)]}'
{"releasenotes/notes/add-system-scope-utilities-26f7e870d9f63450.yaml":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"81d49b5bbeb915ecf3cf06843760c61ce59428f2","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The clients for authenticating for tokens now support requesting and using"},{"line_number":5,"context_line":"    system-scoped tokens from keystone."}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3f79a3b5_1015c73e","line":5,"range":{"start_line":5,"start_character":38,"end_line":5,"end_character":39},"updated":"2018-10-31 10:37:42.000000000","message":"also we should add more information here about how to enable the system scope testing in tempest and what is default behavior. \n\nthat kind of info should be useful for user other than openstack gate CI.","commit_id":"5a33d2a5f1efcddb998d6ca6de2e062dfaec929f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d65d5f1c37d8bc55c0037d1e75a80dc6bdf4c0af","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The clients for authenticating for tokens now support requesting and using"},{"line_number":5,"context_line":"    system-scoped tokens from keystone."}],"source_content_type":"text/x-yaml","patch_set":7,"id":"3f79a3b5_d0e8af7f","line":5,"range":{"start_line":5,"start_character":38,"end_line":5,"end_character":39},"in_reply_to":"3f79a3b5_1015c73e","updated":"2018-10-31 11:11:18.000000000","message":"Done","commit_id":"5a33d2a5f1efcddb998d6ca6de2e062dfaec929f"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"fad7c44707a43d6d52024698a736dbc296d1938a","unresolved":false,"context_lines":[{"line_number":9,"context_line":"    By default, old behaviour of Tempest (without system scope) is maintained."},{"line_number":10,"context_line":"    So deployment with below setting is unchanged:"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"    * keystone system scope feature is not available(which is earlier than Queens)"},{"line_number":13,"context_line":"    * System scope enforcement is disabled which is nothing but"},{"line_number":14,"context_line":"      conf.oslo_policy.enforce_scope config option."},{"line_number":15,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":10,"id":"3f79a3b5_d3c12eff","line":12,"range":{"start_line":12,"start_character":52,"end_line":12,"end_character":53},"updated":"2018-11-06 06:09:08.000000000","message":"nit: missing space","commit_id":"aec48753fcaa25e7decb1f506f7b0a1038de84ec"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"fad7c44707a43d6d52024698a736dbc296d1938a","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"    If you want to enable the system scope testing, do the following:"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"    * Make sure your deployed keystone has system scope feature."},{"line_number":19,"context_line":"    * Set conf.oslo_policy.enforce_scope to True"},{"line_number":20,"context_line":"    * Set conf.tempest.identity.system_scope to True"}],"source_content_type":"text/x-yaml","patch_set":10,"id":"3f79a3b5_3343c299","line":20,"range":{"start_line":18,"start_character":0,"end_line":20,"end_character":52},"updated":"2018-11-06 06:09:08.000000000","message":"This will be useful to mention in the Keystone section under https://docs.openstack.org/tempest/latest/configuration.html or","commit_id":"aec48753fcaa25e7decb1f506f7b0a1038de84ec"}],"tempest/api/identity/admin/v3/test_credentials.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"20dadb5b5501742989e15fa592f4e0ff29024f35","unresolved":false,"context_lines":[{"line_number":19,"context_line":"from tempest.lib import decorators"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"class CredentialsTestJSON(base.BaseIdentityV3AdminTest):"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027system_admin\u0027]"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_3261dca9","line":22,"range":{"start_line":22,"start_character":31,"end_line":22,"end_character":54},"updated":"2018-09-25 03:44:40.000000000","message":"I think it might be worth creating a BaseIdentityV3SystemAdminTest that defines credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027system_admin\u0027] automatically, just like: https://github.com/openstack/tempest/blob/7e3c936898d05eb9f52e5ce37f463f903ee16ed5/tempest/api/identity/base.py#L199","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b9d6c825cf93b81cc306cd41999b431288020fd8","unresolved":false,"context_lines":[{"line_number":19,"context_line":"from tempest.lib import decorators"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"class CredentialsTestJSON(base.BaseIdentityV3AdminTest):"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027system_admin\u0027]"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_d43963cf","line":22,"range":{"start_line":22,"start_character":31,"end_line":22,"end_character":54},"in_reply_to":"3f79a3b5_3261dca9","updated":"2018-09-25 20:13:36.000000000","message":"Done","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"ef2d3cc00e1cb38c634634ffd7ae5cdbcb43478b","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"class CredentialsTestJSON(base.BaseIdentityV3SystemAdminTest):"},{"line_number":23,"context_line":"    # NOTE: force_tenant_isolation is true in the base class by default but"},{"line_number":24,"context_line":"    # overridden to false here to allow test execution for clouds using the"},{"line_number":25,"context_line":"    # pre-provisioned credentials provider."},{"line_number":26,"context_line":"    force_tenant_isolation \u003d False"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    @classmethod"},{"line_number":29,"context_line":"    def resource_setup(cls):"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_a4d11cfb","line":26,"range":{"start_line":23,"start_character":0,"end_line":26,"end_character":34},"updated":"2018-10-19 03:32:07.000000000","message":"We should make this change in a separate patch set, as I don\u0027t believe it\u0027s directly related to supporting system admin at all?","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"676b3aefb669885dfbfa1dbe908575f538e87c0d","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"class CredentialsTestJSON(base.BaseIdentityV3SystemAdminTest):"},{"line_number":23,"context_line":"    # NOTE: force_tenant_isolation is true in the base class by default but"},{"line_number":24,"context_line":"    # overridden to false here to allow test execution for clouds using the"},{"line_number":25,"context_line":"    # pre-provisioned credentials provider."},{"line_number":26,"context_line":"    force_tenant_isolation \u003d False"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"    @classmethod"},{"line_number":29,"context_line":"    def resource_setup(cls):"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_2fee04b5","line":26,"range":{"start_line":23,"start_character":0,"end_line":26,"end_character":34},"in_reply_to":"3f79a3b5_a4d11cfb","updated":"2018-10-23 12:01:48.000000000","message":"Done","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":27078,"name":"Manik Bindlish","email":"manikbindlish19@gmail.com","username":"manik"},"change_message_id":"372a91de5c199a79bad36a62cf350183a0347ca1","unresolved":false,"context_lines":[{"line_number":54,"context_line":"        self.os_system_admin.auth_provider.credentials.project_id \u003d None"},{"line_number":55,"context_line":"        self.os_system_admin.auth_provider.credentials.project_name \u003d None"},{"line_number":56,"context_line":"        self.os_system_admin.auth_provider.credentials.project_domain_id \u003d None"},{"line_number":57,"context_line":"        self.os_system_admin.auth_provider.credentials.project_domain_name \u003d None"},{"line_number":58,"context_line":"        self.os_system_admin.auth_provider.scope \u003d \u0027system\u0027"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"        blob \u003d \u0027{\"access\": \"%s\", \"secret\": \"%s\"}\u0027 % ("}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_dcd0c855","line":57,"range":{"start_line":57,"start_character":8,"end_line":57,"end_character":81},"updated":"2018-10-18 06:52:14.000000000","message":"Line exceeding the maximum length it should be:\nself.os_system_admin.auth_provider.credentials.\\\n            project_domain_name\u003d None","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"676b3aefb669885dfbfa1dbe908575f538e87c0d","unresolved":false,"context_lines":[{"line_number":54,"context_line":"        self.os_system_admin.auth_provider.credentials.project_id \u003d None"},{"line_number":55,"context_line":"        self.os_system_admin.auth_provider.credentials.project_name \u003d None"},{"line_number":56,"context_line":"        self.os_system_admin.auth_provider.credentials.project_domain_id \u003d None"},{"line_number":57,"context_line":"        self.os_system_admin.auth_provider.credentials.project_domain_name \u003d None"},{"line_number":58,"context_line":"        self.os_system_admin.auth_provider.scope \u003d \u0027system\u0027"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"        blob \u003d \u0027{\"access\": \"%s\", \"secret\": \"%s\"}\u0027 % ("}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_f9469a7e","line":57,"range":{"start_line":57,"start_character":8,"end_line":57,"end_character":81},"in_reply_to":"3f79a3b5_dcd0c855","updated":"2018-10-23 12:01:48.000000000","message":"Done","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":27078,"name":"Manik Bindlish","email":"manikbindlish19@gmail.com","username":"manik"},"change_message_id":"372a91de5c199a79bad36a62cf350183a0347ca1","unresolved":false,"context_lines":[{"line_number":102,"context_line":"        self.os_system_admin.auth_provider.credentials.project_id \u003d None"},{"line_number":103,"context_line":"        self.os_system_admin.auth_provider.credentials.project_name \u003d None"},{"line_number":104,"context_line":"        self.os_system_admin.auth_provider.credentials.project_domain_id \u003d None"},{"line_number":105,"context_line":"        self.os_system_admin.auth_provider.credentials.project_domain_name \u003d None"},{"line_number":106,"context_line":"        self.os_system_admin.auth_provider.scope \u003d \u0027system\u0027"},{"line_number":107,"context_line":"        for _ in range(2):"},{"line_number":108,"context_line":"            blob \u003d \u0027{\"access\": \"%s\", \"secret\": \"%s\"}\u0027 % ("}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_9cca509e","line":105,"range":{"start_line":105,"start_character":8,"end_line":105,"end_character":81},"updated":"2018-10-18 06:52:14.000000000","message":"ditto","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"676b3aefb669885dfbfa1dbe908575f538e87c0d","unresolved":false,"context_lines":[{"line_number":102,"context_line":"        self.os_system_admin.auth_provider.credentials.project_id \u003d None"},{"line_number":103,"context_line":"        self.os_system_admin.auth_provider.credentials.project_name \u003d None"},{"line_number":104,"context_line":"        self.os_system_admin.auth_provider.credentials.project_domain_id \u003d None"},{"line_number":105,"context_line":"        self.os_system_admin.auth_provider.credentials.project_domain_name \u003d None"},{"line_number":106,"context_line":"        self.os_system_admin.auth_provider.scope \u003d \u0027system\u0027"},{"line_number":107,"context_line":"        for _ in range(2):"},{"line_number":108,"context_line":"            blob \u003d \u0027{\"access\": \"%s\", \"secret\": \"%s\"}\u0027 % ("}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_b9402261","line":105,"range":{"start_line":105,"start_character":8,"end_line":105,"end_character":81},"in_reply_to":"3f79a3b5_9cca509e","updated":"2018-10-23 12:01:48.000000000","message":"Done","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    @decorators.attr(type\u003d\u0027smoke\u0027)"},{"line_number":44,"context_line":"    @decorators.idempotent_id(\u00277cd59bf9-bda4-4c72-9467-d21cab278355\u0027)"},{"line_number":45,"context_line":"    def test_credentials_create_get_update_delete(self):"},{"line_number":46,"context_line":"        # Overriding these so that we can actually get a system-scoped token,"},{"line_number":47,"context_line":"        # I\u0027m not sure how to do this with the existing plumbing."