)]}'
{"examples/pki/cms/auth_v3_token_revoked.json":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"9a5ca69fa217afbc07a75fbe900e4573f3287512","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{\"token\": "},{"line_number":2,"context_line":"\t{\"catalog\": [{\"endpoints\": [{\"adminURL\": \"http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a\", \"region\": \"regionOne\", \"internalURL\": \"http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a\", \"publicURL\": \"http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a\"}], \"endpoints_links\": [], \"type\": \"volume\", \"name\": \"volume\"},"},{"line_number":3,"context_line":"\t\t\t     {\"endpoints\": [{\"adminURL\": \"http://127.0.0.1:9292/v1\", \"region\": \"regionOne\", \"internalURL\": \"http://127.0.0.1:9292/v1\", \"publicURL\": \"http://127.0.0.1:9292/v1\"}], \"endpoints_links\": [], \"type\": \"image\", \"name\": \"glance\"},"},{"line_number":4,"context_line":"\t\t\t     {\"endpoints\": [{\"adminURL\": \"http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a\", \"region\": \"regionOne\", \"internalURL\": \"http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a\", \"publicURL\": \"http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a\"}], \"endpoints_links\": [], \"type\": \"compute\", \"name\": \"nova\"},"}],"source_content_type":"application/json","patch_set":2,"id":"AAAAN3%2F%2F%2BbE%3D","line":1,"updated":"2013-03-05 01:09:12.000000000","message":"tabs to spaces","commit_id":"93188b517be2e930ff6ee26d7d6bd74fb42950a7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9076ba4fad7a7c7f3f0f9bf0bf4ff39f919ecebf","unresolved":false,"context_lines":[{"line_number":1,"context_line":"{\"token\": "},{"line_number":2,"context_line":"\t{\"catalog\": [{\"endpoints\": [{\"adminURL\": \"http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a\", \"region\": \"regionOne\", \"internalURL\": \"http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a\", \"publicURL\": \"http://127.0.0.1:8776/v1/64b6f3fbcc53435e8a60fcf89bb6617a\"}], \"endpoints_links\": [], \"type\": \"volume\", \"name\": \"volume\"},"},{"line_number":3,"context_line":"\t\t\t     {\"endpoints\": [{\"adminURL\": \"http://127.0.0.1:9292/v1\", \"region\": \"regionOne\", \"internalURL\": \"http://127.0.0.1:9292/v1\", \"publicURL\": \"http://127.0.0.1:9292/v1\"}], \"endpoints_links\": [], \"type\": \"image\", \"name\": \"glance\"},"},{"line_number":4,"context_line":"\t\t\t     {\"endpoints\": [{\"adminURL\": \"http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a\", \"region\": \"regionOne\", \"internalURL\": \"http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a\", \"publicURL\": \"http://127.0.0.1:8774/v1.1/64b6f3fbcc53435e8a60fcf89bb6617a\"}], \"endpoints_links\": [], \"type\": \"compute\", \"name\": \"nova\"},"}],"source_content_type":"application/json","patch_set":2,"id":"AAAAN3%2F%2F4uk%3D","line":1,"in_reply_to":"AAAAN3%2F%2F%2BbE%3D","updated":"2013-03-07 16:44:46.000000000","message":"Done","commit_id":"93188b517be2e930ff6ee26d7d6bd74fb42950a7"}],"keystoneclient/middleware/auth_token.py":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"70a80184aadd22bd309b2bd6d07c1160aa027c02","unresolved":false,"context_lines":[{"line_number":61,"context_line":"    The underlying service will only see a value of \u0027Invalid\u0027 if the Middleware"},{"line_number":62,"context_line":"    is configured to run in \u0027delay_auth_decision\u0027 mode"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"HTTP_X_DOMAIN_ID"},{"line_number":65,"context_line":"    Identity service managed unique identifier, string"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"HTTP_X_DOMAIN_NAME"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FuY%3D","line":64,"updated":"2013-03-04 06:34:29.000000000","message":"What is this for? I thought domain-scoped tokens can\u0027t be used to access services other than Keystone.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"5049fa461b93391b7532ae5f3fd04e36b2492227","unresolved":false,"context_lines":[{"line_number":61,"context_line":"    The underlying service will only see a value of \u0027Invalid\u0027 if the Middleware"},{"line_number":62,"context_line":"    is configured to run in \u0027delay_auth_decision\u0027 mode"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"HTTP_X_DOMAIN_ID"},{"line_number":65,"context_line":"    Identity service managed unique identifier, string"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"HTTP_X_DOMAIN_NAME"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FPQ%3D","line":64,"in_reply_to":"AAAAN3%2F%2F%2FZc%3D","updated":"2013-03-04 15:48:12.000000000","message":"There\u0027s no reason to suppress domain data from services that want to consume domain-scoped tokens.\n\nIt should be clear though from these docs that these attributes will not be provided for project-scoped or unscoped tokens.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b5db850184a4b2a6594a030932d92e77df02fe56","unresolved":false,"context_lines":[{"line_number":61,"context_line":"    The underlying service will only see a value of \u0027Invalid\u0027 if the Middleware"},{"line_number":62,"context_line":"    is configured to run in \u0027delay_auth_decision\u0027 mode"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"HTTP_X_DOMAIN_ID"},{"line_number":65,"context_line":"    Identity service managed unique identifier, string"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"HTTP_X_DOMAIN_NAME"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FZc%3D","line":64,"in_reply_to":"AAAAN3%2F%2F%2FuY%3D","updated":"2013-03-04 14:10:26.000000000","message":"So today no other services does...but I can imagine that some will in the further (e.g. glance having a domain-wide image, or nova\u0027s availability zones for dividing h/w up at the domain level) - I think we discussed this as part of the original domain-scoping blueprint.  So this is preparation for this - but of course, since no other services will ask for a domain token yet, this change is benign.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"70a80184aadd22bd309b2bd6d07c1160aa027c02","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    Identity service managed unique identifier, string"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"HTTP_X_DOMAIN_NAME"},{"line_number":68,"context_line":"    Unique domain name, string"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"HTTP_X_PROJECT_ID"},{"line_number":71,"context_line":"    Identity service managed unique identifier, string"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FuU%3D","line":68,"updated":"2013-03-04 06:34:29.000000000","message":"Same as above.