Merge lp:~yolanda.robla/ubuntu/precise/keystone/essex-sru into lp:ubuntu/precise-updates/keystone

[Yolanda Robla]

[James Page (james-page)]

Yolanda

Minor nitpick; this branch drops an empty line from the changelog;

Other than that builds OK.

review: Needs Fixing

[lp:~yolanda.robla/ubuntu/precise/keystone/essex-sru]

30. By Yolanda Robla on 2012-12-18

fixing typo in changelog

Unmerged revisions

30. By Yolanda Robla on 2012-12-18

fixing typo in changelog

29. By Yolanda Robla on 2012-12-17

[ Chuck Short ]
* debian/keystone.logrotate: Compress log file when rotated. (LP: #1049309)

[ Yolanda Robla Mota ]
* Resynchronize with stable/essex (c17a9992):
  - [8735009] Removing user from a tenant isn't invalidating user access to
    tenant (CVE-2012-5571)
  - [025b1d5] Jenkins jobs fail because of incompatibility between sqlalchemy-
    migrate and the newest sqlalchemy-0.8.0b1 (LP: #1073569)
  - [ddb4019] Open 2012.1.4 development
  - [0e1f05e] memcache driver needs protection against unicode user keys
    (LP: #1056373)
  - [176ee9b] Token invalidation in case of role grant/revoke should be
    limited to affected tenant (LP: #1050025)
  - [58ac669] Token validation includes revoked roles (CVE-2012-4413)
  - [cd1e48a] Memcached Token Backend does not support list tokens
    (LP: #1046905)
  - [5438d3b] Update user's default tenant partially succeeds without authz
    (CVE-2012-3542)

* Dropped, superseeded by new snapshot:
  - debian/patches/CVE-2012-4413.patch [58ac669]
  - debian/patches/CVE-2012-5571.patch [8735009]
  - debian/patches/CVE-2012-3542.patch [5438d3b]

=== modified file '.pc/applied-patches'
--- .pc/applied-patches	2012-11-26 14:07:34 +0000
+++ .pc/applied-patches	2012-12-18 13:48:25 +0000
@@ -1,5 +1,2 @@
 fix-ubuntu-tests.patch
 sql_connection.patch
-keystone-CVE-2012-3542.patch
-keystone-CVE-2012-4413.patch
-keystone-CVE-2012-5571.patch

=== modified file '.pc/fix-ubuntu-tests.patch/tests/test_keystoneclient.py'
--- .pc/fix-ubuntu-tests.patch/tests/test_keystoneclient.py	2012-08-24 03:34:59 +0000
+++ .pc/fix-ubuntu-tests.patch/tests/test_keystoneclient.py	2012-12-18 13:48:25 +0000
@@ -769,15 +769,15 @@
     def test_tenant_add_and_remove_user(self):
         client = self.get_client(admin=True)
         client.roles.add_user_role(tenant=self.tenant_baz['id'],
-                                   user=self.user_foo['id'],
+                                   user=self.user_two['id'],
                                    role=self.role_useless['id'])
         user_refs = client.tenants.list_users(tenant=self.tenant_baz['id'])
-        self.assert_(self.user_foo['id'] in [x.id for x in user_refs])
+        self.assert_(self.user_two['id'] in [x.id for x in user_refs])
         client.roles.remove_user_role(tenant=self.tenant_baz['id'],
-                                      user=self.user_foo['id'],
+                                      user=self.user_two['id'],
                                       role=self.role_useless['id'])
         user_refs = client.tenants.list_users(tenant=self.tenant_baz['id'])
-        self.assert_(self.user_foo['id'] not in [x.id for x in user_refs])
+        self.assert_(self.user_two['id'] not in [x.id for x in user_refs])
 
     def test_user_role_add_404(self):
         from keystoneclient import exceptions as client_exceptions
@@ -890,16 +890,16 @@
     def test_tenant_add_and_remove_user(self):
         client = self.get_client(admin=True)
         client.roles.add_user_to_tenant(tenant_id=self.tenant_baz['id'],
-                                        user_id=self.user_foo['id'],
+                                        user_id=self.user_two['id'],
                                         role_id=self.role_useless['id'])
         role_refs = client.roles.get_user_role_refs(
-                user_id=self.user_foo['id'])
+                user_id=self.user_two['id'])
         self.assert_(self.tenant_baz['id'] in [x.tenantId for x in role_refs])
 
         # get the "role_refs" so we get the proper id, this is how the clients
         # do it
         roleref_refs = client.roles.get_user_role_refs(
-                user_id=self.user_foo['id'])
+                user_id=self.user_two['id'])
         for roleref_ref in roleref_refs:
             if (roleref_ref.roleId == self.role_useless['id']
                 and roleref_ref.tenantId == self.tenant_baz['id']):
@@ -907,11 +907,11 @@
                 break
 
         client.roles.remove_user_from_tenant(tenant_id=self.tenant_baz['id'],
-                                             user_id=self.user_foo['id'],
+                                             user_id=self.user_two['id'],
                                              role_id=roleref_ref.id)
 
         role_refs = client.roles.get_user_role_refs(
-                user_id=self.user_foo['id'])
+                user_id=self.user_two['id'])
         self.assert_(self.tenant_baz['id'] not in
                      [x.tenantId for x in role_refs])
 