},{"line_number":48,"context_line":"        self.os_system_admin.auth_provider.credentials.domain_id \u003d None"},{"line_number":49,"context_line":"        self.os_system_admin.auth_provider.credentials.domain_name \u003d None"},{"line_number":50,"context_line":"        self.os_system_admin.auth_provider.credentials.project_id \u003d None"},{"line_number":51,"context_line":"        self.os_system_admin.auth_provider.credentials.project_name \u003d None"},{"line_number":52,"context_line":"        self.os_system_admin.auth_provider.credentials.project_domain_id \u003d None"},{"line_number":53,"context_line":"        self.os_system_admin.auth_provider.credentials.\\"},{"line_number":54,"context_line":"            project_domain_name \u003d None"},{"line_number":55,"context_line":"        self.os_system_admin.auth_provider.scope \u003d \u0027system\u0027"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"        blob \u003d \u0027{\"access\": \"%s\", \"secret\": \"%s\"}\u0027 % ("},{"line_number":58,"context_line":"            data_utils.rand_name(\u0027Access\u0027), data_utils.rand_name(\u0027Secret\u0027))"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_9d6bb21a","line":55,"range":{"start_line":46,"start_character":0,"end_line":55,"end_character":59},"updated":"2018-10-24 13:59:25.000000000","message":"yea passing the Token till self.os_system_admin is quite complex implementation in Tempest. \n\nWe can pass the scope thing from test.py all the way down to auth_provider which is being used to instantiate the service clients for particular os_*.\n\nwe can inject the scope like below:\n\n1. test.py-\u003eget_client_manager()[1]create the manager class which takes credential and scope for auth_provider. \n\n2. created credential from configured credential_provider [2] has the credential.system info in it. Which is from this patch implementation. \n\n3. Now when test.py create the Manager class [3], it pass only created credential not scope. \n\n4. By default scope in Manager class is \u0027project\u0027 [4] which gets passed to base class[5]\n\n5. Then base class ServiceClients pass that scope to auth_provider[6] self.auth_provider \n\n6. and further self.auth_provider is passed to ClientsFactory and then used to instantiate the service_clients[7]\u003e where auth_request and token with scope is created while any APi call via service_clients.\n\nSo if in step 3, if credentials_type\u003dsystem then, we pass scope\u003dsystem to Manager class which will set the system scope to auth_provider.  That way os_system.* will be system scoped. And then we donot need to set the scope to system here. \n\n[1] https://github.com/openstack/tempest/blob/75048e4c86e777a6db87de47dd3e20ed9f57fa9e/tempest/test.py#L640\n\n[2] https://github.com/openstack/tempest/blob/75048e4c86e777a6db87de47dd3e20ed9f57fa9e/tempest/test.py#L674\n\n[3] https://github.com/openstack/tempest/blob/75048e4c86e777a6db87de47dd3e20ed9f57fa9e/tempest/test.py#L678\n\n[4] https://github.com/openstack/tempest/blob/8c2f3dd7d8de3a81865453f866fe6aac3973dcd7/tempest/clients.py#L27\n\n[5] https://github.com/openstack/tempest/blob/9594233ffd93066677aa601c594d55f3a4f188d8/tempest\n/lib/services/clients.py#L260\n\n[6] https://github.com/openstack/tempest/blob/9594233ffd93066677aa601c594d55f3a4f188d8/tempest/lib/services/clients.py#L351\n\n\n[7] https://github.com/openstack/tempest/blob/9594233ffd93066677aa601c594d55f3a4f188d8/tempest/lib/services/clients.py#L211","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1252e302338e1ada80d316b42cde1163ef061429","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    @decorators.attr(type\u003d\u0027smoke\u0027)"},{"line_number":44,"context_line":"    @decorators.idempotent_id(\u00277cd59bf9-bda4-4c72-9467-d21cab278355\u0027)"},{"line_number":45,"context_line":"    def test_credentials_create_get_update_delete(self):"},{"line_number":46,"context_line":"        # Overriding these so that we can actually get a system-scoped token,"},{"line_number":47,"context_line":"        # I\u0027m not sure how to do this with the existing plumbing."},{"line_number":48,"context_line":"        self.os_system_admin.auth_provider.credentials.domain_id \u003d None"},{"line_number":49,"context_line":"        self.os_system_admin.auth_provider.credentials.domain_name \u003d None"},{"line_number":50,"context_line":"        self.os_system_admin.auth_provider.credentials.project_id \u003d None"},{"line_number":51,"context_line":"        self.os_system_admin.auth_provider.credentials.project_name \u003d None"},{"line_number":52,"context_line":"        self.os_system_admin.auth_provider.credentials.project_domain_id \u003d None"},{"line_number":53,"context_line":"        self.os_system_admin.auth_provider.credentials.\\"},{"line_number":54,"context_line":"            project_domain_name \u003d None"},{"line_number":55,"context_line":"        self.os_system_admin.auth_provider.scope \u003d \u0027system\u0027"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"        blob \u003d \u0027{\"access\": \"%s\", \"secret\": \"%s\"}\u0027 % ("},{"line_number":58,"context_line":"            data_utils.rand_name(\u0027Access\u0027), data_utils.rand_name(\u0027Secret\u0027))"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_57ae4a80","line":55,"range":{"start_line":46,"start_character":0,"end_line":55,"end_character":59},"in_reply_to":"3f79a3b5_9d6bb21a","updated":"2018-10-24 22:44:01.000000000","message":"This explanation was a *huge* help. Thank you!\n\nI took a stab at trying to implement what you said.","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"602d2238e63ea30ee615a754231e59a62ef43ef3","unresolved":false,"context_lines":[{"line_number":19,"context_line":"from tempest.lib import decorators"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"class CredentialsTestJSON(base.BaseIdentityV3SystemAdminTest):"},{"line_number":23,"context_line":"    # NOTE: force_tenant_isolation is true in the base class by default but"},{"line_number":24,"context_line":"    # overridden to false here to allow test execution for clouds using the"},{"line_number":25,"context_line":"    # pre-provisioned credentials provider."}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_59ce4a58","line":22,"range":{"start_line":22,"start_character":45,"end_line":22,"end_character":56},"updated":"2018-10-27 05:25:45.000000000","message":"Here you\u0027ve kept this as SystemAdmin but renamed the credential type to \u0027system\u0027 which is inconsistent. In any case, I vote to keep the credential name as \u0027system_admin\u0027, the reasoning for which I provide here: https://review.openstack.org/#/c/604909/6/tempest/api/identity/base.py\n\nYet another thought which I\u0027m throwing out is around folder oganization for system-scoped tests. I believe it would be meaningful to add such tests under a system/ folder just like admin tests are added under admin/. But this will require discussion as there are some ramifications from doing this - like potentially breaking interop if we just move things around.","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"bf289cd40e253b5f0f79c7630c06df7002c3e667","unresolved":false,"context_lines":[{"line_number":19,"context_line":"from tempest.lib import decorators"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"class CredentialsTestJSON(base.BaseIdentityV3SystemAdminTest):"},{"line_number":23,"context_line":"    # NOTE: force_tenant_isolation is true in the base class by default but"},{"line_number":24,"context_line":"    # overridden to false here to allow test execution for clouds using the"},{"line_number":25,"context_line":"    # pre-provisioned credentials provider."}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_991f02b7","line":22,"range":{"start_line":22,"start_character":45,"end_line":22,"end_character":56},"in_reply_to":"3f79a3b5_59ce4a58","updated":"2018-10-27 05:26:46.000000000","message":"And just to be clear: folder reorganization around \"scope/\" is out of scope in this patch set (no pun intended).","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"4ea3a64761f88070414546122875521c66f697a2","unresolved":false,"context_lines":[{"line_number":19,"context_line":"from tempest.lib import decorators"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"class CredentialsTestJSON(base.BaseIdentityV3SystemAdminTest):"},{"line_number":23,"context_line":"    # NOTE: force_tenant_isolation is true in the base class by default but"},{"line_number":24,"context_line":"    # overridden to false here to allow test execution for clouds using the"},{"line_number":25,"context_line":"    # pre-provisioned credentials provider."}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_7b80a1bf","line":22,"range":{"start_line":22,"start_character":45,"end_line":22,"end_character":56},"in_reply_to":"3f79a3b5_991f02b7","updated":"2018-10-31 09:17:27.000000000","message":"i like the idea of having all system tests under system folder. That might be useful for interop to skip all system tests. \n\nBut again if all system tests are in admin folder only then it might be ok.\n\nSo let\u0027s discuss this as a separate thing than this patch as you mentioned.","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"}],"tempest/api/identity/base.py":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":309,"context_line":""},{"line_number":310,"context_line":"class BaseIdentityV3SystemAdminTest(BaseIdentityV3Test):"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027system_admin\u0027]"},{"line_number":313,"context_line":"    force_tenant_isolation \u003d True"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"    @classmethod"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_a5f21a9a","line":312,"range":{"start_line":312,"start_character":40,"end_line":312,"end_character":52},"updated":"2018-10-24 13:59:25.000000000","message":"can we name it only \u0027system\u0027 otherwise it might sounds like there are 2 system scope \u0027system_admin\u0027 and \u0027system\u0027.","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"de1b5b64e39cd9f6e0d63418d827c3a30e39883a","unresolved":false,"context_lines":[{"line_number":309,"context_line":""},{"line_number":310,"context_line":"class BaseIdentityV3SystemAdminTest(BaseIdentityV3Test):"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027system_admin\u0027]"},{"line_number":313,"context_line":"    force_tenant_isolation \u003d True"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"    @classmethod"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_4458c555","line":312,"range":{"start_line":312,"start_character":40,"end_line":312,"end_character":52},"in_reply_to":"3f79a3b5_052c19fe","updated":"2018-10-25 16:20:02.000000000","message":"Do you want me to revert this back to using system_admin then, or keep it as \u0027system\u0027 until we\u0027re ready to add in system_member support?","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1252e302338e1ada80d316b42cde1163ef061429","unresolved":false,"context_lines":[{"line_number":309,"context_line":""},{"line_number":310,"context_line":"class BaseIdentityV3SystemAdminTest(BaseIdentityV3Test):"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027system_admin\u0027]"},{"line_number":313,"context_line":"    force_tenant_isolation \u003d True"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"    @classmethod"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_dc3e01b5","line":312,"range":{"start_line":312,"start_character":40,"end_line":312,"end_character":52},"in_reply_to":"3f79a3b5_a5f21a9a","updated":"2018-10-24 22:44:01.000000000","message":"My reasoning behind `system_admin` was to reserve system admin in case we wanted to use something like `system_member` in the future. Using self.os_system_admin would reserve clients for system administrators in tests and self.os_system_member or self.os_system_reader would have similar clients for those personas.