)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a3c0e94c1f5bb805e58c5f11d27e21b848441b11","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"To date kerberos has been supported by the \"external\" method"},{"line_number":10,"context_line":"name.  However, the Client plugin architecture needs to refer to the"},{"line_number":11,"context_line":"method name , and we do not want to expose to the client the"},{"line_number":12,"context_line":"difference between kerberos as performed by and external module or"},{"line_number":13,"context_line":"an eventual kerberos-in-eventlet style implementation."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1ae5cdf2_81871e0f","line":11,"updated":"2014-05-29 21:43:59.000000000","message":"nit: remove space before ,","commit_id":"62278b52718c1a284e9f13846d664fa6cc9680c0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a3c0e94c1f5bb805e58c5f11d27e21b848441b11","unresolved":false,"context_lines":[{"line_number":9,"context_line":"To date kerberos has been supported by the \"external\" method"},{"line_number":10,"context_line":"name.  However, the Client plugin architecture needs to refer to the"},{"line_number":11,"context_line":"method name , and we do not want to expose to the client the"},{"line_number":12,"context_line":"difference between kerberos as performed by and external module or"},{"line_number":13,"context_line":"an eventual kerberos-in-eventlet style implementation."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"If the \"external\" plugin is missing, the old code would throw an"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"1ae5cdf2_c178462e","line":12,"updated":"2014-05-29 21:43:59.000000000","message":"s/and/an/","commit_id":"62278b52718c1a284e9f13846d664fa6cc9680c0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b51d5ce4430c633e138698ae7beb830d51fcf46a","unresolved":false,"context_lines":[{"line_number":9,"context_line":"To date kerberos has been supported by the \"external\" method"},{"line_number":10,"context_line":"name.  However, the Client plugin architecture needs to refer to the"},{"line_number":11,"context_line":"method name , and we do not want to expose to the client the"},{"line_number":12,"context_line":"difference between kerberos as performed by and external module or"},{"line_number":13,"context_line":"an eventual kerberos-in-eventlet style implementation."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"If the \"external\" plugin is missing, the old code would throw an"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"1ae5cdf2_bf6ad87e","line":12,"updated":"2014-06-04 02:55:36.000000000","message":"performed by an external module and an eventual ...","commit_id":"746dd7dd34659990cb238ba97401eda3913dae18"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b51d5ce4430c633e138698ae7beb830d51fcf46a","unresolved":false,"context_lines":[{"line_number":15,"context_line":"If the \"external\" plugin is missing, the old code would throw an"},{"line_number":16,"context_line":"exception attempting to process \"REMOTE_USER\" behavior.  If only"},{"line_number":17,"context_line":"\u0027Kerberos\" is specified, this is checked and skipped."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Blueprint: kerberos-authentication"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Change-Id: If698fc1d0751cded556825b081539da4dd51275e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"1ae5cdf2_9fc35c88","line":18,"updated":"2014-06-04 02:55:36.000000000","message":"SecurityImpact","commit_id":"746dd7dd34659990cb238ba97401eda3913dae18"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"688b031e21e29a2fc77316642551a37cc944713b","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"To date kerberos has been supported by the \"external\" method"},{"line_number":10,"context_line":"name.  However, the Client plugin architecture needs to refer to the"},{"line_number":11,"context_line":"method name , and we do not want to expose to the client the"},{"line_number":12,"context_line":"difference between kerberos as performed by an external module or"},{"line_number":13,"context_line":"an eventual kerberos-in-eventlet style implementation."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"1ae5cdf2_dd8fb921","line":11,"updated":"2014-06-18 17:21:29.000000000","message":"... we do not want to expose the client to the ...","commit_id":"705302663dacc423f5ede440d474356fa5c4cf56"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9d41826d297849d304323f0525d384658ce5a486","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"To date kerberos has been supported by the \"external\" method"},{"line_number":10,"context_line":"name.  However, the Client plugin architecture needs to refer to the"},{"line_number":11,"context_line":"method name , and we do not want to expose to the client the"},{"line_number":12,"context_line":"difference between kerberos as performed by an external module or"},{"line_number":13,"context_line":"an eventual kerberos-in-eventlet style implementation."