)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"78bfb2cf2d41182cea93e9b78ac424ce12778fe7","unresolved":false,"context_lines":[{"line_number":16,"context_line":"keystone v3 environment."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This patch modifies keystoneauth to restrict cross-tenant"},{"line_number":19,"context_line":"ACL matching to use only ids. For backwards compatibility,"},{"line_number":20,"context_line":"names will still be matched in ACLs when both the requesting"},{"line_number":21,"context_line":"user and tenant are known to be in the default domain AND the"},{"line_number":22,"context_line":"account\u0027s tenant is also in the default domain (the default"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"1ae5cdf2_db56a15d","line":19,"updated":"2014-06-27 21:04:55.000000000","message":"to use only ids... if using keystone v3 and not in the default domain?","commit_id":"8547ec1b83274e08fe43fe893a43be1975403f62"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"15432a4718c7906667b772dbcd7dd7c701fa028e","unresolved":false,"context_lines":[{"line_number":16,"context_line":"keystone v3 environment."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"This patch modifies keystoneauth to restrict cross-tenant"},{"line_number":19,"context_line":"ACL matching to use only ids. For backwards compatibility,"},{"line_number":20,"context_line":"names will still be matched in ACLs when both the requesting"},{"line_number":21,"context_line":"user and tenant are known to be in the default domain AND the"},{"line_number":22,"context_line":"account\u0027s tenant is also in the default domain (the default"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"baada198_182aa5e7","line":19,"in_reply_to":"1ae5cdf2_db56a15d","updated":"2014-07-08 11:55:04.000000000","message":"Done","commit_id":"8547ec1b83274e08fe43fe893a43be1975403f62"},{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"78bfb2cf2d41182cea93e9b78ac424ce12778fe7","unresolved":false,"context_lines":[{"line_number":34,"context_line":"domain."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Despite this provision for backwards compatibility, names"},{"line_number":37,"context_line":"should no longer be used when setting new ACLs in any account,"},{"line_number":38,"context_line":"including new accounts in the default domain."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"This change obviously impacts users accustomed to specifying"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"1ae5cdf2_9bbc196e","line":37,"updated":"2014-06-27 21:04:55.000000000","message":"too weak, IMHO.  either they may and will, and they can\u0027t.  saying please don\u0027t do this isn\u0027t good enough unless the plan is basically to support it forever... which might be reasonable?","commit_id":"8547ec1b83274e08fe43fe893a43be1975403f62"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"15432a4718c7906667b772dbcd7dd7c701fa028e","unresolved":false,"context_lines":[{"line_number":34,"context_line":"domain."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Despite this provision for backwards compatibility, names"},{"line_number":37,"context_line":"should no longer be used when setting new ACLs in any account,"},{"line_number":38,"context_line":"including new accounts in the default domain."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"This change obviously impacts users accustomed to specifying"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"baada198_78ec8190","line":37,"in_reply_to":"1ae5cdf2_9bbc196e","updated":"2014-07-08 11:55:04.000000000","message":"I\u0027ve changed \u0027should\u0027 to \u0027must\u0027. It can\u0027t be enforced though - names are indistinguishable from id\u0027s so there\u0027s no way to prevent someone setting an ACL with a name in it.","commit_id":"8547ec1b83274e08fe43fe893a43be1975403f62"},{"author":{"_account_id":6968,"name":"Christian Schwede","email":"cschwede@nvidia.com","username":"cschwede"},"change_message_id":"ec9dd1d80afda89e289c1904dcf4da14f14ca094","unresolved":false,"context_lines":[{"line_number":35,"context_line":"domain."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Despite this provision for backwards compatibility, names"},{"line_number":38,"context_line":"must no longer be used when setting new ACLs in any account,"},{"line_number":39,"context_line":"including new accounts in the default domain."