\n\nI can refactor it and change it in the future if we want to change the namespacing.","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"aed1ea16e15c5492ab188369cc0363ccb7349542","unresolved":false,"context_lines":[{"line_number":309,"context_line":""},{"line_number":310,"context_line":"class BaseIdentityV3SystemAdminTest(BaseIdentityV3Test):"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027system_admin\u0027]"},{"line_number":313,"context_line":"    force_tenant_isolation \u003d True"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"    @classmethod"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_052c19fe","line":312,"range":{"start_line":312,"start_character":40,"end_line":312,"end_character":52},"in_reply_to":"3f79a3b5_dc3e01b5","updated":"2018-10-25 09:11:16.000000000","message":"ok, that make sense. and i can get system_member by assigning the member role to user on system. \n\nI think system_admin make sense to me. thanks\n\nIf system_member things are not so far to use, i think can make it system_admin only.","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":337,"context_line":"        cls.endpoint_groups_client \u003d cls.os_admin.endpoint_groups_client"},{"line_number":338,"context_line":"        cls.project_tags_client \u003d cls.os_admin.project_tags_client"},{"line_number":339,"context_line":""},{"line_number":340,"context_line":"        cls.creds_client \u003d cls.os_system_admin.credentials_client"},{"line_number":341,"context_line":""},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"class BaseApplicationCredentialsV3Test(BaseIdentityV3Test):"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_e0f1dddf","line":340,"range":{"start_line":340,"start_character":27,"end_line":340,"end_character":46},"updated":"2018-10-24 13:59:25.000000000","message":"also you need to set the os_system in test.py [1], then only cls.os_system will be set to system scoped Manager object.\n\n[1]https://github.com/openstack/tempest/blob/75048e4c86e777a6db87de47dd3e20ed9f57fa9e/tempest/test.py#L378","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":337,"context_line":"        cls.endpoint_groups_client \u003d cls.os_admin.endpoint_groups_client"},{"line_number":338,"context_line":"        cls.project_tags_client \u003d cls.os_admin.project_tags_client"},{"line_number":339,"context_line":""},{"line_number":340,"context_line":"        cls.creds_client \u003d cls.os_system_admin.credentials_client"},{"line_number":341,"context_line":""},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"class BaseApplicationCredentialsV3Test(BaseIdentityV3Test):"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_fd53c66c","line":340,"range":{"start_line":340,"start_character":31,"end_line":340,"end_character":46},"updated":"2018-10-24 13:59:25.000000000","message":"here os_system_admin is not actually system scoped. we can auto populate it to system scope from test.py. please see my comment in tempest/api/identity/admin/v3/test_credentials.py","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1252e302338e1ada80d316b42cde1163ef061429","unresolved":false,"context_lines":[{"line_number":337,"context_line":"        cls.endpoint_groups_client \u003d cls.os_admin.endpoint_groups_client"},{"line_number":338,"context_line":"        cls.project_tags_client \u003d cls.os_admin.project_tags_client"},{"line_number":339,"context_line":""},{"line_number":340,"context_line":"        cls.creds_client \u003d cls.os_system_admin.credentials_client"},{"line_number":341,"context_line":""},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"class BaseApplicationCredentialsV3Test(BaseIdentityV3Test):"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_973702b0","line":340,"range":{"start_line":340,"start_character":31,"end_line":340,"end_character":46},"in_reply_to":"3f79a3b5_fd53c66c","updated":"2018-10-24 22:44:01.000000000","message":"Done","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"602d2238e63ea30ee615a754231e59a62ef43ef3","unresolved":false,"context_lines":[{"line_number":309,"context_line":""},{"line_number":310,"context_line":"class BaseIdentityV3SystemAdminTest(BaseIdentityV3Test):"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027system\u0027]"},{"line_number":313,"context_line":"    force_tenant_isolation \u003d True"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"    @classmethod"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_99c8624d","line":312,"range":{"start_line":312,"start_character":40,"end_line":312,"end_character":46},"updated":"2018-10-27 05:25:45.000000000","message":"I think we should do what is good for the longterm future and that is to keep it as system_admin. My reasoning behind this is that plugins that begin using \u0027system\u0027 credentials will then have to refactor to system_admin when Tempest does, which will lead to even more future technical debt around renaming.","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d343b3a4b4ca72a5861e61f51bdb6be4eec9c082","unresolved":false,"context_lines":[{"line_number":309,"context_line":""},{"line_number":310,"context_line":"class BaseIdentityV3SystemAdminTest(BaseIdentityV3Test):"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027system\u0027]"},{"line_number":313,"context_line":"    force_tenant_isolation \u003d True"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"    @classmethod"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_d78f5e75","line":312,"range":{"start_line":312,"start_character":40,"end_line":312,"end_character":46},"in_reply_to":"3f79a3b5_99c8624d","updated":"2018-10-30 12:22:45.000000000","message":"Ack - I\u0027ll rename it back then.","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"602d2238e63ea30ee615a754231e59a62ef43ef3","unresolved":false,"context_lines":[{"line_number":310,"context_line":"class BaseIdentityV3SystemAdminTest(BaseIdentityV3Test):"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027system\u0027]"},{"line_number":313,"context_line":"    force_tenant_isolation \u003d True"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"    @classmethod"},{"line_number":316,"context_line":"    def setup_clients(cls):"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_79f6a692","line":313,"range":{"start_line":313,"start_character":4,"end_line":313,"end_character":33},"updated":"2018-10-27 05:25:45.000000000","message":"nit: If we need this here then perhaps it is useful to copy andreaf\u0027s comment on L201 here as well.","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d343b3a4b4ca72a5861e61f51bdb6be4eec9c082","unresolved":false,"context_lines":[{"line_number":310,"context_line":"class BaseIdentityV3SystemAdminTest(BaseIdentityV3Test):"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"    credentials \u003d [\u0027primary\u0027, \u0027admin\u0027, \u0027system\u0027]"},{"line_number":313,"context_line":"    force_tenant_isolation \u003d True"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"    @classmethod"},{"line_number":316,"context_line":"    def setup_clients(cls):"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_57ca6ea3","line":313,"range":{"start_line":313,"start_character":4,"end_line":313,"end_character":33},"in_reply_to":"3f79a3b5_79f6a692","updated":"2018-10-30 12:22:45.000000000","message":"Done","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"b7db2361be033199b6706b7022d6e58cf589cead","unresolved":false,"context_lines":[{"line_number":323,"context_line":"    @classmethod"},{"line_number":324,"context_line":"    def setup_clients(cls):"},{"line_number":325,"context_line":"        super(BaseIdentityV3SystemAdminTest, cls).setup_clients()"},{"line_number":326,"context_line":"        cls.client \u003d cls.os_admin.identity_v3_client"},{"line_number":327,"context_line":"        cls.domains_client \u003d cls.os_admin.domains_client"},{"line_number":328,"context_line":"        cls.users_client \u003d cls.os_admin.users_v3_client"},{"line_number":329,"context_line":"        cls.trusts_client \u003d cls.os_admin.trusts_client"},{"line_number":330,"context_line":"        cls.roles_client \u003d cls.os_admin.roles_v3_client"},{"line_number":331,"context_line":"        cls.inherited_roles_client \u003d cls.os_admin.inherited_roles_client"},{"line_number":332,"context_line":"        cls.token \u003d cls.os_admin.token_v3_client"},{"line_number":333,"context_line":"        cls.endpoints_client \u003d cls.os_admin.endpoints_v3_client"},{"line_number":334,"context_line":"        cls.regions_client \u003d cls.os_admin.regions_client"},{"line_number":335,"context_line":"        cls.services_client \u003d cls.os_admin.identity_services_v3_client"},{"line_number":336,"context_line":"        cls.policies_client \u003d cls.os_admin.policies_client"},{"line_number":337,"context_line":"        cls.creds_client \u003d cls.os_admin.credentials_client"},{"line_number":338,"context_line":"        cls.groups_client \u003d cls.os_admin.groups_client"},{"line_number":339,"context_line":"        cls.projects_client \u003d cls.os_admin.projects_client"},{"line_number":340,"context_line":"        cls.role_assignments \u003d cls.os_admin.role_assignments_client"},{"line_number":341,"context_line":"        cls.oauth_consumers_client \u003d cls.os_admin.oauth_consumers_client"},{"line_number":342,"context_line":"        cls.oauth_token_client \u003d cls.os_admin.oauth_token_client"},{"line_number":343,"context_line":"        cls.domain_config_client \u003d cls.os_admin.domain_config_client"},{"line_number":344,"context_line":"        cls.endpoint_filter_client \u003d cls.os_admin.endpoint_filter_client"},{"line_number":345,"context_line":"        cls.endpoint_groups_client \u003d cls.os_admin.endpoint_groups_client"},{"line_number":346,"context_line":"        cls.project_tags_client \u003d cls.os_admin.project_tags_client"},{"line_number":347,"context_line":""},{"line_number":348,"context_line":""},{"line_number":349,"context_line":"class BaseApplicationCredentialsV3Test(BaseIdentityV3Test):"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_fba03139","line":346,"range":{"start_line":326,"start_character":0,"end_line":346,"end_character":66},"updated":"2018-10-31 09:59:40.000000000","message":"we do not recommend to use more and more alias in base classes, maybe you can avoid these by inheriting this class from BaseIdentityV3AdminTest.","commit_id":"5a33d2a5f1efcddb998d6ca6de2e062dfaec929f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d65d5f1c37d8bc55c0037d1e75a80dc6bdf4c0af","unresolved":false,"context_lines":[{"line_number":323,"context_line":"    @classmethod"},{"line_number":324,"context_line":"    def setup_clients(cls):"},{"line_number":325,"context_line":"        super(BaseIdentityV3SystemAdminTest, cls).setup_clients()"},{"line_number":326,"context_line":"        cls.client \u003d cls.os_admin.identity_v3_client"},{"line_number":327,"context_line":"        cls.domains_client \u003d cls.os_admin.domains_client"},{"line_number":328,"context_line":"        cls.users_client \u003d cls.os_admin.users_v3_client"},{"line_number":329,"context_line":"        cls.trusts_client \u003d cls.os_admin.trusts_client"},{"line_number":330,"context_line":"        cls.roles_client \u003d cls.os_admin.roles_v3_client"},{"line_number":331,"context_line":"        cls.inherited_roles_client \u003d cls.os_admin.inherited_roles_client"},{"line_number":332,"context_line":"        cls.token \u003d cls.os_admin.token_v3_client"},{"line_number":333,"context_line":"        cls.endpoints_client \u003d cls.os_admin.endpoints_v3_client"},{"line_number":334,"context_line":"        cls.regions_client \u003d cls.os_admin.regions_client"},{"line_number":335,"context_line":"        cls.services_client \u003d cls.os_admin.identity_services_v3_client"},{"line_number":336,"context_line":"        cls.policies_client \u003d cls.os_admin.policies_client"},{"line_number":337,"context_line":"        cls.creds_client \u003d cls.os_admin.credentials_client"},{"line_number":338,"context_line":"        cls.groups_client \u003d cls.os_admin.groups_client"},{"line_number":339,"context_line":"        cls.projects_client \u003d cls.os_admin.projects_client"},{"line_number":340,"context_line":"        cls.role_assignments \u003d cls.os_admin.role_assignments_client"},{"line_number":341,"context_line":"        cls.oauth_consumers_client \u003d cls.os_admin.oauth_consumers_client"},{"line_number":342,"context_line":"        cls.oauth_token_client \u003d cls.os_admin.oauth_token_client"},{"line_number":343,"context_line":"        cls.domain_config_client \u003d cls.os_admin.domain_config_client"},{"line_number":344,"context_line":"        cls.endpoint_filter_client \u003d cls.os_admin.endpoint_filter_client"},{"line_number":345,"context_line":"        cls.endpoint_groups_client \u003d cls.os_admin.endpoint_groups_client"},{"line_number":346,"context_line":"        cls.project_tags_client \u003d cls.os_admin.project_tags_client"},{"line_number":347,"context_line":""},{"line_number":348,"context_line":""},{"line_number":349,"context_line":"class BaseApplicationCredentialsV3Test(BaseIdentityV3Test):"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_50d33fd5","line":346,"range":{"start_line":326,"start_character":0,"end_line":346,"end_character":66},"in_reply_to":"3f79a3b5_fba03139","updated":"2018-10-31 