)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"f2da9628da2c8cb912d64caf2fe0c43b7f7179e2","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Tempauth seems to be not affected, however a small doc update has been added to"},{"line_number":20,"context_line":"make it more clear that an ACL is not needed to access a service account in case"},{"line_number":21,"context_line":"a service token is used."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Further details with an example are available in the bug report"},{"line_number":24,"context_line":"(https://bugs.launchpad.net/swift/+bug/1483007)."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"9a1a9d01_8eb1f491","line":21,"updated":"2015-09-28 08:08:59.000000000","message":"the logic of this sentence seems to be inverted: is it not that a service token is not needed to access a service account container in case that an ACL is used?","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"7356f870ba8b24fd93e5de5f874f270d749d368c","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Tempauth seems to be not affected, however a small doc update has been added to"},{"line_number":20,"context_line":"make it more clear that an ACL is not needed to access a service account in case"},{"line_number":21,"context_line":"a service token is used."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Further details with an example are available in the bug report"},{"line_number":24,"context_line":"(https://bugs.launchpad.net/swift/+bug/1483007)."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"9a1a9d01_74086fda","line":21,"in_reply_to":"9a1a9d01_8eb1f491","updated":"2015-09-30 16:59:07.000000000","message":"Done","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"}],"swift/common/middleware/keystoneauth.py":[{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"1448522a79c3c9f00c6660444025a032a8bf12f1","unresolved":false,"context_lines":[{"line_number":433,"context_line":"            self.logger.debug(msg, tenant_id)"},{"line_number":434,"context_line":"            req.environ[\u0027swift_owner\u0027] \u003d True"},{"line_number":435,"context_line":"            return"},{"line_number":436,"context_line":""},{"line_number":437,"context_line":"        account_prefix \u003d self._get_account_prefix(account)"},{"line_number":438,"context_line":"        if account_prefix:"},{"line_number":439,"context_line":"            service_roles \u003d self.account_rules[account_prefix][\u0027service_roles\u0027]"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba15a1d1_6271b10b","line":436,"updated":"2015-09-24 09:04:33.000000000","message":"The question here is: should a reseller also need a service token? If yes, the new code below needs to be placed above line 429.","commit_id":"ad4a825094eabbb45c38864392dc1c9d19ead1d4"},{"author":{"_account_id":12193,"name":"Hisashi Osanai","email":"osanai.hisashi@jp.fujitsu.com","username":"ho"},"change_message_id":"c095b7ecf1a11154c0bcc48a62158d0e2a9ea82d","unresolved":false,"context_lines":[{"line_number":433,"context_line":"            self.logger.debug(msg, tenant_id)"},{"line_number":434,"context_line":"            req.environ[\u0027swift_owner\u0027] \u003d True"},{"line_number":435,"context_line":"            return"},{"line_number":436,"context_line":""},{"line_number":437,"context_line":"        account_prefix \u003d self._get_account_prefix(account)"},{"line_number":438,"context_line":"        if account_prefix:"},{"line_number":439,"context_line":"            service_roles \u003d self.account_rules[account_prefix][\u0027service_roles\u0027]"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba15a1d1_b06390b0","line":436,"in_reply_to":"ba15a1d1_6271b10b","updated":"2015-09-24 09:21:49.000000000","message":"I think reseller doesn\u0027t need to have a service token because access to different reseller prefix accounts is one of the cross project access so a reseller can do it without having a service token.","commit_id":"ad4a825094eabbb45c38864392dc1c9d19ead1d4"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"0d29e684c015ab81f545483a74763cf095957626","unresolved":false,"context_lines":[{"line_number":433,"context_line":"            self.logger.debug(msg, tenant_id)"},{"line_number":434,"context_line":"            req.environ[\u0027swift_owner\u0027] \u003d True"},{"line_number":435,"context_line":"            return"},{"line_number":436,"context_line":""},{"line_number":437,"context_line":"        account_prefix \u003d self._get_account_prefix(account)"},{"line_number":438,"context_line":"        if account_prefix:"},{"line_number":439,"context_line":"            service_roles \u003d