_(group_ids))"},{"line_number":317,"context_line":"            group_ids_backend \u003d [group.id for group in query.all()]"},{"line_number":318,"context_line":"        all_groups_present \u003d bool(group_ids_backend \u003d\u003d group_ids)"},{"line_number":319,"context_line":""},{"line_number":320,"context_line":"        if discard_missing_groups:"},{"line_number":321,"context_line":"            group_ids_result \u003d group_ids_backend"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2BNs%3D","line":318,"in_reply_to":"AAAAVn%2F%2B%2Br4%3D","updated":"2014-03-11 09:35:42.000000000","message":"you are right, just wanted to make more than clear that it\u0027s a boolean value.","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"24e6d12d6b457de7f949f37410ab1f20600a8386","unresolved":false,"context_lines":[{"line_number":315,"context_line":"            query \u003d session.query(Group)"},{"line_number":316,"context_line":"            query \u003d query.filter(Group.id.in_(group_ids))"},{"line_number":317,"context_line":"            group_ids_backend \u003d [group.id for group in query.all()]"},{"line_number":318,"context_line":"        all_groups_present \u003d bool(group_ids_backend \u003d\u003d group_ids)"},{"line_number":319,"context_line":""},{"line_number":320,"context_line":"        if discard_missing_groups:"},{"line_number":321,"context_line":"            group_ids_result \u003d group_ids_backend"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2BAU%3D","line":318,"in_reply_to":"AAAAVn%2F%2B%2Br8%3D","updated":"2014-03-11 09:35:42.000000000","message":"possibly yes.\nI\u0027d go even further and compare sets made out of group ids.","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"}],"keystone/identity/core.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"ae801ab7faf542bec515405491b5217cf6dbd8eb","unresolved":false,"context_lines":[{"line_number":806,"context_line":"        raise exception.NotImplemented()"},{"line_number":807,"context_line":""},{"line_number":808,"context_line":"    @abc.abstractmethod"},{"line_number":809,"context_line":"    def check_groups_presence(self, group_ids, discard_missing_groups\u003dFalse):"},{"line_number":810,"context_line":"        \"\"\"Check whether groups are present in the backend."},{"line_number":811,"context_line":""},{"line_number":812,"context_line":"        Iterate over group ids from group_ids and check whether all"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2BqY%3D","line":809,"updated":"2014-03-10 22:17:45.000000000","message":"this could be made simpler -- just return the groups that exist. The caller can check if there\u0027s any missing.","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"24e6d12d6b457de7f949f37410ab1f20600a8386","unresolved":false,"context_lines":[{"line_number":806,"context_line":"        raise exception.NotImplemented()"},{"line_number":807,"context_line":""},{"line_number":808,"context_line":"    @abc.abstractmethod"},{"line_number":809,"context_line":"    def check_groups_presence(self, group_ids, discard_missing_groups\u003dFalse):"},{"line_number":810,"context_line":"        \"\"\"Check whether groups are present in the backend."},{"line_number":811,"context_line":""},{"line_number":812,"context_line":"        Iterate over group ids from group_ids and check whether all"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B904%3D","line":809,"in_reply_to":"AAAAVn%2F%2B%2BqY%3D","updated":"2014-03-11 09:35:42.000000000","message":"Done","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"ae801ab7faf542bec515405491b5217cf6dbd8eb","unresolved":false,"context_lines":[{"line_number":820,"context_line":"        :returns: a tuple consisting of a boolean parameter"},{"line_number":821,"context_line":"                  (True if all the groups are present in the"},{"line_number":822,"context_line":"                  backend, False otherwise.) and a list of group ids equal"},{"line_number":823,"context_line":"                  to group_ids input parametr if ``discard_invalid_groups``"},{"line_number":824,"context_line":"                  is False or a subset of group_ids input including group"},{"line_number":825,"context_line":"                  ids present in the backend if ``discard_invalid_groups``"},{"line_number":826,"context_line":"                  is set to True."