11:11:18.000000000","message":"Done","commit_id":"5a33d2a5f1efcddb998d6ca6de2e062dfaec929f"}],"tempest/config.py":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"f8f385f131bb04d62175b8086e2ba9d0bc64c7fd","unresolved":false,"context_lines":[{"line_number":166,"context_line":"                default\u003dFalse,"},{"line_number":167,"context_line":"                help\u003d\"Whether keystone identity v3 policy required \""},{"line_number":168,"context_line":"                     \"a domain scoped token to use admin APIs\"),"},{"line_number":169,"context_line":"    cfg.BoolOpt(\u0027system_scope\u0027,"},{"line_number":170,"context_line":"                default\u003dFalse,"},{"line_number":171,"context_line":"                help\u003d\"Whether keystone identity v3 supports system scope\"),"},{"line_number":172,"context_line":"    # Security Compliance (PCI-DSS)"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_7979f4f8","line":169,"range":{"start_line":169,"start_character":0,"end_line":169,"end_character":31},"updated":"2018-10-25 09:22:00.000000000","message":"we can add a TODO here to remove this after Pike EOl\n\n    # System scope is a default feature in Queens. This config\n    # option can removed once Pike is EOL.","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d343b3a4b4ca72a5861e61f51bdb6be4eec9c082","unresolved":false,"context_lines":[{"line_number":166,"context_line":"                default\u003dFalse,"},{"line_number":167,"context_line":"                help\u003d\"Whether keystone identity v3 policy required \""},{"line_number":168,"context_line":"                     \"a domain scoped token to use admin APIs\"),"},{"line_number":169,"context_line":"    cfg.BoolOpt(\u0027system_scope\u0027,"},{"line_number":170,"context_line":"                default\u003dFalse,"},{"line_number":171,"context_line":"                help\u003d\"Whether keystone identity v3 supports system scope\"),"},{"line_number":172,"context_line":"    # Security Compliance (PCI-DSS)"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_37c9f2aa","line":169,"range":{"start_line":169,"start_character":0,"end_line":169,"end_character":31},"in_reply_to":"3f79a3b5_7979f4f8","updated":"2018-10-30 12:22:45.000000000","message":"Done","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"}],"tempest/lib/auth.py":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":466,"context_line":"                domain_name\u003dself.credentials.domain_name)"},{"line_number":467,"context_line":""},{"line_number":468,"context_line":"        if self.scope \u003d\u003d \u0027system\u0027:"},{"line_number":469,"context_line":"            auth_params.update(system\u003d{\u0027all\u0027: True})"},{"line_number":470,"context_line":""},{"line_number":471,"context_line":"        return auth_params"},{"line_number":472,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_f080cef8","line":469,"range":{"start_line":469,"start_character":38,"end_line":469,"end_character":51},"updated":"2018-10-24 13:59:25.000000000","message":"can we use self.credentials.system instead of hard coding it. and this value is checked in credetnial.is_valid() function so that we can avoid sending the other non-supported value to get_token() if keystone validate that.","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":854,"context_line":"             self.project_name is not None and valid_project_domain])"},{"line_number":855,"context_line":"        valid_domain_scope \u003d any("},{"line_number":856,"context_line":"            [self.domain_id is None and self.domain_name is None,"},{"line_number":857,"context_line":"             self.domain_id or self.domain_name])"},{"line_number":858,"context_line":"        return all([self.password is not None,"},{"line_number":859,"context_line":"                    valid_user,"},{"line_number":860,"context_line":"                    valid_project_scope and valid_domain_scope])"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_d05112d7","line":857,"range":{"start_line":857,"start_character":47,"end_line":857,"end_character":49},"updated":"2018-10-24 13:59:25.000000000","message":"can we add check for system scope also like below to avoid anyone passing non {\u0027all\u0027: True} ? but i did not find oslo.policy checking that it checks only existence of \u0027system\u0027 in requested cred [1].\n\nDoes keystone consider non {\u0027all\u0027: True} as invalid value ? if not then we can skip the check here otherwise we can check here to avoid sending the invalid value to keystone.\n\nor at least it avoid hard coding the system \u003d\u003d {\u0027all\u0027: True} on auth param @L469\n\n        valid_system_scope \u003d any(\n            [self.system is None,\n             self.system and self.system \u003d\u003d {\u0027all\u0027: True})\n\n[1] https://github.com/openstack/oslo.policy/blob/fe898122c8cbf8b00e35307c719a04724bfecf46/oslo_policy/policy.py#L865","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"aed1ea16e15c5492ab188369cc0363ccb7349542","unresolved":false,"context_lines":[{"line_number":854,"context_line":"             self.project_name is not None and valid_project_domain])"},{"line_number":855,"context_line":"        valid_domain_scope \u003d any("},{"line_number":856,"context_line":"            [self.domain_id is None and self.domain_name is None,"},{"line_number":857,"context_line":"             self.domain_id or self.domain_name])"},{"line_number":858,"context_line":"        return all([self.password is not None,"},{"line_number":859,"context_line":"                    valid_user,"},{"line_number":860,"context_line":"                    valid_project_scope and valid_domain_scope])"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_234eed6c","line":857,"range":{"start_line":857,"start_character":47,"end_line":857,"end_character":49},"in_reply_to":"3f79a3b5_b7123efd","updated":"2018-10-25 09:11:16.000000000","message":"got it and it is good idea to keep space open for future service based system","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1252e302338e1ada80d316b42cde1163ef061429","unresolved":false,"context_lines":[{"line_number":854,"context_line":"             self.project_name is not None and valid_project_domain])"},{"line_number":855,"context_line":"        valid_domain_scope \u003d any("},{"line_number":856,"context_line":"            [self.domain_id is None and self.domain_name is None,"},{"line_number":857,"context_line":"             self.domain_id or self.domain_name])"},{"line_number":858,"context_line":"        return all([self.password is not None,"},{"line_number":859,"context_line":"                    valid_user,"},{"line_number":860,"context_line":"                    valid_project_scope and valid_domain_scope])"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_b7123efd","line":857,"range":{"start_line":857,"start_character":47,"end_line":857,"end_character":49},"in_reply_to":"3f79a3b5_d05112d7","updated":"2018-10-24 22:44:01.000000000","message":"Good question. Here are the docs we have in keystone for system-scope authentication [0].\n\nKeystone considers the following authentication payload valid for getting system-scoped tokens:\n\n  \"scope\": {\n    \"system\": {\n      \"all\": true\n     }\n  }\n\nThis is because we wanted to leave the implementation open to allow scoping to service catalog entries in the future. For example:\n\n  \"scope\": {\n    \"system\": {\n      \"service\": $SERVICE_ID\n    }\n  }\n\nWhich would result in a token scoped to a specific service. This hasn\u0027t been implemented yet, but hopefully helps explain why we consider \"all: True\" to be special since we intend it to represent all services in the deployment.\n\n\n[0] https://developer.openstack.org/api-ref/identity/v3/index.html?expanded\u003dtoken-authentication-with-scoped-authorization-detail#id30","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"}],"tempest/lib/common/cred_client.py":[{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":83,"context_line":"                      role[\u0027id\u0027], project[\u0027id\u0027], user[\u0027id\u0027])"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"    @abc.abstractmethod"},{"line_number":86,"context_line":"    def get_credentials(self, user, project, password, use_system_admin):"},{"line_number":87,"context_line":"        \"\"\"Produces a Credentials object from the details provided"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"        :param user: a user dict"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_9de892a7","line":86,"range":{"start_line":86,"start_character":55,"end_line":86,"end_character":71},"updated":"2018-10-24 13:59:25.000000000","message":"\u0027use_system\u0027","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1252e302338e1ada80d316b42cde1163ef061429","unresolved":false,"context_lines":[{"line_number":83,"context_line":"                      role[\u0027id\u0027], project[\u0027id\u0027], user[\u0027id\u0027])"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"    @abc.abstractmethod"},{"line_number":86,"context_line":"    def get_credentials(self, user, project, password, use_system_admin):"},{"line_number":87,"context_line":"        \"\"\"Produces a Credentials object from the details provided"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"        :param user: a user dict"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_97bce2db","line":86,"range":{"start_line":86,"start_character":55,"end_line":86,"end_character":71},"in_reply_to":"3f79a3b5_9de892a7","updated":"2018-10-24 22:44:01.000000000","message":"Done","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"}],"tempest/lib/common/dynamic_creds.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"20dadb5b5501742989e15fa592f4e0ff29024f35","unresolved":false,"context_lines":[{"line_number":64,"context_line":"    :param identity_admin_endpoint_type: The endpoint type for identity"},{"line_number":65,"context_line":"                                         admin clients. Defaults to public."},{"line_number":66,"context_line":"    :param identity_uri: Identity URI of the target cloud"},{"line_number":67,"context_line":"    \"\"\""},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    def __init__(self, identity_version, name\u003dNone, network_resources\u003dNone,"},{"line_number":70,"context_line":"                 credentials_domain\u003dNone, admin_role\u003dNone, admin_creds\u003dNone,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_5217b8ef","line":67,"updated":"2018-09-25 03:44:40.000000000","message":"Missing a docstring param for system_admin here.","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b9d6c825cf93b81cc306cd41999b431288020fd8","unresolved":false,"context_lines":[{"line_number":64,"context_line":"    :param identity_admin_endpoint_type: The endpoint type for identity"},{"line_number":65,"context_line":"                                         admin clients. Defaults to public."},{"line_number":66,"context_line":"    :param identity_uri: Identity URI of the target cloud"},{"line_number":67,"context_line":"    \"\"\""},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"    def __init__(self, identity_version, name\u003dNone, network_resources\u003dNone,"},{"line_number":70,"context_line":"                 credentials_domain\u003dNone, admin_role\u003dNone, admin_creds\u003dNone,"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_74d64ff5","line":67,"in_reply_to":"3f79a3b5_5217b8ef","updated":"2018-09-25 20:13:36.000000000","message":"Removed. I originally pulled this from Jamie\u0027s patch but I\u0027m not sure if it\u0027s needed?","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"20dadb5b5501742989e15fa592f4e0ff29024f35","unresolved":false,"context_lines":[{"line_number":159,"context_line":"                    os.network.PortsClient(),"},{"line_number":160,"context_line":"                    os.network.SecurityGroupsClient())"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"    def _create_creds(self, admin\u003dFalse, system\u003dNone, roles\u003dNone):"},{"line_number":163,"context_line":"        \"\"\"Create credentials with random name."