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b5db850184a4b2a6594a030932d92e77df02fe56","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    Identity service managed unique identifier, string"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"HTTP_X_DOMAIN_NAME"},{"line_number":68,"context_line":"    Unique domain name, string"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"HTTP_X_PROJECT_ID"},{"line_number":71,"context_line":"    Identity service managed unique identifier, string"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FZY%3D","line":68,"in_reply_to":"AAAAN3%2F%2F%2FuU%3D","updated":"2013-03-04 14:10:26.000000000","message":"same","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"5049fa461b93391b7532ae5f3fd04e36b2492227","unresolved":false,"context_lines":[{"line_number":71,"context_line":"    Identity service managed unique identifier, string"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"HTTP_X_PROJECT_NAME"},{"line_number":74,"context_line":"    Project name, unique within owning domain, string"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"HTTP_X_PROJECT_DOMAIN_ID"},{"line_number":77,"context_line":"    Identity service managed unique identifier of owning domain of"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FO0%3D","line":74,"updated":"2013-03-04 15:48:12.000000000","message":"the docs for project id / name need to be revised to note that they may not be provided, in the case of domain-scoped tokens","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9686786738f5aa4e7e257b0b91f53e9c2d9fc93d","unresolved":false,"context_lines":[{"line_number":71,"context_line":"    Identity service managed unique identifier, string"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"HTTP_X_PROJECT_NAME"},{"line_number":74,"context_line":"    Project name, unique within owning domain, string"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"HTTP_X_PROJECT_DOMAIN_ID"},{"line_number":77,"context_line":"    Identity service managed unique identifier of owning domain of"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2B%2Fc%3D","line":74,"in_reply_to":"AAAAN3%2F%2F%2FO0%3D","updated":"2013-03-04 17:57:05.000000000","message":"Done","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"5049fa461b93391b7532ae5f3fd04e36b2492227","unresolved":false,"context_lines":[{"line_number":184,"context_line":"    cfg.IntOpt(\u0027auth_port\u0027, default\u003d35357),"},{"line_number":185,"context_line":"    cfg.StrOpt(\u0027auth_protocol\u0027, default\u003d\u0027https\u0027),"},{"line_number":186,"context_line":"    cfg.StrOpt(\u0027auth_uri\u0027, default\u003dNone),"},{"line_number":187,"context_line":"    cfg.StrOpt(\u0027auth_version\u0027, default\u003d\u0027v3\u0027),"},{"line_number":188,"context_line":"    cfg.BoolOpt(\u0027delay_auth_decision\u0027, default\u003dFalse),"},{"line_number":189,"context_line":"    cfg.BoolOpt(\u0027http_connect_timeout\u0027, default\u003dNone),"},{"line_number":190,"context_line":"    cfg.StrOpt(\u0027admin_token\u0027, secret\u003dTrue),"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FOE%3D","line":187,"updated":"2013-03-04 15:48:12.000000000","message":"this default value will break for pre-grizzly installations upgrading to the latest keystoneclient\n\nideally the middleware should detect the correct version to use based on a 300 response from the base url","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"16bf50c2cd5b13552cbd5634da43c3e3d6a07646","unresolved":false,"context_lines":[{"line_number":184,"context_line":"    cfg.IntOpt(\u0027auth_port\u0027, default\u003d35357),"},{"line_number":185,"context_line":"    cfg.StrOpt(\u0027auth_protocol\u0027, default\u003d\u0027https\u0027),"},{"line_number":186,"context_line":"    cfg.StrOpt(\u0027auth_uri\u0027, default\u003dNone),"},{"line_number":187,"context_line":"    cfg.StrOpt(\u0027auth_version\u0027, default\u003d\u0027v3\u0027),"},{"line_number":188,"context_line":"    cfg.BoolOpt(\u0027delay_auth_decision\u0027, default\u003dFalse),"},{"line_number":189,"context_line":"    cfg.BoolOpt(\u0027http_connect_timeout\u0027, default\u003dNone),"},{"line_number":190,"context_line":"    cfg.StrOpt(\u0027admin_token\u0027, secret\u003dTrue),"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2B28%3D","line":187,"in_reply_to":"AAAAN3%2F%2F%2B9I%3D","updated":"2013-03-04 18:17:58.000000000","message":"...for now, I have changed this to default to v2 while we investigate the best solution (i.e. option 3)","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9686786738f5aa4e7e257b0b91f53e9c2d9fc93d","unresolved":false,"context_lines":[{"line_number":184,"context_line":"    cfg.IntOpt(\u0027auth_port\u0027, default\u003d35357),"},{"line_number":185,"context_line":"    cfg.StrOpt(\u0027auth_protocol\u0027, default\u003d\u0027https\u0027),"},{"line_number":186,"context_line":"    cfg.StrOpt(\u0027auth_uri\u0027, default\u003dNone),"},{"line_number":187,"context_line":"    cfg.StrOpt(\u0027auth_version\u0027, default\u003d\u0027v3\u0027),"},{"line_number":188,"context_line":"    cfg.BoolOpt(\u0027delay_auth_decision\u0027, default\u003dFalse),"},{"line_number":189,"context_line":"    cfg.BoolOpt(\u0027http_connect_timeout\u0027, default\u003dNone),"},{"line_number":190,"context_line":"    cfg.StrOpt(\u0027admin_token\u0027, secret\u003dTrue),"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2B9I%3D","line":187,"in_reply_to":"AAAAN3%2F%2F%2FOE%3D","updated":"2013-03-04 17:57:05.000000000","message":"Yes, so this was my one question.  I think we have 3 options:\n\n1) Default to v3, and a service could specify the auth_version in their conf file to restrict this to v2 etc. (this would break your example)\n2) Do 1), but detect the v3 rejection, and try again with v2 (I was worried about the performance overhead of this)\n3) Set the default to v2, and then services could update their conf files if they wanted to use v3 tokens.  While safer, this also feels odd since nothing would prevent them from creating v3 tokens....they would just fail when they tried to to in-line validation in auth_token.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"70a80184aadd22bd309b2bd6d07c1160aa027c02","unresolved":false,"context_lines":[{"line_number":703,"context_line":"            catalog_key \u003d \u0027catalog\u0027"},{"line_number":704,"context_line":"            # For v3, the server will put in any default project, so no need"},{"line_number":705,"context_line":"            # for us to add it here (like we do for a v2 token)"},{"line_number":706,"context_line":"            if \u0027domain\u0027 in token:"},{"line_number":707,"context_line":"                domain_id \u003d token[\u0027domain\u0027][\u0027id\u0027]"},{"line_number":708,"context_line":"                domain_name \u003d token[\u0027domain\u0027][\u0027name\u0027]"},{"line_number":709,"context_line":"            elif \u0027project\u0027 in token:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FuM%3D","line":706,"updated":"2013-03-04 06:34:29.000000000","message":"domain-scoped token can\u0027t access service other than Keystone.