)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"1fd5f44e9aa35e176c49e3da78f56452511b2b89","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Filter environment before mapping the federation rules."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Before the environement dictionary is passed to the RuleProcessor all parameters that"},{"line_number":10,"context_line":"are not inheriting from the basestring type should be filtered out."},{"line_number":11,"context_line":"Additionally, for better control on what parameters should be passed to the"},{"line_number":12,"context_line":"RuleProcessor, one can configure assertion_prefix parameter in the keystone.conf."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"AAAAWH%2F%2F07s%3D","line":9,"updated":"2014-03-13 15:01:58.000000000","message":"typo - should be environment","commit_id":"c5b053c3c6c7c421efdd9c4cd5e0bd9314e2b19b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"1fd5f44e9aa35e176c49e3da78f56452511b2b89","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Parameter assertion_prefix value defaults to empty string - \u0027\u0027."},{"line_number":14,"context_line":"Only environment variables with prefix equal to an assertion_prefix value will be"},{"line_number":15,"context_line":"passed to the RuleProcessor object."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Change-Id: I469107633abfa86232e1dc1f1bc64605cd888dc2"},{"line_number":18,"context_line":"Closes-bug: #1291981"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"AAAAWH%2F%2F07Y%3D","line":16,"updated":"2014-03-13 15:01:58.000000000","message":"\"Before the requests environment is passed to the RuleProcessor, all parameters that are not inheriting from the basestring type should be filtered out.\n\nAdditionally, add an optional assertion_prefix (defaults to empty string - \u0027\u0027), which is used to filter out all keys from the environment before being passed on to the RuleProcessor.\"","commit_id":"c5b053c3c6c7c421efdd9c4cd5e0bd9314e2b19b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"74f32425a3ece46bd2a93548d34f611ed8876f69","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Before the requests environment is passed to the RuleProcessor, all"},{"line_number":10,"context_line":"parameters that are not inheriting from the basestring type should"},{"line_number":11,"context_line":"be filtered out. Additionally, add an optional assertion_prefix"},{"line_number":12,"context_line":"(defaults to empty string - \u0027\u0027), which is used to filter out all keys"},{"line_number":13,"context_line":"from the environment before being passed on to the RuleProcessor."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"AAAAWH%2F%2Fwyk%3D","line":11,"updated":"2014-03-13 23:58:48.000000000","message":"why are these 2 changes being done in 1 commit? split it up. the assertion prefix doesn\u0027t to have anything to do with the bug.","commit_id":"909d6a8f7f0e6a00a26a06e1680cc5d353b4cf10"}],"etc/keystone.conf.sample":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2b07407846fc4c288e0b9e6b7da3dc018b064b11","unresolved":false,"context_lines":[{"line_number":110,"context_line":"# Auto-delete queues in amqp. (boolean value)"},{"line_number":111,"context_line":"#amqp_auto_delete\u003dfalse"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"# Size of RPC connection pool. (integer value)"},{"line_number":114,"context_line":"#rpc_conn_pool_size\u003d30"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"# Modules of exceptions that are permitted to be recreated"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"AAAAWH%2F%2FsMI%3D","line":113,"updated":"2014-03-14 13:34:19.000000000","message":"I don\u0027t see any config changes in this patch so suggest revert the changes to conf.sample.","commit_id":"10addbcbe29648c90aeb3f20f210f2a894bbe19c"}],"keystone/common/config.py":[{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"63b3efa8b163cd40d1afe3afd27de47807d52817","unresolved":false,"context_lines":[{"line_number":350,"context_line":"                           \u0027backends.sql.Federation\u0027,"},{"line_number":351,"context_line":"                   help\u003d\u0027Keystone Federation backend driver.