=== removed directory '.pc/keystone-CVE-2012-3542.patch'
=== removed directory '.pc/keystone-CVE-2012-3542.patch/keystone'
=== removed directory '.pc/keystone-CVE-2012-3542.patch/keystone/identity'
=== removed file '.pc/keystone-CVE-2012-3542.patch/keystone/identity/core.py'
--- .pc/keystone-CVE-2012-3542.patch/keystone/identity/core.py	2012-08-30 15:10:26 +0000
+++ .pc/keystone-CVE-2012-3542.patch/keystone/identity/core.py	1970-01-01 00:00:00 +0000
@@ -1,625 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2012 OpenStack LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-"""Main entry point into the Identity service."""
-
-import uuid
-import urllib
-import urlparse
-
-from keystone import config
-from keystone import exception
-from keystone import policy
-from keystone import token
-from keystone.common import logging
-from keystone.common import manager
-from keystone.common import wsgi
-
-
-CONF = config.CONF
-
-LOG = logging.getLogger(__name__)
-
-
-class Manager(manager.Manager):
-    """Default pivot point for the Identity backend.
-
-    See :mod:`keystone.common.manager.Manager` for more details on how this
-    dynamically calls the backend.
-
-    """
-
-    def __init__(self):
-        super(Manager, self).__init__(CONF.identity.driver)
-
-
-class Driver(object):
-    """Interface description for an Identity driver."""
-
-    def authenticate(self, user_id=None, tenant_id=None, password=None):
-        """Authenticate a given user, tenant and password.
-
-        Returns: (user, tenant, metadata).
-
-        """
-        raise exception.NotImplemented()
-
-    def get_tenant(self, tenant_id):
-        """Get a tenant by id.
-
-        Returns: tenant_ref or None.
-
-        """
-        raise exception.NotImplemented()
-
-    def get_tenant_by_name(self, tenant_name):
-        """Get a tenant by name.
-
-        Returns: tenant_ref or None.
-
-        """
-        raise exception.NotImplemented()
-
-    def get_user(self, user_id):
-        """Get a user by id.
-
-        Returns: user_ref or None.
-
-        """
-        raise exception.NotImplemented()
-
-    def get_user_by_name(self, user_name):
-        """Get a user by name.
-
-        Returns: user_ref or None.
-
-        """
-        raise exception.NotImplemented()
-
-    def get_role(self, role_id):
-        """Get a role by id.
-
-        Returns: role_ref or None.
-
-        """
-        raise exception.NotImplemented()
-
-    def list_users(self):
-        """List all users in the system.
-
-        NOTE(termie): I'd prefer if this listed only the users for a given
-                      tenant.
-
-        Returns: a list of user_refs or an empty list.
-
-        """
-        raise exception.NotImplemented()
-
-    def list_roles(self):
-        """List all roles in the system.
-
-        Returns: a list of role_refs or an empty list.
-
-        """
-        raise exception.NotImplemented()
-
-    # NOTE(termie): seven calls below should probably be exposed by the api
-    #               more clearly when the api redesign happens
-    def add_user_to_tenant(self, tenant_id, user_id):
-        raise exception.NotImplemented()
-
-    def remove_user_from_tenant(self, tenant_id, user_id):
-        raise exception.NotImplemented()
-
-    def get_all_tenants(self):
-        raise exception.NotImplemented()
-
-    def get_tenants_for_user(self, user_id):
-        """Get the tenants associated with a given user.
-
-        Returns: a list of tenant ids.
-
-        """
-        raise exception.NotImplemented()
-
-    def get_roles_for_user_and_tenant(self, user_id, tenant_id):
-        """Get the roles associated with a user within given tenant.
-
-        Returns: a list of role ids.
-
-        """
-        raise exception.NotImplemented()
-
-    def add_role_to_user_and_tenant(self, user_id, tenant_id, role_id):
-        """Add a role to a user within given tenant."""
-        raise exception.NotImplemented()
-
-    def remove_role_from_user_and_tenant(self, user_id, tenant_id, role_id):
-        """Remove a role from a user within given tenant."""
-        raise exception.NotImplemented()
-
-    # user crud
-    def create_user(self, user_id, user):
-        raise exception.NotImplemented()
-
-    def update_user(self, user_id, user):
-        raise exception.NotImplemented()
-
-    def delete_user(self, user_id):
-        raise exception.NotImplemented()
-
-    # tenant crud
-    def create_tenant(self, tenant_id, tenant):
-        raise exception.NotImplemented()
-
-    def update_tenant(self, tenant_id, tenant):
-        raise exception.NotImplemented()
-
-    def delete_tenant(self, tenant_id, tenant):
-        raise exception.NotImplemented()
-
-    # metadata crud
-
-    def get_metadata(self, user_id, tenant_id):
-        raise exception.NotImplemented()
-
-    def create_metadata(self, user_id, tenant_id, metadata):
-        raise exception.NotImplemented()
-
-    def update_metadata(self, user_id, tenant_id, metadata):
-        raise exception.NotImplemented()
-
-    def delete_metadata(self, user_id, tenant_id, metadata):
-        raise exception.NotImplemented()
-
-    # role crud
-    def create_role(self, role_id, role):
-        raise exception.NotImplemented()
-
-    def update_role(self, role_id, role):
-        raise exception.NotImplemented()
-
-    def delete_role(self, role_id):
-        raise exception.NotImplemented()
-
-
-class PublicRouter(wsgi.ComposableRouter):
-    def add_routes(self, mapper):
-        tenant_controller = TenantController()
-        mapper.connect('/tenants',
-                       controller=tenant_controller,
-                       action='get_tenants_for_token',
-                       conditions=dict(methods=['GET']))
-
-
-class AdminRouter(wsgi.ComposableRouter):
-    def add_routes(self, mapper):
-        # Tenant Operations
-        tenant_controller = TenantController()
-        mapper.connect('/tenants',
-                       controller=tenant_controller,
-                       action='get_all_tenants',
-                       conditions=dict(method=['GET']))
-        mapper.connect('/tenants/{tenant_id}',
-                       controller=tenant_controller,
-                       action='get_tenant',
-                       conditions=dict(method=['GET']))
-
-        # User Operations
-        user_controller = UserController()
-        mapper.connect('/users/{user_id}',
-                       controller=user_controller,
-                       action='get_user',
-                       conditions=dict(method=['GET']))
-
-        # Role Operations
-        roles_controller = RoleController()
-        mapper.connect('/tenants/{tenant_id}/users/{user_id}/roles',
-                       controller=roles_controller,
-                       action='get_user_roles',
-                       conditions=dict(method=['GET']))
-        mapper.connect('/users/{user_id}/roles',
-                       controller=user_controller,
-                       action='get_user_roles',
-                       conditions=dict(method=['GET']))
-
-
-class TenantController(wsgi.Application):
-    def __init__(self):
-        self.identity_api = Manager()
-        self.policy_api = policy.Manager()
-        self.token_api = token.Manager()
-        super(TenantController, self).__init__()
-
-    def get_all_tenants(self, context, **kw):
-        """Gets a list of all tenants for an admin user."""
-        self.assert_admin(context)
-        tenant_refs = self.identity_api.get_tenants(context)
-        params = {
-            'limit': context['query_string'].get('limit'),
-            'marker': context['query_string'].get('marker'),
-        }
-        return self._format_tenant_list(tenant_refs, **params)
-
-    def get_tenants_for_token(self, context, **kw):
-        """Get valid tenants for token based on token used to authenticate.
-
-        Pulls the token from the context, validates it and gets the valid
-        tenants for the user in the token.
-
-        Doesn't care about token scopedness.
-
-        """
-        try:
-            token_ref = self.token_api.get_token(context=context,
-                                                 token_id=context['token_id'])
-        except exception.NotFound:
-            raise exception.Unauthorized()
-
-        user_ref = token_ref['user']
-        tenant_ids = self.identity_api.get_tenants_for_user(
-                context, user_ref['id'])
-        tenant_refs = []
-        for tenant_id in tenant_ids:
-            tenant_refs.append(self.identity_api.get_tenant(
-                    context=context,
-                    tenant_id=tenant_id))
-        params = {
-            'limit': context['query_string'].get('limit'),
-            'marker': context['query_string'].get('marker'),
-        }
-        return self._format_tenant_list(tenant_refs, **params)
-
-    def get_tenant(self, context, tenant_id):
-        # TODO(termie): this stuff should probably be moved to middleware
-        self.assert_admin(context)
-        tenant = self.identity_api.get_tenant(context, tenant_id)
-        if tenant is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-
-        return {'tenant': tenant}
-
-    # CRUD Extension
-    def create_tenant(self, context, tenant):
-        tenant_ref = self._normalize_dict(tenant)
-        self.assert_admin(context)
-        tenant_id = (tenant_ref.get('id')
-                     and tenant_ref.get('id')
-                     or uuid.uuid4().hex)
-        tenant_ref['id'] = tenant_id
-
-        tenant = self.identity_api.create_tenant(
-                context, tenant_id, tenant_ref)
-        return {'tenant': tenant}
-
-    def update_tenant(self, context, tenant_id, tenant):
-        self.assert_admin(context)
-        if self.identity_api.get_tenant(context, tenant_id) is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-
-        tenant_ref = self.identity_api.update_tenant(
-                context, tenant_id, tenant)
-        return {'tenant': tenant_ref}
-
-    def delete_tenant(self, context, tenant_id, **kw):
-        self.assert_admin(context)
-        if self.identity_api.get_tenant(context, tenant_id) is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-
-        self.identity_api.delete_tenant(context, tenant_id)
-
-    def get_tenant_users(self, context, tenant_id, **kw):
-        self.assert_admin(context)
-        if self.identity_api.get_tenant(context, tenant_id) is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-
-        user_refs = self.identity_api.get_tenant_users(context, tenant_id)
-        return {'users': user_refs}
-
-    def _format_tenant_list(self, tenant_refs, **kwargs):
-        marker = kwargs.get('marker')
-        page_idx = 0
-        if marker is not None:
-            for (marker_idx, tenant) in enumerate(tenant_refs):
-                if tenant['id'] == marker:
-                    # we start pagination after the marker
-                    page_idx = marker_idx + 1
-                    break
-            else:
-                msg = 'Marker could not be found'
-                raise exception.ValidationError(message=msg)
-
-        limit = kwargs.get('limit')
-        if limit is not None:
-            try:
-                limit = int(limit)
-                if limit < 0:
-                    raise AssertionError()
-            except (ValueError, AssertionError):
-                msg = 'Invalid limit value'
-                raise exception.ValidationError(message=msg)
-
-        tenant_refs = tenant_refs[page_idx:limit]
-
-        for x in tenant_refs:
-            if 'enabled' not in x:
-                x['enabled'] = True
-        o = {'tenants': tenant_refs,
-             'tenants_links': []}
-        return o
-
-
-class UserController(wsgi.Application):
-    def __init__(self):
-        self.identity_api = Manager()
-        self.policy_api = policy.Manager()
-        self.token_api = token.Manager()
-        super(UserController, self).__init__()
-
-    def get_user(self, context, user_id):
-        self.assert_admin(context)
-        user_ref = self.identity_api.get_user(context, user_id)
-        if not user_ref:
-            raise exception.UserNotFound(user_id=user_id)
-
-        return {'user': user_ref}
-
-    def get_users(self, context):
-        # NOTE(termie): i can't imagine that this really wants all the data
-        #               about every single user in the system...
-        self.assert_admin(context)
-        user_refs = self.identity_api.list_users(context)
-        return {'users': user_refs}
-
-    # CRUD extension
-    def create_user(self, context, user):
-        user = self._normalize_dict(user)
-        self.assert_admin(context)
-        tenant_id = user.get('tenantId', None)
-        if (tenant_id is not None
-                and self.identity_api.get_tenant(context, tenant_id) is None):
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-        user_id = uuid.uuid4().hex
-        user_ref = user.copy()
-        user_ref['id'] = user_id
-        new_user_ref = self.identity_api.create_user(
-                context, user_id, user_ref)
-        if tenant_id:
-            self.identity_api.add_user_to_tenant(context, tenant_id, user_id)
-        return {'user': new_user_ref}
-
-    def update_user(self, context, user_id, user):
-        # NOTE(termie): this is really more of a patch than a put
-        self.assert_admin(context)
-        if self.identity_api.get_user(context, user_id) is None:
-            raise exception.UserNotFound(user_id=user_id)
-
-        user_ref = self.identity_api.update_user(context, user_id, user)
-
-        # If the password was changed or the user was disabled we clear tokens
-        if user.get('password') or user.get('enabled', True) == False:
-            try:
-                for token_id in self.token_api.list_tokens(context, user_id):
-                    self.token_api.delete_token(context, token_id)
-            except exception.NotImplemented:
-                # The users status has been changed but tokens remain valid for
-                # backends that can't list tokens for users
-                LOG.warning('User %s status has changed, but existing tokens '
-                            'remain valid' % user_id)
-        return {'user': user_ref}
-
-    def delete_user(self, context, user_id):
-        self.assert_admin(context)
-        if self.identity_api.get_user(context, user_id) is None:
-            raise exception.UserNotFound(user_id=user_id)
-
-        self.identity_api.delete_user(context, user_id)
-
-    def set_user_enabled(self, context, user_id, user):
-        return self.update_user(context, user_id, user)
-
-    def set_user_password(self, context, user_id, user):
-        return self.update_user(context, user_id, user)
-
-    def update_user_tenant(self, context, user_id, user):
-        """Update the default tenant."""
-        # ensure that we're a member of that tenant
-        tenant_id = user.get('tenantId')
-        self.identity_api.add_user_to_tenant(context, tenant_id, user_id)
-        return self.update_user(context, user_id, user)
-
-
-class RoleController(wsgi.Application):
-    def __init__(self):
-        self.identity_api = Manager()
-        self.token_api = token.Manager()
-        self.policy_api = policy.Manager()
-        super(RoleController, self).__init__()
-
-    # COMPAT(essex-3)
-    def get_user_roles(self, context, user_id, tenant_id=None):
-        """Get the roles for a user and tenant pair.
-
-        Since we're trying to ignore the idea of user-only roles we're
-        not implementing them in hopes that the idea will die off.
-
-        """
-        self.assert_admin(context)
-        if tenant_id is None:
-            raise exception.NotImplemented(message='User roles not supported: '
-                                                   'tenant ID required')
-
-        user = self.identity_api.get_user(context, user_id)
-        if user is None:
-            raise exception.UserNotFound(user_id=user_id)
-        tenant = self.identity_api.get_tenant(context, tenant_id)
-        if tenant is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-
-        roles = self.identity_api.get_roles_for_user_and_tenant(
-                context, user_id, tenant_id)
-        return {'roles': [self.identity_api.get_role(context, x)
-                          for x in roles]}
-
-    # CRUD extension
-    def get_role(self, context, role_id):
-        self.assert_admin(context)
-        role_ref = self.identity_api.get_role(context, role_id)
-        if not role_ref:
-            raise exception.RoleNotFound(role_id=role_id)
-        return {'role': role_ref}
-
-    def create_role(self, context, role):
-        role = self._normalize_dict(role)
-        self.assert_admin(context)
-        role_id = uuid.uuid4().hex
-        role['id'] = role_id
-        role_ref = self.identity_api.create_role(context, role_id, role)
-        return {'role': role_ref}
-
-    def delete_role(self, context, role_id):
-        self.assert_admin(context)
-        self.get_role(context, role_id)
-        self.identity_api.delete_role(context, role_id)
-
-    def get_roles(self, context):
-        self.assert_admin(context)
-        roles = self.identity_api.list_roles(context)
-        # TODO(termie): probably inefficient at some point
-        return {'roles': roles}
-
-    def add_role_to_user(self, context, user_id, role_id, tenant_id=None):
-        """Add a role to a user and tenant pair.
-
-        Since we're trying to ignore the idea of user-only roles we're
-        not implementing them in hopes that the idea will die off.
-
-        """
-        self.assert_admin(context)
-        if tenant_id is None:
-            raise exception.NotImplemented(message='User roles not supported: '
-                                                   'tenant_id required')
-        if self.identity_api.get_user(context, user_id) is None:
-            raise exception.UserNotFound(user_id=user_id)
-        if self.identity_api.get_tenant(context, tenant_id) is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-        if self.identity_api.get_role(context, role_id) is None:
-            raise exception.RoleNotFound(role_id=role_id)
-
-        # This still has the weird legacy semantics that adding a role to
-        # a user also adds them to a tenant
-        self.identity_api.add_user_to_tenant(context, tenant_id, user_id)
-        self.identity_api.add_role_to_user_and_tenant(
-                context, user_id, tenant_id, role_id)
-        role_ref = self.identity_api.get_role(context, role_id)
-        return {'role': role_ref}
-
-    def remove_role_from_user(self, context, user_id, role_id, tenant_id=None):
-        """Remove a role from a user and tenant pair.
-
-        Since we're trying to ignore the idea of user-only roles we're
-        not implementing them in hopes that the idea will die off.
-
-        """
-        self.assert_admin(context)
-        if tenant_id is None:
-            raise exception.NotImplemented(message='User roles not supported: '
-                                                   'tenant_id required')
-        if self.identity_api.get_user(context, user_id) is None:
-            raise exception.UserNotFound(user_id=user_id)
-        if self.identity_api.get_tenant(context, tenant_id) is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-        if self.identity_api.get_role(context, role_id) is None:
-            raise exception.RoleNotFound(role_id=role_id)
-
-        # This still has the weird legacy semantics that adding a role to
-        # a user also adds them to a tenant, so we must follow up on that
-        self.identity_api.remove_role_from_user_and_tenant(
-                context, user_id, tenant_id, role_id)
-        roles = self.identity_api.get_roles_for_user_and_tenant(
-                context, user_id, tenant_id)
-        if not roles:
-            self.identity_api.remove_user_from_tenant(
-                    context, tenant_id, user_id)
-        return
-
-    # COMPAT(diablo): CRUD extension
-    def get_role_refs(self, context, user_id):
-        """Ultimate hack to get around having to make role_refs first-class.
-
-        This will basically iterate over the various roles the user has in
-        all tenants the user is a member of and create fake role_refs where
-        the id encodes the user-tenant-role information so we can look
-        up the appropriate data when we need to delete them.
-
-        """
-        self.assert_admin(context)
-        user_ref = self.identity_api.get_user(context, user_id)
-        tenant_ids = self.identity_api.get_tenants_for_user(context, user_id)
-        o = []
-        for tenant_id in tenant_ids:
-            role_ids = self.identity_api.get_roles_for_user_and_tenant(
-                    context, user_id, tenant_id)
-            for role_id in role_ids:
-                ref = {'roleId': role_id,
-                       'tenantId': tenant_id,
-                       'userId': user_id}
-                ref['id'] = urllib.urlencode(ref)
-                o.append(ref)
-        return {'roles': o}
-
-    # COMPAT(diablo): CRUD extension
-    def create_role_ref(self, context, user_id, role):
-        """This is actually used for adding a user to a tenant.
-
-        In the legacy data model adding a user to a tenant required setting
-        a role.
-
-        """
-        self.assert_admin(context)
-        # TODO(termie): for now we're ignoring the actual role
-        tenant_id = role.get('tenantId')
-        role_id = role.get('roleId')
-        self.identity_api.add_user_to_tenant(context, tenant_id, user_id)
-        self.identity_api.add_role_to_user_and_tenant(
-                context, user_id, tenant_id, role_id)
-        role_ref = self.identity_api.get_role(context, role_id)
-        return {'role': role_ref}
-
-    # COMPAT(diablo): CRUD extension
-    def delete_role_ref(self, context, user_id, role_ref_id):
-        """This is actually used for deleting a user from a tenant.
-
-        In the legacy data model removing a user from a tenant required
-        deleting a role.
-
-        To emulate this, we encode the tenant and role in the role_ref_id,
-        and if this happens to be the last role for the user-tenant pair,
-        we remove the user from the tenant.
-
-        """
-        self.assert_admin(context)
-        # TODO(termie): for now we're ignoring the actual role
-        role_ref_ref = urlparse.parse_qs(role_ref_id)
-        tenant_id = role_ref_ref.get('tenantId')[0]
-        role_id = role_ref_ref.get('roleId')[0]
-        self.identity_api.remove_role_from_user_and_tenant(
-                context, user_id, tenant_id, role_id)
-        roles = self.identity_api.get_roles_for_user_and_tenant(
-                context, user_id, tenant_id)
-        if not roles:
-            self.identity_api.remove_user_from_tenant(
-                    context, tenant_id, user_id)

