)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e8736678ef063dfe3e516725423876ba917e76a3","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Brad P. Crochet \u003cbrad@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2017-05-04 16:34:57 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Support transition to proper keystone v3"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The puppet module puppet-mistral is moving to use a proper keystone"},{"line_number":10,"context_line":"authtoken module. This supports that transition. A follow on patch"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"3f044301_bd6cb408","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":40},"updated":"2017-05-04 20:59:35.000000000","message":"This probably hasn\u0027t anything to do with v3. In the patch plugin-based options are used. Commit title should be something like\n\n Support transition to auth plugins","commit_id":"9eacb5f5d3f0b2a353944e7b27a0d6695e4f01f8"},{"author":{"_account_id":7065,"name":"Brad P. Crochet","email":"brad@redhat.com","username":"bcrochet"},"change_message_id":"0933501276bd4d42651380c2c9171ad1568788db","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Brad P. Crochet \u003cbrad@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2017-05-04 16:34:57 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Support transition to proper keystone v3"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"The puppet module puppet-mistral is moving to use a proper keystone"},{"line_number":10,"context_line":"authtoken module. This supports that transition. A follow on patch"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"3f044301_40fdc738","line":7,"in_reply_to":"3f044301_bd6cb408","updated":"2017-05-04 21:36:11.000000000","message":"Good feedback. Thanks.","commit_id":"9eacb5f5d3f0b2a353944e7b27a0d6695e4f01f8"}],"mistral/context.py":[{"author":{"_account_id":10873,"name":"Juan Antonio Osorio Robles","email":"jaosorior@redhat.com","username":"ejuaoso"},"change_message_id":"425452295ba3f05a10457991e31219bc27ca1c37","unresolved":false,"context_lines":[{"line_number":214,"context_line":"        CONF.keystone_authtoken.admin_password)"},{"line_number":215,"context_line":"    tenant_name \u003d ("},{"line_number":216,"context_line":"        CONF.keystone_authtoken.project_name or"},{"line_number":217,"context_line":"        CONF.keystone_authtoken.admin_tenant_name)"},{"line_number":218,"context_line":"    keystone \u003d keystone_client.Client("},{"line_number":219,"context_line":"        username\u003dusername,"},{"line_number":220,"context_line":"        password\u003dpassword,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f044301_2e54fec9","line":217,"updated":"2017-05-04 13:43:37.000000000","message":"what about the user and project domain?","commit_id":"3ff9000cc4c7cd640fd542fdc2bbf5d9d0a38c59"},{"author":{"_account_id":7065,"name":"Brad P. Crochet","email":"brad@redhat.com","username":"bcrochet"},"change_message_id":"954cf1889fe17103e948486b425cda4b6f4c2190","unresolved":false,"context_lines":[{"line_number":214,"context_line":"        CONF.keystone_authtoken.admin_password)"},{"line_number":215,"context_line":"    tenant_name \u003d ("},{"line_number":216,"context_line":"        CONF.keystone_authtoken.project_name or"},{"line_number":217,"context_line":"        CONF.keystone_authtoken.admin_tenant_name)"},{"line_number":218,"context_line":"    keystone \u003d keystone_client.Client("},{"line_number":219,"context_line":"        username\u003dusername,"},{"line_number":220,"context_line":"        password\u003dpassword,"}],"source_content_type":"text/x-python","patch_set":2,"id":"3f044301_498504ad","line":217,"in_reply_to":"3f044301_2e54fec9","updated":"2017-05-04 14:43:51.000000000","message":"Done","commit_id":"3ff9000cc4c7cd640fd542fdc2bbf5d9d0a38c59"}],"mistral/services/security.py":[{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"e8736678ef063dfe3e516725423876ba917e76a3","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    ctx \u003d auth_ctx.ctx()"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    tenant_name \u003d ("},{"line_number":44,"context_line":"        CONF.keystone_authtoken.project_name or"},{"line_number":45,"context_line":"        CONF.keystone_authtoken.admin_tenant_name)"},{"line_number":46,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3f044301_9dd578bc","line":43,"range":{"start_line":43,"start_character":4,"end_line":43,"end_character":15},"updated":"2017-05-04 20:59:35.000000000","message":"it should be project_name","commit_id":"9eacb5f5d3f0b2a353944e7b27a0d6695e4f01f8"},{"author":{"_account_id":7065,"name":"Brad P. Crochet","email":"brad@redhat.com","username":"bcrochet"},"change_message_id":"0933501276bd4d42651380c2c9171ad1568788db","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    ctx \u003d auth_ctx.ctx()"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"    tenant_name \u003d ("},{"line_number":44,"context_line":"        CONF.keystone_authtoken.project_name or"},{"line_number":45,"context_line":"        CONF.keystone_authtoken.admin_tenant_name)"},{"line_number":46,"context_line":""}],"source_content_type":"text/x-python","patch_set":5,"id":"3f044301_20fabb41","line":43,"in_reply_to":"3f044301_9dd578bc","updated":"2017-05-04 21:36:11.000000000","message":"Done","commit_id":"9eacb5f5d3f0b2a353944e7b27a0d6695e4f01f8"}],"mistral/utils/openstack/keystone.py":[{"author":{"_account_id":8731,"name":"Renat Akhmerov","email":"renat.akhmerov@gmail.com","username":"rakhmerov"},"change_message_id":"8342a47e19ed7339da840f4bc361e51fd06327c3","unresolved":false,"context_lines":[{"line_number":47,"context_line":"def _admin_client(trust_id\u003dNone, project_name\u003dNone):"},{"line_number":48,"context_line":"    auth_url \u003d CONF.keystone_authtoken.auth_uri"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    username \u003d ("},{"line_number":51,"context_line":"        CONF.keystone_authtoken.admin_user or"},{"line_number":52,"context_line":"        CONF.keystone_authtoken.username)"},{"line_number":53,"context_line":"    password \u003d ("},{"line_number":54,"context_line":"        CONF.keystone_authtoken.admin_password or"},{"line_number":55,"context_line":"        CONF.keystone_authtoken.password)"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    cl \u003d ks_client.Client("},{"line_number":58,"context_line":"        username\u003dusername,"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f044301_a676dc05","line":55,"range":{"start_line":50,"start_character":4,"end_line":55,"end_character":41},"updated":"2017-05-05 06:50:59.000000000","message":"Sorry if I\u0027m asking something stupid, just don\u0027t have enough expertise in Keystone..\n\nCan you provide some details on why you\u0027re making these changes? It seems weird at first glance that a method called \"_admin_client\" can use non-admin credentials.\n\nI have pretty much the same confusion about changes in other modules too.","commit_id":"1c485867c456df32cf0401a47d177b2478a51313"},{"author":{"_account_id":8731,"name":"Renat Akhmerov","email":"renat.akhmerov@gmail.com","username":"rakhmerov"},"change_message_id":"b68f8f9803950e3a9327d4a8bfc56b9581a4f6d8","unresolved":false,"context_lines":[{"line_number":47,"context_line":"def _admin_client(trust_id\u003dNone, project_name\u003dNone):"},{"line_number":48,"context_line":"    auth_url \u003d CONF.keystone_authtoken.auth_uri"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    username \u003d ("},{"line_number":51,"context_line":"        CONF.keystone_authtoken.admin_user or"},{"line_number":52,"context_line":"        CONF.keystone_authtoken.username)"},{"line_number":53,"context_line":"    password \u003d ("},{"line_number":54,"context_line":"        CONF.keystone_authtoken.admin_password or"},{"line_number":55,"context_line":"        CONF.keystone_authtoken.password)"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    cl \u003d ks_client.Client("},{"line_number":58,"context_line":"        username\u003dusername,"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f044301_ec5f253f","line":55,"range":{"start_line":50,"start_character":4,"end_line":55,"end_character":41},"in_reply_to":"3f044301_6131de0b","updated":"2017-05-05 08:27:16.000000000","message":"Yes, thanks Boris. This is a comprehensive explanation.\n\nBtw, we already have a client-side patch that makes an attempt to use keystoneauth1, not sure if everything is fine with it yet (it doesn\u0027t pass tests). https://review.openstack.org/#/c/455174/25","commit_id":"1c485867c456df32cf0401a47d177b2478a51313"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"4af712f312cae9cb156f7c5ea35d0567f8ccf11b","unresolved":false,"context_lines":[{"line_number":47,"context_line":"def _admin_client(trust_id\u003dNone, project_name\u003dNone):"},{"line_number":48,"context_line":"    auth_url \u003d CONF.keystone_authtoken.auth_uri"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"    username \u003d ("},{"line_number":51,"context_line":"        CONF.keystone_authtoken.admin_user or"},{"line_number":52,"context_line":"        CONF.keystone_authtoken.username)"},{"line_number":53,"context_line":"    password \u003d ("},{"line_number":54,"context_line":"        CONF.keystone_authtoken.admin_password or"},{"line_number":55,"context_line":"        CONF.keystone_authtoken.password)"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"    cl \u003d ks_client.Client("},{"line_number":58,"context_line":"        username\u003dusername,"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f044301_6131de0b","line":55,"range":{"start_line":50,"start_character":4,"end_line":55,"end_character":41},"in_reply_to":"3f044301_a676dc05","updated":"2017-05-05 07:46:10.000000000","message":"In times of identity api v2 there were admins and tenant members. All tenant members were equal. Service users were admins and could use the admin API.\n\nNow there is no admin API, we have RBAC today. Service users, the ones used when a service needs to talk to a service, are simple users. They just have role \"admin\" in... some project. (we don\u0027t really like it and want to get rid of it). _admin_client is probably legacy stuff that needs to be fixed/renamed.\n\nNow about why this change is needed.\n\nBack in the days keystonemiddleware (and other components) had an agreement to use `admin_user` and `admin_password` as credentials for service users. But new authentication methods were appearing, such as x.509 certs. To accommodate growing list of options, we switched to auth plugins, which define their options by themselves. `password` auth plugin defines options `username` and `password` (and several other) and we just use them. Old options, `admin_user` and `admin_password`, are still maintain for compatibility and might be removed.\n\nThis change just uses these new options, because puppets have switched to setting them instead of `admin_*`. Next steps here would be to switch to using auth plugins too. Here is how nova does it: https://git.openstack.org/cgit/openstack/nova/tree/nova/service_auth.py?id\u003dae637e70a72166067e09f3bbc3acb54e5d92771e","commit_id":"1c485867c456df32cf0401a47d177b2478a51313"}]}