)]}'
{"id":"openstack%2Fpython-keystoneclient~106890","triplet_id":"openstack%2Fpython-keystoneclient~master~Ifeca3056b8552d4b78845e97ddc25f00c49950de","project":"openstack/python-keystoneclient","branch":"master","topic":"less_token_exposure-patch7","hashtags":[],"change_id":"Ifeca3056b8552d4b78845e97ddc25f00c49950de","subject":"Do not expose Token IDs in debug output","status":"ABANDONED","created":"2014-07-14 22:56:51.000000000","updated":"2014-07-28 20:07:04.000000000","total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"ed23661ea08fcc9ec826d3c20a3dcf1229985abb","_number":106890,"virtual_id_number":106890,"owner":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"all":[{"value":1,"date":"2014-07-15 01:30:05.000000000","_account_id":3,"name":"Jenkins","username":"jenkins"},{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"rejected":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"all":[{"_account_id":3,"name":"Jenkins","username":"jenkins"},{"value":-1,"date":"2014-07-15 00:30:22.000000000","permitted_voting_range":{"min":-1,"max":0},"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":3,"name":"Jenkins","username":"jenkins"},{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2014-07-15 00:08:53.000000000","updated_by":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"reviewer":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"state":"REVIEWER"},{"updated":"2014-07-15 01:30:05.000000000","updated_by":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"reviewer":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"state":"REVIEWER"}],"messages":[{"id":"7398493edfc3159cee4afe8e74fb50948e5cc356","author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"date":"2014-07-14 22:56:51.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"eaa8de2c45b00a96c4e9d5d0a3618a40f69909a6","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2014-07-14 22:56:52.000000000","message":"Patch Set 1:\n\nStarting check jobs.\nhttp://status.openstack.org/zuul/","accounts_in_message":[],"_revision_number":1},{"id":"f6ecbdb5d8fb694474812642c3f9a35969dde772","author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"date":"2014-07-14 22:57:03.000000000","message":"Patch Set 1: Workflow-1","accounts_in_message":[],"_revision_number":1},{"id":"38d3295b50564307ab493a3d458c07fdb2e8a8c9","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2014-07-14 23:58:46.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed.  For information on how to proceed, see https://wiki.openstack.org/wiki/GerritJenkinsGit#Test_Failures\n\n- gate-python-keystoneclient-pep8 http://logs.openstack.org/90/106890/1/check/gate-python-keystoneclient-pep8/34ee39f : FAILURE in 1m 23s\n- gate-python-keystoneclient-docs http://docs-draft.openstack.org/90/106890/1/check/gate-python-keystoneclient-docs/b8158c2/doc/build/html/ : SUCCESS in 2m 00s\n- gate-python-keystoneclient-python26 http://logs.openstack.org/90/106890/1/check/gate-python-keystoneclient-python26/eb9e467 : SUCCESS in 1m 44s\n- gate-python-keystoneclient-python27 http://logs.openstack.org/90/106890/1/check/gate-python-keystoneclient-python27/46eab6e : SUCCESS in 1m 29s\n- check-tempest-dsvm-full http://logs.openstack.org/90/106890/1/check/check-tempest-dsvm-full/4105543 : SUCCESS in 33m 43s\n- check-tempest-dsvm-postgres-full http://logs.openstack.org/90/106890/1/check/check-tempest-dsvm-postgres-full/9bb1b05 : SUCCESS in 36m 05s\n- check-tempest-dsvm-neutron http://logs.openstack.org/90/106890/1/check/check-tempest-dsvm-neutron/5653bce : SUCCESS in 53m 07s\n- check-tempest-dsvm-neutron-heat-slow http://logs.openstack.org/90/106890/1/check/check-tempest-dsvm-neutron-heat-slow/c9be11d : SUCCESS in 22m 40s\n- check-grenade-dsvm http://logs.openstack.org/90/106890/1/check/check-grenade-dsvm/ec65062 : SUCCESS in 32m 17s\n- check-tempest-dsvm-full-havana http://logs.openstack.org/90/106890/1/check/check-tempest-dsvm-full-havana/1137f27 : SUCCESS in 31m 52s (non-voting)\n- check-tempest-dsvm-neutron-havana http://logs.openstack.org/90/106890/1/check/check-tempest-dsvm-neutron-havana/65af8c5 : SUCCESS in 37m 30s (non-voting)\n- check-tempest-dsvm-full-icehouse http://logs.openstack.org/90/106890/1/check/check-tempest-dsvm-full-icehouse/d39dd0b : SUCCESS in 1h 01m 46s\n- check-tempest-dsvm-neutron-icehouse http://logs.openstack.org/90/106890/1/check/check-tempest-dsvm-neutron-icehouse/c5ba5f9 : SUCCESS in 1h 00m 58s\n- gate-python-keystoneclient-python33 http://logs.openstack.org/90/106890/1/check/gate-python-keystoneclient-python33/1436b41 : SUCCESS in 2m 51s\n- check-devstack-dsvm-cells http://logs.openstack.org/90/106890/1/check/check-devstack-dsvm-cells/8650bc4 : SUCCESS in 15m 40s\n- gate-tempest-dsvm-large-ops http://logs.openstack.org/90/106890/1/check/gate-tempest-dsvm-large-ops/cc00966 : SUCCESS in 23m 03s\n- gate-tempest-dsvm-neutron-large-ops http://logs.openstack.org/90/106890/1/check/gate-tempest-dsvm-neutron-large-ops/9fa1166 : SUCCESS in 26m 46s","accounts_in_message":[],"_revision_number":1},{"id":"e2988767eda826f2c2b9528dc5aeb3de533728aa","author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"date":"2014-07-15 00:08:53.000000000","message":"Patch Set 1: Code-Review-1\n\n(1 comment)\n\nminor comment","accounts_in_message":[],"_revision_number":1},{"id":"7e590ed4f3dadc9aad0422e9ac17b81a5e7209c9","author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"date":"2014-07-15 00:29:24.