)]}'
{"keystone/assignment/backends/ldap.py":[{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"3263bd580523d2e644ff56dd90f6fe833a275334","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"            roles \u003d []"},{"line_number":97,"context_line":"            for assignment in assignments:"},{"line_number":98,"context_line":"                assignment_id \u003d self.user._dn_to_id(assignment.user_dn)"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"                if assignment_id !\u003d user_id:"},{"line_number":101,"context_line":"                    # Skip this assignment, it\u0027s not the target user id."}],"source_content_type":"text/x-python","patch_set":1,"id":"7adec928_5c53196c","line":98,"updated":"2014-05-21 17:13:17.000000000","message":"I think that we are guaranteed that assignment_id will be the id of a user and not a group here (given that we\u0027re using \u0027assignment.user_dn\u0027 to lookup the id).\n\nSince we compare this with the passed in \u0027user_id\u0027, I\u0027m not so sure that we need to perform the DN comparison that was added below.","commit_id":"eadce4b3208e801da348bbeb1f2c031df98748d1"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a4b4d559b00dd4e5fde1d1ee7dae61cbd8693a52","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"            roles \u003d []"},{"line_number":97,"context_line":"            for assignment in assignments:"},{"line_number":98,"context_line":"                assignment_id \u003d self.user._dn_to_id(assignment.user_dn)"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"                if assignment_id !\u003d user_id:"},{"line_number":101,"context_line":"                    # Skip this assignment, it\u0027s not the target user id."}],"source_content_type":"text/x-python","patch_set":1,"id":"7adec928_17d16acd","line":98,"in_reply_to":"7adec928_5c53196c","updated":"2014-05-21 17:43:13.000000000","message":"unfortunately, we get back all the DNs that have a role assignment. The DN can be the DN for a user or a group. get_role_assignments isn\u0027t smart enough to get only user DNs and it sticks all of them in user_dn. Here\u0027s an example run: http://paste.openstack.org/show/81018/\n\n (Pdb) pp [x.user_dn for x in assignments]\n [u\u0027cn\u003d0ddcdc2ee75246999f662a1b09853086,ou\u003dUsers,dc\u003dopenstack,dc\u003dorg\u0027,\n  u\u0027cn\u003d0ddcdc2ee75246999f662a1b09853086,ou\u003dUsers,dc\u003dopenstack,dc\u003dorg\u0027,\n  u\u0027cn\u003d73114eaf976e4f6480776c3d49213289,ou\u003dUsers,dc\u003dopenstack,dc\u003dorg\u0027,\n  u\u0027cn\u003dsuspectid,ou\u003dUserGroups,dc\u003dopenstack,dc\u003dorg\u0027,\n  u\u0027cn\u003d0ddcdc2ee75246999f662a1b09853086,ou\u003dUsers,dc\u003dopenstack,dc\u003dorg\u0027]\n\nSo you can see cn\u003dsuspectid,ou\u003dUserGroups,dc\u003dopenstack,dc\u003dorg (which is obviously a group) is in the list of user_dns.\n\nThe issue that\u0027s being fixed here is that a user and group have the same ID. So there could be a user with ID suspectid (cn\u003dsuspectid,ou\u003dUsers,dc\u003dopenstack,dc\u003dorg) also.\n\nSo just checking the ID at line 100 isn\u0027t good enough, because the user ID might be a group ID instead.","commit_id":"eadce4b3208e801da348bbeb1f2c031df98748d1"},{"author":{"_account_id":8533,"name":"Marcos Fermín Lobo","email":"lobo@lukos.org","username":"mlobo"},"change_message_id":"24602317de28c689afe400bea3fb873155b17395","unresolved":false,"context_lines":[{"line_number":98,"context_line":"        def _get_roles_for_group_and_project(group_id, project_id):"},{"line_number":99,"context_line":"            self.get_project(project_id)"},{"line_number":100,"context_line":"            group_dn \u003d self.group._id_to_dn(group_id)"},{"line_number":101,"context_line":"            # NOTE(marcos-fermin-lobo): In Active Directory, for functions"},{"line_number":102,"context_line":"            # such as \"self.role.get_role_assignments\", it returns"},{"line_number":103,"context_line":"            # the key \"CN\" or \"OU\" in uppercase."},{"line_number":104,"context_line":"            # The group_dn var has \"CN\" and \"OU\" in lowercase."}],"source_content_type":"text/x-python","patch_set":4,"id":"7adec928_0505a2c1","line":101,"updated":"2014-05-22 06:42:03.000000000","message":"I think you can remove this comment now.","commit_id":"01d99eceb562d5ab32063589d9a269588384118b"}]}