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"This change obviously impacts users accustomed to specifying"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"fa98f980_20bfebfd","line":38,"updated":"2014-09-09 15:25:54.000000000","message":"must no longer, should no longer or are not allowed any longer?","commit_id":"a4f634bd898603225d2218eec220b61a8fd9865c"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"f767526ad05703060128df6d26a1a247b2d51913","unresolved":false,"context_lines":[{"line_number":35,"context_line":"domain."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Despite this provision for backwards compatibility, names"},{"line_number":38,"context_line":"must no longer be used when setting new ACLs in any account,"},{"line_number":39,"context_line":"including new accounts in the default domain."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"This change obviously impacts users accustomed to specifying"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"fa98f980_2059ab5b","line":38,"in_reply_to":"fa98f980_20bfebfd","updated":"2014-09-09 15:51:46.000000000","message":"On reflection, \u0027should\u0027 might be better than \u0027must\u0027 - I changed it from version 13 to 14 because there was a comment that \u0027should\u0027 was too weak.\n\nThe intent of the comment was to emphasize that even if you chose to continue to allow tenantname:username in the default domain, users should get out of the habit of doing that because it will not work in other domains. \n\nWe cannot prevent a client setting tenantname:username (a name string cannot be distinguished from an id string). We can (with this patch) prevent a tenantname:username ACL being granted, and for backwards compatibility we can selectively allow tenantname:username in the default domain.","commit_id":"a4f634bd898603225d2218eec220b61a8fd9865c"},{"author":{"_account_id":7479,"name":"paul luse","email":"paul.e.luse@intel.com","username":"peluse"},"change_message_id":"57adf7199f92e0b97103e1480aaa28861bead949","unresolved":false,"context_lines":[{"line_number":38,"context_line":"must no longer be used when setting new ACLs in any account,"},{"line_number":39,"context_line":"including new accounts in the default domain."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"This change obviously impacts users accustomed to specifying"},{"line_number":42,"context_line":"cross-tenant ACLs in terms of names, and further work will be"},{"line_number":43,"context_line":"necessary to restore those use cases. Some ideas are"},{"line_number":44,"context_line":"discussed under the bug report. With that caveat, this patch"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":15,"id":"7ac7a964_9a48515d","line":41,"updated":"2014-08-14 13:13:04.000000000","message":"I\u0027m not super familiar with these kinds of use cases, you can provide an example scenario both before and after this patch?\n\nAlso its not clear to me what remaining work will be needed and, if this patch closes the bug, where/how that remaining work will be tracked.\n\nSorry for the basic questions, there\u0027s a ton of history on this that\u0027s hard to follow if you weren\u0027t tracking it to begin with :)","commit_id":"a4f634bd898603225d2218eec220b61a8fd9865c"}],"etc/proxy-server.conf-sample":[{"author":{"_account_id":7479,"name":"paul luse","email":"paul.e.luse@intel.com","username":"peluse"},"change_message_id":"294e6bc0a0dffafe42b5163bad1ae93422fb6403","unresolved":false,"context_lines":[{"line_number":294,"context_line":"# For a new installation, or an installation in which keystone projects may"},{"line_number":295,"context_line":"# move between domains, you should disable backwards compatible name matching"},{"line_number":296,"context_line":"# in ACLs here:"},{"line_number":297,"context_line":"# allow_names_in_acls \u003d false"},{"line_number":298,"context_line":""},{"line_number":299,"context_line":"[filter:healthcheck]"},{"line_number":300,"context_line":"use \u003d egg:swift#healthcheck"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"baada198_83cdd65f","line":297,"updated":"2014-07-24 21:58:35.000000000","message":"isn\u0027t the convention here to list the default value?  