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"b94f1c65e2815b50cdf677376d53cdc04c77ca99","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2014-07-15 00:29:38.000000000","message":"Patch Set 2:\n\nStarting check jobs.\nhttp://status.openstack.org/zuul/","accounts_in_message":[],"_revision_number":2},{"id":"f9a8cb6479a30f8862b6b3ef826d43efc89862ae","author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"date":"2014-07-15 00:30:22.000000000","message":"Patch Set 2: Workflow-1\n\nposting wip","accounts_in_message":[],"_revision_number":2},{"id":"6a1e78fa82f671e6de3c5378e277d31ab0a24c1d","author":{"_account_id":3,"name":"Jenkins","username":"jenkins"},"date":"2014-07-15 01:30:05.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded.\n\n- gate-python-keystoneclient-pep8 http://logs.openstack.org/90/106890/2/check/gate-python-keystoneclient-pep8/e5ac32e : SUCCESS in 1m 29s\n- gate-python-keystoneclient-docs http://docs-draft.openstack.org/90/106890/2/check/gate-python-keystoneclient-docs/bfa0332/doc/build/html/ : SUCCESS in 2m 13s\n- gate-python-keystoneclient-python26 http://logs.openstack.org/90/106890/2/check/gate-python-keystoneclient-python26/3f5b8a5 : SUCCESS in 1m 14s\n- gate-python-keystoneclient-python27 http://logs.openstack.org/90/106890/2/check/gate-python-keystoneclient-python27/975021a : SUCCESS in 1m 22s\n- check-tempest-dsvm-full http://logs.openstack.org/90/106890/2/check/check-tempest-dsvm-full/dfcc09f : SUCCESS in 37m 20s\n- check-tempest-dsvm-postgres-full http://logs.openstack.org/90/106890/2/check/check-tempest-dsvm-postgres-full/51c5ec0 : SUCCESS in 38m 10s\n- check-tempest-dsvm-neutron http://logs.openstack.org/90/106890/2/check/check-tempest-dsvm-neutron/c19a685 : SUCCESS in 47m 10s\n- check-tempest-dsvm-neutron-heat-slow http://logs.openstack.org/90/106890/2/check/check-tempest-dsvm-neutron-heat-slow/a7c4c11 : SUCCESS in 18m 45s\n- check-grenade-dsvm http://logs.openstack.org/90/106890/2/check/check-grenade-dsvm/227be3c : SUCCESS in 47m 25s\n- check-tempest-dsvm-full-havana http://logs.openstack.org/90/106890/2/check/check-tempest-dsvm-full-havana/f21d5ec : SUCCESS in 33m 41s (non-voting)\n- check-tempest-dsvm-neutron-havana http://logs.openstack.org/90/106890/2/check/check-tempest-dsvm-neutron-havana/6bebdc0 : SUCCESS in 40m 12s (non-voting)\n- check-tempest-dsvm-full-icehouse http://logs.openstack.org/90/106890/2/check/check-tempest-dsvm-full-icehouse/9492ef0 : SUCCESS in 50m 41s\n- check-tempest-dsvm-neutron-icehouse http://logs.openstack.org/90/106890/2/check/check-tempest-dsvm-neutron-icehouse/c9f25f6 : SUCCESS in 1h 00m 19s\n- gate-python-keystoneclient-python33 http://logs.openstack.org/90/106890/2/check/gate-python-keystoneclient-python33/3558935 : SUCCESS in 2m 43s\n- check-devstack-dsvm-cells http://logs.openstack.org/90/106890/2/check/check-devstack-dsvm-cells/744656c : SUCCESS in 20m 42s\n- gate-tempest-dsvm-large-ops http://logs.openstack.org/90/106890/2/check/gate-tempest-dsvm-large-ops/2aded60 : SUCCESS in 18m 46s\n- gate-tempest-dsvm-neutron-large-ops http://logs.openstack.org/90/106890/2/check/gate-tempest-dsvm-neutron-large-ops/0f5cc5e : SUCCESS in 26m 25s","accounts_in_message":[],"_revision_number":2},{"id":"b3f417bd01e8859e3a01e8eae47be6faf58c07d0","author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"date":"2014-07-28 20:07:04.000000000","message":"Abandoned","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"b7a34b2a155f2bf719df8001b2f69dee26e77d92","revisions":{"f39399276762369fd232b28a7bd5a42a999a00ff":{"kind":"REWORK","_number":1,"created":"2014-07-14 22:56:51.000000000","uploader":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"ref":"refs/changes/90/106890/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/python-keystoneclient","ref":"refs/changes/90/106890/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/python-keystoneclient refs/changes/90/106890/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/python-keystoneclient refs/changes/90/106890/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/python-keystoneclient refs/changes/90/106890/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/python-keystoneclient