=== removed directory '.pc/keystone-CVE-2012-4413.patch'
=== removed directory '.pc/keystone-CVE-2012-4413.patch/keystone'
=== removed directory '.pc/keystone-CVE-2012-4413.patch/keystone/identity'
=== removed file '.pc/keystone-CVE-2012-4413.patch/keystone/identity/core.py'
--- .pc/keystone-CVE-2012-4413.patch/keystone/identity/core.py	2012-09-12 09:47:55 +0000
+++ .pc/keystone-CVE-2012-4413.patch/keystone/identity/core.py	1970-01-01 00:00:00 +0000
@@ -1,626 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2012 OpenStack LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-"""Main entry point into the Identity service."""
-
-import uuid
-import urllib
-import urlparse
-
-from keystone import config
-from keystone import exception
-from keystone import policy
-from keystone import token
-from keystone.common import logging
-from keystone.common import manager
-from keystone.common import wsgi
-
-
-CONF = config.CONF
-
-LOG = logging.getLogger(__name__)
-
-
-class Manager(manager.Manager):
-    """Default pivot point for the Identity backend.
-
-    See :mod:`keystone.common.manager.Manager` for more details on how this
-    dynamically calls the backend.
-
-    """
-
-    def __init__(self):
-        super(Manager, self).__init__(CONF.identity.driver)
-
-
-class Driver(object):
-    """Interface description for an Identity driver."""
-
-    def authenticate(self, user_id=None, tenant_id=None, password=None):
-        """Authenticate a given user, tenant and password.
-
-        Returns: (user, tenant, metadata).
-
-        """
-        raise exception.NotImplemented()
-
-    def get_tenant(self, tenant_id):
-        """Get a tenant by id.
-
-        Returns: tenant_ref or None.
-
-        """
-        raise exception.NotImplemented()
-
-    def get_tenant_by_name(self, tenant_name):
-        """Get a tenant by name.
-
-        Returns: tenant_ref or None.
-
-        """
-        raise exception.NotImplemented()
-
-    def get_user(self, user_id):
-        """Get a user by id.
-
-        Returns: user_ref or None.
-
-        """
-        raise exception.NotImplemented()
-
-    def get_user_by_name(self, user_name):
-        """Get a user by name.
-
-        Returns: user_ref or None.
-
-        """
-        raise exception.NotImplemented()
-
-    def get_role(self, role_id):
-        """Get a role by id.
-
-        Returns: role_ref or None.
-
-        """
-        raise exception.NotImplemented()
-
-    def list_users(self):
-        """List all users in the system.
-
-        NOTE(termie): I'd prefer if this listed only the users for a given
-                      tenant.
-
-        Returns: a list of user_refs or an empty list.
-
-        """
-        raise exception.NotImplemented()
-
-    def list_roles(self):
-        """List all roles in the system.
-
-        Returns: a list of role_refs or an empty list.
-
-        """
-        raise exception.NotImplemented()
-
-    # NOTE(termie): seven calls below should probably be exposed by the api
-    #               more clearly when the api redesign happens
-    def add_user_to_tenant(self, tenant_id, user_id):
-        raise exception.NotImplemented()
-
-    def remove_user_from_tenant(self, tenant_id, user_id):
-        raise exception.NotImplemented()
-
-    def get_all_tenants(self):
-        raise exception.NotImplemented()
-
-    def get_tenants_for_user(self, user_id):
-        """Get the tenants associated with a given user.
-
-        Returns: a list of tenant ids.
-
-        """
-        raise exception.NotImplemented()
-
-    def get_roles_for_user_and_tenant(self, user_id, tenant_id):
-        """Get the roles associated with a user within given tenant.
-
-        Returns: a list of role ids.
-
-        """
-        raise exception.NotImplemented()
-
-    def add_role_to_user_and_tenant(self, user_id, tenant_id, role_id):
-        """Add a role to a user within given tenant."""
-        raise exception.NotImplemented()
-
-    def remove_role_from_user_and_tenant(self, user_id, tenant_id, role_id):
-        """Remove a role from a user within given tenant."""
-        raise exception.NotImplemented()
-
-    # user crud
-    def create_user(self, user_id, user):
-        raise exception.NotImplemented()
-
-    def update_user(self, user_id, user):
-        raise exception.NotImplemented()
-
-    def delete_user(self, user_id):
-        raise exception.NotImplemented()
-
-    # tenant crud
-    def create_tenant(self, tenant_id, tenant):
-        raise exception.NotImplemented()
-
-    def update_tenant(self, tenant_id, tenant):
-        raise exception.NotImplemented()
-
-    def delete_tenant(self, tenant_id, tenant):
-        raise exception.NotImplemented()
-
-    # metadata crud
-
-    def get_metadata(self, user_id, tenant_id):
-        raise exception.NotImplemented()
-
-    def create_metadata(self, user_id, tenant_id, metadata):
-        raise exception.NotImplemented()
-
-    def update_metadata(self, user_id, tenant_id, metadata):
-        raise exception.NotImplemented()
-
-    def delete_metadata(self, user_id, tenant_id, metadata):
-        raise exception.NotImplemented()
-
-    # role crud
-    def create_role(self, role_id, role):
-        raise exception.NotImplemented()
-
-    def update_role(self, role_id, role):
-        raise exception.NotImplemented()
-
-    def delete_role(self, role_id):
-        raise exception.NotImplemented()
-
-
-class PublicRouter(wsgi.ComposableRouter):
-    def add_routes(self, mapper):
-        tenant_controller = TenantController()
-        mapper.connect('/tenants',
-                       controller=tenant_controller,
-                       action='get_tenants_for_token',
-                       conditions=dict(methods=['GET']))
-
-
-class AdminRouter(wsgi.ComposableRouter):
-    def add_routes(self, mapper):
-        # Tenant Operations
-        tenant_controller = TenantController()
-        mapper.connect('/tenants',
-                       controller=tenant_controller,
-                       action='get_all_tenants',
-                       conditions=dict(method=['GET']))
-        mapper.connect('/tenants/{tenant_id}',
-                       controller=tenant_controller,
-                       action='get_tenant',
-                       conditions=dict(method=['GET']))
-
-        # User Operations
-        user_controller = UserController()
-        mapper.connect('/users/{user_id}',
-                       controller=user_controller,
-                       action='get_user',
-                       conditions=dict(method=['GET']))
-
-        # Role Operations
-        roles_controller = RoleController()
-        mapper.connect('/tenants/{tenant_id}/users/{user_id}/roles',
-                       controller=roles_controller,
-                       action='get_user_roles',
-                       conditions=dict(method=['GET']))
-        mapper.connect('/users/{user_id}/roles',
-                       controller=user_controller,
-                       action='get_user_roles',
-                       conditions=dict(method=['GET']))
-
-
-class TenantController(wsgi.Application):
-    def __init__(self):
-        self.identity_api = Manager()
-        self.policy_api = policy.Manager()
-        self.token_api = token.Manager()
-        super(TenantController, self).__init__()
-
-    def get_all_tenants(self, context, **kw):
-        """Gets a list of all tenants for an admin user."""
-        self.assert_admin(context)
-        tenant_refs = self.identity_api.get_tenants(context)
-        params = {
-            'limit': context['query_string'].get('limit'),
-            'marker': context['query_string'].get('marker'),
-        }
-        return self._format_tenant_list(tenant_refs, **params)
-
-    def get_tenants_for_token(self, context, **kw):
-        """Get valid tenants for token based on token used to authenticate.
-
-        Pulls the token from the context, validates it and gets the valid
-        tenants for the user in the token.
-
-        Doesn't care about token scopedness.
-
-        """
-        try:
-            token_ref = self.token_api.get_token(context=context,
-                                                 token_id=context['token_id'])
-        except exception.NotFound:
-            raise exception.Unauthorized()
-
-        user_ref = token_ref['user']
-        tenant_ids = self.identity_api.get_tenants_for_user(
-                context, user_ref['id'])
-        tenant_refs = []
-        for tenant_id in tenant_ids:
-            tenant_refs.append(self.identity_api.get_tenant(
-                    context=context,
-                    tenant_id=tenant_id))
-        params = {
-            'limit': context['query_string'].get('limit'),
-            'marker': context['query_string'].get('marker'),
-        }
-        return self._format_tenant_list(tenant_refs, **params)
-
-    def get_tenant(self, context, tenant_id):
-        # TODO(termie): this stuff should probably be moved to middleware
-        self.assert_admin(context)
-        tenant = self.identity_api.get_tenant(context, tenant_id)
-        if tenant is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-
-        return {'tenant': tenant}
-
-    # CRUD Extension
-    def create_tenant(self, context, tenant):
-        tenant_ref = self._normalize_dict(tenant)
-        self.assert_admin(context)
-        tenant_id = (tenant_ref.get('id')
-                     and tenant_ref.get('id')
-                     or uuid.uuid4().hex)
-        tenant_ref['id'] = tenant_id
-
-        tenant = self.identity_api.create_tenant(
-                context, tenant_id, tenant_ref)
-        return {'tenant': tenant}
-
-    def update_tenant(self, context, tenant_id, tenant):
-        self.assert_admin(context)
-        if self.identity_api.get_tenant(context, tenant_id) is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-
-        tenant_ref = self.identity_api.update_tenant(
-                context, tenant_id, tenant)
-        return {'tenant': tenant_ref}
-
-    def delete_tenant(self, context, tenant_id, **kw):
-        self.assert_admin(context)
-        if self.identity_api.get_tenant(context, tenant_id) is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-
-        self.identity_api.delete_tenant(context, tenant_id)
-
-    def get_tenant_users(self, context, tenant_id, **kw):
-        self.assert_admin(context)
-        if self.identity_api.get_tenant(context, tenant_id) is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-
-        user_refs = self.identity_api.get_tenant_users(context, tenant_id)
-        return {'users': user_refs}
-
-    def _format_tenant_list(self, tenant_refs, **kwargs):
-        marker = kwargs.get('marker')
-        page_idx = 0
-        if marker is not None:
-            for (marker_idx, tenant) in enumerate(tenant_refs):
-                if tenant['id'] == marker:
-                    # we start pagination after the marker
-                    page_idx = marker_idx + 1
-                    break
-            else:
-                msg = 'Marker could not be found'
-                raise exception.ValidationError(message=msg)
-
-        limit = kwargs.get('limit')
-        if limit is not None:
-            try:
-                limit = int(limit)
-                if limit < 0:
-                    raise AssertionError()
-            except (ValueError, AssertionError):
-                msg = 'Invalid limit value'
-                raise exception.ValidationError(message=msg)
-
-        tenant_refs = tenant_refs[page_idx:limit]
