)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"079ff1fd3b3d9162cc11c3e7c29e6ad201ec6703","unresolved":false,"context_lines":[{"line_number":15,"context_line":"is set to True."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Also, this change prevents the revocation list from being"},{"line_number":18,"context_line":"checked twice for a PKI token that\u0027s validate off-line."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Change-Id: I5408bbe12aefda608ebcb81cf3c7ef068b2bf2f6"},{"line_number":21,"context_line":"Closes-Bug: #1312858"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":9,"id":"9ad9bd40_a33a10cb","line":18,"updated":"2014-05-02 19:38:30.000000000","message":"(nit) validated","commit_id":"a03c6b9f346dfd6b838fb8175bc50191642576a2"}],"keystoneclient/middleware/auth_token.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"c866c07cabae08ac38b5d16c2d91aa8296cb89be","unresolved":false,"context_lines":[{"line_number":315,"context_line":"               \u0027 unknown the token will be rejected. \"required\" any form of\u0027"},{"line_number":316,"context_line":"               \u0027 token binding is needed to be allowed. Finally the name of a\u0027"},{"line_number":317,"context_line":"               \u0027 binding method that must be present in tokens.\u0027),"},{"line_number":318,"context_line":"    cfg.BoolOpt(\u0027check_revocations_for_cached\u0027, default\u003dFalse,"},{"line_number":319,"context_line":"                help\u003d\u0027If true, the revocation list will be checked for cached\u0027"},{"line_number":320,"context_line":"                \u0027 tokens. This requires that PKI tokens are configured on the\u0027"},{"line_number":321,"context_line":"                \u0027 Keystone server.\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad9bd40_5a1de265","line":318,"updated":"2014-04-30 15:34:06.000000000","message":"Default to true, or you introduce a major security hole.","commit_id":"6dfb64c95b77aa182f25f8bcc0f8c5f44b85f823"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"9d4c4b6a4251a8a05adbc957761baf436ef5a3e2","unresolved":false,"context_lines":[{"line_number":315,"context_line":"               \u0027 unknown the token will be rejected. \"required\" any form of\u0027"},{"line_number":316,"context_line":"               \u0027 token binding is needed to be allowed. Finally the name of a\u0027"},{"line_number":317,"context_line":"               \u0027 binding method that must be present in tokens.\u0027),"},{"line_number":318,"context_line":"    cfg.BoolOpt(\u0027check_revocations_for_cached\u0027, default\u003dFalse,"},{"line_number":319,"context_line":"                help\u003d\u0027If true, the revocation list will be checked for cached\u0027"},{"line_number":320,"context_line":"                \u0027 tokens. This requires that PKI tokens are configured on the\u0027"},{"line_number":321,"context_line":"                \u0027 Keystone server.\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad9bd40_7a73864d","line":318,"in_reply_to":"9ad9bd40_3a481e2d","updated":"2014-04-30 15:47:53.000000000","message":"No, as I pointed out before, there is no way to determine if a token was originally a UID or PKI token, this essentially by passes the revocation check for all tokens, not just UUID ones.","commit_id":"6dfb64c95b77aa182f25f8bcc0f8c5f44b85f823"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"af0fec133f0f93171f243cf40fe4489c5840981b","unresolved":false,"context_lines":[{"line_number":315,"context_line":"               \u0027 unknown the token will be rejected. \"required\" any form of\u0027"},{"line_number":316,"context_line":"               \u0027 token binding is needed to be allowed. Finally the name of a\u0027"},{"line_number":317,"context_line":"               \u0027 binding method that must be present in tokens.\u0027),"},{"line_number":318,"context_line":"    cfg.BoolOpt(\u0027check_revocations_for_cached\u0027, default\u003dFalse,"},{"line_number":319,"context_line":"                help\u003d\u0027If true, the revocation list will be checked for cached\u0027"},{"line_number":320,"context_line":"                \u0027 tokens. This requires that PKI tokens are configured on the\u0027"},{"line_number":321,"context_line":"                \u0027 Keystone server.