self.account_rules[account_prefix][\u0027service_roles\u0027]"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba15a1d1_90d52c1d","line":436,"in_reply_to":"ba15a1d1_b06390b0","updated":"2015-09-24 09:32:56.000000000","message":"Agree.","commit_id":"ad4a825094eabbb45c38864392dc1c9d19ead1d4"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"93458eeda5b5e60c8bcff26787f2363dc2625429","unresolved":false,"context_lines":[{"line_number":506,"context_line":"        if acl_authorized is not None:"},{"line_number":507,"context_line":"            return self.denied_response(req)"},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"        # Cleanup - make sure that a previously set swift_owner setting, that"},{"line_number":510,"context_line":"        # did not yet return, is cleared now. This might happen for example"},{"line_number":511,"context_line":"        # with COPY requests"},{"line_number":512,"context_line":"        req.environ[\u0027swift_owner\u0027] \u003d False"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a1a9d01_dccef882","line":509,"updated":"2015-09-25 10:56:47.000000000","message":"Too late? we return with ACLs above at line 455, 460","commit_id":"e780619affb5f77a19062ab70608164ef09f9e3b"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"f8ebe7ceeffd3adb2f934a0d30a167d722e10c4c","unresolved":false,"context_lines":[{"line_number":506,"context_line":"        if acl_authorized is not None:"},{"line_number":507,"context_line":"            return self.denied_response(req)"},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"        # Cleanup - make sure that a previously set swift_owner setting, that"},{"line_number":510,"context_line":"        # did not yet return, is cleared now. This might happen for example"},{"line_number":511,"context_line":"        # with COPY requests"},{"line_number":512,"context_line":"        req.environ[\u0027swift_owner\u0027] \u003d False"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a1a9d01_e536bc02","line":509,"in_reply_to":"9a1a9d01_5c60a835","updated":"2015-09-25 14:44:07.000000000","message":"I agree. I\u0027ve been trying to think if this represents a change of behavior for any existing feature, but can\u0027t come up with anything. Even in the case where several auths are in the pipeline, you don\u0027t want swift_owner from one of the auths to influence *this* auth. In anycase, with multiple auths you would have distinct account and token namespaces so it\u0027s hard to see a use case where a single request would involve two auths at once.","commit_id":"e780619affb5f77a19062ab70608164ef09f9e3b"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"d90cb9c2a4ca41ac4bc136b671cdc343fc2b9244","unresolved":false,"context_lines":[{"line_number":506,"context_line":"        if acl_authorized is not None:"},{"line_number":507,"context_line":"            return self.denied_response(req)"},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"        # Cleanup - make sure that a previously set swift_owner setting, that"},{"line_number":510,"context_line":"        # did not yet return, is cleared now. This might happen for example"},{"line_number":511,"context_line":"        # with COPY requests"},{"line_number":512,"context_line":"        req.environ[\u0027swift_owner\u0027] \u003d False"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a1a9d01_5c60a835","line":509,"in_reply_to":"9a1a9d01_dccef882","updated":"2015-09-25 11:02:50.000000000","message":"Hmm, maybe we should do this right at the beginning of authorize?","commit_id":"e780619affb5f77a19062ab70608164ef09f9e3b"},{"author":{"_account_id":12193,"name":"Hisashi Osanai","email":"osanai.hisashi@jp.fujitsu.com","username":"ho"},"change_message_id":"594c04365a16f79a521ac87371c8b28182e7225b","unresolved":false,"context_lines":[{"line_number":506,"context_line":"        if acl_authorized is not None:"},{"line_number":507,"context_line":"            return self.denied_response(req)"},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"        # Cleanup - make sure that a previously set swift_owner setting, that"},{"line_number":510,"context_line":"        # did not yet return, is cleared now. This might happen for example"},{"line_number":511,"context_line":"        # with COPY requests"},{"line_number":512,"context_line":"        req.environ[\u0027swift_owner\u0027] \u003d False"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a1a9d01_1a7a02f2","line":509,"in_reply_to":"9a1a9d01_e536bc02","updated":"2015-09-28 04:26:31.000000000","message":"I think this behavior is related to swift_owner handling when a method is marked with delay_denial. We have two choice to put clearing swift_owner in environ logic.