\u0027),"},{"line_number":352,"context_line":"        cfg.StrOpt(\u0027assertion_prefix\u0027,"},{"line_number":353,"context_line":"                   default\u003d\u0027\u0027)],"},{"line_number":354,"context_line":""},{"line_number":355,"context_line":"    \u0027policy\u0027: ["},{"line_number":356,"context_line":"        cfg.StrOpt(\u0027driver\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAWH%2F%2F1VI%3D","line":353,"updated":"2014-03-13 14:33:07.000000000","message":"Add some help text, especially since the default value is empty, to explain this prefix will filter SAML assertions in the environment","commit_id":"c5b053c3c6c7c421efdd9c4cd5e0bd9314e2b19b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"24e6727758e83c8a2d05c3d63795f9239e9a33a3","unresolved":false,"context_lines":[{"line_number":350,"context_line":"                           \u0027backends.sql.Federation\u0027,"},{"line_number":351,"context_line":"                   help\u003d\u0027Keystone Federation backend driver.\u0027),"},{"line_number":352,"context_line":"        cfg.StrOpt(\u0027assertion_prefix\u0027,"},{"line_number":353,"context_line":"                   default\u003d\u0027\u0027)],"},{"line_number":354,"context_line":""},{"line_number":355,"context_line":"    \u0027policy\u0027: ["},{"line_number":356,"context_line":"        cfg.StrOpt(\u0027driver\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAWH%2F%2F1Ic%3D","line":353,"in_reply_to":"AAAAWH%2F%2F1VI%3D","updated":"2014-03-13 14:50:02.000000000","message":"good point!","commit_id":"c5b053c3c6c7c421efdd9c4cd5e0bd9314e2b19b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"44fff792a95236e3953161ce5098511cdbe7de7d","unresolved":false,"context_lines":[{"line_number":353,"context_line":"                   default\u003d\u0027\u0027),"},{"line_number":354,"context_line":"                   help\u003d\u0027Value to be used when filtering assertion parameters \u0027"},{"line_number":355,"context_line":"                        \u0027from the environment. Defaults to \u0027\u0027 which means \u0027"},{"line_number":356,"context_line":"                        \u0027eventually all the basestring parameters will be \u0027"},{"line_number":357,"context_line":"                        \u0027passed to the RuleProcessor object.\u0027],"},{"line_number":358,"context_line":""},{"line_number":359,"context_line":"    \u0027policy\u0027: ["}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAWH%2F%2F0lQ%3D","line":356,"updated":"2014-03-13 15:40:09.000000000","message":"from the environment, defaults to \u0027\u0027.\n\nThe rest is implementation detail that doesn\u0027t need to be exposed.","commit_id":"616a8989c60e6d4350d06de50599d80cffb4f138"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"74f32425a3ece46bd2a93548d34f611ed8876f69","unresolved":false,"context_lines":[{"line_number":352,"context_line":"        cfg.StrOpt(\u0027assertion_prefix\u0027,"},{"line_number":353,"context_line":"                   default\u003d\u0027\u0027,"},{"line_number":354,"context_line":"                   help\u003d\u0027Value to be used when filtering assertion parameters \u0027"},{"line_number":355,"context_line":"                        \u0027from the environment, defaults to \"\".\u0027)],"},{"line_number":356,"context_line":""},{"line_number":357,"context_line":"    \u0027policy\u0027: ["},{"line_number":358,"context_line":"        cfg.StrOpt(\u0027driver\u0027,"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAWH%2F%2Fwzo%3D","line":355,"updated":"2014-03-13 23:58:48.000000000","message":"remove \u0027, defaults to \"\"\u0027 -- the default is already set.","commit_id":"909d6a8f7f0e6a00a26a06e1680cc5d353b4cf10"}],"keystone/tests/test_v3_federation.