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"1ae5cdf2_4925cf08","line":11,"updated":"2014-06-18 03:10:43.000000000","message":"extra space here after name and before ,","commit_id":"705302663dacc423f5ede440d474356fa5c4cf56"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"5fcfb326399b8473ff31df1ad1643985a99a63d5","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"To date kerberos has been supported by the \"external\" method"},{"line_number":10,"context_line":"name.  However, the Client plugin architecture needs to refer to the"},{"line_number":11,"context_line":"method name , and we do not want to expose to the client the"},{"line_number":12,"context_line":"difference between kerberos as performed by an external module or"},{"line_number":13,"context_line":"an eventual kerberos-in-eventlet style implementation."},{"line_number":14,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"1ae5cdf2_c602850b","line":11,"in_reply_to":"1ae5cdf2_dd8fb921","updated":"2014-06-18 20:50:47.000000000","message":"Nope.   Reread it.  \"we do not want to expose to the client the difference ...\"","commit_id":"705302663dacc423f5ede440d474356fa5c4cf56"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"688b031e21e29a2fc77316642551a37cc944713b","unresolved":false,"context_lines":[{"line_number":13,"context_line":"an eventual kerberos-in-eventlet style implementation."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"If the \"external\" plugin is missing, the old code would throw an"},{"line_number":16,"context_line":"exception attempting to process \"REMOTE_USER\" behavior.  If only"},{"line_number":17,"context_line":"\u0027Kerberos\" is specified, this is checked and skipped."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Blueprint: kerberos-authentication"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"1ae5cdf2_9d8ff1cc","line":16,"updated":"2014-06-18 17:21:29.000000000","message":"It is a bit confusing until I read the code.  I would add to the beginning of the 2nd sentence, \"With the new code,...\"","commit_id":"705302663dacc423f5ede440d474356fa5c4cf56"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d5af7f3c2a3f04cca3f61cf99c09ee05933b42c6","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"If the \"external\" plugin is missing, the old code would throw an"},{"line_number":16,"context_line":"exception attempting to process \"REMOTE_USER\" behavior.  If only"},{"line_number":17,"context_line":"\u0027Kerberos\" is specified, this is checked and skipped."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Blueprint: kerberos-authentication"},{"line_number":20,"context_line":"SecurityImpact:  Minimal, as Kerberos is already used via external,"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":7,"id":"1ae5cdf2_346d2133","line":17,"updated":"2014-06-18 14:50:00.000000000","message":"Mismatched quotes.","commit_id":"705302663dacc423f5ede440d474356fa5c4cf56"}],"keystone/auth/controllers.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a3c0e94c1f5bb805e58c5f11d27e21b848441b11","unresolved":false,"context_lines":[{"line_number":411,"context_line":"        # user has been authenticated externally"},{"line_number":412,"context_line":"        if \u0027REMOTE_USER\u0027 in context[\u0027environment\u0027]:"},{"line_number":413,"context_line":"            external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":414,"context_line":"            if external is not None:"},{"line_number":415,"context_line":"                external.authenticate(context, auth_info, auth_context)"},{"line_number":416,"context_line":""},{"line_number":417,"context_line":"        # need to aggregate the results in case two or more methods"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_c1ca066e","line":414,"updated":"2014-05-29 21:43:59.000000000","message":"can a unit test be added for this? Stubbing out get_auth_method and verifying external.authenticate() isn\u0027t called.","commit_id":"62278b52718c1a284e9f13846d664fa6cc9680c0"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"95f791d1ed56bff4ccddc989cbdce9848e233d26","unresolved":false,"context_lines":[{"line_number":412,"context_line":"        if \u0027REMOTE_USER\u0027 in context[\u0027environment\u0027]:"},{"line_number":413,"context_line":"            external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":414,"context_line":"            if external is not None:"},{"line_number":415,"context_line":"                external.authenticate(context, auth_info, auth_context)"},{"line_number":416,"context_line":""},{"line_number":417,"context_line":"        # need to aggregate the results in case two or more methods"},{"line_number":418,"context_line":"        # are specified"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_e1762206","line":415,"updated":"2014-05-29 21:53:32.000000000","message":"This is broken:  get_auth_method throws an exception.  