\n\nif \u0027swift_owner\u0027 in req.environ:\n    del req.environ[\u0027swift_owner\u0027]\n\n(1) put the logic at the beginning of authorize\n(2) put the logic after the delay_denial handling in server.py (my patch)\n\nI prefer to (2) because keystoneauth works right but delay_denial doesn\u0027t remove swift_owner even if he executes authorize again.\n\nbut both cases I will put +1","commit_id":"e780619affb5f77a19062ab70608164ef09f9e3b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"f2da9628da2c8cb912d64caf2fe0c43b7f7179e2","unresolved":false,"context_lines":[{"line_number":133,"context_line":"    the syntax ``\u003ctenant\u003e:\u003cuser\u003e`` to specify a grantee in container Access"},{"line_number":134,"context_line":"    Control Lists (ACLs). For a request to be granted by an ACL, the grantee"},{"line_number":135,"context_line":"    ``\u003ctenant\u003e`` must match the UUID of the tenant to which the request"},{"line_number":136,"context_line":"    token is scoped and the grantee ``\u003cuser\u003e`` must match the UUID of the"},{"line_number":137,"context_line":"    user authenticated by the request token."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    Note that names must no longer be used in cross-tenant ACLs because with"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_eeebd076","line":136,"updated":"2015-09-28 08:08:59.000000000","message":"we should clarify on this paragraph (above) that \"request token\" means \"X-Auth-Token\".\n\nIn fact, I wonder if we have any tests to verify that the user/project id in a service token is NOT used to validate an ACL. A follow on patch perhaps.","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"7356f870ba8b24fd93e5de5f874f270d749d368c","unresolved":false,"context_lines":[{"line_number":133,"context_line":"    the syntax ``\u003ctenant\u003e:\u003cuser\u003e`` to specify a grantee in container Access"},{"line_number":134,"context_line":"    Control Lists (ACLs). For a request to be granted by an ACL, the grantee"},{"line_number":135,"context_line":"    ``\u003ctenant\u003e`` must match the UUID of the tenant to which the request"},{"line_number":136,"context_line":"    token is scoped and the grantee ``\u003cuser\u003e`` must match the UUID of the"},{"line_number":137,"context_line":"    user authenticated by the request token."},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    Note that names must no longer be used in cross-tenant ACLs because with"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_5411ab02","line":136,"in_reply_to":"9a1a9d01_eeebd076","updated":"2015-09-30 16:59:07.000000000","message":"Done","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"f2da9628da2c8cb912d64caf2fe0c43b7f7179e2","unresolved":false,"context_lines":[{"line_number":407,"context_line":""},{"line_number":408,"context_line":"    def authorize(self, env_identity, req):"},{"line_number":409,"context_line":"        # Cleanup - make sure that a previously set swift_owner setting, that"},{"line_number":410,"context_line":"        # did not yet return, is cleared now. This might happen for example"},{"line_number":411,"context_line":"        # with COPY requests"},{"line_number":412,"context_line":"        req.environ[\u0027swift_owner\u0027] \u003d False"},{"line_number":413,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_f3297938","line":410,"updated":"2015-09-28 08:08:59.000000000","message":"nit: not 100% clear to me what \u0027did not yet return\u0027 means .","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"7356f870ba8b24fd93e5de5f874f270d749d368c","unresolved":false,"context_lines":[{"line_number":407,"context_line":""},{"line_number":408,"context_line":"    def authorize(self, env_identity, req):"},{"line_number":409,"context_line":"        # Cleanup - make sure that a previously set swift_owner setting, that"},{"line_number":410,"context_line":"        # did not yet return, is cleared now. This might happen for example"},{"line_number":411,"context_line":"        # with COPY requests"},{"line_number":412,"context_line":"        req.environ[\u0027swift_owner\u0027] \u003d False"},{"line_number":413,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_340e77e5","line":410,"in_reply_to":"9a1a9d01_f3297938","updated":"2015-09-30 16:59:07.000000000","message":"Done","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"},{"author":{"_account_id":12193,"name":"Hisashi Osanai","email":"osanai.hisashi@jp.fujitsu.com","username":"ho"},"change_message_id":"9187e0fb97097956c3a1364c5113f80940400343","unresolved":false,"context_lines":[{"line_number":408,"context_line":"    def authorize(self, env_identity, req):"},{"line_number":409,"context_line":"        # Cleanup - make sure that a previously set swift_owner setting is"},{"line_number":410,"context_line":"        # cleared now. This might happen for example with COPY requests."