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"        Creates project and user. When admin flag is True create user"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_726674be","line":162,"range":{"start_line":162,"start_character":48,"end_line":162,"end_character":52},"updated":"2018-09-25 03:44:40.000000000","message":"If this is a flag, should this not default to False, esp. given L172?","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b9d6c825cf93b81cc306cd41999b431288020fd8","unresolved":false,"context_lines":[{"line_number":159,"context_line":"                    os.network.PortsClient(),"},{"line_number":160,"context_line":"                    os.network.SecurityGroupsClient())"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"    def _create_creds(self, admin\u003dFalse, system\u003dNone, roles\u003dNone):"},{"line_number":163,"context_line":"        \"\"\"Create credentials with random name."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"        Creates project and user. When admin flag is True create user"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_94a52ba2","line":162,"range":{"start_line":162,"start_character":48,"end_line":162,"end_character":52},"in_reply_to":"3f79a3b5_726674be","updated":"2018-09-25 20:13:36.000000000","message":"Done","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"20dadb5b5501742989e15fa592f4e0ff29024f35","unresolved":false,"context_lines":[{"line_number":341,"context_line":"        else:"},{"line_number":342,"context_line":"            if credential_type in [\u0027primary\u0027, \u0027alt\u0027, \u0027admin\u0027, \u0027system_admin\u0027]:"},{"line_number":343,"context_line":"                is_admin \u003d (credential_type \u003d\u003d \u0027admin\u0027)"},{"line_number":344,"context_line":"                system_admin \u003d (credential_type \u003d\u003d \u0027system_admin\u0027)"},{"line_number":345,"context_line":"                credentials \u003d self._create_creds("},{"line_number":346,"context_line":"                    admin\u003dis_admin, system\u003dsystem_admin)"},{"line_number":347,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_b2c88c75","line":344,"range":{"start_line":344,"start_character":16,"end_line":344,"end_character":28},"updated":"2018-09-25 03:44:40.000000000","message":"nit: is_system_admin","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b9d6c825cf93b81cc306cd41999b431288020fd8","unresolved":false,"context_lines":[{"line_number":341,"context_line":"        else:"},{"line_number":342,"context_line":"            if credential_type in [\u0027primary\u0027, \u0027alt\u0027, \u0027admin\u0027, \u0027system_admin\u0027]:"},{"line_number":343,"context_line":"                is_admin \u003d (credential_type \u003d\u003d \u0027admin\u0027)"},{"line_number":344,"context_line":"                system_admin \u003d (credential_type \u003d\u003d \u0027system_admin\u0027)"},{"line_number":345,"context_line":"                credentials \u003d self._create_creds("},{"line_number":346,"context_line":"                    admin\u003dis_admin, system\u003dsystem_admin)"},{"line_number":347,"context_line":"            else:"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_f4301f58","line":344,"range":{"start_line":344,"start_character":16,"end_line":344,"end_character":28},"in_reply_to":"3f79a3b5_b2c88c75","updated":"2018-09-25 20:13:36.000000000","message":"Done","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"20dadb5b5501742989e15fa592f4e0ff29024f35","unresolved":false,"context_lines":[{"line_number":343,"context_line":"                is_admin \u003d (credential_type \u003d\u003d \u0027admin\u0027)"},{"line_number":344,"context_line":"                system_admin \u003d (credential_type \u003d\u003d \u0027system_admin\u0027)"},{"line_number":345,"context_line":"                credentials \u003d self._create_creds("},{"line_number":346,"context_line":"                    admin\u003dis_admin, system\u003dsystem_admin)"},{"line_number":347,"context_line":"            else:"},{"line_number":348,"context_line":"                credentials \u003d self._create_creds(roles\u003dcredential_type)"},{"line_number":349,"context_line":"            self._creds[str(credential_type)] \u003d credentials"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_52c5785b","line":346,"range":{"start_line":346,"start_character":43,"end_line":346,"end_character":55},"updated":"2018-09-25 03:44:40.000000000","message":"Ditto","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b9d6c825cf93b81cc306cd41999b431288020fd8","unresolved":false,"context_lines":[{"line_number":343,"context_line":"                is_admin \u003d (credential_type \u003d\u003d \u0027admin\u0027)"},{"line_number":344,"context_line":"                system_admin \u003d (credential_type \u003d\u003d \u0027system_admin\u0027)"},{"line_number":345,"context_line":"                credentials \u003d self._create_creds("},{"line_number":346,"context_line":"                    admin\u003dis_admin, system\u003dsystem_admin)"},{"line_number":347,"context_line":"            else:"},{"line_number":348,"context_line":"                credentials \u003d self._create_creds(roles\u003dcredential_type)"},{"line_number":349,"context_line":"            self._creds[str(credential_type)] \u003d credentials"}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_d437234b","line":346,"range":{"start_line":346,"start_character":43,"end_line":346,"end_character":55},"in_reply_to":"3f79a3b5_52c5785b","updated":"2018-09-25 20:13:36.000000000","message":"Done","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"ef2d3cc00e1cb38c634634ffd7ae5cdbcb43478b","unresolved":false,"context_lines":[{"line_number":44,"context_line":"    :param dict network_resources: network resources to be created for"},{"line_number":45,"context_line":"                                   the created credentials"},{"line_number":46,"context_line":"    :param Credentials admin_creds: initial admin credentials"},{"line_number":47,"context_line":"    :param bool identity_admin_domain_scope: Set to true if admin should be"},{"line_number":48,"context_line":"                                             scoped to the domain. By"},{"line_number":49,"context_line":"                                             default this is False and the"},{"line_number":50,"context_line":"                                             admin role is scoped to the"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_0440105f","line":47,"range":{"start_line":47,"start_character":16,"end_line":47,"end_character":43},"updated":"2018-10-19 03:32:07.000000000","message":"I\u0027m assuming the following might need to be done to get the scope to be passed around:\n\n1) Introduce config option similar to https://github.com/openstack/tempest/blob/44ddb4076a5bc3574814f36f414d060fe44af4c4/tempest/config.py#L165 for system scope (I\u0027m assuming there\u0027s a corresponding feature flag or something in Keystone?)\n2) Populate it near here: https://github.com/openstack/tempest/blob/44ddb4076a5bc3574814f36f414d060fe44af4c4/tempest/common/credentials_factory.py#L80\n3) Define a similar variable here: https://github.com/openstack/tempest/blob/44ddb4076a5bc3574814f36f414d060fe44af4c4/tempest/lib/common/dynamic_creds.py#L69\n4) Set the token to \u0027system\u0027 if that `identity_admin_system_scope` variable is set here: https://github.com/openstack/tempest/blob/44ddb4076a5bc3574814f36f414d060fe44af4c4/tempest/lib/common/dynamic_creds.py#L145\n\nThen that looks like it will propagate the scope\u003d\u0027system\u0027 all the way to https://review.openstack.org/#/c/604909/3/tempest/lib/auth.py@430","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"695edeb48070bb07fa5487099e7c1a80ea4ef142","unresolved":false,"context_lines":[{"line_number":44,"context_line":"    :param dict network_resources: network resources to be created for"},{"line_number":45,"context_line":"                                   the created credentials"},{"line_number":46,"context_line":"    :param Credentials admin_creds: initial admin credentials"},{"line_number":47,"context_line":"    :param bool identity_admin_domain_scope: Set to true if admin should be"},{"line_number":48,"context_line":"                                             scoped to the domain. By"},{"line_number":49,"context_line":"                                             default this is False and the"},{"line_number":50,"context_line":"                                             admin role is scoped to the"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_170e7d32","line":47,"range":{"start_line":47,"start_character":16,"end_line":47,"end_character":43},"in_reply_to":"3f79a3b5_03909195","updated":"2018-10-25 16:21:13.000000000","message":"Perfect, that sounds good. Thanks!","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"18f4cedd3048146c24dfd344ec52f400f313c2d1","unresolved":false,"context_lines":[{"line_number":44,"context_line":"    :param dict network_resources: network resources to be created for"},{"line_number":45,"context_line":"                                   the created credentials"},{"line_number":46,"context_line":"    :param Credentials admin_creds: initial admin credentials"},{"line_number":47,"context_line":"    :param bool identity_admin_domain_scope: Set to true if admin should be"},{"line_number":48,"context_line":"                                             scoped to the domain. By"},{"line_number":49,"context_line":"                                             default this is False and the"},{"line_number":50,"context_line":"                                             admin role is scoped to the"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_ef732c1b","line":47,"range":{"start_line":47,"start_character":16,"end_line":47,"end_character":43},"in_reply_to":"3f79a3b5_0440105f","updated":"2018-10-23 12:09:14.000000000","message":"\u003e I\u0027m assuming the following might need to be done to get the scope\n \u003e to be passed around:\n \u003e \n \u003e 1) Introduce config option similar to https://github.com/openstack/tempest/blob/44ddb4076a5bc3574814f36f414d060fe44af4c4/tempest/config.py#L165\n \u003e for system scope (I\u0027m assuming there\u0027s a corresponding feature flag\n \u003e or something in Keystone?)\n\nNo - system scope is available automatically. There isn\u0027t a toggle to use it. So long as you have a Queens deployment, you can get system-scoped tokens [0].\n\nThat said, do we need a feature flat in tempest or can we just build it without that?\n\n[0] http://specs.openstack.org/openstack/keystone-specs/specs/keystone/queens/system-scope.html#authenticating-for-a-system-scoped-token\n\n \u003e 2) Populate it near here: https://github.com/openstack/tempest/blob/44ddb4076a5bc3574814f36f414d060fe44af4c4/tempest/common/credentials_factory.py#L80\n \u003e 3) Define a similar variable here: https://github.com/openstack/tempest/blob/44ddb4076a5bc3574814f36f414d060fe44af4c4/tempest/lib/common/dynamic_creds.py#L69\n \u003e 4) Set the token to \u0027system\u0027 if that `identity_admin_system_scope`\n \u003e variable is set here: https://github.com/openstack/tempest/blob/44ddb4076a5bc3574814f36f414d060fe44af4c4/tempest/lib/common/dynamic_creds.py#L145\n \u003e \n \u003e Then that looks like it will propagate the scope\u003d\u0027system\u0027 all the\n \u003e way to https://review.openstack.org/#/c/604909/3/tempest/lib/auth.py@430\n\n\nI guess the big thing that I\u0027m wondering is if we need to have a configuration flag in tempest to setup system-scoped credentials when they aren\u0027t exactly configurable in keystone (there isn\u0027t anything required for operators to do to use them besides setting up basic role assignments like they would with a domain, anyway).","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"aed1ea16e15c5492ab188369cc0363ccb7349542","unresolved":false,"context_lines":[{"line_number":44,"context_line":"    :param dict network_resources: network resources to be created for"},{"line_number":45,"context_line":"                                   the created credentials"},{"line_number":46,"context_line":"    :param Credentials admin_creds: initial admin credentials"},{"line_number":47,"context_line":"    :param bool identity_admin_domain_scope: Set to true if admin should be"},{"line_number":48,"context_line":"                                             scoped to the domain. By"},{"line_number":49,"context_line":"                                             default this is False and the"},{"line_number":50,"context_line":"                                             admin role is scoped to the"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_03909195","line":47,"range":{"start_line":47,"start_character":16,"end_line":47,"end_character":43},"in_reply_to":"3f79a3b5_972b82e8","updated":"2018-10-25 09:11:16.000000000","message":"true, we can make that config flag as false by default to keep backward compatibility till queens and make true on queens onwards via devstack. like- [1]\n\n[1] https://github.com/openstack-dev/devstack/blob/4daef3b712b2ae877495cffcfa06c46c38a01840/lib/tempest#L267","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"11a1d4451248c01f00f69c71751e095017602037","unresolved":false,"context_lines":[{"line_number":44,"context_line":"    :param dict network_resources: network resources to be created for"},{"line_number":45,"context_line":"                                   the created credentials"},{"line_number":46,"context_line":"    :param Credentials admin_creds: initial admin credentials"},{"line_number":47,"context_line":"    :param bool identity_admin_domain_scope: Set to true if admin should be"},{"line_number":48,"context_line":"                                             scoped to the domain. By"},{"line_number":49,"context_line":"                                             default this is False and the"},{"line_number":50,"context_line":"                                             admin role is scoped to the"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_972b82e8","line":47,"range":{"start_line":47,"start_character":16,"end_line":47,"end_character":43},"in_reply_to":"3f79a3b5_e020fdfa","updated":"2018-10-24 22:46:54.000000000","message":"Oh - I see what you both mean now. I also see that Pike deployments are failing with my most recent patch sets, which makes sense because system-scope and system role assignments was implemented in Queens.