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b5db850184a4b2a6594a030932d92e77df02fe56","unresolved":false,"context_lines":[{"line_number":703,"context_line":"            catalog_key \u003d \u0027catalog\u0027"},{"line_number":704,"context_line":"            # For v3, the server will put in any default project, so no need"},{"line_number":705,"context_line":"            # for us to add it here (like we do for a v2 token)"},{"line_number":706,"context_line":"            if \u0027domain\u0027 in token:"},{"line_number":707,"context_line":"                domain_id \u003d token[\u0027domain\u0027][\u0027id\u0027]"},{"line_number":708,"context_line":"                domain_name \u003d token[\u0027domain\u0027][\u0027name\u0027]"},{"line_number":709,"context_line":"            elif \u0027project\u0027 in token:"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FZU%3D","line":706,"in_reply_to":"AAAAN3%2F%2F%2FuM%3D","updated":"2013-03-04 14:10:26.000000000","message":"same as above","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"70a80184aadd22bd309b2bd6d07c1160aa027c02","unresolved":false,"context_lines":[{"line_number":710,"context_line":"                project_id \u003d token[\u0027project\u0027][\u0027id\u0027]"},{"line_number":711,"context_line":"                project_name \u003d token[\u0027project\u0027][\u0027name\u0027]"},{"line_number":712,"context_line":"                project_domain_id \u003d token[\u0027project\u0027][\u0027domain\u0027][\u0027id\u0027]"},{"line_number":713,"context_line":"                project_domain_name \u003d token[\u0027project\u0027][\u0027domain\u0027][\u0027name\u0027]"},{"line_number":714,"context_line":""},{"line_number":715,"context_line":"        user_id \u003d user[\u0027id\u0027]"},{"line_number":716,"context_line":"        user_name \u003d user[\u0027name\u0027]"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FuE%3D","line":713,"updated":"2013-03-04 06:34:29.000000000","message":"I think this is where we need a flag indicating whether services are domain-aware. If the service is not domain-aware, we should not allow non-default domains. Otherwise, we have a security problem.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b5db850184a4b2a6594a030932d92e77df02fe56","unresolved":false,"context_lines":[{"line_number":710,"context_line":"                project_id \u003d token[\u0027project\u0027][\u0027id\u0027]"},{"line_number":711,"context_line":"                project_name \u003d token[\u0027project\u0027][\u0027name\u0027]"},{"line_number":712,"context_line":"                project_domain_id \u003d token[\u0027project\u0027][\u0027domain\u0027][\u0027id\u0027]"},{"line_number":713,"context_line":"                project_domain_name \u003d token[\u0027project\u0027][\u0027domain\u0027][\u0027name\u0027]"},{"line_number":714,"context_line":""},{"line_number":715,"context_line":"        user_id \u003d user[\u0027id\u0027]"},{"line_number":716,"context_line":"        user_name \u003d user[\u0027name\u0027]"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FXs%3D","line":713,"in_reply_to":"AAAAN3%2F%2F%2FuE%3D","updated":"2013-03-04 14:10:26.000000000","message":"Could you elaborate on the security problem?  I think you mean that a non-domain aware service (that, say, supplies tenant or user name rather than id) might get the wrong entity (since it didn\u0027t know to add in the domain name/id)?  Clearly want to prevent that - although I\u0027m not sure that is an issue for auth_token - it\u0027s one for when they issue the v3 create token request to authenticate - and that would fail if the domain parameters where not there.  If they only have a v2 token, then the auth-token code works the way it does today, and we don\u0027t add in any of the domain attributes.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"70a80184aadd22bd309b2bd6d07c1160aa027c02","unresolved":false,"context_lines":[{"line_number":737,"context_line":"        }"},{"line_number":738,"context_line":""},{"line_number":739,"context_line":"        try:"},{"line_number":740,"context_line":"            catalog \u003d catalog_root[catalog_key]"},{"line_number":741,"context_line":"            rval[\u0027X-Service-Catalog\u0027] \u003d jsonutils.dumps(catalog)"},{"line_number":742,"context_line":"        except KeyError:"},{"line_number":743,"context_line":"            pass"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FuQ%3D","line":740,"updated":"2013-03-04 06:34:29.000000000","message":"I thought catalog is mandatory in V3. If its not there, we should error out.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"5049fa461b93391b7532ae5f3fd04e36b2492227","unresolved":false,"context_lines":[{"line_number":737,"context_line":"        }"},{"line_number":738,"context_line":""},{"line_number":739,"context_line":"        try:"},{"line_number":740,"context_line":"            catalog \u003d catalog_root[catalog_key]"},{"line_number":741,"context_line":"            rval[\u0027X-Service-Catalog\u0027] \u003d jsonutils.dumps(catalog)"},{"line_number":742,"context_line":"        except KeyError:"},{"line_number":743,"context_line":"            pass"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FOo%3D","line":740,"in_reply_to":"AAAAN3%2F%2F%2FXM%3D","updated":"2013-03-04 15:48:12.000000000","message":"The catalog is only provided in the case of a scoped token, in which case it must be present but may be empty","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b5db850184a4b2a6594a030932d92e77df02fe56","unresolved":false,"context_lines":[{"line_number":737,"context_line":"        }"},{"line_number":738,"context_line":""},{"line_number":739,"context_line":"        try:"},{"line_number":740,"context_line":"            catalog \u003d catalog_root[catalog_key]"},{"line_number":741,"context_line":"            rval[\u0027X-Service-Catalog\u0027] \u003d jsonutils.dumps(catalog)"},{"line_number":742,"context_line":"        except KeyError:"},{"line_number":743,"context_line":"            pass"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FXM%3D","line":740,"in_reply_to":"AAAAN3%2F%2F%2FuQ%3D","updated":"2013-03-04 14:10:26.000000000","message":"Ah, if that\u0027s the case then I agree - although the keystone server token-factory doesn\u0027t seem to fail if there is no catalog, I think it just put an empty one.  Would this not be an issue that should be resolved at create token time?","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"02b0c328a695be964cab4b7001d93c282cdc86f7","unresolved":false,"context_lines":[{"line_number":631,"context_line":""},{"line_number":632,"context_line":"        Build headers that represent authenticated user:"},{"line_number":633,"context_line":"         * X_IDENTITY_STATUS: Confirmed or Invalid"},{"line_number":634,"context_line":"         * X_DOMAIN_ID: id of domain if domain is present"},{"line_number":635,"context_line":"         * X_DOMAIN_NAME: name of domain if domain is present"},{"line_number":636,"context_line":"         * X_PROJECT_ID: id of project if project is present"},{"line_number":637,"context_line":"         * X_PROJECT_NAME: name of project if project is present"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAN3%2F%2F6Kc%3D","line":634,"updated":"2013-03-06 22:04:31.000000000","message":"In the v2 case, project_id and project_name are set at line 700, but domain_id isn\u0027t set. So it\u0027s also possible to have no X_DOMAIN_ID if domain is present. The comment doesn\u0027t match what the code