},{"line_number":411,"context_line":"        req.environ[\u0027swift_owner\u0027] \u003d False"},{"line_number":412,"context_line":""},{"line_number":413,"context_line":"        tenant_id, tenant_name \u003d env_identity[\u0027tenant\u0027]"},{"line_number":414,"context_line":"        user_id, user_name \u003d env_identity[\u0027user\u0027]"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a1a9d01_b924ae0c","line":411,"updated":"2015-10-01 01:10:17.000000000","message":"I prefer to remove the key from the environ because there is no code that initializes the value with False. So to keep consistency we have two patterns swift_owner in environ with true or no swift_owner in environ.\n\nchecked list:\nhttp://paste.openstack.org/show/474980/","commit_id":"b66c4e10dce0f9dbeffcee736647b429bd2056be"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3d9a0f80a238a5915c1eafa4c0b62f56ad8debc1","unresolved":false,"context_lines":[{"line_number":408,"context_line":"    def authorize(self, env_identity, req):"},{"line_number":409,"context_line":"        # Cleanup - make sure that a previously set swift_owner setting is"},{"line_number":410,"context_line":"        # cleared now. This might happen for example with COPY requests."},{"line_number":411,"context_line":"        req.environ[\u0027swift_owner\u0027] \u003d False"},{"line_number":412,"context_line":""},{"line_number":413,"context_line":"        tenant_id, tenant_name \u003d env_identity[\u0027tenant\u0027]"},{"line_number":414,"context_line":"        user_id, user_name \u003d env_identity[\u0027user\u0027]"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a1a9d01_d2e854b5","line":411,"in_reply_to":"9a1a9d01_b924ae0c","updated":"2015-10-01 09:03:03.000000000","message":"Done","commit_id":"b66c4e10dce0f9dbeffcee736647b429bd2056be"},{"author":{"_account_id":330,"name":"John Dickinson","email":"me@not.mn","username":"notmyname"},"change_message_id":"674ea5dbc145c447be3457f2702dfc93ca85de19","unresolved":false,"context_lines":[{"line_number":477,"context_line":"        # in operator_roles? service_roles? in service_roles?     swift_owner?"},{"line_number":478,"context_line":"        # ------------------ -------------- --------------------  ------------"},{"line_number":479,"context_line":"        # yes                yes            yes                   yes"},{"line_number":480,"context_line":"        # yes                no             don\u0027t care            yes"},{"line_number":481,"context_line":"        # no                 don\u0027t care     don\u0027t care            no"},{"line_number":482,"context_line":"        # ------------------ -------------- --------------------  ------------"},{"line_number":483,"context_line":"        account_prefix \u003d self._get_account_prefix(account)"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a1a9d01_79b3764d","line":480,"updated":"2015-10-01 00:51:20.000000000","message":"is there another line that needs to be here?\n\n\n        # yes                yes             no            no","commit_id":"b66c4e10dce0f9dbeffcee736647b429bd2056be"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"500ba0b9a582d9f23c766772055a4f6790ae661b","unresolved":false,"context_lines":[{"line_number":477,"context_line":"        # in operator_roles? service_roles? in service_roles?     swift_owner?"},{"line_number":478,"context_line":"        # ------------------ -------------- --------------------  ------------"},{"line_number":479,"context_line":"        # yes                yes            yes                   yes"},{"line_number":480,"context_line":"        # yes                no             don\u0027t care            yes"},{"line_number":481,"context_line":"        # no                 don\u0027t care     don\u0027t care            no"},{"line_number":482,"context_line":"        # ------------------ -------------- --------------------  ------------"},{"line_number":483,"context_line":"        account_prefix \u003d self._get_account_prefix(account)"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a1a9d01_86cf0155","line":480,"in_reply_to":"9a1a9d01_79b3764d","updated":"2015-10-01 08:42:10.000000000","message":"Correct -- probably best placed as second entry in the table","commit_id":"b66c4e10dce0f9dbeffcee736647b429bd2056be"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3d9a0f80a238a5915c1eafa4c0b62f56ad8debc1","unresolved":false,"context_lines":[{"line_number":477,"context_line":"        # in operator_roles? service_roles? in service_roles?     