)]}'
{"keystoneclient/middleware/auth_token.py":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"ea627da5b99ea69aa155751a78c07aede12fb2a6","unresolved":false,"context_lines":[{"line_number":237,"context_line":"                \u0027 API server.\u0027),"},{"line_number":238,"context_line":"    cfg.BoolOpt(\u0027revocation_events_enabled\u0027,"},{"line_number":239,"context_line":"                default\u003dFalse,"},{"line_number":240,"context_line":"                help\u003d\u0027If True, revocation events will be scrubbed to\u0027"},{"line_number":241,"context_line":"                \u0027 determine tokens have been revoked. This requires that\u0027"},{"line_number":242,"context_line":"                \u0027 revocation events are configured on the Keystone server.\u0027),"},{"line_number":243,"context_line":"    cfg.IntOpt(\u0027http_request_max_retries\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"1ae5cdf2_8c922e55","line":240,"updated":"2014-06-12 21:14:03.000000000","message":"if true token will be checked against the revocation events for validity.  If flase, they will be checked aginst the revocation_list.","commit_id":"5bed884927402d7b8fbf56168c4746133af1893f"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"d1e7626d4585d2caaec3cb6a9c1ab41ea3edad9d","unresolved":false,"context_lines":[{"line_number":237,"context_line":"                \u0027 API server.\u0027),"},{"line_number":238,"context_line":"    cfg.BoolOpt(\u0027revocation_events_enabled\u0027,"},{"line_number":239,"context_line":"                default\u003dFalse,"},{"line_number":240,"context_line":"                help\u003d\u0027If True, revocation events will be scrubbed to\u0027"},{"line_number":241,"context_line":"                \u0027 determine tokens have been revoked. This requires that\u0027"},{"line_number":242,"context_line":"                \u0027 revocation events are configured on the Keystone server.\u0027),"},{"line_number":243,"context_line":"    cfg.IntOpt(\u0027http_request_max_retries\u0027,"}],"source_content_type":"text/x-python","patch_set":1,"id":"1ae5cdf2_2304b348","line":240,"in_reply_to":"1ae5cdf2_8c922e55","updated":"2014-06-13 13:52:53.000000000","message":"Done","commit_id":"5bed884927402d7b8fbf56168c4746133af1893f"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"ea627da5b99ea69aa155751a78c07aede12fb2a6","unresolved":false,"context_lines":[{"line_number":922,"context_line":"                    # regardless of initial mechanism used to validate it,"},{"line_number":923,"context_line":"                    # and needs to be checked."},{"line_number":924,"context_line":"                    for tid in token_ids:"},{"line_number":925,"context_line":"                        is_revoked \u003d self.is_signed_token_revoked([tid])"},{"line_number":926,"context_line":"                        if is_revoked:"},{"line_number":927,"context_line":"                            self.LOG.debug("},{"line_number":928,"context_line":"                                \u0027Token is marked as having been revoked\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1ae5cdf2_ec8ad219","line":925,"updated":"2014-06-12 21:14:03.000000000","message":"I don\u0027t think this is going to work.  For Signed tokens, you need to unpack the token first.","commit_id":"5bed884927402d7b8fbf56168c4746133af1893f"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"d1e7626d4585d2caaec3cb6a9c1ab41ea3edad9d","unresolved":false,"context_lines":[{"line_number":922,"context_line":"                    # regardless of initial mechanism used to validate it,"},{"line_number":923,"context_line":"                    # and needs to be checked."},{"line_number":924,"context_line":"                    for tid in token_ids:"},{"line_number":925,"context_line":"                        is_revoked \u003d self.is_signed_token_revoked([tid])"},{"line_number":926,"context_line":"                        if is_revoked:"},{"line_number":927,"context_line":"                            self.LOG.debug("},{"line_number":928,"context_line":"                                \u0027Token is marked as having been revoked\u0027)"}],"source_content_type":"text/x-python","patch_set":1,"id":"1ae5cdf2_83f58752","line":925,"in_reply_to":"1ae5cdf2_ec8ad219","updated":"2014-06-13 13:52:53.000000000","message":"Noted as per our conversation. Will reconfigure.","commit_id":"5bed884927402d7b8fbf56168c4746133af1893f"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"687c841fb0e52776589cd3ec7c792f1510328a5a","unresolved":false,"context_lines":[{"line_number":922,"context_line":"                    # regardless of initial mechanism used to validate it,"},{"line_number":923,"context_line":"                    # and needs to be checked."