does.","commit_id":"93188b517be2e930ff6ee26d7d6bd74fb42950a7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9076ba4fad7a7c7f3f0f9bf0bf4ff39f919ecebf","unresolved":false,"context_lines":[{"line_number":631,"context_line":""},{"line_number":632,"context_line":"        Build headers that represent authenticated user:"},{"line_number":633,"context_line":"         * X_IDENTITY_STATUS: Confirmed or Invalid"},{"line_number":634,"context_line":"         * X_DOMAIN_ID: id of domain if domain is present"},{"line_number":635,"context_line":"         * X_DOMAIN_NAME: name of domain if domain is present"},{"line_number":636,"context_line":"         * X_PROJECT_ID: id of project if project is present"},{"line_number":637,"context_line":"         * X_PROJECT_NAME: name of project if project is present"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAN3%2F%2F4vY%3D","line":634,"in_reply_to":"AAAAN3%2F%2F6Kc%3D","updated":"2013-03-07 16:44:46.000000000","message":"You\u0027re right text needs to be clearer, there is domain scoping and the domain of a project/user - they\u0027re different.","commit_id":"93188b517be2e930ff6ee26d7d6bd74fb42950a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"02b0c328a695be964cab4b7001d93c282cdc86f7","unresolved":false,"context_lines":[{"line_number":708,"context_line":"                     for role in token.get(\u0027roles\u0027, [])]))"},{"line_number":709,"context_line":"            catalog_root \u003d token"},{"line_number":710,"context_line":"            catalog_key \u003d \u0027catalog\u0027"},{"line_number":711,"context_line":"            # For v3, the server will put in any default project, so no need"},{"line_number":712,"context_line":"            # for us to add it here (like we do for a v2 token)"},{"line_number":713,"context_line":"            if \u0027domain\u0027 in token:"},{"line_number":714,"context_line":"                domain_id \u003d token[\u0027domain\u0027][\u0027id\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAN3%2F%2F6Ks%3D","line":711,"updated":"2013-03-06 22:04:31.000000000","message":"\"any\" -\u003e \"a\" or \"the\"","commit_id":"93188b517be2e930ff6ee26d7d6bd74fb42950a7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9076ba4fad7a7c7f3f0f9bf0bf4ff39f919ecebf","unresolved":false,"context_lines":[{"line_number":708,"context_line":"                     for role in token.get(\u0027roles\u0027, [])]))"},{"line_number":709,"context_line":"            catalog_root \u003d token"},{"line_number":710,"context_line":"            catalog_key \u003d \u0027catalog\u0027"},{"line_number":711,"context_line":"            # For v3, the server will put in any default project, so no need"},{"line_number":712,"context_line":"            # for us to add it here (like we do for a v2 token)"},{"line_number":713,"context_line":"            if \u0027domain\u0027 in token:"},{"line_number":714,"context_line":"                domain_id \u003d token[\u0027domain\u0027][\u0027id\u0027]"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAN3%2F%2F4vM%3D","line":711,"in_reply_to":"AAAAN3%2F%2F6Ks%3D","updated":"2013-03-07 16:44:46.000000000","message":"Done","commit_id":"93188b517be2e930ff6ee26d7d6bd74fb42950a7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"af62d7cd8800e6bc6ae66fe9a0ec153adcae84dd","unresolved":false,"context_lines":[{"line_number":339,"context_line":"        # If the configuration specifies an auth_version we will only"},{"line_number":340,"context_line":"        # attempt that single version"},{"line_number":341,"context_line":"        if self._conf_get(\u0027auth_version\u0027):"},{"line_number":342,"context_line":"            versions_to_attempt \u003d [self._conf_get(\u0027auth_version\u0027)]"},{"line_number":343,"context_line":"        else:"},{"line_number":344,"context_line":"            versions_to_attempt \u003d LIST_OF_VERSIONS_TO_ATTEMPT"},{"line_number":345,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAN3%2F%2F1Es%3D","line":342,"updated":"2013-03-11 04:18:28.000000000","message":"why are we still attempt to determine the version if user already know which version to use. Otherwise, what\u0027s the point of making \u0027auth_version\u0027 configurable.\n\nIf \u0027auth_version\u0027 is given, we should just use it.","commit_id":"8178df596e7846280f85cd6584150f3eef6a8006"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"6ee2ed940bbca1755cabf8aae5ab3367903fbc7a","unresolved":false,"context_lines":[{"line_number":339,"context_line":"        # If the configuration specifies an auth_version we will only"},{"line_number":340,"context_line":"        # attempt that single version"},{"line_number":341,"context_line":"        if self._conf_get(\u0027auth_version\u0027):"},{"line_number":342,"context_line":"            versions_to_attempt \u003d [self._conf_get(\u0027auth_version\u0027)]"},{"line_number":343,"context_line":"        else:"},{"line_number":344,"context_line":"            versions_to_attempt \u003d LIST_OF_VERSIONS_TO_ATTEMPT"},{"line_number":345,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAN3%2F%2F0uQ%3D","line":342,"in_reply_to":"AAAAN3%2F%2F1Es%3D","updated":"2013-03-11 11:31:46.000000000","message":"So the rationale for still checking was to fail more cleanly if we were being asked for an auth_version that the server did not support.  The counter argument (that I have been debating with myself) is that given that this code is being added relatively late in the cycle, having an override that by-passes this code is probably an advantage.\n\nI\u0027ll change it so that if auth_version is specified, we just assume that it is supported.","commit_id":"8178df596e7846280f85cd6584150f3eef6a8006"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"af62d7cd8800e6bc6ae66fe9a0ec153adcae84dd","unresolved":false,"context_lines":[{"line_number":357,"context_line":"                \u0027Attempted versions (%s) not in list supported by server (%s)\u0027,"},{"line_number":358,"context_line":"                \u0027, \u0027.join(versions_to_attempt),"},{"line_number":359,"context_line":"                \u0027, \u0027.join(versions_supported_by_server))"},{"line_number":360,"context_line":"            raise ServiceError(\u0027Requested api version not supported\u0027)"},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"    def _assert_valid_memcache_protection_config(self):"},{"line_number":363,"context_line":"        if self._memcache_security_strategy:"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAN3%2F%2F1E0%3D","line":360,"updated":"2013-03-11 04:18:28.000000000","message":"Line #337-360 could use a bit of re-factoring. Putting them into a separate method would make the code look much nicer.","commit_id":"8178df596e7846280f85cd6584150f3eef6a8006"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"6ee2ed940bbca1755cabf8aae5ab3367903fbc7a","unresolved":false,"context_lines":[{"line_number":357,"context_line":"                \u0027Attempted versions (%s) not in list supported by server (%s)\u0027,"},{"line_number":358,"context_line":"                \u0027, \u0027.join(versions_to_attempt),"},{"line_number":359,"context_line":"                \u0027, \u0027.join(versions_supported_by_server))"},{"line_number":360,"context_line":"            raise ServiceError(\u0027Requested api version not supported\u0027)"},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"    def _assert_valid_memcache_protection_config(self):"},{"line_number":363,"context_line":"        if self._memcache_security_strategy:"}],"source_content_type":"text/x-python","patch_set":4,"id":"AAAAN3%2F%2F0uM%3D","line":360,"in_reply_to":"AAAAN3%2F%2F1E0%3D","updated":"2013-03-11 11:31:46.000000000","message":"Agreed, good suggestion.  