swift_owner?"},{"line_number":478,"context_line":"        # ------------------ -------------- --------------------  ------------"},{"line_number":479,"context_line":"        # yes                yes            yes                   yes"},{"line_number":480,"context_line":"        # yes                no             don\u0027t care            yes"},{"line_number":481,"context_line":"        # no                 don\u0027t care     don\u0027t care            no"},{"line_number":482,"context_line":"        # ------------------ -------------- --------------------  ------------"},{"line_number":483,"context_line":"        account_prefix \u003d self._get_account_prefix(account)"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a1a9d01_a9ae967e","line":480,"in_reply_to":"9a1a9d01_79b3764d","updated":"2015-10-01 09:03:03.000000000","message":"Done","commit_id":"b66c4e10dce0f9dbeffcee736647b429bd2056be"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"3d9a0f80a238a5915c1eafa4c0b62f56ad8debc1","unresolved":false,"context_lines":[{"line_number":477,"context_line":"        # in operator_roles? service_roles? in service_roles?     swift_owner?"},{"line_number":478,"context_line":"        # ------------------ -------------- --------------------  ------------"},{"line_number":479,"context_line":"        # yes                yes            yes                   yes"},{"line_number":480,"context_line":"        # yes                no             don\u0027t care            yes"},{"line_number":481,"context_line":"        # no                 don\u0027t care     don\u0027t care            no"},{"line_number":482,"context_line":"        # ------------------ -------------- --------------------  ------------"},{"line_number":483,"context_line":"        account_prefix \u003d self._get_account_prefix(account)"}],"source_content_type":"text/x-python","patch_set":9,"id":"9a1a9d01_09bc62b9","line":480,"in_reply_to":"9a1a9d01_86cf0155","updated":"2015-10-01 09:03:03.000000000","message":"Done","commit_id":"b66c4e10dce0f9dbeffcee736647b429bd2056be"}],"swift/common/middleware/tempauth.py":[{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"1448522a79c3c9f00c6660444025a032a8bf12f1","unresolved":false,"context_lines":[{"line_number":502,"context_line":"            self.logger.debug(\"User %s has reseller admin authorizing.\""},{"line_number":503,"context_line":"                              % account_user)"},{"line_number":504,"context_line":"            return None"},{"line_number":505,"context_line":""},{"line_number":506,"context_line":"        account_prefix \u003d self._get_account_prefix(account)"},{"line_number":507,"context_line":"        require_group \u003d self.account_rules.get(account_prefix).get("},{"line_number":508,"context_line":"            \u0027require_group\u0027)"}],"source_content_type":"text/x-python","patch_set":3,"id":"ba15a1d1_0261d538","line":505,"updated":"2015-09-24 09:04:33.000000000","message":"Same question here - should a reseller also need a service token? If yes, the new code below needs to be placed above line 497.","commit_id":"ad4a825094eabbb45c38864392dc1c9d19ead1d4"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"06a0197bdef557dc2a59a7e4a37ac17196c07609","unresolved":false,"context_lines":[{"line_number":532,"context_line":"                and \u0027x-timestamp\u0027 in req.headers):"},{"line_number":533,"context_line":"            self.logger.debug(\"Allow request with container sync-key: %s.\""},{"line_number":534,"context_line":"                              % req.environ[\u0027swift_sync_key\u0027])"},{"line_number":535,"context_line":"            return None"},{"line_number":536,"context_line":""},{"line_number":537,"context_line":"        if req.method \u003d\u003d \u0027OPTIONS\u0027:"},{"line_number":538,"context_line":"            # allow OPTIONS requests to proceed as normal"}],"source_content_type":"text/x-python","patch_set":4,"id":"9a1a9d01_3120a0f7","line":535,"updated":"2015-09-24 15:28:28.000000000","message":"func tests fail because this comes too late and an OPTIONS request against SERVICE_ account fails.\n\nAs an experiment, I moved this up. but hit another func test failure. Still debugging that one.","commit_id":"d456faa26e4665480264ff1b2407f08b4a733909"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"f2da9628da2c8cb912d64caf2fe0c43b7f7179e2","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    X-Service-Token:"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"    If an X-Service-Token is presented in the request headers, the groups"},{"line_number":96,"context_line":"    derived from the token are appended to the roles derived form"},{"line_number":97,"context_line":"    X-Auth-Token. If X-Auth-Token is missing or invalid, X-Service-Token"},{"line_number":98,"context_line":"    is not processed."