-
-        for x in tenant_refs:
-            if 'enabled' not in x:
-                x['enabled'] = True
-        o = {'tenants': tenant_refs,
-             'tenants_links': []}
-        return o
-
-
-class UserController(wsgi.Application):
-    def __init__(self):
-        self.identity_api = Manager()
-        self.policy_api = policy.Manager()
-        self.token_api = token.Manager()
-        super(UserController, self).__init__()
-
-    def get_user(self, context, user_id):
-        self.assert_admin(context)
-        user_ref = self.identity_api.get_user(context, user_id)
-        if not user_ref:
-            raise exception.UserNotFound(user_id=user_id)
-
-        return {'user': user_ref}
-
-    def get_users(self, context):
-        # NOTE(termie): i can't imagine that this really wants all the data
-        #               about every single user in the system...
-        self.assert_admin(context)
-        user_refs = self.identity_api.list_users(context)
-        return {'users': user_refs}
-
-    # CRUD extension
-    def create_user(self, context, user):
-        user = self._normalize_dict(user)
-        self.assert_admin(context)
-        tenant_id = user.get('tenantId', None)
-        if (tenant_id is not None
-                and self.identity_api.get_tenant(context, tenant_id) is None):
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-        user_id = uuid.uuid4().hex
-        user_ref = user.copy()
-        user_ref['id'] = user_id
-        new_user_ref = self.identity_api.create_user(
-                context, user_id, user_ref)
-        if tenant_id:
-            self.identity_api.add_user_to_tenant(context, tenant_id, user_id)
-        return {'user': new_user_ref}
-
-    def update_user(self, context, user_id, user):
-        # NOTE(termie): this is really more of a patch than a put
-        self.assert_admin(context)
-        if self.identity_api.get_user(context, user_id) is None:
-            raise exception.UserNotFound(user_id=user_id)
-
-        user_ref = self.identity_api.update_user(context, user_id, user)
-
-        # If the password was changed or the user was disabled we clear tokens
-        if user.get('password') or user.get('enabled', True) == False:
-            try:
-                for token_id in self.token_api.list_tokens(context, user_id):
-                    self.token_api.delete_token(context, token_id)
-            except exception.NotImplemented:
-                # The users status has been changed but tokens remain valid for
-                # backends that can't list tokens for users
-                LOG.warning('User %s status has changed, but existing tokens '
-                            'remain valid' % user_id)
-        return {'user': user_ref}
-
-    def delete_user(self, context, user_id):
-        self.assert_admin(context)
-        if self.identity_api.get_user(context, user_id) is None:
-            raise exception.UserNotFound(user_id=user_id)
-
-        self.identity_api.delete_user(context, user_id)
-
-    def set_user_enabled(self, context, user_id, user):
-        return self.update_user(context, user_id, user)
-
-    def set_user_password(self, context, user_id, user):
-        return self.update_user(context, user_id, user)
-
-    def update_user_tenant(self, context, user_id, user):
-        """Update the default tenant."""
-        self.assert_admin(context)
-        # ensure that we're a member of that tenant
-        tenant_id = user.get('tenantId')
-        self.identity_api.add_user_to_tenant(context, tenant_id, user_id)
-        return self.update_user(context, user_id, user)
-
-
-class RoleController(wsgi.Application):
-    def __init__(self):
-        self.identity_api = Manager()
-        self.token_api = token.Manager()
-        self.policy_api = policy.Manager()
-        super(RoleController, self).__init__()
-
-    # COMPAT(essex-3)
-    def get_user_roles(self, context, user_id, tenant_id=None):
-        """Get the roles for a user and tenant pair.
-
-        Since we're trying to ignore the idea of user-only roles we're
-        not implementing them in hopes that the idea will die off.
-
-        """
-        self.assert_admin(context)
-        if tenant_id is None:
-            raise exception.NotImplemented(message='User roles not supported: '
-                                                   'tenant ID required')
-
-        user = self.identity_api.get_user(context, user_id)
-        if user is None:
-            raise exception.UserNotFound(user_id=user_id)
-        tenant = self.identity_api.get_tenant(context, tenant_id)
-        if tenant is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-
-        roles = self.identity_api.get_roles_for_user_and_tenant(
-                context, user_id, tenant_id)
-        return {'roles': [self.identity_api.get_role(context, x)
-                          for x in roles]}
-
-    # CRUD extension
-    def get_role(self, context, role_id):
-        self.assert_admin(context)
-        role_ref = self.identity_api.get_role(context, role_id)
-        if not role_ref:
-            raise exception.RoleNotFound(role_id=role_id)
-        return {'role': role_ref}
-
-    def create_role(self, context, role):
-        role = self._normalize_dict(role)
-        self.assert_admin(context)
-        role_id = uuid.uuid4().hex
-        role['id'] = role_id
-        role_ref = self.identity_api.create_role(context, role_id, role)
-        return {'role': role_ref}
-
-    def delete_role(self, context, role_id):
-        self.assert_admin(context)
-        self.get_role(context, role_id)
-        self.identity_api.delete_role(context, role_id)
-
-    def get_roles(self, context):
-        self.assert_admin(context)
-        roles = self.identity_api.list_roles(context)
-        # TODO(termie): probably inefficient at some point
-        return {'roles': roles}
-
-    def add_role_to_user(self, context, user_id, role_id, tenant_id=None):
-        """Add a role to a user and tenant pair.
-
-        Since we're trying to ignore the idea of user-only roles we're
-        not implementing them in hopes that the idea will die off.
-
-        """
-        self.assert_admin(context)
-        if tenant_id is None:
-            raise exception.NotImplemented(message='User roles not supported: '
-                                                   'tenant_id required')
-        if self.identity_api.get_user(context, user_id) is None:
-            raise exception.UserNotFound(user_id=user_id)
-        if self.identity_api.get_tenant(context, tenant_id) is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-        if self.identity_api.get_role(context, role_id) is None:
-            raise exception.RoleNotFound(role_id=role_id)
-
-        # This still has the weird legacy semantics that adding a role to
-        # a user also adds them to a tenant
-        self.identity_api.add_user_to_tenant(context, tenant_id, user_id)
-        self.identity_api.add_role_to_user_and_tenant(
-                context, user_id, tenant_id, role_id)
-        role_ref = self.identity_api.get_role(context, role_id)
-        return {'role': role_ref}
-
-    def remove_role_from_user(self, context, user_id, role_id, tenant_id=None):
-        """Remove a role from a user and tenant pair.
-
-        Since we're trying to ignore the idea of user-only roles we're
-        not implementing them in hopes that the idea will die off.
-
-        """
-        self.assert_admin(context)
-        if tenant_id is None:
-            raise exception.NotImplemented(message='User roles not supported: '
-                                                   'tenant_id required')
-        if self.identity_api.get_user(context, user_id) is None:
-            raise exception.UserNotFound(user_id=user_id)
-        if self.identity_api.get_tenant(context, tenant_id) is None:
-            raise exception.TenantNotFound(tenant_id=tenant_id)
-        if self.identity_api.get_role(context, role_id) is None:
-            raise exception.RoleNotFound(role_id=role_id)
-
-        # This still has the weird legacy semantics that adding a role to
-        # a user also adds them to a tenant, so we must follow up on that
-        self.identity_api.remove_role_from_user_and_tenant(
-                context, user_id, tenant_id, role_id)
-        roles = self.identity_api.get_roles_for_user_and_tenant(
-                context, user_id, tenant_id)
-        if not roles:
-            self.identity_api.remove_user_from_tenant(
-                    context, tenant_id, user_id)
-        return
-
-    # COMPAT(diablo): CRUD extension
-    def get_role_refs(self, context, user_id):
-        """Ultimate hack to get around having to make role_refs first-class.
-
-        This will basically iterate over the various roles the user has in
-        all tenants the user is a member of and create fake role_refs where
-        the id encodes the user-tenant-role information so we can look
-        up the appropriate data when we need to delete them.
-
-        """
-        self.assert_admin(context)
-        user_ref = self.identity_api.get_user(context, user_id)
-        tenant_ids = self.identity_api.get_tenants_for_user(context, user_id)
-        o = []
-        for tenant_id in tenant_ids:
-            role_ids = self.identity_api.get_roles_for_user_and_tenant(
-                    context, user_id, tenant_id)
-            for role_id in role_ids:
-                ref = {'roleId': role_id,
-                       'tenantId': tenant_id,
-                       'userId': user_id}
-                ref['id'] = urllib.urlencode(ref)
-                o.append(ref)
-        return {'roles': o}
-
-    # COMPAT(diablo): CRUD extension
-    def create_role_ref(self, context, user_id, role):
-        """This is actually used for adding a user to a tenant.
-
-        In the legacy data model adding a user to a tenant required setting
-        a role.
-
-        """
-        self.assert_admin(context)
-        # TODO(termie): for now we're ignoring the actual role
-        tenant_id = role.get('tenantId')
-        role_id = role.get('roleId')
-        self.identity_api.add_user_to_tenant(context, tenant_id, user_id)
-        self.identity_api.add_role_to_user_and_tenant(
-                context, user_id, tenant_id, role_id)
-        role_ref = self.identity_api.get_role(context, role_id)
-        return {'role': role_ref}
-
-    # COMPAT(diablo): CRUD extension
-    def delete_role_ref(self, context, user_id, role_ref_id):
-        """This is actually used for deleting a user from a tenant.
-
-        In the legacy data model removing a user from a tenant required
-        deleting a role.
-
-        To emulate this, we encode the tenant and role in the role_ref_id,
-        and if this happens to be the last role for the user-tenant pair,
-        we remove the user from the tenant.
-
-        """
-        self.assert_admin(context)
-        # TODO(termie): for now we're ignoring the actual role
-        role_ref_ref = urlparse.parse_qs(role_ref_id)
-        tenant_id = role_ref_ref.get('tenantId')[0]
-        role_id = role_ref_ref.get('roleId')[0]
-        self.identity_api.remove_role_from_user_and_tenant(
-                context, user_id, tenant_id, role_id)
-        roles = self.identity_api.get_roles_for_user_and_tenant(
-                context, user_id, tenant_id)
-        if not roles:
-            self.identity_api.remove_user_from_tenant(
-                    context, tenant_id, user_id)