Instead, it needs to continue on.","commit_id":"62278b52718c1a284e9f13846d664fa6cc9680c0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b51d5ce4430c633e138698ae7beb830d51fcf46a","unresolved":false,"context_lines":[{"line_number":418,"context_line":"        # user has been authenticated externally"},{"line_number":419,"context_line":"        if \u0027REMOTE_USER\u0027 in context[\u0027environment\u0027]:"},{"line_number":420,"context_line":"            external \u003d get_auth_method(\u0027external\u0027, should_raise\u003dFalse)"},{"line_number":421,"context_line":"            if external is not None:"},{"line_number":422,"context_line":"                external.authenticate(context, auth_info, auth_context)"},{"line_number":423,"context_line":""},{"line_number":424,"context_line":"        # need to aggregate the results in case two or more methods"}],"source_content_type":"text/x-python","patch_set":3,"id":"1ae5cdf2_9ff8bcc4","line":421,"updated":"2014-06-04 02:55:36.000000000","message":"not sure if I understand this change, why would the \u0027external\u0027 method missing? How does this related to Kerberos method?","commit_id":"746dd7dd34659990cb238ba97401eda3913dae18"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9d41826d297849d304323f0525d384658ce5a486","unresolved":false,"context_lines":[{"line_number":453,"context_line":"    def authenticate(self, context, auth_info, auth_context):"},{"line_number":454,"context_line":"        \"\"\"Authenticate user.\"\"\""},{"line_number":455,"context_line":""},{"line_number":456,"context_line":"        # THe \u0027external\u0027 method allows any \u0027REMOTE_USER\u0027 based authentication"},{"line_number":457,"context_line":"        if \u0027REMOTE_USER\u0027 in context[\u0027environment\u0027]:"},{"line_number":458,"context_line":"            try:"},{"line_number":459,"context_line":"                external \u003d get_auth_method(\u0027external\u0027)"}],"source_content_type":"text/x-python","patch_set":7,"id":"1ae5cdf2_496cef36","line":456,"updated":"2014-06-18 03:10:43.000000000","message":"s/THe/The","commit_id":"705302663dacc423f5ede440d474356fa5c4cf56"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d5af7f3c2a3f04cca3f61cf99c09ee05933b42c6","unresolved":false,"context_lines":[{"line_number":455,"context_line":""},{"line_number":456,"context_line":"        # THe \u0027external\u0027 method allows any \u0027REMOTE_USER\u0027 based authentication"},{"line_number":457,"context_line":"        if \u0027REMOTE_USER\u0027 in context[\u0027environment\u0027]:"},{"line_number":458,"context_line":"            try:"},{"line_number":459,"context_line":"                external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":460,"context_line":"                external.authenticate(context, auth_info, auth_context)"},{"line_number":461,"context_line":"            except exception.AuthMethodNotSupported:"}],"source_content_type":"text/x-python","patch_set":7,"id":"1ae5cdf2_b74db374","line":458,"updated":"2014-06-18 14:50:00.000000000","message":"It\u0027s not clear to my why we are now catching this exception. The code itself doesn\u0027t look like it would change this behavior, so it must be the tests?\n\nThis is a behavior change and should probably have a new test to show why this is happening.","commit_id":"705302663dacc423f5ede440d474356fa5c4cf56"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"5fcfb326399b8473ff31df1ad1643985a99a63d5","unresolved":false,"context_lines":[{"line_number":455,"context_line":""},{"line_number":456,"context_line":"        # THe \u0027external\u0027 method allows any \u0027REMOTE_USER\u0027 based authentication"},{"line_number":457,"context_line":"        if \u0027REMOTE_USER\u0027 in context[\u0027environment\u0027]:"},{"line_number":458,"context_line":"            try:"},{"line_number":459,"context_line":"                external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":460,"context_line":"                external.authenticate(context, auth_info, auth_context)"},{"line_number":461,"context_line":"            except exception.AuthMethodNotSupported:"}],"source_content_type":"text/x-python","patch_set":7,"id":"1ae5cdf2_c6f8c54c","line":458,"in_reply_to":"1ae5cdf2_b74db374","updated":"2014-06-18 20:50:47.000000000","message":"If the method is \u0027kerberos\u0027 and there is no registered \u0027external\u0027 method, then the presense of \u0027REMOTE-USER\u0027 will trigger this excpetion.  For the \u0027kerberos\u0027 case, this is acceptable, and the exception can and should be ignored.  If both \u0027external and \u0027kerberos\u0027 are registered, for a \u0027kerberos\u0027 based authentication, the auth [plugin would be called twice.\n\nUpdated the comment to explain this better (I hope)","commit_id":"705302663dacc423f5ede440d474356fa5c4cf56"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"780e2a8dd84f78d20fc9868695c2e6d7c16fa78e","unresolved":false,"context_lines":[{"line_number":459,"context_line":"                external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":460,"context_line":"                external.authenticate(context, auth_info, auth_context)"},{"line_number":461,"context_line":"            except exception.AuthMethodNotSupported:"},{"line_number":462,"context_line":"                # This will happen i \u0027extermnal\u0027 is not set, but the container"},{"line_number":463,"context_line":"                # is performing authentication.  