},{"line_number":99,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_b3e30105","line":96,"updated":"2015-09-28 08:08:59.000000000","message":"nit: if you need another version then s/form/from/ here as well","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"7356f870ba8b24fd93e5de5f874f270d749d368c","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    X-Service-Token:"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"    If an X-Service-Token is presented in the request headers, the groups"},{"line_number":96,"context_line":"    derived from the token are appended to the roles derived form"},{"line_number":97,"context_line":"    X-Auth-Token. If X-Auth-Token is missing or invalid, X-Service-Token"},{"line_number":98,"context_line":"    is not processed."},{"line_number":99,"context_line":""}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_be190624","line":96,"in_reply_to":"9a1a9d01_b3e30105","updated":"2015-09-30 16:59:07.000000000","message":"Done","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"},{"author":{"_account_id":7233,"name":"Matthew Oliver","email":"matt@oliver.net.au","username":"mattoliverau"},"change_message_id":"1000b95dbdd79cb7dd5b552fa4447396316303a7","unresolved":false,"context_lines":[{"line_number":117,"context_line":"    Please note that it is not required to use a service token in case an ACL"},{"line_number":118,"context_line":"    is set on a container in the service account. In that case the ACL might"},{"line_number":119,"context_line":"    allow access to the container without a service token, just like any other"},{"line_number":120,"context_line":"    cross-reseller request using ACLs."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    Account ACLs:"},{"line_number":123,"context_line":"        If a swift_owner issues a POST or PUT to the account, with the"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_dd824400","line":120,"updated":"2015-09-28 05:54:07.000000000","message":"A above sentence doesn\u0027t ready correctly. And repeats itself. Maybe we can say something like:\n\n  Please note that ACLs can be set on service accounts. As such ACLs can                                                                                                                                                                                      \n  grant access to a service account\u0027s container without needing to provide\n  a service token. Just like any other cross-reseller request using ACLs.","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"7356f870ba8b24fd93e5de5f874f270d749d368c","unresolved":false,"context_lines":[{"line_number":117,"context_line":"    Please note that it is not required to use a service token in case an ACL"},{"line_number":118,"context_line":"    is set on a container in the service account. In that case the ACL might"},{"line_number":119,"context_line":"    allow access to the container without a service token, just like any other"},{"line_number":120,"context_line":"    cross-reseller request using ACLs."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    Account ACLs:"},{"line_number":123,"context_line":"        If a swift_owner issues a POST or PUT to the account, with the"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_3edc1645","line":120,"in_reply_to":"9a1a9d01_13898d26","updated":"2015-09-30 16:59:07.000000000","message":"Done","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"7356f870ba8b24fd93e5de5f874f270d749d368c","unresolved":false,"context_lines":[{"line_number":117,"context_line":"    Please note that it is not required to use a service token in case an ACL"},{"line_number":118,"context_line":"    is set on a container in the service account. In that case the ACL might"},{"line_number":119,"context_line":"    allow access to the container without a service token, just like any other"},{"line_number":120,"context_line":"    cross-reseller request using ACLs."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    Account ACLs:"},{"line_number":123,"context_line":"        If a swift_owner issues a POST or PUT to the account, with the"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_9ed9a259","line":120,"in_reply_to":"9a1a9d01_dd824400","updated":"2015-09-30 16:59:07.000000000","message":"Done","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"f2da9628da2c8cb912d64caf2fe0c43b7f7179e2","unresolved":false,"context_lines":[{"line_number":117,"context_line":"    Please note that it is not required to use a service token in case an ACL"},{"line_number":118,"context_line":"    is set on a container in the service account. In that case the ACL might"},{"line_number":119,"context_line":"    allow access to the container without a service token, just like any other"},{"line_number":120,"context_line":"    cross-reseller request using ACLs."