GitHub PushEvent at 2014-12-19 15:57:25
Repository: keystone
Actor: citrix-openstack-build
Payload: {"shas":[["7bb322fd70bfd32c8c8ed0193bba50765c180475","d00136b1f350cdfd4a4b13e2c189b3ba40c3257e@gmail.com","Fix Jenkins translation jobs\n\nThe jobs keystone-propose-translation-update and\nkeystone-upstream-translation-update do not update from\ntransifex since our po files contain duplicate entries where obsolete\nentries duplicate normal entries.\n\nRemove all obsolete entries to fix the jobs.\n\nNOTE: This is NOT a clean backport of the patch from master, but rather\nthis patch was generated similarly to the patch to master using\nhttps://gist.github.com/dolph/9915293\n\nCloses-Bug: #1299349\n\nChange-Id: Ibbf26bb8158735a5dc57bff7d77a49e00239857c","Dolph Mathews",true],["856f7df76f2b0232d1e7bc7234db8d2e5593341f","c4fc2f709f5975ecbf38eef838230aa99615205d@huawei.com","Fix create_region_with_id raise 500 Error bug\n\n1. add sql.handle_conflicts wrapper in sql backend driver.\n2. check duplicate region id in kvs backend driver.\n3. add 2 test cases to check exception.Conflict when create duplicate id region.\n\nCloses-Bug: #1283904\n\nChange-Id: Icfc5edf661501a5c134f324a76824812dbda2760","ruichen",true],["ce6cedb30c5c4b4cf4db9380f09443de22414b39","ae636e45f03fbb934c7cdec89f262fb5d54a26c0@cloudwatt.com","Sanitizes authentication methods received in requests.\n\nWhen a user authenticates against Identity V3 API, he can specify\nmultiple authentication methods. This patch removes duplicates, which\ncould have been used to achieve DoS attacks.\n\nChange-Id: Iec9a1875a4ff6e2fac0fb2c3db6f3ce34a5dfd1d\nCloses-Bug: 1300274","Florent Flament",true],["f2b62bd05d501c60a586469e10ac4a530651566d","d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","Merge \"Fix create_region_with_id raise 500 Error bug\" into milestone-proposed","Jenkins",true],["c15fac2b9a074de2d81b67b857bab38f1b1e3fb3","6b0d31c0d563223024da45691584643ac78c96e8@metacloud.com","Sync from oslo db.sqlalchemy.migration\n\nSync the updated migration module to prevent errors on non-utf8\nmigrate_version and alembic_version tables (not controlled by the\nschema migration directory).\n\nChange from oslo commits:\n[2fd457bf2cc] Ignore migrate versioning tables in utf8 sanity check\n\nChange-Id: I6aef126b8d09c7a44f3815c4143ef1d4e5463426\nCloses-Bug: #1301036","Morgan Fainberg",true],["b8c161fbdbee0a8df4fa8c92ea109cb1d98e95da","d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","Merge \"Sanitizes authentication methods received in requests.\" into milestone-proposed","Jenkins",true],["58b790f1cc7a3e4b8d105e98e0064d873dff2903","d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","Merge \"Sync from oslo db.sqlalchemy.migration\" into milestone-proposed","Jenkins",true],["628f383fbb14ae99679957ab05a02562a4d43d91","1150688ef4531a9968266ddcbdddd37ed9b81ac8@huawei.com","For ldap, API wrongly reports user is in group\n\nWhen the ldap identity backend is configured,\nHEAD v3/groups/​{group_id}​/users/​{user_id}\nalways returns 200, even if the user is not actually in the group.\nThis is because the sql and kvs backend will raise NotFound\nexception if the user is not in the group, but the ldap backend\njust return result.\n\nChange-Id: Ie1585c8aebe054091bd76fded666bf41125ff9ca\nCloses-Bug: 1245247","wanghong",true],["c61ef66eda61c6e8e181272d6fb662c3b62b7767","38c8728ee30e7562e7872660a2fab1bda7c7a859@us.ibm.com","Keystone doesn't use pam\n\nThe requirements.txt file had pam, but Keystone doesn't use pam.\n\nChange-Id: Ib617146d4ec75532f994ae85837ecbf383647306","Brant Knudson",true],["13ca3ee130a5774ff7cdf9a853136b23e2d56983","d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","Merge \"Keystone doesn't use pam\" into milestone-proposed","Jenkins",true],["4f0b42ea827f811b961b63042b6ee912d1afbcc0","d0e802219b8415aabb9bc4c8d263995604c83e38@redhat.com","Remove legacy_endpoint_id and enabled from service catalog\n\nThose two fields are for internal use, and should not be in the token.\n\nThe token size was expanding past the threshold where it could\nbe passed between a wsgi process and Apache HTTPD, even for\na basic, devstack sized catalog.  This reduces the size.\n\nChange-Id: Ic8eb70e519a8a35fd05b497d917f9889e82b6e7f\nCloses-Bug: 1302075","Adam Young",true],["5b5331fa02de38207cd81922d5794192ebb4b77a","38c8728ee30e7562e7872660a2fab1bda7c7a859@us.ibm.com","Fix invalid LDAP filter for user ID with comma\n\nThe Keystone server would respond with a 500 error when configured\nto use the LDAP identity backend and a request is made to get a\ntoken for a user that has an ID with a comma. The response is like:\n\n Authorization Failed: An unexpected error prevented the server from\n fulfilling your request. {'desc': 'Bad search filter'} (HTTP 500)\n\nThis is because the user DN wasn't properly escaped in the filter\nfor the query to get the groups that the user is a member of.