=== removed directory '.pc/keystone-CVE-2012-4413.patch/keystone/token'
=== removed file '.pc/keystone-CVE-2012-4413.patch/keystone/token/core.py'
--- .pc/keystone-CVE-2012-4413.patch/keystone/token/core.py	2012-09-12 09:47:55 +0000
+++ .pc/keystone-CVE-2012-4413.patch/keystone/token/core.py	1970-01-01 00:00:00 +0000
@@ -1,107 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2012 OpenStack LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-"""Main entry point into the Token service."""
-
-import datetime
-
-from keystone import config
-from keystone import exception
-from keystone.common import manager
-
-
-CONF = config.CONF
-config.register_int('expiration', group='token', default=86400)
-
-
-class Manager(manager.Manager):
-    """Default pivot point for the Token backend.
-
-    See :mod:`keystone.common.manager.Manager` for more details on how this
-    dynamically calls the backend.
-
-    """
-
-    def __init__(self):
-        super(Manager, self).__init__(CONF.token.driver)
-
-
-class Driver(object):
-    """Interface description for a Token driver."""
-
-    def get_token(self, token_id):
-        """Get a token by id.
-
-        :param token_id: identity of the token
-        :type token_id: string
-        :returns: token_ref
-        :raises: keystone.exception.TokenNotFound
-
-        """
-        raise exception.NotImplemented()
-
-    def create_token(self, token_id, data):
-        """Create a token by id and data.
-
-        :param token_id: identity of the token
-        :type token_id: string
-        :param data: dictionary with additional reference information
-
-        ::
-
-            {
-                expires=''
-                id=token_id,
-                user=user_ref,
-                tenant=tenant_ref,
-                metadata=metadata_ref
-            }
-
-        :type data: dict
-        :returns: token_ref or None.
-
-        """
-        raise exception.NotImplemented()
-
-    def delete_token(self, token_id):
-        """Deletes a token by id.
-
-        :param token_id: identity of the token
-        :type token_id: string
-        :returns: None.
-        :raises: keystone.exception.TokenNotFound
-
-        """
-        raise exception.NotImplemented()
-
-    def list_tokens(self, user_id):
-        """Returns a list of current token_id's for a user
-
-        :param user_id: identity of the user
-        :type user_id: string
-        :returns: list of token_id's
-
-        """
-        raise exception.NotImplemented()
-
-    def _get_default_expire_time(self):
-        """Determine when a token should expire based on the config.
-
-        :returns: a naive utc datetime.datetime object
-
-        """
-        expire_delta = datetime.timedelta(seconds=CONF.token.expiration)
-        return datetime.datetime.utcnow() + expire_delta