Done.","commit_id":"8178df596e7846280f85cd6584150f3eef6a8006"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cc7c0064bcf4d45bba6b8a873d0bff0fcac18444","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"HTTP_X_TENANT_ID"},{"line_number":106,"context_line":"    *Deprecated* in favor of HTTP_X_PROJECT_ID"},{"line_number":107,"context_line":"    Identity service managed unique identifier, string. For v3 tokens, this"},{"line_number":108,"context_line":"    will be set to the same value as HTTP_X_PROJECT_ID"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"HTTP_X_TENANT_NAME"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2FzeE%3D","line":107,"updated":"2013-03-11 23:58:18.000000000","message":"what will this be set to for v2 tokens?","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"6109cc465dd137501c8544b675ee5740377319d4","unresolved":false,"context_lines":[{"line_number":104,"context_line":""},{"line_number":105,"context_line":"HTTP_X_TENANT_ID"},{"line_number":106,"context_line":"    *Deprecated* in favor of HTTP_X_PROJECT_ID"},{"line_number":107,"context_line":"    Identity service managed unique identifier, string. For v3 tokens, this"},{"line_number":108,"context_line":"    will be set to the same value as HTTP_X_PROJECT_ID"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"HTTP_X_TENANT_NAME"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2FzMU%3D","line":107,"in_reply_to":"AAAAN3%2F%2FzeE%3D","updated":"2013-03-12 04:29:27.000000000","message":"Tenant for V2, Project for V3","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cc7c0064bcf4d45bba6b8a873d0bff0fcac18444","unresolved":false,"context_lines":[{"line_number":109,"context_line":""},{"line_number":110,"context_line":"HTTP_X_TENANT_NAME"},{"line_number":111,"context_line":"    *Deprecated* in favor of HTTP_X_PROJECT_NAME"},{"line_number":112,"context_line":"    Project identifier, unique within owning domain, string. For v3 tokens,"},{"line_number":113,"context_line":"    this will be set to the same value as HTTP_X_PROJECT_NAME"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"HTTP_X_TENANT"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2Fzd8%3D","line":112,"updated":"2013-03-11 23:58:18.000000000","message":"what will this be set to for v2 tokens?","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cc7c0064bcf4d45bba6b8a873d0bff0fcac18444","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"HTTP_X_TENANT"},{"line_number":116,"context_line":"    *Deprecated* in favor of HTTP_X_TENANT_ID and HTTP_X_TENANT_NAME"},{"line_number":117,"context_line":"    Keystone-assigned unique identifier, string. For v3 tokens, this"},{"line_number":118,"context_line":"    will be set to the same value as HTTP_X_PROJECT_ID"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"HTTP_X_USER"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2Fzd0%3D","line":117,"updated":"2013-03-11 23:58:18.000000000","message":"what will this be set to for v2 tokens?","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fcc1cf453062d586ba6c6f05ce638f2cd8502312","unresolved":false,"context_lines":[{"line_number":211,"context_line":"]"},{"line_number":212,"context_line":"CONF.register_opts(opts, group\u003d\u0027keystone_authtoken\u0027)"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"LIST_OF_VERSIONS_TO_ATTEMPT \u003d [\u0027v3.0\u0027, \u0027v2.0\u0027]"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":""},{"line_number":217,"context_line":"def will_expire_soon(expiry):"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2F0gA%3D","line":214,"updated":"2013-03-11 14:41:01.000000000","message":"May be useful to have a comment here stating that we will try to use the highest version first.","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fcc1cf453062d586ba6c6f05ce638f2cd8502312","unresolved":false,"context_lines":[{"line_number":268,"context_line":"            # Really only used for unit testing, since we need to"},{"line_number":269,"context_line":"            # have a fake handler set up before we issue an http"},{"line_number":270,"context_line":"            # request to get the list of versions supported by the"},{"line_number":271,"context_line":"            # server at the end of this initialization"},{"line_number":272,"context_line":"            self.http_client_class \u003d self._conf_get(\u0027http_handler\u0027)"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"        self.auth_admin_prefix \u003d self._conf_get(\u0027auth_admin_prefix\u0027)"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2F0gY%3D","line":271,"updated":"2013-03-11 14:41:01.000000000","message":"Nice comment!","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fcc1cf453062d586ba6c6f05ce638f2cd8502312","unresolved":false,"context_lines":[{"line_number":382,"context_line":"        # that this version is supported by the server, but in case"},{"line_number":383,"context_line":"        # there are some problems in the field, we want as little code"},{"line_number":384,"context_line":"        # as possible in the way of letting auth_token talk to the"},{"line_number":385,"context_line":"        # server."},{"line_number":386,"context_line":"        if self._conf_get(\u0027auth_version\u0027):"},{"line_number":387,"context_line":"            version_to_use \u003d self._conf_get(\u0027auth_version\u0027)"},{"line_number":388,"context_line":"            self.LOG.info(\u0027Auth Token proceeding with requested %s apis\u0027,"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2F0gw%3D","line":385,"updated":"2013-03-11 14:41:01.000000000","message":"I agreed. In some cases, Keystone is running behind a proxy and not everyone will be exposing the get version functionality for whatever reason. Furthermore, we want token validation to have as little dependency as possible. In other words, middleware should not fail simply because there\u0027s a problem with get version. Having the ability to override check version is a good balance.","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fcc1cf453062d586ba6c6f05ce638f2cd8502312","unresolved":false,"context_lines":[{"line_number":425,"context_line":"                                   \u0027from keystone\u0027)"},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"        self.LOG.debug(\u0027Server reports support for api versions: %s\u0027,"},{"line_number":428,"context_line":"                       \u0027, \u0027.join(versions))"},{"line_number":429,"context_line":"        return versions"},{"line_number":430,"context_line":""},{"line_number":431,"context_line":"    def __call__(self, env, start_response):"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2F0f4%3D","line":428,"updated":"2013-03-11 14:41:01.000000000","message":"If ServiceError, we may want to fall back to the lowest version instead of bailing out. Some deployments have Keystone running behind a proxy and may not want to expose get version functionality for whatever reason.","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2acb24290d811076619dfdae0f6b448c8481fc9c","unresolved":false,"context_lines":[{"line_number":425,"context_line":"                                   \u0027from keystone\u0027)"},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"        self.LOG.debug(\u0027Server reports support for api versions: %s\u0027,"},{"line_number":428,"context_line":"                       \u0027, \u0027.join(versions))"},{"line_number":429,"context_line":"        return versions"},{"line_number":430,"context_line":""},{"line_number":431,"context_line":"    def __call__(self, env, start_response):"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2Fz9s%3D","line":428,"in_reply_to":"AAAAN3%2F%2F0f4%3D","updated":"2013-03-11 18:23:09.000000000","message":"I wonder if we need this AND the ability to specify an auth_version?","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cc7c0064bcf4d45bba6b8a873d0bff0fcac18444","unresolved":false,"context_lines":[{"line_number":723,"context_line":"           if token is scoped to a project"},{"line_number":724,"context_line":"         * X_TENANT: For legacy compatibility before we had ID and Name, this"},{"line_number":725,"context_line":"           is will be the same as X_TENANT_NAME"},{"line_number":726,"context_line":"         * X_ROLE: list of roles"},{"line_number":727,"context_line":""},{"line_number":728,"context_line":"        :param token_info: token object returned by keystone on authentication"},{"line_number":729,"context_line":"        :raise InvalidUserToken when unable to parse token object"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2FzdU%3D","line":726,"updated":"2013-03-11 23:58:18.000000000","message":"it would be easier for reviewers if this documentation wasn\u0027t duplicated. It\u0027s difficult to verify because need to match it with what\u0027s above, and also I don\u0027t know which one\u0027s correct if there\u0027s a difference. Suggest remove it.","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cc7c0064bcf4d45bba6b8a873d0bff0fcac18444","unresolved":false,"context_lines":[{"line_number":762,"context_line":"        project_domain_id \u003d None"},{"line_number":763,"context_line":"        project_domain_name \u003d None"},{"line_number":764,"context_line":""},{"line_number":765,"context_line":"        if \u0027access\u0027 in token_info:"},{"line_number":766,"context_line":"            #v2 token"},{"line_number":767,"context_line":"            user \u003d token_info[\u0027access\u0027][\u0027user\u0027]"},{"line_number":768,"context_line":"            token \u003d token_info[\u0027access\u0027][\u0027token\u0027]"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2Fzdc%3D","line":765,"updated":"2013-03-11 23:58:18.000000000","message":"suggest have a function called _is_v2_token(token_info), or _calc_token_version(token_info).\n\nLooking for \u0027access\u0027 doesn\u0027t help me figure out the intent of this line of code.","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cc7c0064bcf4d45bba6b8a873d0bff0fcac18444","unresolved":false,"context_lines":[{"line_number":947,"context_line":"        quick check of token freshness on retrieval."},{"line_number":948,"context_line":"        \"\"\""},{"line_number":949,"context_line":"        if self._cache and data:"},{"line_number":950,"context_line":"            if \u0027token\u0027 in data.get(\u0027access\u0027, {}):"},{"line_number":951,"context_line":"                # It\u0027s a v2 token"},{"line_number":952,"context_line":"                timestamp \u003d data[\u0027access\u0027][\u0027token\u0027][\u0027expires\u0027]"},{"line_number":953,"context_line":"            elif \u0027token\u0027 in data:"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAN3%2F%2FzdA%3D","line":950,"updated":"2013-03-11 23:58:18.000000000","message":"here\u0027s another spot to use a function to calculate token version.","commit_id":"d782a998474d92d4299b4404b69442f0288efc3b"}],"tests/test_auth_token_middleware.py":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"19ebe69cf3604f1768a000adee990f36e00dae9d","unresolved":false,"context_lines":[{"line_number":217,"context_line":"                \u0027domain\u0027: {"},{"line_number":218,"context_line":"                    \u0027id\u0027: \u0027domain_id1\u0027,"},{"line_number":219,"context_line":"                    \u0027name\u0027: \u0027domain_name1\u0027"},{"line_number":220,"context_line":"                }"},{"line_number":221,"context_line":"            },"},{"line_number":222,"context_line":"            \u0027roles\u0027: ["},{"line_number":223,"context_line":"                {\u0027name\u0027: \u0027role1\u0027, \u0027id\u0027: \u0027Role1\u0027},"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FNU%3D","line":220,"updated":"2013-03-04 16:09:02.000000000","message":"this should contain a service catalog because it has a project -- remove the project or add a service catalog","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9686786738f5aa4e7e257b0b91f53e9c2d9fc93d","unresolved":false,"context_lines":[{"line_number":217,"context_line":"                \u0027domain\u0027: {"},{"line_number":218,"context_line":"                    \u0027id\u0027: \u0027domain_id1\u0027,"},{"line_number":219,"context_line":"                    \u0027name\u0027: \u0027domain_name1\u0027"},{"line_number":220,"context_line":"                }"},{"line_number":221,"context_line":"            },"},{"line_number":222,"context_line":"            \u0027roles\u0027: ["},{"line_number":223,"context_line":"                {\u0027name\u0027: \u0027role1\u0027, \u0027id\u0027: \u0027Role1\u0027},"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FAI%3D","line":220,"in_reply_to":"AAAAN3%2F%2F%2FNU%3D","updated":"2013-03-04 17:57:05.000000000","message":"Done","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"19ebe69cf3604f1768a000adee990f36e00dae9d","unresolved":false,"context_lines":[{"line_number":290,"context_line":"        cms.cms_hash_token(self.SIGNED_TOKEN_SCOPED)"},{"line_number":291,"context_line":"    self.SIGNED_TOKEN_UNSCOPED_KEY \u003d\\"},{"line_number":292,"context_line":"        cms.cms_hash_token(self.SIGNED_TOKEN_UNSCOPED)"},{"line_number":293,"context_line":"    self.SIGNED_v3_TOKEN_SCOPED_KEY \u003d\\"},{"line_number":294,"context_line":"        cms.cms_hash_token(self.SIGNED_v3_TOKEN_SCOPED)"},{"line_number":295,"context_line":""},{"line_number":296,"context_line":"    self.TOKEN_RESPONSES[self.SIGNED_TOKEN_SCOPED_KEY] \u003d {"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FNQ%3D","line":293,"updated":"2013-03-04 16:09:02.000000000","message":"rewrite the backslash continuations","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9686786738f5aa4e7e257b0b91f53e9c2d9fc93d","unresolved":false,"context_lines":[{"line_number":290,"context_line":"        