\n\nCloses-Bug: #1302106\n\nChange-Id: Ib4886e66af0e979fcf23a84bcd51b07034547cb9","Brant Knudson",true],["a3933982c8d1f256e34d9bc62d0a744617152849","d95b56ce41a2e1ac4cecdd398defd7414407cc08@openstack.org","Updated from global requirements\n\nChange-Id: I009a6494637c2daaae7a08e8ed3c6bf13155ead6","OpenStack Jenkins",true],["b07840a0532ef92fda8dc00c99059ec96a98c564","d95b56ce41a2e1ac4cecdd398defd7414407cc08@review.openstack.org","Merge \"Fix invalid LDAP filter for user ID with comma\" into milestone-proposed","Jenkins",true],["1e948043fe2456bd91b398317c71c665d69e9935","819d67e53b6c9983dea118cea592f5214247b065@openstack.org","Opening stable/icehouse\n\nBump version to next stable release on icehouse branch, and set\ndefaultbranch in .gitreview for convenience.\n\nChange-Id: I64f11ddbb5fb28ec6cbeb55f672f7eae0c56d38d","Thierry Carrez",true],["1716748df15443f1141f69ea620c4bc33758433d","796c134aef5e348abf17f72824ce6669b6c9396b@redhat.com","Treat LDAP attribute names as case-insensitive\n\nLDAP attribute names are case-insensitive, and different LDAP\nserver implementations behave differently when returning search\nresults.  Keystone attempts to use the attribute names as defined\nin the mapping configuration when checking for values in the dict\nthat represents the search results.  If the case doesn't match,\nwe won't find the values which can lead to errors.\n\nThis patch converts the dictionary keys to lowercase to allow us\nto perform a case-insensitive lookup when processing LDAP search\nresults.  When we create the model object, we still use the\nattribute name case as defined in the mapping to allow predictable\nlookups when we process the model object later.\n\nChange-Id: Ib9a03b912bc7652dc6a61b1c97a950e263a9c6fa\nCloses-bug: 1281216\n(cherry picked from commit 7c104e13fce919dd2563f06ce31c059f145beb77)","Nathan Kinder",true],["b932321212897ca18ea4fd566d73c9d86b781182","38c8728ee30e7562e7872660a2fab1bda7c7a859@us.ibm.com","Allow any attributes in mapping and include in results\n\nWhen using attribute mapping (e.g., user_additional_attribute_mapping), any\nattributes that Keystone didn't know about were ignored and a warning was\nissued, like\n\n WARNING keystone.common.ldap.core [-] Invalid additional attribute mapping:\n \"description:description\". Value \"description\" must use one of password,\n enabled, default_project_id, name, email.\n\nThis check is removed. Additional attribute mappings for \"unexpected\"\nattributes (such as description) should be allowed. For one thing, all the\nknown attributes already have a way of setting the mapping, via the\nuser_*_attribute config option. This will allow setting a \"description\" or\nany other attribute mapping for users.\n\nThe extra attributes defined in the *_additional_attribute_mapping config\noptions weren't included in the list results. These attributes should be\nincluded in the list results.\n\nThis is a combination of 3 commits from master:\n(cherry picked from commit 17db03164200f0d7fff564058fc7df8e97705523)\n(cherry picked from commit 10051adace7cd728d46cd4c999e3019fdbf2d961)\n(cherry picked from commit ebfdab034f2b35074f1645b70c1f07d0c4dfd337)\n\nChange-Id: Ia80174063a5eacdef690ca378b7cb71300a5f5f8\nCloses-Bug: #1293698","Brant Knudson",true],["0bd819c4695034b8a68a13c7739accd2726879a7","ec9a0ead2f8f0542f8910fd3c90067585d10bd52@gmail.com","Removed duplication with list_user_ids_for_project\n\nKeystone list_user_ids_for_project has the possibility of returning\nduplicate users if the user has more than one role in the project.\nlist_user_ids_for_project queries the assignment table which has\none entry for every role the user has but will now remove\nduplicate combinations of target_id and actor_id. This impacts\nV2 calls for tenants.list_users(<tenant_id>) and\nusers.list(tenant_id=<tenant_id>).\n\nChange-Id: I9a1e5b944c2c627138851976e81d405f54fae1c9\nCloses-Bug: #1308218\n(cherry picked from commit d6cb7043cb47f5e73b61635af596736314441275)","Christina Darretta",true],["e56fe4c6d077e2d7d4971f5be09fba25a3bfd19a","934369a96ec7951e6b5c2a5d93ac570f8bd16c80@lists.openstack.org","Updated from global requirements\n\nChange-Id: Ieea9cc5b41ac787fe9b1378f0df2f5c43ad4e6a9","OpenStack Proposal Bot",true],["786af9829c5329a982e3451f77afebbfb21850bd","38c8728ee30e7562e7872660a2fab1bda7c7a859@us.ibm.com","SQL and LDAP fixes for get_roles_for_user_and_project user=group ID\n\nWhen there was a role assigned to a group with the same ID as a user,\nthe SQL and LDAP assignment backends would incorrectly return the\nassignment to the group when requesting roles for the user via the\nget_roles_for_user_and_project method.\n\nWith this change, assignments to a group with the same ID are not\nreturned for the user when calling get_roles_for_user_and_project.\n\nFunctions were added to compare DNs more accurately based on the\nLDAP RFCs.\n\nThe fakeldap code was changed to normalize the values when\ncomparing values for checking if the values match the filter.\n\nCo-Authored By: Nathan Kinder <nkinder@redhat.com>\nCo-Authored By: Adam Young <ayoung@redhat.com>\n\nChange-Id: Id3d6f66c995e65e37d909359420d71ecdde86b69\nCloses-Bug: #1309228","Brant Knudson",true]],"size":89,"ref":"refs/heads/ctx-nova-network-smoke-latest","head":"c82875b1b48c670e9c76fcf3112bdfd4ca05fd2e"}