},{"line_number":924,"context_line":"                    for tid in token_ids:"},{"line_number":925,"context_line":"                        is_revoked \u003d self.is_signed_token_revoked([tid])"},{"line_number":926,"context_line":"                        if is_revoked:"},{"line_number":927,"context_line":"                            self.LOG.debug("},{"line_number":928,"context_line":"                                \u0027Token is marked as having been revoked\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_462e2344","line":925,"updated":"2014-06-13 19:26:22.000000000","message":"pass data in to it here as well","commit_id":"da54cef6823247bd6cbabfe7ed3fd73bf03a616a"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"308d4ebb675ffddc9c3efe104847354318f344b6","unresolved":false,"context_lines":[{"line_number":922,"context_line":"                    # regardless of initial mechanism used to validate it,"},{"line_number":923,"context_line":"                    # and needs to be checked."},{"line_number":924,"context_line":"                    for tid in token_ids:"},{"line_number":925,"context_line":"                        is_revoked \u003d self.is_signed_token_revoked([tid])"},{"line_number":926,"context_line":"                        if is_revoked:"},{"line_number":927,"context_line":"                            self.LOG.debug("},{"line_number":928,"context_line":"                                \u0027Token is marked as having been revoked\u0027)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_b629a78b","line":925,"in_reply_to":"1ae5cdf2_462e2344","updated":"2014-06-16 12:50:06.000000000","message":"Done","commit_id":"da54cef6823247bd6cbabfe7ed3fd73bf03a616a"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"687c841fb0e52776589cd3ec7c792f1510328a5a","unresolved":false,"context_lines":[{"line_number":929,"context_line":"                            raise InvalidUserToken("},{"line_number":930,"context_line":"                                \u0027Token authorization failed\u0027)"},{"line_number":931,"context_line":"            elif cms.is_pkiz(user_token):"},{"line_number":932,"context_line":"                if self.is_signed_token_revoked(token_ids):"},{"line_number":933,"context_line":"                    raise InvalidUserToken(\u0027Token has been revoked\u0027)"},{"line_number":934,"context_line":"                verified \u003d self.verify_pkiz_token(user_token, token_ids)"},{"line_number":935,"context_line":"                data \u003d jsonutils.loads(verified)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_a6a6070d","line":932,"updated":"2014-06-13 19:26:22.000000000","message":"move this call to after line 940 and you will be able to do the logic for revcation events inside that function","commit_id":"da54cef6823247bd6cbabfe7ed3fd73bf03a616a"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"308d4ebb675ffddc9c3efe104847354318f344b6","unresolved":false,"context_lines":[{"line_number":929,"context_line":"                            raise InvalidUserToken("},{"line_number":930,"context_line":"                                \u0027Token authorization failed\u0027)"},{"line_number":931,"context_line":"            elif cms.is_pkiz(user_token):"},{"line_number":932,"context_line":"                if self.is_signed_token_revoked(token_ids):"},{"line_number":933,"context_line":"                    raise InvalidUserToken(\u0027Token has been revoked\u0027)"},{"line_number":934,"context_line":"                verified \u003d self.verify_pkiz_token(user_token, token_ids)"},{"line_number":935,"context_line":"                data \u003d jsonutils.loads(verified)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_16389bd3","line":932,"in_reply_to":"1ae5cdf2_a6a6070d","updated":"2014-06-16 12:50:06.000000000","message":"Done","commit_id":"da54cef6823247bd6cbabfe7ed3fd73bf03a616a"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"687c841fb0e52776589cd3ec7c792f1510328a5a","unresolved":false,"context_lines":[{"line_number":934,"context_line":"                