\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad9bd40_beba59df","line":318,"in_reply_to":"9ad9bd40_5a1de265","updated":"2014-04-30 22:13:08.000000000","message":"Done","commit_id":"6dfb64c95b77aa182f25f8bcc0f8c5f44b85f823"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"6bfe07819520d0b41f8719a5064cde46b237be21","unresolved":false,"context_lines":[{"line_number":315,"context_line":"               \u0027 unknown the token will be rejected. \"required\" any form of\u0027"},{"line_number":316,"context_line":"               \u0027 token binding is needed to be allowed. Finally the name of a\u0027"},{"line_number":317,"context_line":"               \u0027 binding method that must be present in tokens.\u0027),"},{"line_number":318,"context_line":"    cfg.BoolOpt(\u0027check_revocations_for_cached\u0027, default\u003dFalse,"},{"line_number":319,"context_line":"                help\u003d\u0027If true, the revocation list will be checked for cached\u0027"},{"line_number":320,"context_line":"                \u0027 tokens. This requires that PKI tokens are configured on the\u0027"},{"line_number":321,"context_line":"                \u0027 Keystone server.\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad9bd40_3a481e2d","line":318,"in_reply_to":"9ad9bd40_5a1de265","updated":"2014-04-30 15:41:02.000000000","message":"If this introduces a major security hole then we had the security hole before https://review.openstack.org/#/c/78241/ was merged last week, since before that auth_token didn\u0027t check the revocation list for cached tokens.\n\nAlso, if this defaults to true then we\u0027ll also have to update devstack to set it to false on all of the projects if UUID tokens are configured.","commit_id":"6dfb64c95b77aa182f25f8bcc0f8c5f44b85f823"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"19923719846d32ea3500ae2206debf200ead5f9b","unresolved":false,"context_lines":[{"line_number":315,"context_line":"               \u0027 unknown the token will be rejected. \"required\" any form of\u0027"},{"line_number":316,"context_line":"               \u0027 token binding is needed to be allowed. Finally the name of a\u0027"},{"line_number":317,"context_line":"               \u0027 binding method that must be present in tokens.\u0027),"},{"line_number":318,"context_line":"    cfg.BoolOpt(\u0027check_revocations_for_cached\u0027, default\u003dFalse,"},{"line_number":319,"context_line":"                help\u003d\u0027If true, the revocation list will be checked for cached\u0027"},{"line_number":320,"context_line":"                \u0027 tokens. This requires that PKI tokens are configured on the\u0027"},{"line_number":321,"context_line":"                \u0027 Keystone server.\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad9bd40_9a95aae6","line":318,"in_reply_to":"9ad9bd40_7a73864d","updated":"2014-04-30 15:59:15.000000000","message":"Here\u0027s what the code did pre- https://review.openstack.org/#/c/78241/ :\n\n token_id \u003d cms.cms_hash_token(user_token)\n cached \u003d self._cache_get(token_id)\n if cached:\n     return cached\n\nit handled both UUID and PKI tokens the same way... the revocation check was skipped for both PKI and UUID.\n\nhttp://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/middleware/auth_token.py?id\u003d6c3cbab1a8e19f085c152a062b753bb2696b8964#n846","commit_id":"6dfb64c95b77aa182f25f8bcc0f8c5f44b85f823"},{"author":{"_account_id":706,"name":"Brian Lamar","email":"brian.lamar@rackspace.com","username":"blamar"},"change_message_id":"0883f5d04d024b78c94cf88401559db9dfc971b8","unresolved":false,"context_lines":[{"line_number":315,"context_line":"               \u0027 unknown the token will be rejected. \"required\" any form of\u0027"},{"line_number":316,"context_line":"               \u0027 token binding is needed to be allowed. Finally the name of a\u0027"},{"line_number":317,"context_line":"               \u0027 binding method that must be present in tokens.\u0027),"},{"line_number":318,"context_line":"    cfg.BoolOpt(\u0027check_revocations_for_cached\u0027, default\u003dFalse,"},{"line_number":319,"context_line":"                help\u003d\u0027If true, the revocation list will be checked for cached\u0027"},{"line_number":320,"context_line":"                \u0027 tokens. This requires that PKI tokens are configured on the\u0027"},{"line_number":321,"context_line":"                \u0027 Keystone server.