)]}'
{"keystone/identity/backends/ldap.py":[{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e10c8defac44f50f4f431e7f9556a2aa5cb3c6a6","unresolved":false,"context_lines":[{"line_number":99,"context_line":"        if \u0027name\u0027 in user and old_obj.get(\u0027name\u0027) !\u003d user[\u0027name\u0027]:"},{"line_number":100,"context_line":"            raise exception.Conflict(_(\u0027Cannot change user name\u0027))"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"        user \u003d utils.hash_ldap_user_password(user)"},{"line_number":103,"context_line":"        if self.user.enabled_mask:"},{"line_number":104,"context_line":"            self.user.mask_enabled_attribute(user)"},{"line_number":105,"context_line":"        self.user.update(user_id, user, old_obj)"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAXH%2F%2F124%3D","side":"PARENT","line":102,"updated":"2014-04-17 02:31:49.000000000","message":"So I tracked this down and this function came in originally with the fakeldap unit testing code. So ideally once you refactor the code as recommended by ayoung I think you can safely pull this out. I vagely recall someone adding it here to add \"extra security\" but can\u0027t remember the details. But if it causing your LDAP real bugs I think it can be removed. Might be worth getting bknudson\u0027s opinion as well.","commit_id":"0473e5ab75ece62df8b7bb429c9e75db34ce71f6"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b569db52b4cdc53a4ccc02f9214a45b52ce84bcd","unresolved":false,"context_lines":[{"line_number":99,"context_line":"        if \u0027name\u0027 in user and old_obj.get(\u0027name\u0027) !\u003d user[\u0027name\u0027]:"},{"line_number":100,"context_line":"            raise exception.Conflict(_(\u0027Cannot change user name\u0027))"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"        user \u003d utils.hash_ldap_user_password(user)"},{"line_number":103,"context_line":"        if self.user.enabled_mask:"},{"line_number":104,"context_line":"            self.user.mask_enabled_attribute(user)"},{"line_number":105,"context_line":"        self.user.update(user_id, user, old_obj)"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAXH%2F%2FwWQ%3D","side":"PARENT","line":102,"in_reply_to":"AAAAXH%2F%2F124%3D","updated":"2014-04-17 17:24:13.000000000","message":"as far as i can tell, ayoung originally included hashing here https://review.openstack.org/#/c/4362/","commit_id":"0473e5ab75ece62df8b7bb429c9e75db34ce71f6"}],"keystone/tests/fakeldap.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"5d527c912f0c1f5a5aa21f4a3a020be5f0e6f908","unresolved":false,"context_lines":[{"line_number":250,"context_line":"                      core.utf8_decode(who))"},{"line_number":251,"context_line":"            raise ldap.INAPPROPRIATE_AUTH"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"        if not cred \u003d\u003d db_password:"},{"line_number":254,"context_line":"            LOG.debug(\u0027bind fail: password for who\u003d%s does not match\u0027,"},{"line_number":255,"context_line":"                      core.utf8_decode(who))"},{"line_number":256,"context_line":"            raise ldap.INVALID_CREDENTIALS"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAXH%2F%2FwVo%3D","line":253,"updated":"2014-04-17 17:25:03.000000000","message":"cred !\u003d db_password","commit_id":"cc52bd3f749b68866cefe378b4987be70fafc806"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"f088ec4dd579545f3ca2adfee9801c3ab18d5c43","unresolved":false,"context_lines":[{"line_number":250,"context_line":"                      core.utf8_decode(who))"},{"line_number":251,"context_line":"            raise ldap.INAPPROPRIATE_AUTH"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"        if not cred \u003d\u003d db_password:"},{"line_number":254,"context_line":"            LOG.debug(\u0027bind fail: password for who\u003d%s does not match\u0027,"},{"line_number":255,"context_line":"                      core.utf8_decode(who))"},{"line_number":256,"context_line":"            raise ldap.INVALID_CREDENTIALS"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAXH%2F%2FwQQ%3D","line":253,"in_reply_to":"AAAAXH%2F%2FwUg%3D","updated":"2014-04-17 17:36:27.000000000","message":"Done","commit_id":"cc52bd3f749b68866cefe378b4987be70fafc806"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ecc52f56fa4bdbb7a53817bba9ad1a8189ff2c6e","unresolved":false,"context_lines":[{"line_number":250,"context_line":"                      core.utf8_decode(who))"},{"line_number":251,"context_line":"            raise ldap.INAPPROPRIATE_AUTH"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"        if not cred \u003d\u003d db_password:"},{"line_number":254,"context_line":"            LOG.debug(\u0027bind fail: password for who\u003d%s does not match\u0027,"},{"line_number":255,"context_line":"                      core.utf8_decode(who))"},{"line_number":256,"context_line":"            raise ldap.INVALID_CREDENTIALS"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAXH%2F%2FwUg%3D","line":253,"in_reply_to":"AAAAXH%2F%2FwVo%3D","updated":"2014-04-17 17:27:04.000000000","message":"otherwise it\u0027s ambiguous as to whether you meant\n\n  not (cred \u003d\u003d db_password)\n\nor \n\n  (not cred) \u003d\u003d db_password\"","commit_id":"cc52bd3f749b68866cefe378b4987be70fafc806"}],"keystone/tests/test_backend_ldap.py":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"bd5c1ab6958ae572a3d083fd681b540bf98b6f3a","unresolved":false,"context_lines":[{"line_number":253,"context_line":"    def test_delete_group_with_user_project_domain_links(self):"},{"line_number":254,"context_line":"        self.skipTest(\u0027N/A: LDAP does not support multiple domains\u0027)"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"    def test_password_hashed(self):"},{"line_number":257,"context_line":"        self.skipTest(\u0027N/A: hashing is left up to the LDAP server\u0027)"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"    def test_list_projects_for_user(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAXH%2F%2FwGE%3D","line":256,"updated":"2014-04-17 18:46:27.000000000","message":"Can we do this test for the live ldap tests (test_ldap_livetest)? (which it looks like the live tests are broken now...)\n\nI think we should move test_password_hashed down into the different driver tests rather than putting it in test_backend.\n\ntest_backend_sql reimplements it, test_backend_ldap skips it... so it\u0027s really only usable for KVS, and it uses a private method of the driver, which a general backend test shouldn\u0027t do.\n\nThat change can be made separately.","commit_id":"c94d19b486a54eb889585ce03aac58d644a9599c"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"2168d18100c658f28a7809d6549466c19fc56690","unresolved":false,"context_lines":[{"line_number":253,"context_line":"    def test_delete_group_with_user_project_domain_links(self):"},{"line_number":254,"context_line":"        self.skipTest(\u0027N/A: LDAP does not support multiple domains\u0027)"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"    def test_password_hashed(self):"},{"line_number":257,"context_line":"        self.skipTest(\u0027N/A: hashing is left up to the LDAP server\u0027)"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"    def test_list_projects_for_user(self):"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAXH%2F%2Fvdk%3D","line":256,"in_reply_to":"AAAAXH%2F%2FwGE%3D","updated":"2014-04-17 19:25:46.000000000","message":"I don\u0027t think we can/should rely on the LDAP server exposing the password hash to Keystone.\n\nActive Directory doesn\u0027t expose the password hash, and best practice is to lock down access to the hashed \"userPassword\" value with any LDAP server.  In operation, Keystone doesn\u0027t ever need to directly access the \"userPassword\" attribute value, so I don\u0027t think that our tests should rely on it.\n\nMoving test_password_hashed to the KVS driver test makes a lot of sense to me.","commit_id":"c94d19b486a54eb889585ce03aac58d644a9599c"}]}