}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2Bpc%3D","line":823,"updated":"2014-03-10 22:17:45.000000000","message":"change \"paramtr\" to \"parameter\"","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"24e6d12d6b457de7f949f37410ab1f20600a8386","unresolved":false,"context_lines":[{"line_number":820,"context_line":"        :returns: a tuple consisting of a boolean parameter"},{"line_number":821,"context_line":"                  (True if all the groups are present in the"},{"line_number":822,"context_line":"                  backend, False otherwise.) and a list of group ids equal"},{"line_number":823,"context_line":"                  to group_ids input parametr if ``discard_invalid_groups``"},{"line_number":824,"context_line":"                  is False or a subset of group_ids input including group"},{"line_number":825,"context_line":"                  ids present in the backend if ``discard_invalid_groups``"},{"line_number":826,"context_line":"                  is set to True."}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B98k%3D","line":823,"in_reply_to":"AAAAVn%2F%2B%2Bpc%3D","updated":"2014-03-11 09:35:42.000000000","message":"Done","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0be595398f9753588531712bba57bd7c3951da28","unresolved":false,"context_lines":[{"line_number":811,"context_line":""},{"line_number":812,"context_line":"        Iterate over group ids from group_ids and check what"},{"line_number":813,"context_line":"        groups are present in the backend."},{"line_number":814,"context_line":"        If ``discard_invalid_groups`` parameter is True remove missing"},{"line_number":815,"context_line":"        group ids from the resulting list of present group_ids."},{"line_number":816,"context_line":""},{"line_number":817,"context_line":"        :param group_ids: iterable with group ids to be checked."}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAVn%2F%2B4oI%3D","line":814,"updated":"2014-03-11 17:32:25.000000000","message":"this isn\u0027t documented as part of the method signature?","commit_id":"59b8ab944df3fd967136b7a34a5d4c0785e6d749"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0be595398f9753588531712bba57bd7c3951da28","unresolved":false,"context_lines":[{"line_number":816,"context_line":""},{"line_number":817,"context_line":"        :param group_ids: iterable with group ids to be checked."},{"line_number":818,"context_line":""},{"line_number":819,"context_line":"        :returns: group_ids_backend - list of group ids with all the"},{"line_number":820,"context_line":"                  group_ids subset present in the backend."},{"line_number":821,"context_line":""},{"line_number":822,"context_line":"        \"\"\""}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAVn%2F%2B4nY%3D","line":819,"updated":"2014-03-11 17:32:25.000000000","message":"returns aren\u0027t named in the interface, so drop \"group_ids_backend\"","commit_id":"59b8ab944df3fd967136b7a34a5d4c0785e6d749"}],"keystone/tests/test_v3_federation.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"ae801ab7faf542bec515405491b5217cf6dbd8eb","unresolved":false,"context_lines":[{"line_number":875,"context_line":"        \"\"\"Inject assertion that matches rule issuing bad group id."},{"line_number":876,"context_line":""},{"line_number":877,"context_line":"        Expect server to discard group not present in the backend"},{"line_number":878,"context_line":"        and return token only with valid groups."},{"line_number":879,"context_line":""},{"line_number":880,"context_line":"        \"\"\""},{"line_number":881,"context_line":"        r \u003d self._issue_unscoped_token(assertion\u003d\u0027CONTRACTOR_ASSERTION\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2Bos%3D","line":878,"updated":"2014-03-10 22:17:45.000000000","message":"remove \"with\"","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"24e6d12d6b457de7f949f37410ab1f20600a8386","unresolved":false,"context_lines":[{"line_number":875,"context_line":"        \"\"\"Inject assertion that matches rule issuing bad group id."