The \u0027kerberos\u0027  and \u0027saml\u0027"},{"line_number":464,"context_line":"                # methods will be used this way, as it will prevent double"},{"line_number":465,"context_line":"                # checking the identity backend."}],"source_content_type":"text/x-python","patch_set":7,"id":"1ae5cdf2_0982e7ff","line":462,"updated":"2014-06-18 02:57:32.000000000","message":"This will happen as \"external\" is not set,","commit_id":"705302663dacc423f5ede440d474356fa5c4cf56"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9d41826d297849d304323f0525d384658ce5a486","unresolved":false,"context_lines":[{"line_number":459,"context_line":"                external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":460,"context_line":"                external.authenticate(context, auth_info, auth_context)"},{"line_number":461,"context_line":"            except exception.AuthMethodNotSupported:"},{"line_number":462,"context_line":"                # This will happen i \u0027extermnal\u0027 is not set, but the container"},{"line_number":463,"context_line":"                # is performing authentication.  The \u0027kerberos\u0027  and \u0027saml\u0027"},{"line_number":464,"context_line":"                # methods will be used this way, as it will prevent double"},{"line_number":465,"context_line":"                # checking the identity backend."}],"source_content_type":"text/x-python","patch_set":7,"id":"1ae5cdf2_e914dba0","line":462,"updated":"2014-06-18 03:10:43.000000000","message":"s/i/if\n\ns/extermnal/external","commit_id":"705302663dacc423f5ede440d474356fa5c4cf56"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9c40698a0ca1dbfc3ff8306a750450f16dc1a936","unresolved":false,"context_lines":[{"line_number":459,"context_line":"                external \u003d get_auth_method(\u0027external\u0027)"},{"line_number":460,"context_line":"                external.authenticate(context, auth_info, auth_context)"},{"line_number":461,"context_line":"            except exception.AuthMethodNotSupported:"},{"line_number":462,"context_line":"                # This will happen there is no \u0027external\u0027 plugin registered"},{"line_number":463,"context_line":"                # and the container is performing authentication."},{"line_number":464,"context_line":"                # The \u0027kerberos\u0027  and \u0027saml\u0027 methods will be used this way."},{"line_number":465,"context_line":"                # In those cases, it is correct to not register an"}],"source_content_type":"text/x-python","patch_set":8,"id":"1ae5cdf2_8303e60e","line":462,"updated":"2014-06-19 18:19:10.000000000","message":"nit: will happen *if* there is no ...","commit_id":"66108d55c8d8cda9d5e7710e6d3c1bbab064dae2"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9c40698a0ca1dbfc3ff8306a750450f16dc1a936","unresolved":false,"context_lines":[{"line_number":461,"context_line":"            except exception.AuthMethodNotSupported:"},{"line_number":462,"context_line":"                # This will happen there is no \u0027external\u0027 plugin registered"},{"line_number":463,"context_line":"                # and the container is performing authentication."},{"line_number":464,"context_line":"                # The \u0027kerberos\u0027  and \u0027saml\u0027 methods will be used this way."},{"line_number":465,"context_line":"                # In those cases, it is correct to not register an"},{"line_number":466,"context_line":"                # \u0027external\u0027 plugin;  if there is both an \u0027external\u0027 and a"},{"line_number":467,"context_line":"                # \u0027kerberos\u0027 plugin, it would run the check on identity twice."}],"source_content_type":"text/x-python","patch_set":8,"id":"1ae5cdf2_260a2020","line":464,"updated":"2014-06-19 18:19:10.000000000","message":"nit: double space","commit_id":"66108d55c8d8cda9d5e7710e6d3c1bbab064dae2"}],"keystone/tests/test_v3_auth.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9d41826d297849d304323f0525d384658ce5a486","unresolved":false,"context_lines":[{"line_number":1534,"context_line":"        remote_user \u003d self.user[\u0027name\u0027]"},{"line_number":1535,"context_line":"        remote_domain \u003d self.domain[\u0027name\u0027]"},{"line_number":1536,"context_line":"        context, auth_info, auth_context \u003d self.build_external_auth_request("},{"line_number":1537,"context_line":"            remote_user, remote_domain\u003dremote_domain, kerberos\u003dself.kerberos)"},{"line_number":1538,"context_line":""},{"line_number":1539,"context_line":"        api.authenticate(context, auth_info, auth_context)"},{"line_number":1540,"context_line":"        self.assertEqual(auth_context[\u0027user_id\u0027], self.user[\u0027id\u0027])"}],"source_content_type":"text/x-python","patch_set":7,"id":"1ae5cdf2_c9c63f16","line":1537,"updated":"2014-06-18 03:10:43.000000000","message":"since build_external_auth_request is already defaulting kerberos to False, you don\u0027t need to set it at line 1525, or supply it here, or any of the other 3 tests below.\n\n*edit* never mind, i see what you did, a bit funky.","commit_id":"705302663dacc423f5ede440d474356fa5c4cf56"}]}