The code sets this to true by default but its listed here as false","commit_id":"e41d407f800ded1e60d524190236b954ed938c68"}],"swift/common/middleware/keystoneauth.py":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"54709a34c300c1039b507316c4f83113b1ed979d","unresolved":false,"context_lines":[{"line_number":252,"context_line":"        u_name \u003d t_name \u003d None"},{"line_number":253,"context_line":"        if self._allow_names_in_acls(env_identity):"},{"line_number":254,"context_line":"            u_name \u003d user_name"},{"line_number":255,"context_line":"            t_name \u003d tenant_name"},{"line_number":256,"context_line":"        matched_acl \u003d self._authorize_cross_tenant(user_id, u_name,"},{"line_number":257,"context_line":"                                                   tenant_id, t_name,"},{"line_number":258,"context_line":"                                                   roles)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAW3%2F%2F2QE%3D","line":255,"updated":"2014-04-09 23:57:56.000000000","message":"What if someone created a user or tenant with the name \"None\"?","commit_id":"1123aca4de691d86d44862d4e5baf6b9d4420a27"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"8baf96a331a8c1fffc5bf6019ad3daea4f03129b","unresolved":false,"context_lines":[{"line_number":252,"context_line":"        u_name \u003d t_name \u003d None"},{"line_number":253,"context_line":"        if self._allow_names_in_acls(env_identity):"},{"line_number":254,"context_line":"            u_name \u003d user_name"},{"line_number":255,"context_line":"            t_name \u003d tenant_name"},{"line_number":256,"context_line":"        matched_acl \u003d self._authorize_cross_tenant(user_id, u_name,"},{"line_number":257,"context_line":"                                                   tenant_id, t_name,"},{"line_number":258,"context_line":"                                                   roles)"}],"source_content_type":"text/x-python","patch_set":2,"id":"AAAAW3%2F%2Fzbc%3D","line":255,"in_reply_to":"AAAAW3%2F%2F2QE%3D","updated":"2014-04-10 09:55:43.000000000","message":"I think the user/tenant name would be passed as a string and therefore \"None\" !\u003d None. However, I have rejigged the code anyway to make it even more explicit when names are not included.","commit_id":"1123aca4de691d86d44862d4e5baf6b9d4420a27"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a9e31b38af7e4e699110ded66b80a4e13482ecc7","unresolved":false,"context_lines":[{"line_number":183,"context_line":""},{"line_number":184,"context_line":"    def _authorize_cross_tenant(self, user_id, user_name,"},{"line_number":185,"context_line":"                                tenant_id, tenant_name, roles,"},{"line_number":186,"context_line":"                                allow_names\u003dTrue):"},{"line_number":187,"context_line":"        \"\"\"Check cross-tenant ACLs."},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"        Match tenant:user, tenant and user could be its id, name or \u0027*\u0027"}],"source_content_type":"text/x-python","patch_set":9,"id":"7adec928_3ced51f0","line":186,"updated":"2014-05-09 18:11:45.000000000","message":"should allow_names default to False to be consistent with the doc?\n\nallow_names\u003dFalse","commit_id":"ce9013a3ffeed17b7490aa645ee15dae354f5583"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a9e31b38af7e4e699110ded66b80a4e13482ecc7","unresolved":false,"context_lines":[{"line_number":250,"context_line":""},{"line_number":251,"context_line":"        # cross-tenant authorization"},{"line_number":252,"context_line":"        allow_names \u003d (self.allow_names_in_acls"},{"line_number":253,"context_line":"                       or env_identity[\u0027auth_version\u0027] !\u003d \u00273\u0027)"},{"line_number":254,"context_line":"        matched_acl \u003d self._authorize_cross_tenant(user_id, user_name,"},{"line_number":255,"context_line":"                                                   tenant_id, tenant_name,"},{"line_number":256,"context_line":"                                                   roles, allow_names)"}],"source_content_type":"text/x-python","patch_set":9,"id":"7adec928_3c72b149","line":253,"updated":"2014-05-09 18:11:45.000000000","message":"perhaps\n\nallow_names \u003d (self.allow_names_in_acls\n                           or env_identity[\u0027auth_version\u0027] \u003d\u003d \u00272\u0027)\n\nwe know version 2 is safe, but not any other versions.","commit_id":"ce9013a3ffeed17b7490aa645ee15dae354f5583"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"383c4749b54bc65640d4349881e2d6c8f27f69c6","unresolved":false,"context_lines":[{"line_number":217,"context_line":"    def _get_project_domain_id(self, environ):"},{"line_number":218,"context_line":"        info \u003d get_account_info(environ, self.app, \u0027KS\u0027)"},{"line_number":219,"context_line":"        