\n\nI\u0027ll see if I can get a configuration option added to work around this for Pike deployments. I assume we\u0027d be able to remove that option though once Pike is no longer supported?","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"9c519db65f534aa2f1ae67117107f0264d560178","unresolved":false,"context_lines":[{"line_number":44,"context_line":"    :param dict network_resources: network resources to be created for"},{"line_number":45,"context_line":"                                   the created credentials"},{"line_number":46,"context_line":"    :param Credentials admin_creds: initial admin credentials"},{"line_number":47,"context_line":"    :param bool identity_admin_domain_scope: Set to true if admin should be"},{"line_number":48,"context_line":"                                             scoped to the domain. By"},{"line_number":49,"context_line":"                                             default this is False and the"},{"line_number":50,"context_line":"                                             admin role is scoped to the"}],"source_content_type":"text/x-python","patch_set":3,"id":"3f79a3b5_e020fdfa","line":47,"range":{"start_line":47,"start_character":16,"end_line":47,"end_character":43},"in_reply_to":"3f79a3b5_ef732c1b","updated":"2018-10-24 14:04:57.000000000","message":"humm this is another things we should do. we should support old deployment also where keystone system scope things not present. \n\nmay be we can handle that in test.py where we will actually ask Manager class to provide the \u0027system\u0027 scoped token for actual API call.\n\nStep3 in my comment - https://review.openstack.org/#/c/604909/4/tempest/api/identity/admin/v3/test_credentials.py@55\n\nBut we need to check if that is enough","commit_id":"1521be409eb8a68eb5183aef4037aeaea704e251"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":142,"context_line":"        else:"},{"line_number":143,"context_line":"            # We use a dedicated client manager for identity client in case we"},{"line_number":144,"context_line":"            # need a different token scope for them."},{"line_number":145,"context_line":"            scope \u003d \u0027domain\u0027 if self.identity_admin_domain_scope else \u0027project\u0027"},{"line_number":146,"context_line":"            identity_os \u003d clients.ServiceClients(self.default_admin_creds,"},{"line_number":147,"context_line":"                                                 self.identity_uri,"},{"line_number":148,"context_line":"                                                 scope\u003dscope)"},{"line_number":149,"context_line":"            return (identity_os.identity_v3.IdentityClient(**params),"},{"line_number":150,"context_line":"                    identity_os.identity_v3.ProjectsClient(**params),"},{"line_number":151,"context_line":"                    identity_os.identity_v3.UsersClient(**params),"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_bdcb0e71","line":148,"range":{"start_line":145,"start_character":0,"end_line":148,"end_character":61},"updated":"2018-10-24 13:59:25.000000000","message":"is it true now with system scope also? when we implemented we consider that keystone admin api need \u0027domain\u0027 scope and based on config options  CONF.identity.admin_domain_scope we added \u0027domain\u0027 scope for admin API call.\n\nWhat i see from [1] is assigning the role to user on domain API are system scoped and will not work with \u0027domain\u0027 scoped. \n\n[1] https://github.com/openstack/keystone/blob/d04bb1e7e61a39404b27ecf5248a0b7982863043/keystone/common/policies/grant.py#L94","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1252e302338e1ada80d316b42cde1163ef061429","unresolved":false,"context_lines":[{"line_number":142,"context_line":"        else:"},{"line_number":143,"context_line":"            # We use a dedicated client manager for identity client in case we"},{"line_number":144,"context_line":"            # need a different token scope for them."},{"line_number":145,"context_line":"            scope \u003d \u0027domain\u0027 if self.identity_admin_domain_scope else \u0027project\u0027"},{"line_number":146,"context_line":"            identity_os \u003d clients.ServiceClients(self.default_admin_creds,"},{"line_number":147,"context_line":"                                                 self.identity_uri,"},{"line_number":148,"context_line":"                                                 scope\u003dscope)"},{"line_number":149,"context_line":"            return (identity_os.identity_v3.IdentityClient(**params),"},{"line_number":150,"context_line":"                    identity_os.identity_v3.ProjectsClient(**params),"},{"line_number":151,"context_line":"                    identity_os.identity_v3.UsersClient(**params),"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_d7a01a91","line":148,"range":{"start_line":145,"start_character":0,"end_line":148,"end_character":61},"in_reply_to":"3f79a3b5_bdcb0e71","updated":"2018-10-24 22:44:01.000000000","message":"Correct, system-scope, domain-scope, and project-scope are all different things that are meant to complement each other.","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":189,"context_line":"            username, user_password, project, email)"},{"line_number":190,"context_line":"        role_assigned \u003d False"},{"line_number":191,"context_line":"        if system:"},{"line_number":192,"context_line":"            self.creds_client.assign_user_role_on_system(user, self.admin_role)"},{"line_number":193,"context_line":"            role_assigned \u003d True"},{"line_number":194,"context_line":"        elif admin:"},{"line_number":195,"context_line":"            self.creds_client.assign_user_role(user, project, self.admin_role)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_bd9eae52","line":192,"range":{"start_line":192,"start_character":11,"end_line":192,"end_character":79},"updated":"2018-10-24 13:59:25.000000000","message":"This is still not clear to me. In what cases we need to assign admin role on user when requesting the system scope token.","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"de1b5b64e39cd9f6e0d63418d827c3a30e39883a","unresolved":false,"context_lines":[{"line_number":189,"context_line":"            username, user_password, project, email)"},{"line_number":190,"context_line":"        role_assigned \u003d False"},{"line_number":191,"context_line":"        if system:"},{"line_number":192,"context_line":"            self.creds_client.assign_user_role_on_system(user, self.admin_role)"},{"line_number":193,"context_line":"            role_assigned \u003d True"},{"line_number":194,"context_line":"        elif admin:"},{"line_number":195,"context_line":"            self.creds_client.assign_user_role(user, project, self.admin_role)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_44068523","line":192,"range":{"start_line":192,"start_character":11,"end_line":192,"end_character":79},"in_reply_to":"3f79a3b5_8376e1a2","updated":"2018-10-25 16:20:02.000000000","message":"Correct. Since keystone pre-populates admin, member, and reader as of Rocky, those roles are available by default.","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"aed1ea16e15c5492ab188369cc0363ccb7349542","unresolved":false,"context_lines":[{"line_number":189,"context_line":"            username, user_password, project, email)"},{"line_number":190,"context_line":"        role_assigned \u003d False"},{"line_number":191,"context_line":"        if system:"},{"line_number":192,"context_line":"            self.creds_client.assign_user_role_on_system(user, self.admin_role)"},{"line_number":193,"context_line":"            role_assigned \u003d True"},{"line_number":194,"context_line":"        elif admin:"},{"line_number":195,"context_line":"            self.creds_client.assign_user_role(user, project, self.admin_role)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_8376e1a2","line":192,"range":{"start_line":192,"start_character":11,"end_line":192,"end_character":79},"in_reply_to":"3f79a3b5_b7c0fe4c","updated":"2018-10-25 09:11:16.000000000","message":"understood now from your other reply on system_member, system_admin etc.\n\nSo here we can assign the different role (admin, member, reader) to user on system.","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1252e302338e1ada80d316b42cde1163ef061429","unresolved":false,"context_lines":[{"line_number":189,"context_line":"            username, user_password, project, email)"},{"line_number":190,"context_line":"        role_assigned \u003d False"},{"line_number":191,"context_line":"        if system:"},{"line_number":192,"context_line":"            self.creds_client.assign_user_role_on_system(user, self.admin_role)"},{"line_number":193,"context_line":"            role_assigned \u003d True"},{"line_number":194,"context_line":"        elif admin:"},{"line_number":195,"context_line":"            self.creds_client.assign_user_role(user, project, self.admin_role)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_b7c0fe4c","line":192,"range":{"start_line":192,"start_character":11,"end_line":192,"end_character":79},"in_reply_to":"3f79a3b5_bd9eae52","updated":"2018-10-24 22:44:01.000000000","message":"Keystone will only issue a system-scoped token if the user has a role assignment on the system. This is exactly the same as a user requesting a project-scope token and requiring them to have a role on the project they are requesting a token for.","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":337,"context_line":"        if self._creds.get(str(credential_type)):"},{"line_number":338,"context_line":"            credentials \u003d self._creds[str(credential_type)]"},{"line_number":339,"context_line":"        else:"},{"line_number":340,"context_line":"            if credential_type in [\u0027primary\u0027, \u0027alt\u0027, \u0027admin\u0027, \u0027system_admin\u0027]:"},{"line_number":341,"context_line":"                is_admin \u003d (credential_type \u003d\u003d \u0027admin\u0027)"},{"line_number":342,"context_line":"                is_system_admin \u003d (credential_type \u003d\u003d \u0027system_admin\u0027)"},{"line_number":343,"context_line":"                credentials \u003d self._create_creds("}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_7dd25600","line":340,"range":{"start_line":340,"start_character":63,"end_line":340,"end_character":75},"updated":"2018-10-24 13:59:25.000000000","message":"\u0027system\u0027","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1252e302338e1ada80d316b42cde1163ef061429","unresolved":false,"context_lines":[{"line_number":337,"context_line":"        if self._creds.get(str(credential_type)):"},{"line_number":338,"context_line":"            credentials \u003d self._creds[str(credential_type)]"},{"line_number":339,"context_line":"        else:"},{"line_number":340,"context_line":"            if credential_type in [\u0027primary\u0027, \u0027alt\u0027, \u0027admin\u0027, \u0027system_admin\u0027]:"},{"line_number":341,"context_line":"                is_admin \u003d (credential_type \u003d\u003d \u0027admin\u0027)"},{"line_number":342,"context_line":"                is_system_admin \u003d (credential_type \u003d\u003d \u0027system_admin\u0027)"},{"line_number":343,"context_line":"                credentials \u003d self._create_creds("}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_b7955e40","line":340,"range":{"start_line":340,"start_character":63,"end_line":340,"end_character":75},"in_reply_to":"3f79a3b5_7dd25600","updated":"2018-10-24 22:44:01.000000000","message":"Done","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":363,"context_line":"    def get_admin_creds(self):"},{"line_number":364,"context_line":"        return self.get_credentials(\u0027admin\u0027)"},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"    def get_system_admin_creds(self):"},{"line_number":367,"context_line":"        return self.get_credentials(\u0027system_admin\u0027)"},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"    def get_alt_creds(self):"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_1de482de","line":366,"range":{"start_line":366,"start_character":8,"end_line":366,"end_character":30},"updated":"2018-10-24 13:59:25.000000000","message":"get_system_creds","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1252e302338e1ada80d316b42cde1163ef061429","unresolved":false,"context_lines":[{"line_number":363,"context_line":"    def get_admin_creds(self):"},{"line_number":364,"context_line":"        return self.get_credentials(\u0027admin\u0027)"},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"    def get_system_admin_creds(self):"},{"line_number":367,"context_line":"        return self.get_credentials(\u0027system_admin\u0027)"},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"    def get_alt_creds(self):"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_57808af6","line":366,"range":{"start_line":366,"start_character":8,"end_line":366,"end_character":30},"in_reply_to":"3f79a3b5_1de482de","updated":"2018-10-24 22:44:01.000000000","message":"Done","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"861b4d6a13fe44ae04d9812ee49d0c8de6cf8590","unresolved":false,"context_lines":[{"line_number":364,"context_line":"        return self.get_credentials(\u0027admin\u0027)"},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"    def get_system_admin_creds(self):"},{"line_number":367,"context_line":"        return self.get_credentials(\u0027system_admin\u0027)"},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"    def get_alt_creds(self):"},{"line_number":370,"context_line":"        return self.get_credentials(\u0027alt\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_3dd93e27","line":367,"range":{"start_line":367,"start_character":37,"end_line":367,"end_character":49},"updated":"2018-10-24 13:59:25.000000000","message":"ditto, we can make it \u0027system\u0027 only to avoid the confusion that \u0027system\u0027 \u0026 \u0027system_admin\u0027 are not separate things","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1252e302338e1ada80d316b42cde1163ef061429","unresolved":false,"context_lines":[{"line_number":364,"context_line":"        return self.get_credentials(\u0027admin\u0027)"},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"    def get_system_admin_creds(self):"},{"line_number":367,"context_line":"        return self.get_credentials(\u0027system_admin\u0027)"},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"    def get_alt_creds(self):"},{"line_number":370,"context_line":"        return self.get_credentials(\u0027alt\u0027)"}],"source_content_type":"text/x-python","patch_set":4,"id":"3f79a3b5_b76ebe62","line":367,"range":{"start_line":367,"start_character":37,"end_line":367,"end_character":49},"in_reply_to":"3f79a3b5_3dd93e27","updated":"2018-10-24 22:44:01.000000000","message":"Done.\n\nJust to clarify, my usage of \u0027system\u0027 here is implying the role assigned to the user in keystone on the system is the admin role.","commit_id":"09e55f49c1c6f579395213eac84c2475500ded4a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"aed1ea16e15c5492ab188369cc0363ccb7349542","unresolved":false,"context_lines":[{"line_number":196,"context_line":"            # supports it. Once Ocata and Pike are EOL\u0027d, we should be able to"},{"line_number":197,"context_line":"            # remove this if-statement since this functionality will always be"},{"line_number":198,"context_line":"            # available."},{"line_number":199,"context_line":"            if self.identity_system_scope:"},{"line_number":200,"context_line":"                self.creds_client.assign_user_role_on_system("},{"line_number":201,"context_line":"                    user, self.admin_role)"},{"line_number":202,"context_line":"            role_assigned \u003d True"},{"line_number":203,"context_line":"        elif admin:"},{"line_number":204,"context_line":"            self.creds_client.assign_user_role(user, project, self.admin_role)"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_fe364a4f","line":201,"range":{"start_line":199,"start_character":0,"end_line":201,"end_character":42},"updated":"2018-10-25 09:11:16.000000000","message":"i think it is not assigning the role and thats why failure ?","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bb958b6f5aa696dd9e8f92f7ee0b9fc9de5ee7c9","unresolved":false,"context_lines":[{"line_number":196,"context_line":"            # supports it. Once Ocata and Pike are EOL\u0027d, we should be able to"},{"line_number":197,"context_line":"            # remove this if-statement since this functionality will always be"},{"line_number":198,"context_line":"            # available."},{"line_number":199,"context_line":"            if self.identity_system_scope:"},{"line_number":200,"context_line":"                self.creds_client.assign_user_role_on_system("},{"line_number":201,"context_line":"                    user, self.admin_role)"},{"line_number":202,"context_line":"            role_assigned \u003d True"},{"line_number":203,"context_line":"        elif admin:"},{"line_number":204,"context_line":"            self.creds_client.assign_user_role(user, project, self.admin_role)"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_97e4cd43","line":201,"range":{"start_line":199,"start_character":0,"end_line":201,"end_character":42},"in_reply_to":"3f79a3b5_fe364a4f","updated":"2018-10-25 16:27:48.000000000","message":"Oh - it\u0027s failing because the role assignment does exist and the user can\u0027t get a system-scoped token?","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"b7db2361be033199b6706b7022d6e58cf589cead","unresolved":false,"context_lines":[{"line_number":196,"context_line":"            # supports it. Once Ocata and Pike are EOL\u0027d, we should be able to"},{"line_number":197,"context_line":"            # remove this if-statement since this functionality will always be"},{"line_number":198,"context_line":"            # available."},{"line_number":199,"context_line":"            if self.identity_system_scope:"},{"line_number":200,"context_line":"                self.creds_client.assign_user_role_on_system("},{"line_number":201,"context_line":"                    user, self.admin_role)"},{"line_number":202,"context_line":"            role_assigned \u003d True"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_8d39c4a3","line":199,"range":{"start_line":199,"start_character":12,"end_line":199,"end_character":42},"updated":"2018-10-31 09:59:40.000000000","message":"in else condition (where we do not have system scope available), we are going to request \u0027project\u0027 scope [1] but we end up not assigning any role to user here. so we should assign the admin role in else condition so that we can support the old deployment. \n\nor by modifying the next elif admin condition. \n\nThis is why it is failing on master job with this config option false[2]\n\n[1] https://review.openstack.org/#/c/604909/6/tempest/test.py@687\n\n[2] http://logs.openstack.org/09/604909/7/check/tempest-full/6feeb88/job-output.txt.gz#_2018-10-30_13_36_56_753362","commit_id":"5a33d2a5f1efcddb998d6ca6de2e062dfaec929f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d65d5f1c37d8bc55c0037d1e75a80dc6bdf4c0af","unresolved":false,"context_lines":[{"line_number":196,"context_line":"            # supports it. Once Ocata and Pike are EOL\u0027d, we should be able to"},{"line_number":197,"context_line":"            # remove this if-statement since this functionality will always be"},{"line_number":198,"context_line":"            # available."},{"line_number":199,"context_line":"            if self.identity_system_scope:"},{"line_number":200,"context_line":"                self.creds_client.assign_user_role_on_system("},{"line_number":201,"context_line":"                    user, self.admin_role)"},{"line_number":202,"context_line":"            role_assigned \u003d True"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_70d0bbc7","line":199,"range":{"start_line":199,"start_character":12,"end_line":199,"end_character":42},"in_reply_to":"3f79a3b5_8d39c4a3","updated":"2018-10-31 11:11:18.000000000","message":"Done","commit_id":"5a33d2a5f1efcddb998d6ca6de2e062dfaec929f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"b7db2361be033199b6706b7022d6e58cf589cead","unresolved":false,"context_lines":[{"line_number":199,"context_line":"            if self.identity_system_scope:"},{"line_number":200,"context_line":"                self.creds_client.assign_user_role_on_system("},{"line_number":201,"context_line":"                    user, self.admin_role)"},{"line_number":202,"context_line":"            role_assigned \u003d True"},{"line_number":203,"context_line":"        elif admin:"},{"line_number":204,"context_line":"            self.creds_client.assign_user_role(user, project, self.admin_role)"},{"line_number":205,"context_line":"            role_assigned \u003d True"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_3b030914","line":202,"range":{"start_line":202,"start_character":12,"end_line":202,"end_character":32},"updated":"2018-10-31 09:59:40.000000000","message":"this should go under second if condition.","commit_id":"5a33d2a5f1efcddb998d6ca6de2e062dfaec929f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d65d5f1c37d8bc55c0037d1e75a80dc6bdf4c0af","unresolved":false,"context_lines":[{"line_number":199,"context_line":"            if self.identity_system_scope:"},{"line_number":200,"context_line":"                self.creds_client.assign_user_role_on_system("},{"line_number":201,"context_line":"                    user, self.admin_role)"},{"line_number":202,"context_line":"            role_assigned \u003d True"},{"line_number":203,"context_line":"        elif admin:"},{"line_number":204,"context_line":"            self.creds_client.assign_user_role(user, project, self.admin_role)"},{"line_number":205,"context_line":"            role_assigned \u003d True"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_10ddc7dd","line":202,"range":{"start_line":202,"start_character":12,"end_line":202,"end_character":32},"in_reply_to":"3f79a3b5_3b030914","updated":"2018-10-31 11:11:18.000000000","message":"Done","commit_id":"5a33d2a5f1efcddb998d6ca6de2e062dfaec929f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"b7db2361be033199b6706b7022d6e58cf589cead","unresolved":false,"context_lines":[{"line_number":200,"context_line":"                self.creds_client.assign_user_role_on_system("},{"line_number":201,"context_line":"                    user, self.admin_role)"},{"line_number":202,"context_line":"            role_assigned \u003d True"},{"line_number":203,"context_line":"        elif admin:"},{"line_number":204,"context_line":"            self.creds_client.assign_user_role(user, project, self.admin_role)"},{"line_number":205,"context_line":"            role_assigned \u003d True"},{"line_number":206,"context_line":"            if (self.identity_version \u003d\u003d \u0027v3\u0027 and"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_adf040fe","line":203,"range":{"start_line":203,"start_character":0,"end_line":203,"end_character":19},"updated":"2018-10-31 09:59:40.000000000","message":"we can assign the admin role if system is requested and system_scope not available\n\n        if admin or (system and not self.identity_system_scope):","commit_id":"5a33d2a5f1efcddb998d6ca6de2e062dfaec929f"},{"author":{"_account_id":8556,"name":"Ghanshyam Maan","display_name":"Ghanshyam Maan","email":"gmaan.os14@gmail.com","username":"ghanshyam"},"change_message_id":"d65d5f1c37d8bc55c0037d1e75a80dc6bdf4c0af","unresolved":false,"context_lines":[{"line_number":200,"context_line":"                self.creds_client.assign_user_role_on_system("},{"line_number":201,"context_line":"                    user, self.admin_role)"},{"line_number":202,"context_line":"            role_assigned \u003d True"},{"line_number":203,"context_line":"        elif admin:"},{"line_number":204,"context_line":"            self.creds_client.assign_user_role(user, project, self.admin_role)"},{"line_number":205,"context_line":"            role_assigned \u003d True"},{"line_number":206,"context_line":"            if (self.identity_version \u003d\u003d \u0027v3\u0027 and"}],"source_content_type":"text/x-python","patch_set":7,"id":"3f79a3b5_30da43e6","line":203,"range":{"start_line":203,"start_character":0,"end_line":203,"end_character":19},"in_reply_to":"3f79a3b5_adf040fe","updated":"2018-10-31 11:11:18.000000000","message":"Done","commit_id":"5a33d2a5f1efcddb998d6ca6de2e062dfaec929f"}],"tempest/lib/services/identity/v3/roles_client.