)]}'
{"tempest/common/preprov_creds.py":[{"author":{"_account_id":1921,"name":"Andrea Frittoli","email":"andrea.frittoli@gmail.com","username":"andrea-frittoli"},"change_message_id":"0b007deb7fcb34417e8740b1eb5f266ca7d6d0e4","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"    def __init__(self, identity_version, test_accounts_file,"},{"line_number":47,"context_line":"                 accounts_lock_dir, name\u003dNone, credentials_domain\u003dNone,"},{"line_number":48,"context_line":"                 admin_role\u003dNone, tempest_roles\u003dNone,"},{"line_number":49,"context_line":"                 object_storage_operator_role\u003dNone,"},{"line_number":50,"context_line":"                 object_storage_reseller_admin_role\u003dNone):"},{"line_number":51,"context_line":"        \"\"\"Credentials provider using pre-provisioned accounts"}],"source_content_type":"text/x-python","patch_set":6,"id":"7aa08908_8db1e849","line":48,"range":{"start_line":48,"start_character":34,"end_line":48,"end_character":53},"updated":"2016-06-08 11:03:35.000000000","message":"Since this is not a stable interface yet, and I don\u0027t know of any direct consumer of this outside of tempest, it should be fine to add a parameter in the middle.","commit_id":"a018ecbc8c69cf0d324792c3aef124f70e64c8d1"}],"tempest/config.py":[{"author":{"_account_id":1921,"name":"Andrea Frittoli","email":"andrea.frittoli@gmail.com","username":"andrea-frittoli"},"change_message_id":"0b007deb7fcb34417e8740b1eb5f266ca7d6d0e4","unresolved":false,"context_lines":[{"line_number":71,"context_line":"                                                   group\u003d\u0027orchestration\u0027)]),"},{"line_number":72,"context_line":"    cfg.ListOpt(\u0027tempest_roles\u0027,"},{"line_number":73,"context_line":"                help\u003d\"Roles that a standard user should have. These are \""},{"line_number":74,"context_line":"                     \"assigned to all users created by tempest and are \""},{"line_number":75,"context_line":"                     \"matched with users in tests that do not define role \""},{"line_number":76,"context_line":"                     \"requirements.\","},{"line_number":77,"context_line":"                default\u003d[\u0027Member\u0027]),"},{"line_number":78,"context_line":"    cfg.StrOpt(\u0027default_credentials_domain_name\u0027,"},{"line_number":79,"context_line":"               default\u003d\u0027Default\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"7aa08908_305acb2a","line":76,"range":{"start_line":74,"start_character":62,"end_line":76,"end_character":35},"updated":"2016-06-08 11:03:35.000000000","message":"Perhaps it\u0027s worth mentioning that this is related to pre-provisioned credentials?","commit_id":"a018ecbc8c69cf0d324792c3aef124f70e64c8d1"},{"author":{"_account_id":1921,"name":"Andrea Frittoli","email":"andrea.frittoli@gmail.com","username":"andrea-frittoli"},"change_message_id":"0b007deb7fcb34417e8740b1eb5f266ca7d6d0e4","unresolved":false,"context_lines":[{"line_number":74,"context_line":"                     \"assigned to all users created by tempest and are \""},{"line_number":75,"context_line":"                     \"matched with users in tests that do not define role \""},{"line_number":76,"context_line":"                     \"requirements.\","},{"line_number":77,"context_line":"                default\u003d[\u0027Member\u0027]),"},{"line_number":78,"context_line":"    cfg.StrOpt(\u0027default_credentials_domain_name\u0027,"},{"line_number":79,"context_line":"               default\u003d\u0027Default\u0027,"},{"line_number":80,"context_line":"               help\u003d\"Default domain used when getting v3 credentials. \""}],"source_content_type":"text/x-python","patch_set":6,"id":"7aa08908_30712ba9","line":77,"range":{"start_line":77,"start_character":25,"end_line":77,"end_character":33},"updated":"2016-06-08 11:03:35.000000000","message":"I\u0027m not 100% convinced we need to change the default here, both for pre-provisioned and dynamic credentials provider.\n\nThe dynamic credential provider would start assigning this role to all users (v2 and v3) regardless of other roles they may have and I don\u0027t believe that\u0027s a desired behaviour. \n\nThe current logic is that if the identity version in use is v3 and not other role has been assigned yet, then Member will be assigned because in v3 a user must have a role explicitly assigned onto a projects for things to work.\n\nThe pre-provisioned credential provider does not expect by default any role to be specified for the accounts (primary and alt), which is good enough for most tests in devstack deployment in the gate. In case of v3 credentials a role is required though, so I believe the solution could be found in having in pre-provisioned credentials provider a logic symmetric with what is done in the dynamic one, that is:\n- define a new type which can be used to signify the list of roles configured in tempest_roles\n- if not type and no role is found for an account, and if identity_version \u003d\u003d v3, exclude it from the list of usable hashes\n\nThe alternative is of course to stop the v2/v3 differentiation, and always require a role for v2 credentials as well. It would make the logic simpler, but I would prefer not too, since it may break people already using pre-provisioned credentials for v2.\n\nMore opinions on this are welcome.","commit_id":"a018ecbc8c69cf0d324792c3aef124f70e64c8d1"}]}