verified \u003d self.verify_pkiz_token(user_token, token_ids)"},{"line_number":935,"context_line":"                data \u003d jsonutils.loads(verified)"},{"line_number":936,"context_line":"            elif cms.is_asn1_token(user_token):"},{"line_number":937,"context_line":"                if self.is_signed_token_revoked(token_ids):"},{"line_number":938,"context_line":"                    raise InvalidUserToken(\u0027Token has been revoked\u0027)"},{"line_number":939,"context_line":"                verified \u003d self.verify_signed_token(user_token, token_ids)"},{"line_number":940,"context_line":"                data \u003d jsonutils.loads(verified)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_e6abafd3","line":937,"updated":"2014-06-13 19:26:22.000000000","message":"same with this, move it to 940.","commit_id":"da54cef6823247bd6cbabfe7ed3fd73bf03a616a"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"308d4ebb675ffddc9c3efe104847354318f344b6","unresolved":false,"context_lines":[{"line_number":934,"context_line":"                verified \u003d self.verify_pkiz_token(user_token, token_ids)"},{"line_number":935,"context_line":"                data \u003d jsonutils.loads(verified)"},{"line_number":936,"context_line":"            elif cms.is_asn1_token(user_token):"},{"line_number":937,"context_line":"                if self.is_signed_token_revoked(token_ids):"},{"line_number":938,"context_line":"                    raise InvalidUserToken(\u0027Token has been revoked\u0027)"},{"line_number":939,"context_line":"                verified \u003d self.verify_signed_token(user_token, token_ids)"},{"line_number":940,"context_line":"                data \u003d jsonutils.loads(verified)"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_363597db","line":937,"in_reply_to":"1ae5cdf2_e6abafd3","updated":"2014-06-16 12:50:06.000000000","message":"Done","commit_id":"da54cef6823247bd6cbabfe7ed3fd73bf03a616a"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"687c841fb0e52776589cd3ec7c792f1510328a5a","unresolved":false,"context_lines":[{"line_number":1302,"context_line":""},{"line_number":1303,"context_line":"            raise InvalidUserToken()"},{"line_number":1304,"context_line":""},{"line_number":1305,"context_line":"    def is_signed_token_revoked(self, token_ids):"},{"line_number":1306,"context_line":"        \"\"\"Indicate whether the token is revoked.\"\"\""},{"line_number":1307,"context_line":"        if self._conf_get(\u0027revocation_events_enabled\u0027):"},{"line_number":1308,"context_line":"            for token_id in token_ids:"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_06b7bb3a","line":1305,"updated":"2014-06-13 19:26:22.000000000","message":"expand the parameter list to take the data as well as the token_ids","commit_id":"da54cef6823247bd6cbabfe7ed3fd73bf03a616a"},{"author":{"_account_id":11589,"name":"Harry Rybacki","email":"hrybacki@redhat.com","username":"hrybacki"},"change_message_id":"308d4ebb675ffddc9c3efe104847354318f344b6","unresolved":false,"context_lines":[{"line_number":1302,"context_line":""},{"line_number":1303,"context_line":"            raise InvalidUserToken()"},{"line_number":1304,"context_line":""},{"line_number":1305,"context_line":"    def is_signed_token_revoked(self, token_ids):"},{"line_number":1306,"context_line":"        \"\"\"Indicate whether the token is revoked.\"\"\""},{"line_number":1307,"context_line":"        if self._conf_get(\u0027revocation_events_enabled\u0027):"},{"line_number":1308,"context_line":"            for token_id in token_ids:"}],"source_content_type":"text/x-python","patch_set":2,"id":"1ae5cdf2_b650c70b","line":1305,"in_reply_to":"1ae5cdf2_06b7bb3a","updated":"2014-06-16 12:50:06.000000000","message":"I opted to use an optional parameter. There were _way_ too many regression faults in the middleware tests otherwise.","commit_id":"da54cef6823247bd6cbabfe7ed3fd73bf03a616a"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"595a26b1798360ea5c09d6a6764e5946641cb7a0","unresolved":false,"context_lines":[{"line_number":1333,"context_line":"    def _is_token_in_revocation_events(self, token_id, data):"},{"line_number":1334,"context_line":"        \"\"\"Indicates if the token has is subject to a revocation event.