domain_id \u003d info.get(\u0027sysmeta\u0027, {}).get(\u0027project-domain-id\u0027)"},{"line_number":220,"context_line":"        exists \u003d is_success(info.get(\u0027status\u0027, 0))"},{"line_number":221,"context_line":"        return exists, domain_id"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"    def _set_project_domain_id(self, req, path_parts, env_identity):"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ae5cdf2_48c1734d","line":220,"updated":"2014-06-24 17:06:34.000000000","message":"what is \"exists\" for?","commit_id":"2723fb0488d6b5cce710ca614c15fe1843a28643"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"59c9553e01544d30b40ff9d8099d70811549e7d8","unresolved":false,"context_lines":[{"line_number":217,"context_line":"    def _get_project_domain_id(self, environ):"},{"line_number":218,"context_line":"        info \u003d get_account_info(environ, self.app, \u0027KS\u0027)"},{"line_number":219,"context_line":"        domain_id \u003d info.get(\u0027sysmeta\u0027, {}).get(\u0027project-domain-id\u0027)"},{"line_number":220,"context_line":"        exists \u003d is_success(info.get(\u0027status\u0027, 0))"},{"line_number":221,"context_line":"        return exists, domain_id"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"    def _set_project_domain_id(self, req, path_parts, env_identity):"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ae5cdf2_b7187c1f","line":220,"in_reply_to":"1ae5cdf2_48c1734d","updated":"2014-06-25 08:38:29.000000000","message":"exists indicates if the account has been created within swift.\nwe need to distinguish between the project domain id returning None because the account does not exist, versus returning None because a project domain id has not been stored for the account.","commit_id":"2723fb0488d6b5cce710ca614c15fe1843a28643"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"383c4749b54bc65640d4349881e2d6c8f27f69c6","unresolved":false,"context_lines":[{"line_number":227,"context_line":"        account, and also for a container PUT in case that"},{"line_number":228,"context_line":"        causes the account to be auto-created."},{"line_number":229,"context_line":"        \u0027\u0027\u0027"},{"line_number":230,"context_line":"        if PROJECT_DOMAIN_ID_SYSMETA_HEADER in req.headers:"},{"line_number":231,"context_line":"            return"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"        version, account, container, obj \u003d path_parts"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ae5cdf2_a858378b","line":230,"updated":"2014-06-24 17:06:34.000000000","message":"Who sets this header? Can the caller set it? Could be problematic if caller can set this.","commit_id":"2723fb0488d6b5cce710ca614c15fe1843a28643"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"59c9553e01544d30b40ff9d8099d70811549e7d8","unresolved":false,"context_lines":[{"line_number":227,"context_line":"        account, and also for a container PUT in case that"},{"line_number":228,"context_line":"        causes the account to be auto-created."},{"line_number":229,"context_line":"        \u0027\u0027\u0027"},{"line_number":230,"context_line":"        if PROJECT_DOMAIN_ID_SYSMETA_HEADER in req.headers:"},{"line_number":231,"context_line":"            return"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"        version, account, container, obj \u003d path_parts"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ae5cdf2_77cc348b","line":230,"in_reply_to":"1ae5cdf2_a858378b","updated":"2014-06-25 08:38:29.000000000","message":"Its set at the end of this method, this check is just to prevent repeat work if authorize has already been called. The header cannot be set by a client because swift has a \u0027gatekeeper\u0027 middleware that filters out all \u0027internal reserved\u0027 headers such as this.","commit_id":"2723fb0488d6b5cce710ca614c15fe1843a28643"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"383c4749b54bc65640d4349881e2d6c8f27f69c6","unresolved":false,"context_lines":[{"line_number":276,"context_line":"        else:"},{"line_number":277,"context_line":"            # retrieve project domain id from account sysmeta"},{"line_number":278,"context_line":"            exists, proj_domain_id \u003d self._get_project_domain_id(req.environ)"},{"line_number":279,"context_line":"            allow \u003d exists and proj_domain_id in [self.default_domain_id, None]"},{"line_number":280,"context_line":"        