},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"    Account ACLs:"},{"line_number":123,"context_line":"        If a swift_owner issues a POST or PUT to the account, with the"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_13898d26","line":120,"in_reply_to":"9a1a9d01_dd824400","updated":"2015-09-28 08:08:59.000000000","message":"Think I prefer Matt\u0027s version, but have a nit re the last sentence (which isn\u0027t a proper sentence ;) ): change to \u0027... a service token, just like any...\u0027\n\nIs the bottom line here that when we evaluate ACLs we do using the X-Auth-Token validated identity info (user, tenant etc) and disregard the existence of X-Service-Token and the identity that it validates?","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"}],"test/unit/common/middleware/test_keystoneauth.py":[{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"93458eeda5b5e60c8bcff26787f2363dc2625429","unresolved":false,"context_lines":[{"line_number":382,"context_line":"        env \u003d {info_key: {\u0027status\u0027: 0, \u0027sysmeta\u0027: {}},"},{"line_number":383,"context_line":"               \u0027keystone.token_info\u0027: _fake_token_info(version\u003d\u00272\u0027)}"},{"line_number":384,"context_line":"        req \u003d Request.blank(path, environ\u003denv, headers\u003dheaders)"},{"line_number":385,"context_line":"        req.method \u003d method"},{"line_number":386,"context_line":"        req.environ[\u0027swift_owner\u0027] \u003d True"},{"line_number":387,"context_line":"        fake_app \u003d FakeApp(iter([(\u0027200 OK\u0027, {}, \u0027\u0027)]))"},{"line_number":388,"context_line":"        test_auth \u003d keystoneauth.filter_factory(conf)(fake_app)"}],"source_content_type":"text/x-python","patch_set":7,"id":"9a1a9d01_bcc5445c","line":385,"updated":"2015-09-25 10:56:47.000000000","message":"Very nice!","commit_id":"e780619affb5f77a19062ab70608164ef09f9e3b"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"f2da9628da2c8cb912d64caf2fe0c43b7f7179e2","unresolved":false,"context_lines":[{"line_number":383,"context_line":"               \u0027keystone.token_info\u0027: _fake_token_info(version\u003d\u00272\u0027)}"},{"line_number":384,"context_line":"        req \u003d Request.blank(path, environ\u003denv, headers\u003dheaders)"},{"line_number":385,"context_line":"        req.method \u003d method"},{"line_number":386,"context_line":"        req.environ[\u0027swift_owner\u0027] \u003d True"},{"line_number":387,"context_line":"        fake_app \u003d FakeApp(iter([(\u0027200 OK\u0027, {}, \u0027\u0027)]))"},{"line_number":388,"context_line":"        test_auth \u003d keystoneauth.filter_factory(conf)(fake_app)"},{"line_number":389,"context_line":"        resp \u003d req.get_response(test_auth)"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_b37301e7","line":386,"updated":"2015-09-28 08:08:59.000000000","message":"hmmm, is there a danger that passing swift_owner\u003dTrue in all of the test scenarios could allow an undetected regression in the positive auth\u0027d cases. I wonder if we should not explicitly test with swift_owner\u003dTrue or False.\n\nHow about something like this?...\nhttp://paste.openstack.org/show/474354/","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"7356f870ba8b24fd93e5de5f874f270d749d368c","unresolved":false,"context_lines":[{"line_number":383,"context_line":"               \u0027keystone.token_info\u0027: _fake_token_info(version\u003d\u00272\u0027)}"},{"line_number":384,"context_line":"        req \u003d Request.blank(path, environ\u003denv, headers\u003dheaders)"},{"line_number":385,"context_line":"        req.method \u003d method"},{"line_number":386,"context_line":"        req.environ[\u0027swift_owner\u0027] \u003d True"},{"line_number":387,"context_line":"        fake_app \u003d FakeApp(iter([(\u0027200 OK\u0027, {}, \u0027\u0027)]))"},{"line_number":388,"context_line":"        test_auth \u003d keystoneauth.filter_factory(conf)(fake_app)"},{"line_number":389,"context_line":"        resp \u003d req.get_response(test_auth)"}],"source_content_type":"text/x-python","patch_set":8,"id":"9a1a9d01_b40287b2","line":386,"in_reply_to":"9a1a9d01_b37301e7","updated":"2015-09-30 16:59:07.000000000","message":"Done","commit_id":"e533eafeb9abc504a998da9885dad67b5b01f134"}]}