\"\"\""},{"line_number":1335,"context_line":"        # TODO(hrybacki) connect with RevocationEventManager and unstub this!"},{"line_number":1336,"context_line":"        return False"},{"line_number":1337,"context_line":""},{"line_number":1338,"context_line":"    def cms_verify(self, data, inform\u003dcms.PKI_ASN1_FORM):"},{"line_number":1339,"context_line":"        \"\"\"Verifies the signature of the provided data\u0027s IAW CMS syntax."}],"source_content_type":"text/x-python","patch_set":5,"id":"1ae5cdf2_f23dc92d","line":1336,"updated":"2014-06-17 14:02:37.000000000","message":"I think this call reduces to \n\nreturn admin_client.revocations.is_revoked(data)\n\nBut it needs to be rebased on top of https://review.openstack.org/#/c/74908/","commit_id":"e40e76863f00a9c921790d2b691932dadd069cda"},{"author":{"_account_id":11333,"name":"David J Hu","email":"david.hu@hpe.com","username":"dhu"},"change_message_id":"66c0ff10067c2b4cfb8e065df5c7e4a6d679c2c6","unresolved":false,"context_lines":[{"line_number":1367,"context_line":"                raise"},{"line_number":1368,"context_line":""},{"line_number":1369,"context_line":"    def verify_signed_token(self, signed_text, token_ids):"},{"line_number":1370,"context_line":"        \"\"\"Check that the token is unrevoked and has a valid signature.\"\"\""},{"line_number":1371,"context_line":"        formatted \u003d cms.token_to_cms(signed_text)"},{"line_number":1372,"context_line":"        verified \u003d self.cms_verify(formatted)"},{"line_number":1373,"context_line":"        return verified"}],"source_content_type":"text/x-python","patch_set":5,"id":"1ae5cdf2_1c2a682c","line":1370,"updated":"2014-06-16 21:00:45.000000000","message":"1.  The comment still calls for a token revocation check, however the code that does the checking was removed.\n\n2.  What was the reason that the code no longer checks if the token had been revoked?","commit_id":"e40e76863f00a9c921790d2b691932dadd069cda"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"595a26b1798360ea5c09d6a6764e5946641cb7a0","unresolved":false,"context_lines":[{"line_number":1367,"context_line":"                raise"},{"line_number":1368,"context_line":""},{"line_number":1369,"context_line":"    def verify_signed_token(self, signed_text, token_ids):"},{"line_number":1370,"context_line":"        \"\"\"Check that the token is unrevoked and has a valid signature.\"\"\""},{"line_number":1371,"context_line":"        formatted \u003d cms.token_to_cms(signed_text)"},{"line_number":1372,"context_line":"        verified \u003d self.cms_verify(formatted)"},{"line_number":1373,"context_line":"        return verified"}],"source_content_type":"text/x-python","patch_set":5,"id":"1ae5cdf2_d2ad2d9d","line":1370,"in_reply_to":"1ae5cdf2_1c2a682c","updated":"2014-06-17 14:02:37.000000000","message":"The revocation check was pulled up to a higher level function.  There PKIZ, PKI, and UUID token formats all produce the same data.  Checking the revocation separately makes it impossible to convert the logic from a check on an ID to a check on the contents of the token.\n\nHarry, please remove the \u0027unrevoked\u0027  comment, and also convert this function to be  private  (_verify_signed_token)  as well as for the pkiz version.","commit_id":"e40e76863f00a9c921790d2b691932dadd069cda"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"595a26b1798360ea5c09d6a6764e5946641cb7a0","unresolved":false,"context_lines":[{"line_number":1477,"context_line":"            raise ServiceError(\u0027Revocation list improperly formatted.\u0027)"},{"line_number":1478,"context_line":"        return self.cms_verify(data[\u0027signed\u0027])"},{"line_number":1479,"context_line":""},{"line_number":1480,"context_line":"    def fetch_revocation_events(self, retry\u003dTrue):"},{"line_number":1481,"context_line":"        headers \u003d {\u0027X-Auth-Token\u0027: self.get_admin_token()}"},{"line_number":1482,"context_line":"        response, data \u003d self._json_request(\u0027GET\u0027, \u0027/OS-REVOKE/events\u0027,"},{"line_number":1483,"context_line":"                                            additional_headers\u003dheaders)"}],"source_content_type":"text/x-python","patch_set":5,"id":"1ae5cdf2_7287f912","line":1480,"updated":"2014-06-17 14:02:37.000000000","message":"This should be done by the API, and not by auth_token.","commit_id":"e40e76863f00a9c921790d2b691932dadd069cda"}]}