if allow:"},{"line_number":281,"context_line":"            self.logger.debug(\"Names allowed in acls for user in domain \" +"},{"line_number":282,"context_line":"                              \"%s accessing project in domain %s\""}],"source_content_type":"text/x-python","patch_set":10,"id":"1ae5cdf2_9cb73cd7","line":279,"updated":"2014-06-24 17:06:34.000000000","message":"not sure if I understand this logic. Don\u0027t we have to ensure both the caller\u0027s scoped project domain id and the account\u0027s domain id are in the default domain, regardless of reseller check?","commit_id":"2723fb0488d6b5cce710ca614c15fe1843a28643"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"59c9553e01544d30b40ff9d8099d70811549e7d8","unresolved":false,"context_lines":[{"line_number":276,"context_line":"        else:"},{"line_number":277,"context_line":"            # retrieve project domain id from account sysmeta"},{"line_number":278,"context_line":"            exists, proj_domain_id \u003d self._get_project_domain_id(req.environ)"},{"line_number":279,"context_line":"            allow \u003d exists and proj_domain_id in [self.default_domain_id, None]"},{"line_number":280,"context_line":"        if allow:"},{"line_number":281,"context_line":"            self.logger.debug(\"Names allowed in acls for user in domain \" +"},{"line_number":282,"context_line":"                              \"%s accessing project in domain %s\""}],"source_content_type":"text/x-python","patch_set":10,"id":"1ae5cdf2_7787d4b6","line":279,"in_reply_to":"1ae5cdf2_9cb73cd7","updated":"2014-06-25 08:38:29.000000000","message":"So the condition I am applying to allow names is that the caller\u0027s *user* domain is the default domain AND the account (\u003d\u003dproject) domain id is the default domain.\n\nBut maybe I am missing the tenant:* ACL use case, for which as you say I need to check that the caller\u0027s scoped project is in the default domain.\n\nWill re-work. Thanks!","commit_id":"2723fb0488d6b5cce710ca614c15fe1843a28643"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"383c4749b54bc65640d4349881e2d6c8f27f69c6","unresolved":false,"context_lines":[{"line_number":351,"context_line":"            return self.denied_response(req)"},{"line_number":352,"context_line":""},{"line_number":353,"context_line":"        # cross-tenant authorization"},{"line_number":354,"context_line":"        matched_acl \u003d None"},{"line_number":355,"context_line":"        if roles:"},{"line_number":356,"context_line":"            allow_names \u003d self._is_name_allowed_in_acl(req, part, env_identity)"},{"line_number":357,"context_line":"            matched_acl \u003d self._authorize_cross_tenant(user_id, user_name,"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ae5cdf2_286a6781","line":354,"updated":"2014-06-24 17:06:34.000000000","message":"nice!","commit_id":"2723fb0488d6b5cce710ca614c15fe1843a28643"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"59c9553e01544d30b40ff9d8099d70811549e7d8","unresolved":false,"context_lines":[{"line_number":351,"context_line":"            return self.denied_response(req)"},{"line_number":352,"context_line":""},{"line_number":353,"context_line":"        # cross-tenant authorization"},{"line_number":354,"context_line":"        matched_acl \u003d None"},{"line_number":355,"context_line":"        if roles:"},{"line_number":356,"context_line":"            allow_names \u003d self._is_name_allowed_in_acl(req, part, env_identity)"},{"line_number":357,"context_line":"            matched_acl \u003d self._authorize_cross_tenant(user_id, user_name,"}],"source_content_type":"text/x-python","patch_set":10,"id":"1ae5cdf2_9770e0db","line":354,"in_reply_to":"1ae5cdf2_286a6781","updated":"2014-06-25 08:38:29.000000000","message":"yeah, reason for this is that _is_name_allowed_in_acl() can trigger backend requests in swift (cached results) so want to avoid those if there are no acl\u0027s to match!","commit_id":"2723fb0488d6b5cce710ca614c15fe1843a28643"}],"test/functional/__init__.py":[{"author":{"_account_id":597,"name":"Pete Zaitcev","email":"zaitcev@kotori.zaitcev.us","username":"zaitcev"},"change_message_id":"2bb1095f4622c33e26ef451aa3bd4230415eed13","unresolved":false,"context_lines":[{"line_number":471,"context_line":"                        tenant_id \u003d retry(get_tenant_id, use_account\u003d_ + 1)"},{"line_number":472,"context_line":"                        swift_test_perm[_] \u003d tenant_id + \u0027:*\u0027"},{"line_number":473,"context_line":"                    except Exception:"},{"line_number":474,"context_line":"                        print \u003e\u003esys.stderr, \\"},{"line_number":475,"context_line":"                            \u0027FAILED TO GET TENANT ID FOR ACCOUNT %d \u0027 \\"},{"line_number":476,"context_line":"                            \u0027DURING SETUP\u0027 % _"},{"line_number":477,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":9,"id":"7adec928_ba95c841","line":474,"updated":"2014-05-12 18:43:54.000000000","message":"Is printing the right thing to do here as opposed to asserting so 1 test fails? I bet most people running functests will never know anything failed. Note I didn\u0027t run functests with Keystone in a while.","commit_id":"ce9013a3ffeed17b7490aa645ee15dae354f5583"}],"test/unit/common/middleware/test_keystoneauth.py":[{"author":{"_account_id":1179,"name":"Clay Gerrard","email":"clay.gerrard@gmail.com","username":"clay-gerrard"},"change_message_id":"1e02b574f2510f295c616eac3f45ea20072751cf","unresolved":false,"context_lines":[{"line_number":413,"context_line":"            self.test_auth._authorize_cross_tenant("},{"line_number":414,"context_line":"                \u0027userID\u0027, \u0027userA\u0027, \u0027tenantID\u0027, \u0027tenantNAME\u0027,"},{"line_number":415,"context_line":"                [\u0027tenantID:userA\u0027], allow_names\u003dFalse),"},{"line_number":416,"context_line":"            None)"},{"line_number":417,"context_line":"        self.assertEqual("},{"line_number":418,"context_line":"            self.test_auth._authorize_cross_tenant("},{"line_number":419,"context_line":"                \u0027userID\u0027, \u0027userA\u0027, \u0027tenantID\u0027, \u0027tenantNAME\u0027,"}],"source_content_type":"text/x-python","patch_set":9,"id":"7adec928_bfc40141","line":416,"updated":"2014-05-09 05:46:19.000000000","message":"I don\u0027t get why this isn\u0027t unambiguous, isn\u0027t tenantID a uuid?  Domain or no i sure hope something with \"id\" in the name would uniquely qualify the user?  Isn\u0027t there a wildcard syntax too?  Would love to seem some tests here to document the expectations.","commit_id":"ce9013a3ffeed17b7490aa645ee15dae354f5583"},{"author":{"_account_id":7847,"name":"Alistair Coles","email":"alistairncoles@gmail.com","username":"acoles"},"change_message_id":"77afd7aa422c9804482fe87fd4a0d5a5ac3dcc43","unresolved":false,"context_lines":[{"line_number":413,"context_line":"            self.test_auth._authorize_cross_tenant("},{"line_number":414,"context_line":"                \u0027userID\u0027, \u0027userA\u0027, \u0027tenantID\u0027, \u0027tenantNAME\u0027,"},{"line_number":415,"context_line":"                [\u0027tenantID:userA\u0027], allow_names\u003dFalse),"},{"line_number":416,"context_line":"            None)"},{"line_number":417,"context_line":"        self.assertEqual("},{"line_number":418,"context_line":"            self.test_auth._authorize_cross_tenant("},{"line_number":419,"context_line":"                \u0027userID\u0027, \u0027userA\u0027, \u0027tenantID\u0027, \u0027tenantNAME\u0027,"}],"source_content_type":"text/x-python","patch_set":9,"id":"7adec928_2b58ac31","line":416,"in_reply_to":"7adec928_bfc40141","updated":"2014-05-09 13:54:25.000000000","message":"TenantId is uuid. The reason that tenantId:userA is ambiguous is that user names are not unique \u0027within\u0027 a tenant. In fact users are not \u0027contained within\u0027 tenants, so the user namespace is completely independent of tenants. Users are given admin roles on tenants (\u0027projects\u0027 is probably more helpful term) which allows them to get tokens scoped for that tenant. So the tenantID alone does not disambiguate the user. \n\nWhat the syntax tenantID:userNameBob expresses is \u0027allow access to userNameBob only if userNameBob has a token scoped for tenantID\u0027. With v3 there could be userNameBob in domainX and userNameBob in domainY, both having tokens scoped for tenantID, so the only way to disambiguate them is to require their user IDs to be given in the ACL.\n\nSame goes for tenantNameFoo:userID - this means allow userID if their token is scoped on tenantNameFoo, but there could be a tenantNameFoo in domainX and a tenantNameFoo in domainY so its ambiguous.\n\nThe wildcard syntax is tested in test_cross_tenant_authorization_success(), this test was added to check the allow_names arg does what it says.","commit_id":"ce9013a3ffeed17b7490aa645ee15dae354f5583"}]}