cms.cms_hash_token(self.SIGNED_TOKEN_SCOPED)"},{"line_number":291,"context_line":"    self.SIGNED_TOKEN_UNSCOPED_KEY \u003d\\"},{"line_number":292,"context_line":"        cms.cms_hash_token(self.SIGNED_TOKEN_UNSCOPED)"},{"line_number":293,"context_line":"    self.SIGNED_v3_TOKEN_SCOPED_KEY \u003d\\"},{"line_number":294,"context_line":"        cms.cms_hash_token(self.SIGNED_v3_TOKEN_SCOPED)"},{"line_number":295,"context_line":""},{"line_number":296,"context_line":"    self.TOKEN_RESPONSES[self.SIGNED_TOKEN_SCOPED_KEY] \u003d {"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FAE%3D","line":293,"in_reply_to":"AAAAN3%2F%2F%2FNQ%3D","updated":"2013-03-04 17:57:05.000000000","message":"Done","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"19ebe69cf3604f1768a000adee990f36e00dae9d","unresolved":false,"context_lines":[{"line_number":349,"context_line":"            \u0027roles\u0027: ["},{"line_number":350,"context_line":"                    {\u0027name\u0027: \u0027role1\u0027},"},{"line_number":351,"context_line":"                    {\u0027name\u0027: \u0027role2\u0027}"},{"line_number":352,"context_line":"            ]"},{"line_number":353,"context_line":"        }"},{"line_number":354,"context_line":"    }"},{"line_number":355,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FM8%3D","line":352,"updated":"2013-03-04 16:09:02.000000000","message":"should have a service catalog","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9686786738f5aa4e7e257b0b91f53e9c2d9fc93d","unresolved":false,"context_lines":[{"line_number":349,"context_line":"            \u0027roles\u0027: ["},{"line_number":350,"context_line":"                    {\u0027name\u0027: \u0027role1\u0027},"},{"line_number":351,"context_line":"                    {\u0027name\u0027: \u0027role2\u0027}"},{"line_number":352,"context_line":"            ]"},{"line_number":353,"context_line":"        }"},{"line_number":354,"context_line":"    }"},{"line_number":355,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FAA%3D","line":352,"in_reply_to":"AAAAN3%2F%2F%2FM8%3D","updated":"2013-03-04 17:57:05.000000000","message":"Done","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"19ebe69cf3604f1768a000adee990f36e00dae9d","unresolved":false,"context_lines":[{"line_number":497,"context_line":"        if method \u003d\u003d \u0027POST\u0027:"},{"line_number":498,"context_line":"            status \u003d 200"},{"line_number":499,"context_line":"            body \u003d jsonutils.dumps({"},{"line_number":500,"context_line":"                \u0027access\u0027: {"},{"line_number":501,"context_line":"                    \u0027token\u0027: {\u0027id\u0027: \u0027admin_token2\u0027},"},{"line_number":502,"context_line":"                },"},{"line_number":503,"context_line":"            })"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FLg%3D","line":500,"updated":"2013-03-04 16:09:02.000000000","message":"this isn\u0027t a v3 compliant response  at all-- see the spec","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9686786738f5aa4e7e257b0b91f53e9c2d9fc93d","unresolved":false,"context_lines":[{"line_number":497,"context_line":"        if method \u003d\u003d \u0027POST\u0027:"},{"line_number":498,"context_line":"            status \u003d 200"},{"line_number":499,"context_line":"            body \u003d jsonutils.dumps({"},{"line_number":500,"context_line":"                \u0027access\u0027: {"},{"line_number":501,"context_line":"                    \u0027token\u0027: {\u0027id\u0027: \u0027admin_token2\u0027},"},{"line_number":502,"context_line":"                },"},{"line_number":503,"context_line":"            })"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2B%2F4%3D","line":500,"in_reply_to":"AAAAN3%2F%2F%2FLg%3D","updated":"2013-03-04 17:57:05.000000000","message":"This because auth-token will still issue a v2 call to get the admin token that it will use to validate a v3 user token.  The rationale for this was to minimise changes to auth-token - and since we support a mix of tokens, let\u0027s use that capability for now.  This is explained in the intro text to this class, above.  In the future we might, of course, go all v3.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"19ebe69cf3604f1768a000adee990f36e00dae9d","unresolved":false,"context_lines":[{"line_number":770,"context_line":"    def assert_valid_last_url(self, token_id):"},{"line_number":771,"context_line":"        # Default version (v2) has id in the token, override this"},{"line_number":772,"context_line":"        # method for v3 and other versions"},{"line_number":773,"context_line":"        self.assertEqual(\"/testadmin/v2.0/tokens/%s\" % token_id,"},{"line_number":774,"context_line":"                         self.middleware.http_client_class.last_requested_url)"},{"line_number":775,"context_line":""},{"line_number":776,"context_line":"    def assert_valid_request_200(self, token, with_catalog\u003dTrue):"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FLQ%3D","line":773,"updated":"2013-03-04 16:09:02.000000000","message":"i see it on the left as well, but what\u0027s the testadmin prefix?","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9686786738f5aa4e7e257b0b91f53e9c2d9fc93d","unresolved":false,"context_lines":[{"line_number":770,"context_line":"    def assert_valid_last_url(self, token_id):"},{"line_number":771,"context_line":"        # Default version (v2) has id in the token, override this"},{"line_number":772,"context_line":"        # method for v3 and other versions"},{"line_number":773,"context_line":"        self.assertEqual(\"/testadmin/v2.0/tokens/%s\" % token_id,"},{"line_number":774,"context_line":"                         self.middleware.http_client_class.last_requested_url)"},{"line_number":775,"context_line":""},{"line_number":776,"context_line":"    def assert_valid_request_200(self, token, with_catalog\u003dTrue):"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2B%2F0%3D","line":773,"in_reply_to":"AAAAN3%2F%2F%2FLQ%3D","updated":"2013-03-04 17:57:05.000000000","message":"This is the way these tests were defined - the \"testadmin\" bit os passed in as part of the config - see the Setup() for the Base class.