\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad9bd40_faedd68c","line":318,"in_reply_to":"9ad9bd40_7a73864d","updated":"2014-04-30 15:56:44.000000000","message":"Wouldn\u0027t is_asn1_token still work on the cached data?","commit_id":"6dfb64c95b77aa182f25f8bcc0f8c5f44b85f823"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"e381a87d23d751f649ae398f85587b4757bd32bb","unresolved":false,"context_lines":[{"line_number":315,"context_line":"               \u0027 unknown the token will be rejected. \"required\" any form of\u0027"},{"line_number":316,"context_line":"               \u0027 token binding is needed to be allowed. Finally the name of a\u0027"},{"line_number":317,"context_line":"               \u0027 binding method that must be present in tokens.\u0027),"},{"line_number":318,"context_line":"    cfg.BoolOpt(\u0027check_revocations_for_cached\u0027, default\u003dFalse,"},{"line_number":319,"context_line":"                help\u003d\u0027If true, the revocation list will be checked for cached\u0027"},{"line_number":320,"context_line":"                \u0027 tokens. This requires that PKI tokens are configured on the\u0027"},{"line_number":321,"context_line":"                \u0027 Keystone server.\u0027),"}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad9bd40_bdeee820","line":318,"in_reply_to":"9ad9bd40_faedd68c","updated":"2014-04-30 16:07:37.000000000","message":"Brian - We\u0027re not storing the user_token in the cache, we store the data after decrypting and JSON-decoding. If clients were passing in token hashes only we wouldn\u0027t know that it was originally PKI.","commit_id":"6dfb64c95b77aa182f25f8bcc0f8c5f44b85f823"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"4e2686aa8b23ea80cb342fd2a1e41e86b79329f5","unresolved":false,"context_lines":[{"line_number":318,"context_line":"    cfg.BoolOpt(\u0027check_revocations_for_cached\u0027, default\u003dFalse,"},{"line_number":319,"context_line":"                help\u003d\u0027If true, the revocation list will be checked for cached\u0027"},{"line_number":320,"context_line":"                \u0027 tokens. This requires that PKI tokens are configured on the\u0027"},{"line_number":321,"context_line":"                \u0027 Keystone server.\u0027),"},{"line_number":322,"context_line":"]"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"CONF \u003d cfg.CONF"}],"source_content_type":"text/x-python","patch_set":3,"id":"9ad9bd40_73b028de","line":321,"updated":"2014-04-30 02:22:02.000000000","message":"introducing a configuration variable for this means that we can\u0027t release this fix as 0.8.1, but rather it needs to go out as 0.9.0","commit_id":"6dfb64c95b77aa182f25f8bcc0f8c5f44b85f823"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"6fdafae84b86fecbb93f7d2325f7213c12f1f8f6","unresolved":false,"context_lines":[{"line_number":315,"context_line":"               \u0027 unknown the token will be rejected. \"required\" any form of\u0027"},{"line_number":316,"context_line":"               \u0027 token binding is needed to be allowed. Finally the name of a\u0027"},{"line_number":317,"context_line":"               \u0027 binding method that must be present in tokens.\u0027),"},{"line_number":318,"context_line":"    cfg.BoolOpt(\u0027check_revocations_for_cached\u0027, default\u003dTrue,"},{"line_number":319,"context_line":"                help\u003d\u0027If true, the revocation list will be checked for cached\u0027"},{"line_number":320,"context_line":"                \u0027 tokens. This requires that PKI tokens are configured on the\u0027"},{"line_number":321,"context_line":"                \u0027 Keystone server.\u0027),"}],"source_content_type":"text/x-python","patch_set":4,"id":"9ad9bd40_104b2488","line":318,"updated":"2014-05-01 16:06:58.000000000","message":"so now this is just as broken as in 0.8.0, unless UUID users add new configuration to disable this option. my preferred \"fix\" to this issue is to revert to the 0.7.1 behavior without a new configuration option, and then we can re-introduce this extra revocation check in a subsequent release","commit_id":"e34289c105b94620d2b99433a9552eb103370739"}]}