=== removed directory '.pc/keystone-CVE-2012-4413.patch/tests'
=== removed file '.pc/keystone-CVE-2012-4413.patch/tests/test_keystoneclient.py'
--- .pc/keystone-CVE-2012-4413.patch/tests/test_keystoneclient.py	2012-09-12 09:47:55 +0000
+++ .pc/keystone-CVE-2012-4413.patch/tests/test_keystoneclient.py	1970-01-01 00:00:00 +0000
@@ -1,970 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2012 OpenStack LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-import time
-import uuid
-
-import nose.exc
-
-from keystone import test
-
-import default_fixtures
-
-OPENSTACK_REPO = 'https://review.openstack.org/p/openstack'
-KEYSTONECLIENT_REPO = '%s/python-keystoneclient.git' % OPENSTACK_REPO
-
-
-class CompatTestCase(test.TestCase):
-    def setUp(self):
-        super(CompatTestCase, self).setUp()
-
-        self.load_backends()
-        self.load_fixtures(default_fixtures)
-
-        self.public_server = self.serveapp('keystone', name='main')
-        self.admin_server = self.serveapp('keystone', name='admin')
-
-        # TODO(termie): is_admin is being deprecated once the policy stuff
-        #               is all working
-        # TODO(termie): add an admin user to the fixtures and use that user
-        # override the fixtures, for now
-        self.metadata_foobar = self.identity_api.update_metadata(
-            self.user_foo['id'], self.tenant_bar['id'],
-            dict(roles=['keystone_admin'], is_admin='1'))
-
-    def tearDown(self):
-        self.public_server.kill()
-        self.admin_server.kill()
-        self.public_server = None
-        self.admin_server = None
-        super(CompatTestCase, self).tearDown()
-
-    def _public_url(self):
-        public_port = self.public_server.socket_info['socket'][1]
-        return "http://localhost:%s/v2.0" % public_port
-
-    def _admin_url(self):
-        admin_port = self.admin_server.socket_info['socket'][1]
-        return "http://localhost:%s/v2.0" % admin_port
-
-    def _client(self, admin=False, **kwargs):
-        from keystoneclient.v2_0 import client as ks_client
-
-        url = self._admin_url() if admin else self._public_url()
-        kc = ks_client.Client(endpoint=url,
-                              auth_url=self._public_url(),
-                              **kwargs)
-        kc.authenticate()
-        # have to manually overwrite the management url after authentication
-        kc.management_url = url
-        return kc
-
-    def get_client(self, user_ref=None, tenant_ref=None, admin=False):
-        if user_ref is None:
-            user_ref = self.user_foo
-        if tenant_ref is None:
-            for user in default_fixtures.USERS:
-                if user['id'] == user_ref['id']:
-                    tenant_id = user['tenants'][0]
-        else:
-            tenant_id = tenant_ref['id']
-
-        return self._client(username=user_ref['name'],
-                            password=user_ref['password'],
-                            tenant_id=tenant_id,
-                            admin=admin)
-
-
-class KeystoneClientTests(object):
-    """Tests for all versions of keystoneclient."""
-
-    def test_authenticate_tenant_name_and_tenants(self):
-        client = self.get_client()
-        tenants = client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-    def test_authenticate_tenant_id_and_tenants(self):
-        client = self._client(username=self.user_foo['name'],
-                              password=self.user_foo['password'],
-                              tenant_id='bar')
-        tenants = client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-    def test_authenticate_invalid_tenant_id(self):
-        from keystoneclient import exceptions as client_exceptions
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self._client,
-                          username=self.user_foo['name'],
-                          password=self.user_foo['password'],
-                          tenant_id='baz')
-
-    def test_authenticate_token_no_tenant(self):
-        client = self.get_client()
-        token = client.auth_token
-        token_client = self._client(token=token)
-        tenants = token_client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-    def test_authenticate_token_tenant_id(self):
-        client = self.get_client()
-        token = client.auth_token
-        token_client = self._client(token=token, tenant_id='bar')
-        tenants = token_client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-    def test_authenticate_token_invalid_tenant_id(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client()
-        token = client.auth_token
-        self.assertRaises(client_exceptions.AuthorizationFailure,
-                          self._client, token=token, tenant_id='baz')
-
-    def test_authenticate_token_tenant_name(self):
-        client = self.get_client()
-        token = client.auth_token
-        token_client = self._client(token=token, tenant_name='BAR')
-        tenants = token_client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-    def test_authenticate_and_delete_token(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        client = self.get_client(admin=True)
-        token = client.auth_token
-        token_client = self._client(token=token)
-        tenants = token_client.tenants.list()
-        self.assertEquals(tenants[0].id, self.tenant_bar['id'])
-
-        client.tokens.delete(token_client.auth_token)
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          token_client.tenants.list)
-
-    def test_authenticate_no_password(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        user_ref = self.user_foo.copy()
-        user_ref['password'] = None
-        self.assertRaises(client_exceptions.AuthorizationFailure,
-                          self.get_client,
-                          user_ref)
-
-    def test_authenticate_no_username(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        user_ref = self.user_foo.copy()
-        user_ref['name'] = None
-        self.assertRaises(client_exceptions.AuthorizationFailure,
-                          self.get_client,
-                          user_ref)
-
-    def test_authenticate_disabled_tenant(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        admin_client = self.get_client(admin=True)
-
-        tenant = {
-            'name': uuid.uuid4().hex,
-            'description': uuid.uuid4().hex,
-            'enabled': False,
-        }
-        tenant_ref = admin_client.tenants.create(
-            tenant_name=tenant['name'],
-            description=tenant['description'],
-            enabled=tenant['enabled'])
-        tenant['id'] = tenant_ref.id
-
-        user = {
-            'name': uuid.uuid4().hex,
-            'password': uuid.uuid4().hex,
-            'email': uuid.uuid4().hex,
-            'tenant_id': tenant['id'],
-        }
-        user_ref = admin_client.users.create(
-            name=user['name'],
-            password=user['password'],
-            email=user['email'],
-            tenant_id=user['tenant_id'])
-        user['id'] = user_ref.id
-
-        # password authentication
-        self.assertRaises(
-            client_exceptions.Unauthorized,
-            self._client,
-            username=user['name'],
-            password=user['password'],
-            tenant_id=tenant['id'])
-
-        # token authentication
-        client = self._client(
-            username=user['name'],
-            password=user['password'])
-        self.assertRaises(
-            client_exceptions.Unauthorized,
-            self._client,
-            token=client.auth_token,
-            tenant_id=tenant['id'])
-
-    # FIXME(ja): this test should require the "keystone:admin" roled
-    #            (probably the role set via --keystone_admin_role flag)
-    # FIXME(ja): add a test that admin endpoint is only sent to admin user
-    # FIXME(ja): add a test that admin endpoint returns unauthorized if not
-    #            admin
-    def test_tenant_create_update_and_delete(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        tenant_name = 'original_tenant'
-        tenant_description = 'My original tenant!'
-        tenant_enabled = True
-        client = self.get_client(admin=True)
-
-        # create, get, and list a tenant
-        tenant = client.tenants.create(tenant_name=tenant_name,
-                                       description=tenant_description,
-                                       enabled=tenant_enabled)
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        tenant = client.tenants.get(tenant_id=tenant.id)
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        tenant = [t for t in client.tenants.list() if t.id == tenant.id].pop()
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        # update, get, and list a tenant
-        tenant_name = 'updated_tenant'
-        tenant_description = 'Updated tenant!'
-        tenant_enabled = False
-        tenant = client.tenants.update(tenant_id=tenant.id,
-                                       tenant_name=tenant_name,
-                                       enabled=tenant_enabled,
-                                       description=tenant_description)
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        tenant = client.tenants.get(tenant_id=tenant.id)
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        tenant = [t for t in client.tenants.list() if t.id == tenant.id].pop()
-        self.assertEquals(tenant.name, tenant_name)
-        self.assertEquals(tenant.description, tenant_description)
-        self.assertEquals(tenant.enabled, tenant_enabled)
-
-        # delete, get, and list a tenant
-        client.tenants.delete(tenant=tenant.id)
-        self.assertRaises(client_exceptions.NotFound, client.tenants.get,
-                          tenant.id)
-        self.assertFalse([t for t in client.tenants.list()
-                           if t.id == tenant.id])
-
-    def test_tenant_delete_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.tenants.delete,
-                          tenant=uuid.uuid4().hex)
-
-    def test_tenant_get_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.tenants.get,
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_tenant_update_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.tenants.update,
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_tenant_list(self):
-        client = self.get_client()
-        tenants = client.tenants.list()
-        self.assertEquals(len(tenants), 1)
-
-        # Admin endpoint should return *all* tenants
-        client = self.get_client(admin=True)
-        tenants = client.tenants.list()
-        self.assertEquals(len(tenants), len(default_fixtures.TENANTS))
-
-    def test_invalid_password(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        good_client = self._client(username=self.user_foo['name'],
-                                   password=self.user_foo['password'])
-        good_client.tenants.list()
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self._client,
-                          username=self.user_foo['name'],
-                          password='invalid')
-
-    def test_invalid_user_password(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self._client,
-                          username='blah',
-                          password='blah')
-
-    def test_change_password_invalidates_token(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        client = self.get_client(admin=True)
-
-        username = uuid.uuid4().hex
-        passwd = uuid.uuid4().hex
-        user = client.users.create(name=username, password=passwd,
-                                   email=uuid.uuid4().hex)
-
-        token_id = client.tokens.authenticate(username=username,
-                                              password=passwd).id
-
-        # authenticate with a token should work before a password change
-        client.tokens.authenticate(token=token_id)
-
-        client.users.update_password(user=user.id, password=uuid.uuid4().hex)
-
-        # authenticate with a token should not work after a password change
-        self.assertRaises(client_exceptions.Unauthorized,
-                          client.tokens.authenticate,
-                          token=token_id)
-
-    def test_disable_user_invalidates_token(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        admin_client = self.get_client(admin=True)
-        foo_client = self.get_client(self.user_foo)
-
-        admin_client.users.update_enabled(user=self.user_foo['id'],
-                                          enabled=False)
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          foo_client.tokens.authenticate,
-                          token=foo_client.auth_token)
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                          self.get_client,
-                          self.user_foo)
-
-    def test_token_expiry_maintained(self):
-        foo_client = self.get_client(self.user_foo)
-        orig_token = foo_client.service_catalog.catalog['token']
-
-        time.sleep(1.01)
-        reauthenticated_token = foo_client.tokens.authenticate(
-                                    token=foo_client.auth_token)
-
-        self.assertEquals(orig_token['expires'],
-                          reauthenticated_token.expires)
-
-    def test_user_create_update_delete(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        test_username = 'new_user'
-        client = self.get_client(admin=True)
-        user = client.users.create(name=test_username,
-                                   password='password',
-                                   email='[e-mail]')
-        self.assertEquals(user.name, test_username)
-
-        user = client.users.get(user=user.id)
-        self.assertEquals(user.name, test_username)
-
-        user = client.users.update(user=user,
-                                   name=test_username,
-                                   email='[e-mail]')
-        self.assertEquals(user.email, '[e-mail]')
-
-        # NOTE(termie): update_enabled doesn't return anything, probably a bug
-        client.users.update_enabled(user=user, enabled=False)
-        user = client.users.get(user.id)
-        self.assertFalse(user.enabled)
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                  self._client,
-                  username=test_username,
-                  password='password')
-        client.users.update_enabled(user, True)
-
-        user = client.users.update_password(user=user, password='password2')
-
-        self._client(username=test_username,
-                     password='password2')
-
-        user = client.users.update_tenant(user=user, tenant='bar')
-        # TODO(ja): once keystonelight supports default tenant
-        #           when you login without specifying tenant, the
-        #           token should be scoped to tenant 'bar'
-
-        client.users.delete(user.id)
-        self.assertRaises(client_exceptions.NotFound, client.users.get,
-                          user.id)
-
-        # Test creating a user with a tenant (auto-add to tenant)
-        user2 = client.users.create(name=test_username,
-                                    password='password',
-                                    email='[e-mail]',
-                                    tenant_id='bar')
-        self.assertEquals(user2.name, test_username)
-
-    def test_user_create_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.create,
-                          name=uuid.uuid4().hex,
-                          password=uuid.uuid4().hex,
-                          email=uuid.uuid4().hex,
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_user_get_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.get,
-                          user=uuid.uuid4().hex)
-
-    def test_user_list_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.list,
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_user_update_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.update,
-                          user=uuid.uuid4().hex)
-
-    def test_user_update_tenant_404(self):
-        raise nose.exc.SkipTest('N/A')
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.update,
-                          user=self.user_foo['id'],
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_user_update_password_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.update_password,
-                          user=uuid.uuid4().hex,
-                          password=uuid.uuid4().hex)
-
-    def test_user_delete_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.users.delete,
-                          user=uuid.uuid4().hex)
-
-    def test_user_list(self):
-        client = self.get_client(admin=True)
-        users = client.users.list()
-        self.assertTrue(len(users) > 0)
-        user = users[0]
-        self.assertRaises(AttributeError, lambda: user.password)
-
-    def test_user_get(self):
-        client = self.get_client(admin=True)
-        user = client.users.get(user=self.user_foo['id'])
-        self.assertRaises(AttributeError, lambda: user.password)
-
-    def test_role_get(self):
-        client = self.get_client(admin=True)
-        role = client.roles.get(role='keystone_admin')
-        self.assertEquals(role.id, 'keystone_admin')
-
-    def test_role_crud(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        test_role = 'new_role'
-        client = self.get_client(admin=True)
-        role = client.roles.create(name=test_role)
-        self.assertEquals(role.name, test_role)
-
-        role = client.roles.get(role=role.id)
-        self.assertEquals(role.name, test_role)
-
-        client.roles.delete(role=role.id)
-
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.delete,
-                          role=role.id)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.get,
-                          role=role.id)