},{"line_number":876,"context_line":""},{"line_number":877,"context_line":"        Expect server to discard group not present in the backend"},{"line_number":878,"context_line":"        and return token only with valid groups."},{"line_number":879,"context_line":""},{"line_number":880,"context_line":"        \"\"\""},{"line_number":881,"context_line":"        r \u003d self._issue_unscoped_token(assertion\u003d\u0027CONTRACTOR_ASSERTION\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B98Q%3D","line":878,"in_reply_to":"AAAAVn%2F%2B%2Bos%3D","updated":"2014-03-11 09:35:42.000000000","message":"Done","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"ae801ab7faf542bec515405491b5217cf6dbd8eb","unresolved":false,"context_lines":[{"line_number":995,"context_line":"         - Expect 401 HTTP Unauthorized"},{"line_number":996,"context_line":""},{"line_number":997,"context_line":"        \"\"\""},{"line_number":998,"context_line":"        #create group and role"},{"line_number":999,"context_line":"        group \u003d self.new_group_ref("},{"line_number":1000,"context_line":"            domain_id\u003dself.domainA[\u0027id\u0027])"},{"line_number":1001,"context_line":"        self.identity_api.create_group(group[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B%2Blo%3D","line":998,"updated":"2014-03-10 22:17:45.000000000","message":"add space after # for consistency. This applies to all these comments.","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"24e6d12d6b457de7f949f37410ab1f20600a8386","unresolved":false,"context_lines":[{"line_number":995,"context_line":"         - Expect 401 HTTP Unauthorized"},{"line_number":996,"context_line":""},{"line_number":997,"context_line":"        \"\"\""},{"line_number":998,"context_line":"        #create group and role"},{"line_number":999,"context_line":"        group \u003d self.new_group_ref("},{"line_number":1000,"context_line":"            domain_id\u003dself.domainA[\u0027id\u0027])"},{"line_number":1001,"context_line":"        self.identity_api.create_group(group[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":3,"id":"AAAAVn%2F%2B97o%3D","line":998,"in_reply_to":"AAAAVn%2F%2B%2Blo%3D","updated":"2014-03-11 09:35:42.000000000","message":"Done","commit_id":"9ab42d81e4cbd1d090bfcc367be3e195efe0f10b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"00671b78b5fc6e9bff2cb379dbd82644fdbedb88","unresolved":false,"context_lines":[{"line_number":1045,"context_line":"        # delete group"},{"line_number":1046,"context_line":"        self.identity_api.delete_group(group[\u0027id\u0027])"},{"line_number":1047,"context_line":""},{"line_number":1048,"context_line":"        # scope token to project_all, expect HTTP 401"},{"line_number":1049,"context_line":"        scoped_token \u003d self._scope_request("},{"line_number":1050,"context_line":"            token_id, \u0027project\u0027,"},{"line_number":1051,"context_line":"            self.project_all[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAVn%2F%2B2Oc%3D","line":1048,"updated":"2014-03-11 19:04:38.000000000","message":"change 401 to 500 otherwise this is confusing.","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"96395fd2865de5422e1ded1e0942b37539439ec9","unresolved":false,"context_lines":[{"line_number":1045,"context_line":"        # delete group"},{"line_number":1046,"context_line":"        self.identity_api.delete_group(group[\u0027id\u0027])"},{"line_number":1047,"context_line":""},{"line_number":1048,"context_line":"        # scope token to project_all, expect HTTP 401"},{"line_number":1049,"context_line":"        scoped_token \u003d self._scope_request("},{"line_number":1050,"context_line":"            token_id, \u0027project\u0027,"},{"line_number":1051,"context_line":"            self.project_all[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAVn%2F%2Bx3U%3D","line":1048,"in_reply_to":"AAAAVn%2F%2B2Oc%3D","updated":"2014-03-12 14:58:46.000000000","message":"Done","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"70994558dda20c82851aee1a715f677fdaf2056a","unresolved":false,"context_lines":[{"line_number":1055,"context_line":"                  expected_status\u003d500)"},{"line_number":1056,"context_line":""},{"line_number":1057,"context_line":"        # revert to old mapping"},{"line_number":1058,"context_line":"        self.federation_api.update_mapping(self.mapping[\u0027id\u0027],"},{"line_number":1059,"context_line":"                                           self.rules)"},{"line_number":1060,"context_line":""},{"line_number":1061,"context_line":"    def load_federation_sample_data(self):"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAVn%2F%2B2MY%3D","line":1058,"updated":"2014-03-11 19:11:12.000000000","message":"What is the point of doing this in the test? Is this something that may failed based on this feature?","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"af215ea65aaa0321806970cf289908f03fde5793","unresolved":false,"context_lines":[{"line_number":1055,"context_line":"                  expected_status\u003d500)"},{"line_number":1056,"context_line":""},{"line_number":1057,"context_line":"        # revert to old mapping"},{"line_number":1058,"context_line":"        self.federation_api.update_mapping(self.mapping[\u0027id\u0027],"},{"line_number":1059,"context_line":"                                           self.rules)"},{"line_number":1060,"context_line":""},{"line_number":1061,"context_line":"    def load_federation_sample_data(self):"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAWH%2F%2F%2FGA%3D","line":1058,"in_reply_to":"AAAAVn%2F%2B140%3D","updated":"2014-03-12 14:43:27.000000000","message":"If you delete this line the tests should still pass because their data is setup before each test runs.","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"886c92914c7ad637d25b92aa96f0b9cedb202bab","unresolved":false,"context_lines":[{"line_number":1055,"context_line":"                  expected_status\u003d500)"},{"line_number":1056,"context_line":""},{"line_number":1057,"context_line":"        # revert to old mapping"},{"line_number":1058,"context_line":"        self.federation_api.update_mapping(self.mapping[\u0027id\u0027],"},{"line_number":1059,"context_line":"                                           self.rules)"},{"line_number":1060,"context_line":""},{"line_number":1061,"context_line":"    def load_federation_sample_data(self):"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAVn%2F%2B140%3D","line":1058,"in_reply_to":"AAAAVn%2F%2B2MY%3D","updated":"2014-03-11 22:08:46.000000000","message":"All the tests except this one rely on the objects prepared in the load_federation_sample_data() method. So it\u0027s IdP, protocol, mapping, and rules configured and added to the backend.\nThe aim of this test is to simulate situation where a rule assumes the group exists (in fact it does at that point), an unscoped token is issued, the group is now deleted and the client tries to scope the token. Since I must delete some roles/groups I am also creating some dynamic groups just for this test. If I create the group here, I need to update the mappings to include that groups id in the \u0027local\u0027 object. When the test is done I must revert the mapping to the old one, so the rest of the tests can carry out.\nI could create this extra \u0027group\u0027 just for this test inside the load_federation_sample_data() method, but eventually I would also juggle the mappings and upload a new one and later revert. Otherwise I would have to add another protocol, another maping, just for a single test....","commit_id":"b5623fe03a3ac8e382301a3b6ac42c0ce9a235f5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"91de9b1800181ae2e91e920fdac3431c329d3dc5","unresolved":false,"context_lines":[{"line_number":1302,"context_line":"                        }"},{"line_number":1303,"context_line":"                    ]"},{"line_number":1304,"context_line":"                },"},{"line_number":1305,"context_line":"                {"},{"line_number":1306,"context_line":"                    \u0027local\u0027: ["},{"line_number":1307,"context_line":"                        {"},{"line_number":1308,"context_line":"                            \u0027group\u0027: {"}],"source_content_type":"text/x-python","patch_set":8,"id":"AAAAWH%2F%2F8zk%3D","line":1305,"updated":"2014-03-12 18:24:25.000000000","message":"Are the changes to these rules necessary?","commit_id":"36b30c0bad7ecd058a19a6e80d18c19163ce4e6c"}]}