refs/changes/90/106890/1"}}},"commit":{"parents":[{"commit":"dd5260b3deebeb32d31fb3a3c31d3a6604ef29e5","subject":"Merge \"Add invalidate doc string to identity plugin\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-keystoneclient/commit/dd5260b3deebeb32d31fb3a3c31d3a6604ef29e5"}]}],"author":{"name":"Brant Knudson","email":"bknudson@us.ibm.com","date":"2014-07-14 22:08:07.000000000","tz":-300},"committer":{"name":"Brant Knudson","email":"bknudson@us.ibm.com","date":"2014-07-14 22:56:33.000000000","tz":-300},"subject":"Do not expose Token IDs in debug output","message":"Do not expose Token IDs in debug output\n\nIt is only very slightly less of a security issue to expose\nToken IDs in the logs than it is to expose password details. This\nchange obscures the Token ID in the debug output in all cases to\nensure that the ID is not presented in any of the logs that could\nbe read by a unprivileged source (e.g. lower priv log watchers,\ncentralized logging, etc).\n\nThe main use case is to ensure that it is possible to correlate a\ntoken to the various requests made. In some cases this has shown\nwhere a token has expired (tokens weren\u0027t properly refreshed).\nThis use case for debugging eliminates simple redaction of the\ntoken id from the logs.\n\nSHA1 is no longer allowed as a hashing mode for CMS token hashing.\nThis is because SHA1 is being used to obscure tokens in the\nsession object debug. This is done to  prevent the debug output\nfrom being potentially exposing a valid token (PKI-\u003esha1-short-id)\nin some configurations of Keystone / auth_token middleware.\n\nThe raw data elements from the token (e.g. user, roles, expiration\netc) could be added into debug/trace level logging at a future time.\n\nSecurityImpact\n\nChange-Id: Ifeca3056b8552d4b78845e97ddc25f00c49950de\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-keystoneclient/commit/f39399276762369fd232b28a7bd5a42a999a00ff"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-keystoneclient/commit/f39399276762369fd232b28a7bd5a42a999a00ff"}]},"branch":"refs/heads/master"},"b7a34b2a155f2bf719df8001b2f69dee26e77d92":{"kind":"REWORK","_number":2,"created":"2014-07-15 00:29:24.000000000","uploader":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"ref":"refs/changes/90/106890/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/python-keystoneclient","ref":"refs/changes/90/106890/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/python-keystoneclient refs/changes/90/106890/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/python-keystoneclient refs/changes/90/106890/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/python-keystoneclient refs/changes/90/106890/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/python-keystoneclient refs/changes/90/106890/2"}}},"commit":{"parents":[{"commit":"0068a4e448a3c37d81bbfcc127ba214f809718d5","subject":"Merge \"Provide an __all__ for auth module\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-keystoneclient/commit/0068a4e448a3c37d81bbfcc127ba214f809718d5"}]}],"author":{"name":"Brant Knudson","email":"bknudson@us.ibm.com","date":"2014-07-14 22:08:07.000000000","tz":-300},"committer":{"name":"Brant Knudson","email":"bknudson@us.ibm.com","date":"2014-07-15 00:29:20.000000000","tz":-300},"subject":"Do not expose Token IDs in debug output","message":"Do not expose Token IDs in debug output\n\nIt is only very slightly less of a security issue to expose\nToken IDs in the logs than it is to expose password details. This\nchange obscures the Token ID in the debug output in all cases to\nensure that the ID is not presented in any of the logs that could\nbe read by a unprivileged source (e.g. lower priv log watchers,\ncentralized logging, etc).\n\nThe main use case is to ensure that it is possible to correlate a\ntoken to the various requests made. In some cases this has shown\nwhere a token has expired (tokens weren\u0027t properly refreshed).\nThis use case for debugging eliminates simple redaction of the\ntoken id from the logs.\n\nSHA1 is no longer allowed as a hashing mode for CMS token hashing.\nThis is because SHA1 is being used to obscure tokens in the\nsession object debug. This is done to  prevent the debug output\nfrom being potentially exposing a valid token (PKI-\u003esha1-short-id)\nin some configurations of Keystone / auth_token middleware.\n\nThe raw data elements from the token (e.g. user, roles, expiration\netc) could be added into debug/trace level logging at a future time.\n\nSecurityImpact\n\nChange-Id: Ifeca3056b8552d4b78845e97ddc25f00c49950de\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-keystoneclient/commit/b7a34b2a155f2bf719df8001b2f69dee26e77d92"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/python-keystoneclient/commit/b7a34b2a155f2bf719df8001b2f69dee26e77d92"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}