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"20dadb5b5501742989e15fa592f4e0ff29024f35","unresolved":false,"context_lines":[{"line_number":85,"context_line":"        self.expected_success(204, resp.status)"},{"line_number":86,"context_line":"        return rest_client.ResponseBody(resp, body)"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"    def create_user_role_on_system(self, user_id, role_id):"},{"line_number":89,"context_line":"        \"\"\"Add roles to a user on the system.\"\"\""},{"line_number":90,"context_line":"        resp, body \u003d self.put(\u0027system/users/%s/roles/%s\u0027 %"},{"line_number":91,"context_line":"                              (user_id, role_id), None)"},{"line_number":92,"context_line":"        self.expected_success(204, resp.status)"},{"line_number":93,"context_line":"        return rest_client.ResponseBody(resp, body)"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"    def list_user_roles_on_project(self, project_id, user_id):"},{"line_number":96,"context_line":"        \"\"\"list roles of a user on a project.\"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_52fed8af","line":93,"range":{"start_line":88,"start_character":0,"end_line":93,"end_character":51},"updated":"2018-09-25 03:44:40.000000000","message":"We will have to add a reno for this (as you are adding a new library method), and, in addition, a unit test.\n\nUnit test somewhere around here: https://github.com/openstack/tempest/blob/7e3c936898d05eb9f52e5ce37f463f903ee16ed5/tempest/tests/lib/services/identity/v3/test_roles_client.py#L352","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b9d6c825cf93b81cc306cd41999b431288020fd8","unresolved":false,"context_lines":[{"line_number":85,"context_line":"        self.expected_success(204, resp.status)"},{"line_number":86,"context_line":"        return rest_client.ResponseBody(resp, body)"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"    def create_user_role_on_system(self, user_id, role_id):"},{"line_number":89,"context_line":"        \"\"\"Add roles to a user on the system.\"\"\""},{"line_number":90,"context_line":"        resp, body \u003d self.put(\u0027system/users/%s/roles/%s\u0027 %"},{"line_number":91,"context_line":"                              (user_id, role_id), None)"},{"line_number":92,"context_line":"        self.expected_success(204, resp.status)"},{"line_number":93,"context_line":"        return rest_client.ResponseBody(resp, body)"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"    def list_user_roles_on_project(self, project_id, user_id):"},{"line_number":96,"context_line":"        \"\"\"list roles of a user on a project.\"\"\""}],"source_content_type":"text/x-python","patch_set":1,"id":"3f79a3b5_d48de335","line":93,"range":{"start_line":88,"start_character":0,"end_line":93,"end_character":51},"in_reply_to":"3f79a3b5_52fed8af","updated":"2018-09-25 20:13:36.000000000","message":"Nice - thanks for the pointer.","commit_id":"6023225e35fd6741c4450ed6bda9a37c0b84ea51"}],"tempest/lib/services/identity/v3/token_client.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"602d2238e63ea30ee615a754231e59a62ef43ef3","unresolved":false,"context_lines":[{"line_number":51,"context_line":"    def auth(self, user_id\u003dNone, username\u003dNone, password\u003dNone, project_id\u003dNone,"},{"line_number":52,"context_line":"             project_name\u003dNone, user_domain_id\u003dNone, user_domain_name\u003dNone,"},{"line_number":53,"context_line":"             project_domain_id\u003dNone, project_domain_name\u003dNone, domain_id\u003dNone,"},{"line_number":54,"context_line":"             domain_name\u003dNone, system\u003dNone, token\u003dNone, app_cred_id\u003dNone,"},{"line_number":55,"context_line":"             app_cred_secret\u003dNone):"},{"line_number":56,"context_line":"        \"\"\"Obtains a token from the authentication service"},{"line_number":57,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_192bf2e9","line":54,"range":{"start_line":54,"start_character":31,"end_line":54,"end_character":43},"updated":"2018-10-27 05:25:45.000000000","message":"Since this is in lib this *could* break someone (like a plugin) as this changes the ordering of the other kwargs. This should be the last kwarg.","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d343b3a4b4ca72a5861e61f51bdb6be4eec9c082","unresolved":false,"context_lines":[{"line_number":51,"context_line":"    def auth(self, user_id\u003dNone, username\u003dNone, password\u003dNone, project_id\u003dNone,"},{"line_number":52,"context_line":"             project_name\u003dNone, user_domain_id\u003dNone, user_domain_name\u003dNone,"},{"line_number":53,"context_line":"             project_domain_id\u003dNone, project_domain_name\u003dNone, domain_id\u003dNone,"},{"line_number":54,"context_line":"             domain_name\u003dNone, system\u003dNone, token\u003dNone, app_cred_id\u003dNone,"},{"line_number":55,"context_line":"             app_cred_secret\u003dNone):"},{"line_number":56,"context_line":"        \"\"\"Obtains a token from the authentication service"},{"line_number":57,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_370c92ea","line":54,"range":{"start_line":54,"start_character":31,"end_line":54,"end_character":43},"in_reply_to":"3f79a3b5_192bf2e9","updated":"2018-10-30 12:22:45.000000000","message":"Done","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"602d2238e63ea30ee615a754231e59a62ef43ef3","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        :param domain_name: a domain name to scope to"},{"line_number":66,"context_line":"        :param project_id: a project id to scope to"},{"line_number":67,"context_line":"        :param project_name: a project name to scope to"},{"line_number":68,"context_line":"        :param system: a dictionary containing the system to scope to"},{"line_number":69,"context_line":"        :param token: a token to re-scope."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"        Accepts different combinations of credentials."}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_793b0638","line":68,"updated":"2018-10-27 05:25:45.000000000","message":"This param list is missing plenty of things like password and the params aren\u0027t aligned with the order of the actual args in the function prototype. Still, can w emake this the last param, along with making the system kwarg last?","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d343b3a4b4ca72a5861e61f51bdb6be4eec9c082","unresolved":false,"context_lines":[{"line_number":65,"context_line":"        :param domain_name: a domain name to scope to"},{"line_number":66,"context_line":"        :param project_id: a project id to scope to"},{"line_number":67,"context_line":"        :param project_name: a project name to scope to"},{"line_number":68,"context_line":"        :param system: a dictionary containing the system to scope to"},{"line_number":69,"context_line":"        :param token: a token to re-scope."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"        Accepts different combinations of credentials."}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_d7f0bede","line":68,"in_reply_to":"3f79a3b5_793b0638","updated":"2018-10-30 12:22:45.000000000","message":"Done","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"}],"tempest/test.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"602d2238e63ea30ee615a754231e59a62ef43ef3","unresolved":false,"context_lines":[{"line_number":683,"context_line":"                    \"Invalid credentials type %s\" % credential_type)"},{"line_number":684,"context_line":"        if CONF.identity.system_scope and credential_type \u003d\u003d \u0027system\u0027:"},{"line_number":685,"context_line":"            scope \u003d \u0027system\u0027"},{"line_number":686,"context_line":"        else:"},{"line_number":687,"context_line":"            scope \u003d \u0027project\u0027"},{"line_number":688,"context_line":"        manager \u003d cls.client_manager("},{"line_number":689,"context_line":"            credentials\u003dcreds.credentials, scope\u003dscope)"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_39410ea8","line":686,"updated":"2018-10-27 05:25:45.000000000","message":"Does Keystone not use \u0027domain\u0027 scope anywhere?","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d343b3a4b4ca72a5861e61f51bdb6be4eec9c082","unresolved":false,"context_lines":[{"line_number":683,"context_line":"                    \"Invalid credentials type %s\" % credential_type)"},{"line_number":684,"context_line":"        if CONF.identity.system_scope and credential_type \u003d\u003d \u0027system\u0027:"},{"line_number":685,"context_line":"            scope \u003d \u0027system\u0027"},{"line_number":686,"context_line":"        else:"},{"line_number":687,"context_line":"            scope \u003d \u0027project\u0027"},{"line_number":688,"context_line":"        manager \u003d cls.client_manager("},{"line_number":689,"context_line":"            credentials\u003dcreds.credentials, scope\u003dscope)"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_3725725c","line":686,"in_reply_to":"3f79a3b5_39410ea8","updated":"2018-10-30 12:22:45.000000000","message":"Keystone does, mostly for users and projects, but I\u0027m not sure what the status of those tests are in tempest.","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"}],"tempest/tests/lib/services/identity/v3/test_roles_client.py":[{"author":{"_account_id":23186,"name":"Felipe Monteiro","email":"felipe.carneiro.monteiro@gmail.com","username":"felipe.monteiro"},"change_message_id":"602d2238e63ea30ee615a754231e59a62ef43ef3","unresolved":false,"context_lines":[{"line_number":225,"context_line":"            role_id\u003d\"1234\","},{"line_number":226,"context_line":"            status\u003d204)"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"    def _test_create_user_role_on_system(self, bytes_body\u003dFalse):"},{"line_number":229,"context_line":"        self.check_service_client_function("},{"line_number":230,"context_line":"            self.client.create_user_role_on_system,"},{"line_number":231,"context_line":"            \u0027tempest.lib.common.rest_client.RestClient.put\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_b9067e73","line":228,"updated":"2018-10-27 05:25:45.000000000","message":"This is prefixed with \"_\" so isn\u0027t an actual test that is getting executed. Please follow the pattern on L497 instead.\n\nReason why is because this returns an empty response body (204) so we don\u0027t need to check bytes_body. So drop bytes_body and drop the \"_\" and should be good to go.","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"d343b3a4b4ca72a5861e61f51bdb6be4eec9c082","unresolved":false,"context_lines":[{"line_number":225,"context_line":"            role_id\u003d\"1234\","},{"line_number":226,"context_line":"            status\u003d204)"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"    def _test_create_user_role_on_system(self, bytes_body\u003dFalse):"},{"line_number":229,"context_line":"        self.check_service_client_function("},{"line_number":230,"context_line":"            self.client.create_user_role_on_system,"},{"line_number":231,"context_line":"            \u0027tempest.lib.common.rest_client.RestClient.put\u0027,"}],"source_content_type":"text/x-python","patch_set":6,"id":"3f79a3b5_77876a13","line":228,"in_reply_to":"3f79a3b5_b9067e73","updated":"2018-10-30 12:22:45.000000000","message":"Done","commit_id":"da1e3f51148b65690a32cb672bc2d59fea7e679a"}]}