-
-    def test_role_get_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.get,
-                          role=uuid.uuid4().hex)
-
-    def test_role_delete_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.delete,
-                          role=uuid.uuid4().hex)
-
-    def test_role_list_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.roles_for_user,
-                          user=uuid.uuid4().hex,
-                          tenant=uuid.uuid4().hex)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.roles_for_user,
-                          user=self.user_foo['id'],
-                          tenant=uuid.uuid4().hex)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.roles_for_user,
-                          user=uuid.uuid4().hex,
-                          tenant=self.tenant_bar['id'])
-
-    def test_role_list(self):
-        client = self.get_client(admin=True)
-        roles = client.roles.list()
-        # TODO(devcamcar): This assert should be more specific.
-        self.assertTrue(len(roles) > 0)
-
-    def test_ec2_credential_crud(self):
-        client = self.get_client()
-        creds = client.ec2.list(user_id=self.user_foo['id'])
-        self.assertEquals(creds, [])
-
-        cred = client.ec2.create(user_id=self.user_foo['id'],
-                                 tenant_id=self.tenant_bar['id'])
-        creds = client.ec2.list(user_id=self.user_foo['id'])
-        self.assertEquals(creds, [cred])
-
-        got = client.ec2.get(user_id=self.user_foo['id'], access=cred.access)
-        self.assertEquals(cred, got)
-
-        client.ec2.delete(user_id=self.user_foo['id'], access=cred.access)
-        creds = client.ec2.list(user_id=self.user_foo['id'])
-        self.assertEquals(creds, [])
-
-    def test_ec2_credentials_create_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client()
-        self.assertRaises(client_exceptions.NotFound,
-                          client.ec2.create,
-                          user_id=uuid.uuid4().hex,
-                          tenant_id=self.tenant_bar['id'])
-        self.assertRaises(client_exceptions.NotFound,
-                          client.ec2.create,
-                          user_id=self.user_foo['id'],
-                          tenant_id=uuid.uuid4().hex)
-
-    def test_ec2_credentials_delete_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client()
-        self.assertRaises(client_exceptions.NotFound,
-                          client.ec2.delete,
-                          user_id=uuid.uuid4().hex,
-                          access=uuid.uuid4().hex)
-
-    def test_ec2_credentials_get_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client()
-        self.assertRaises(client_exceptions.NotFound,
-                          client.ec2.get,
-                          user_id=uuid.uuid4().hex,
-                          access=uuid.uuid4().hex)
-
-    def test_ec2_credentials_list_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client()
-        self.assertRaises(client_exceptions.NotFound,
-                          client.ec2.list,
-                          user_id=uuid.uuid4().hex)
-
-    def test_ec2_credentials_list_user_forbidden(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        two = self.get_client(self.user_two)
-        self.assertRaises(client_exceptions.Forbidden, two.ec2.list,
-                          user_id=self.user_foo['id'])
-
-    def test_ec2_credentials_get_user_forbidden(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        foo = self.get_client()
-        cred = foo.ec2.create(user_id=self.user_foo['id'],
-                              tenant_id=self.tenant_bar['id'])
-
-        two = self.get_client(self.user_two)
-        self.assertRaises(client_exceptions.Forbidden, two.ec2.get,
-                          user_id=self.user_foo['id'], access=cred.access)
-
-        foo.ec2.delete(user_id=self.user_foo['id'], access=cred.access)
-
-    def test_ec2_credentials_delete_user_forbidden(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        foo = self.get_client()
-        cred = foo.ec2.create(user_id=self.user_foo['id'],
-                              tenant_id=self.tenant_bar['id'])
-
-        two = self.get_client(self.user_two)
-        self.assertRaises(client_exceptions.Forbidden, two.ec2.delete,
-                          user_id=self.user_foo['id'], access=cred.access)
-
-        foo.ec2.delete(user_id=self.user_foo['id'], access=cred.access)
-
-    def test_service_create_and_delete(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        test_service = 'new_service'
-        client = self.get_client(admin=True)
-        service = client.services.create(name=test_service,
-                                         service_type='test',
-                                         description='test')
-        self.assertEquals(service.name, test_service)
-
-        service = client.services.get(id=service.id)
-        self.assertEquals(service.name, test_service)
-
-        client.services.delete(id=service.id)
-        self.assertRaises(client_exceptions.NotFound, client.services.get,
-                          id=service.id)
-
-    def test_service_list(self):
-        client = self.get_client(admin=True)
-        test_service = 'new_service'
-        service = client.services.create(name=test_service,
-                                         service_type='test',
-                                         description='test')
-        services = client.services.list()
-        # TODO(devcamcar): This assert should be more specific.
-        self.assertTrue(len(services) > 0)
-
-    def test_service_delete_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.services.delete,
-                          id=uuid.uuid4().hex)
-
-    def test_service_get_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.services.get,
-                          id=uuid.uuid4().hex)
-
-    def test_endpoint_create_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.endpoints.create,
-                          region=uuid.uuid4().hex,
-                          service_id=uuid.uuid4().hex,
-                          publicurl=uuid.uuid4().hex,
-                          adminurl=uuid.uuid4().hex,
-                          internalurl=uuid.uuid4().hex)
-
-    def test_endpoint_delete_404(self):
-        # the catalog backend is expected to return Not Implemented
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.HTTPNotImplemented,
-                          client.endpoints.delete,
-                          id=uuid.uuid4().hex)
-
-    def test_admin_requires_adminness(self):
-        from keystoneclient import exceptions as client_exceptions
-        # FIXME(ja): this should be Unauthorized
-        exception = client_exceptions.ClientException
-
-        two = self.get_client(self.user_two, admin=True)  # non-admin user
-
-        # USER CRUD
-        self.assertRaises(exception,
-                          two.users.list)
-        self.assertRaises(exception,
-                          two.users.get,
-                          user=self.user_two['id'])
-        self.assertRaises(exception,
-                          two.users.create,
-                          name='oops',
-                          password='password',
-                          email='[e-mail]')
-        self.assertRaises(exception,
-                          two.users.delete,
-                          user=self.user_foo['id'])
-
-        # TENANT CRUD
-        self.assertRaises(exception,
-                          two.tenants.list)
-        self.assertRaises(exception,
-                          two.tenants.get,
-                          tenant_id=self.tenant_bar['id'])
-        self.assertRaises(exception,
-                          two.tenants.create,
-                          tenant_name='oops',
-                          description="shouldn't work!",
-                          enabled=True)
-        self.assertRaises(exception,
-                          two.tenants.delete,
-                          tenant=self.tenant_baz['id'])
-
-        # ROLE CRUD
-        self.assertRaises(exception,
-                          two.roles.get,
-                          role='keystone_admin')
-        self.assertRaises(exception,
-                          two.roles.list)
-        self.assertRaises(exception,
-                          two.roles.create,
-                          name='oops')
-        self.assertRaises(exception,
-                          two.roles.delete,
-                          role='keystone_admin')
-
-        # TODO(ja): MEMBERSHIP CRUD
-        # TODO(ja): determine what else todo
-
-
-class KcMasterTestCase(CompatTestCase, KeystoneClientTests):
-    def test_tenant_add_and_remove_user(self):
-        client = self.get_client(admin=True)
-        client.roles.add_user_role(tenant=self.tenant_baz['id'],
-                                   user=self.user_foo['id'],
-                                   role=self.role_useless['id'])
-        user_refs = client.tenants.list_users(tenant=self.tenant_baz['id'])
-        self.assert_(self.user_foo['id'] in [x.id for x in user_refs])
-        client.roles.remove_user_role(tenant=self.tenant_baz['id'],
-                                      user=self.user_foo['id'],
-                                      role=self.role_useless['id'])
-        user_refs = client.tenants.list_users(tenant=self.tenant_baz['id'])
-        self.assert_(self.user_foo['id'] not in [x.id for x in user_refs])
-
-    def test_user_role_add_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.add_user_role,
-                          tenant=uuid.uuid4().hex,
-                          user=self.user_foo['id'],
-                          role=self.role_useless['id'])
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.add_user_role,
-                          tenant=self.tenant_baz['id'],
-                          user=uuid.uuid4().hex,
-                          role=self.role_useless['id'])
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.add_user_role,
-                          tenant=self.tenant_baz['id'],
-                          user=self.user_foo['id'],
-                          role=uuid.uuid4().hex)
-
-    def test_user_role_remove_404(self):
-        from keystoneclient import exceptions as client_exceptions
-        client = self.get_client(admin=True)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.remove_user_role,
-                          tenant=uuid.uuid4().hex,
-                          user=self.user_foo['id'],
-                          role=self.role_useless['id'])
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.remove_user_role,
-                          tenant=self.tenant_baz['id'],
-                          user=uuid.uuid4().hex,
-                          role=self.role_useless['id'])
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.remove_user_role,
-                          tenant=self.tenant_baz['id'],
-                          user=self.user_foo['id'],
-                          role=uuid.uuid4().hex)
-        self.assertRaises(client_exceptions.NotFound,
-                          client.roles.remove_user_role,
-                          tenant=self.tenant_baz['id'],
-                          user=self.user_foo['id'],
-                          role=self.role_useless['id'])
-
-    def test_tenant_list_marker(self):
-        client = self.get_client()
-
-        # Add two arbitrary tenants to user for testing purposes
-        for i in range(2):
-            tenant_id = uuid.uuid4().hex
-            tenant = {'name': 'tenant-%s' % tenant_id, 'id': tenant_id}
-            self.identity_api.create_tenant(tenant_id, tenant)
-            self.identity_api.add_user_to_tenant(tenant_id,
-                                                 self.user_foo['id'])
-
-        tenants = client.tenants.list()
-        self.assertEqual(len(tenants), 3)
-
-        tenants_marker = client.tenants.list(marker=tenants[0].id)
-        self.assertEqual(len(tenants_marker), 2)
-        self.assertEqual(tenants[1].name, tenants_marker[0].name)
-        self.assertEqual(tenants[2].name, tenants_marker[1].name)
-
-    def test_tenant_list_marker_not_found(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        client = self.get_client()
-        self.assertRaises(client_exceptions.BadRequest,
-                          client.tenants.list, marker=uuid.uuid4().hex)
-
-    def test_tenant_list_limit(self):
-        client = self.get_client()
-
-        # Add two arbitrary tenants to user for testing purposes
-        for i in range(2):
-            tenant_id = uuid.uuid4().hex
-            tenant = {'name': 'tenant-%s' % tenant_id, 'id': tenant_id}
-            self.identity_api.create_tenant(tenant_id, tenant)
-            self.identity_api.add_user_to_tenant(tenant_id,
-                                                 self.user_foo['id'])
-
-        tenants = client.tenants.list()
-        self.assertEqual(len(tenants), 3)
-
-        tenants_limited = client.tenants.list(limit=2)
-        self.assertEqual(len(tenants_limited), 2)
-        self.assertEqual(tenants[0].name, tenants_limited[0].name)
-        self.assertEqual(tenants[1].name, tenants_limited[1].name)
-
-    def test_tenant_list_limit_bad_value(self):
-        from keystoneclient import exceptions as client_exceptions
-
-        client = self.get_client()
-        self.assertRaises(client_exceptions.BadRequest,
-                          client.tenants.list, limit='a')
-        self.assertRaises(client_exceptions.BadRequest,
-                          client.tenants.list, limit=-1)
-
-    def test_roles_get_by_user(self):
-        client = self.get_client(admin=True)
-        roles = client.roles.roles_for_user(user=self.user_foo['id'],
-                                            tenant=self.tenant_bar['id'])
-        self.assertTrue(len(roles) > 0)
-
-
-class KcEssex3TestCase(CompatTestCase, KeystoneClientTests):
-    def test_tenant_add_and_remove_user(self):
-        raise nose.exc.SkipTest('Keystoneclient Essex 3 tests disabled.')
-        client = self.get_client(admin=True)
-        client.roles.add_user_to_tenant(tenant_id=self.tenant_baz['id'],
-                                        user_id=self.user_foo['id'],
-                                        role_id=self.role_useless['id'])
-        role_refs = client.roles.get_user_role_refs(
-                user_id=self.user_foo['id'])
-        self.assert_(self.tenant_baz['id'] in [x.tenantId for x in role_refs])
-
-        # get the "role_refs" so we get the proper id, this is how the clients
-        # do it
-        roleref_refs = client.roles.get_user_role_refs(
-                user_id=self.user_foo['id'])
-        for roleref_ref in roleref_refs:
-            if (roleref_ref.roleId == self.role_useless['id']
-                and roleref_ref.tenantId == self.tenant_baz['id']):
-                # use python's scope fall through to leave roleref_ref set
-                break
-
-        client.roles.remove_user_from_tenant(tenant_id=self.tenant_baz['id'],
-                                             user_id=self.user_foo['id'],
-                                             role_id=roleref_ref.id)
-
-        role_refs = client.roles.get_user_role_refs(
-                user_id=self.user_foo['id'])
-        self.assert_(self.tenant_baz['id'] not in
-                     [x.tenantId for x in role_refs])
-
-    def test_roles_get_by_user(self):
-        raise nose.exc.SkipTest('Keystoneclient Essex 3 tests disabled.')
-        client = self.get_client(admin=True)
-        roles = client.roles.get_user_role_refs(user_id='foo')
-        self.assertTrue(len(roles) > 0)
-
-    def test_role_list_404(self):
-        raise nose.exc.SkipTest('N/A')
-
-    def test_authenticate_and_delete_token(self):
-        raise nose.exc.SkipTest('N/A')
-
-    def test_user_create_update_delete(self):
-        raise nose.exc.SkipTest('Keystoneclient Essex 3 tests disabled.')
-        from keystoneclient import exceptions as client_exceptions
-
-        test_username = 'new_user'
-        client = self.get_client(admin=True)
-        user = client.users.create(name=test_username,
-                                   password='password',
-                                   email='[e-mail]')
-        self.assertEquals(user.name, test_username)
-
-        user = client.users.get(user=user.id)
-        self.assertEquals(user.name, test_username)
-
-        user = client.users.update_email(user=user, email='[e-mail]')
-        self.assertEquals(user.email, '[e-mail]')
-
-        # NOTE(termie): update_enabled doesn't return anything, probably a bug
-        client.users.update_enabled(user=user, enabled=False)
-        user = client.users.get(user.id)
-        self.assertFalse(user.enabled)
-
-        self.assertRaises(client_exceptions.Unauthorized,
-                  self._client,
-                  username=test_username,
-                  password='password')
-        client.users.update_enabled(user, True)
-
-        user = client.users.update_password(user=user, password='password2')
-
-        self._client(username=test_username,
-                     password='password2')
-
-        user = client.users.update_tenant(user=user, tenant='bar')
-        # TODO(ja): once keystonelight supports default tenant
-        #           when you login without specifying tenant, the
-        #           token should be scoped to tenant 'bar'
-
-        client.users.delete(user.id)
-        self.assertRaises(client_exceptions.NotFound, client.users.get,
-                          user.id)
-
-    def test_user_update_404(self):
-        raise nose.exc.SkipTest('N/A')
-
-    def test_endpoint_create_404(self):
-        raise nose.exc.SkipTest('N/A')
-
-    def test_endpoint_delete_404(self):
-        raise nose.exc.SkipTest('N/A')