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5d7ffb9205189b963ab42f7f020f3435fffda902","unresolved":false,"context_lines":[{"line_number":825,"context_line":"        }"},{"line_number":826,"context_line":"        self._inject_assertion(context, \u0027EMPLOYEE_ASSERTION\u0027)"},{"line_number":827,"context_line":"        r \u003d api.authenticate_for_token(context, self.UNSCOPED_V3_SAML2_REQ)"},{"line_number":828,"context_line":"        self.assertIsNotNone(r.headers.get(\u0027X-Subject-Token\u0027))"},{"line_number":829,"context_line":""},{"line_number":830,"context_line":"    def test_scope_to_project_once(self):"},{"line_number":831,"context_line":"        r \u003d self.post(self.AUTH_URL,"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAWH%2F%2F1L0%3D","line":828,"updated":"2014-03-13 14:37:26.000000000","message":"The assertion should not be valid in this context, so why would a token be issued?","commit_id":"c5b053c3c6c7c421efdd9c4cd5e0bd9314e2b19b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"efd62fa782f0ca0f220ac0d93717d973815a8351","unresolved":false,"context_lines":[{"line_number":825,"context_line":"        }"},{"line_number":826,"context_line":"        self._inject_assertion(context, \u0027EMPLOYEE_ASSERTION\u0027)"},{"line_number":827,"context_line":"        r \u003d api.authenticate_for_token(context, self.UNSCOPED_V3_SAML2_REQ)"},{"line_number":828,"context_line":"        self.assertIsNotNone(r.headers.get(\u0027X-Subject-Token\u0027))"},{"line_number":829,"context_line":""},{"line_number":830,"context_line":"    def test_scope_to_project_once(self):"},{"line_number":831,"context_line":"        r \u003d self.post(self.AUTH_URL,"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAWH%2F%2F0%2Fs%3D","line":828,"in_reply_to":"AAAAWH%2F%2F1Ig%3D","updated":"2014-03-13 14:54:30.000000000","message":"Ah okay, I missed that part. This makes sense now.","commit_id":"c5b053c3c6c7c421efdd9c4cd5e0bd9314e2b19b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"24e6727758e83c8a2d05c3d63795f9239e9a33a3","unresolved":false,"context_lines":[{"line_number":825,"context_line":"        }"},{"line_number":826,"context_line":"        self._inject_assertion(context, \u0027EMPLOYEE_ASSERTION\u0027)"},{"line_number":827,"context_line":"        r \u003d api.authenticate_for_token(context, self.UNSCOPED_V3_SAML2_REQ)"},{"line_number":828,"context_line":"        self.assertIsNotNone(r.headers.get(\u0027X-Subject-Token\u0027))"},{"line_number":829,"context_line":""},{"line_number":830,"context_line":"    def test_scope_to_project_once(self):"},{"line_number":831,"context_line":"        r \u003d self.post(self.AUTH_URL,"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAWH%2F%2F1Ig%3D","line":828,"in_reply_to":"AAAAWH%2F%2F1L0%3D","updated":"2014-03-13 14:50:02.000000000","message":"@Steve:\n\nI am injecting some non valid objects to the faked context[\u0027environment\u0027] and later passing this object to the normal helper function _inject_assertion() that inserts expected assertion parameters. The aim of this test is to make sure that Keystone will not fail, discard object(), tuple, dictionary, parse EMPLOYEE_ASSERTION and issue a token.","commit_id":"c5b053c3c6c7c421efdd9c4cd5e0bd9314e2b19b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2b07407846fc4c288e0b9e6b7da3dc018b064b11","unresolved":false,"context_lines":[{"line_number":818,"context_line":"                          self._issue_unscoped_token,"},{"line_number":819,"context_line":"                          assertion\u003d\u0027BAD_TESTER_ASSERTION\u0027)"},{"line_number":820,"context_line":""},{"line_number":821,"context_line":"    def test_issue_unscoped_token_malformed_environment(self):"},{"line_number":822,"context_line":"        api \u003d auth_controllers.Auth()"},{"line_number":823,"context_line":"        context \u003d {"},{"line_number":824,"context_line":"            \u0027environment\u0027: {"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAWH%2F%2FsKw%3D","line":821,"updated":"2014-03-14 13:34:19.000000000","message":"add a comment what this is testing... that non-strings are removed from the environment.","commit_id":"10addbcbe29648c90aeb3f20f210f2a894bbe19c"}]}