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"19ebe69cf3604f1768a000adee990f36e00dae9d","unresolved":false,"context_lines":[{"line_number":804,"context_line":"        self.middleware(req.environ, self.start_fake_response)"},{"line_number":805,"context_line":"        self.assertEqual(self.response_status, 401)"},{"line_number":806,"context_line":""},{"line_number":807,"context_line":"    def get_revocation_list_json(self, token_ids\u003d[]):"},{"line_number":808,"context_line":"        if token_ids \u003d\u003d []:"},{"line_number":809,"context_line":"            token_ids \u003d [self.token_dict[\u0027revoked_token_hash\u0027]]"},{"line_number":810,"context_line":"        revocation_list \u003d {\u0027revoked\u0027: [{\u0027id\u0027: x, \u0027expires\u0027: timeutils.utcnow()}"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FLI%3D","line":807,"updated":"2013-03-04 16:09:02.000000000","message":"-2! I doubt this behaves the way you expect. Restore the old signature","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9686786738f5aa4e7e257b0b91f53e9c2d9fc93d","unresolved":false,"context_lines":[{"line_number":804,"context_line":"        self.middleware(req.environ, self.start_fake_response)"},{"line_number":805,"context_line":"        self.assertEqual(self.response_status, 401)"},{"line_number":806,"context_line":""},{"line_number":807,"context_line":"    def get_revocation_list_json(self, token_ids\u003d[]):"},{"line_number":808,"context_line":"        if token_ids \u003d\u003d []:"},{"line_number":809,"context_line":"            token_ids \u003d [self.token_dict[\u0027revoked_token_hash\u0027]]"},{"line_number":810,"context_line":"        revocation_list \u003d {\u0027revoked\u0027: [{\u0027id\u0027: x, \u0027expires\u0027: timeutils.utcnow()}"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2B%2Fs%3D","line":807,"in_reply_to":"AAAAN3%2F%2F%2FLI%3D","updated":"2013-03-04 17:57:05.000000000","message":"oops..sorry a handover form a previous big finding attempt.  Nice catch.  Done.","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"19ebe69cf3604f1768a000adee990f36e00dae9d","unresolved":false,"context_lines":[{"line_number":1237,"context_line":"        self.middleware(req.environ, self.start_fake_response)"},{"line_number":1238,"context_line":"        self.assertEqual(self.response_status, 401)"},{"line_number":1239,"context_line":"        self.assertEqual(self.response_headers[\u0027WWW-Authenticate\u0027],"},{"line_number":1240,"context_line":"                         \u0027Keystone uri\u003d\\\u0027https://keystone.example.com:1234\\\u0027\u0027)"},{"line_number":1241,"context_line":""},{"line_number":1242,"context_line":"    def test_unscoped_uuid_token_receives_401(self):"},{"line_number":1243,"context_line":"        self.assert_unscoped_token_receives_401(UUID_TOKEN_UNSCOPED)"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2FLA%3D","line":1240,"updated":"2013-03-04 16:09:02.000000000","message":"Prefer \"double quotes\" or \"\"\"triple double quotes\"\"\" instead of fussing with escaping","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9686786738f5aa4e7e257b0b91f53e9c2d9fc93d","unresolved":false,"context_lines":[{"line_number":1237,"context_line":"        self.middleware(req.environ, self.start_fake_response)"},{"line_number":1238,"context_line":"        self.assertEqual(self.response_status, 401)"},{"line_number":1239,"context_line":"        self.assertEqual(self.response_headers[\u0027WWW-Authenticate\u0027],"},{"line_number":1240,"context_line":"                         \u0027Keystone uri\u003d\\\u0027https://keystone.example.com:1234\\\u0027\u0027)"},{"line_number":1241,"context_line":""},{"line_number":1242,"context_line":"    def test_unscoped_uuid_token_receives_401(self):"},{"line_number":1243,"context_line":"        self.assert_unscoped_token_receives_401(UUID_TOKEN_UNSCOPED)"}],"source_content_type":"text/x-python","patch_set":1,"id":"AAAAN3%2F%2F%2B%2Fo%3D","line":1240,"in_reply_to":"AAAAN3%2F%2F%2FLA%3D","updated":"2013-03-04 17:57:05.000000000","message":"Done","commit_id":"2d04527dc7f43d259974d4f574340444a38d0a7e"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"9a5ca69fa217afbc07a75fbe900e4573f3287512","unresolved":false,"context_lines":[{"line_number":469,"context_line":""},{"line_number":470,"context_line":"        \"\"\""},{"line_number":471,"context_line":"        v3FakeHTTPConnection.last_requested_url \u003d path"},{"line_number":472,"context_line":"        if method \u003d\u003d \u0027POST\u0027:"},{"line_number":473,"context_line":"            status \u003d 200"},{"line_number":474,"context_line":"            body \u003d jsonutils.dumps({"},{"line_number":475,"context_line":"                \u0027access\u0027: {"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAN3%2F%2F%2BBI%3D","line":472,"updated":"2013-03-05 01:09:12.000000000","message":"This will probably mess someone up in the future. Please do a minimal check that the URL coming in is the right one.  I think we have a library for doing just these form of mock request/response calls for HTTP.","commit_id":"93188b517be2e930ff6ee26d7d6bd74fb42950a7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9076ba4fad7a7c7f3f0f9bf0bf4ff39f919ecebf","unresolved":false,"context_lines":[{"line_number":469,"context_line":""},{"line_number":470,"context_line":"        \"\"\""},{"line_number":471,"context_line":"        v3FakeHTTPConnection.last_requested_url \u003d path"},{"line_number":472,"context_line":"        if method \u003d\u003d \u0027POST\u0027:"},{"line_number":473,"context_line":"            status \u003d 200"},{"line_number":474,"context_line":"            body \u003d jsonutils.dumps({"},{"line_number":475,"context_line":"                \u0027access\u0027: {"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAN3%2F%2F4vE%3D","line":472,"in_reply_to":"AAAAN3%2F%2F%2BBI%3D","updated":"2013-03-07 16:44:46.000000000","message":"Done","commit_id":"93188b517be2e930ff6ee26d7d6bd74fb42950a7"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"02b0c328a695be964cab4b7001d93c282cdc86f7","unresolved":false,"context_lines":[{"line_number":1169,"context_line":"    There are some differences between how the auth-token middleware handles"},{"line_number":1170,"context_line":"    v2 and v3 tokens over and above the token formats, namely:"},{"line_number":1171,"context_line":""},{"line_number":1172,"context_line":"    - A v3 ketsone server will auto scope a token to a user\u0027s default project"},{"line_number":1173,"context_line":"      if no scope is specified. A v2 server assumes that the auth-token"},{"line_number":1174,"context_line":"      middleware will do that."},{"line_number":1175,"context_line":"    - A v2 keystone server may issue a token without a catalog, even with a"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAN3%2F%2F6KA%3D","line":1172,"updated":"2013-03-06 22:04:31.000000000","message":"\"ketsone\" -\u003e \"keystone\"","commit_id":"93188b517be2e930ff6ee26d7d6bd74fb42950a7"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"9076ba4fad7a7c7f3f0f9bf0bf4ff39f919ecebf","unresolved":false,"context_lines":[{"line_number":1169,"context_line":"    There are some differences between how the auth-token middleware handles"},{"line_number":1170,"context_line":"    v2 and v3 tokens over and above the token formats, namely:"},{"line_number":1171,"context_line":""},{"line_number":1172,"context_line":"    - A v3 ketsone server will auto scope a token to a user\u0027s default project"},{"line_number":1173,"context_line":"      if no scope is specified. A v2 server assumes that the auth-token"},{"line_number":1174,"context_line":"      middleware will do that."},{"line_number":1175,"context_line":"    - A v2 keystone server may issue a token without a catalog, even with a"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAN3%2F%2F4uo%3D","line":1172,"in_reply_to":"AAAAN3%2F%2F6KA%3D","updated":"2013-03-07 16:44:46.000000000","message":"Done","commit_id":"93188b517be2e930ff6ee26d7d6bd74fb42950a7"}]}