=== removed directory '.pc/keystone-CVE-2012-5571.patch'
=== removed directory '.pc/keystone-CVE-2012-5571.patch/keystone'
=== removed directory '.pc/keystone-CVE-2012-5571.patch/keystone/contrib'
=== removed directory '.pc/keystone-CVE-2012-5571.patch/keystone/contrib/ec2'
=== removed file '.pc/keystone-CVE-2012-5571.patch/keystone/contrib/ec2/core.py'
--- .pc/keystone-CVE-2012-5571.patch/keystone/contrib/ec2/core.py	2012-11-26 14:07:34 +0000
+++ .pc/keystone-CVE-2012-5571.patch/keystone/contrib/ec2/core.py	1970-01-01 00:00:00 +0000
@@ -1,347 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2012 OpenStack LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-"""Main entry point into the EC2 Credentials service.
-
-This service allows the creation of access/secret credentials used for
-the ec2 interop layer of OpenStack.
-
-A user can create as many access/secret pairs, each of which map to a
-specific tenant.  This is required because OpenStack supports a user
-belonging to multiple tenants, whereas the signatures created on ec2-style
-requests don't allow specification of which tenant the user wishs to act
-upon.
-
-To complete the cycle, we provide a method that OpenStack services can
-use to validate a signature and get a corresponding openstack token.  This
-token allows method calls to other services within the context the
-access/secret was created.  As an example, nova requests keystone to validate
-the signature of a request, receives a token, and then makes a request to
-glance to list images needed to perform the requested task.
-
-"""
-
-import uuid
-
-from keystone import catalog
-from keystone import config
-from keystone import exception
-from keystone import identity
-from keystone import policy
-from keystone import service
-from keystone import token
-from keystone.common import manager
-from keystone.common import utils
-from keystone.common import wsgi
-
-
-CONF = config.CONF
-
-
-class Manager(manager.Manager):
-    """Default pivot point for the EC2 Credentials backend.
-
-    See :mod:`keystone.common.manager.Manager` for more details on how this
-    dynamically calls the backend.
-
-    """
-
-    def __init__(self):
-        super(Manager, self).__init__(CONF.ec2.driver)
-
-
-class Ec2Extension(wsgi.ExtensionRouter):
-    def add_routes(self, mapper):
-        ec2_controller = Ec2Controller()
-        # validation
-        mapper.connect('/ec2tokens',
-                       controller=ec2_controller,
-                       action='authenticate',
-                       conditions=dict(method=['POST']))
-
-        # crud
-        mapper.connect('/users/{user_id}/credentials/OS-EC2',
-                       controller=ec2_controller,
-                       action='create_credential',
-                       conditions=dict(method=['POST']))
-        mapper.connect('/users/{user_id}/credentials/OS-EC2',
-                       controller=ec2_controller,
-                       action='get_credentials',
-                       conditions=dict(method=['GET']))
-        mapper.connect('/users/{user_id}/credentials/OS-EC2/{credential_id}',
-                       controller=ec2_controller,
-                       action='get_credential',
-                       conditions=dict(method=['GET']))
-        mapper.connect('/users/{user_id}/credentials/OS-EC2/{credential_id}',
-                       controller=ec2_controller,
-                       action='delete_credential',
-                       conditions=dict(method=['DELETE']))
-
-
-class Ec2Controller(wsgi.Application):
-    def __init__(self):
-        self.catalog_api = catalog.Manager()
-        self.identity_api = identity.Manager()
-        self.token_api = token.Manager()
-        self.policy_api = policy.Manager()
-        self.ec2_api = Manager()
-        super(Ec2Controller, self).__init__()
-
-    def check_signature(self, creds_ref, credentials):
-        signer = utils.Ec2Signer(creds_ref['secret'])
-        signature = signer.generate(credentials)
-        if utils.auth_str_equal(credentials['signature'], signature):
-            return
-        # NOTE(vish): Some libraries don't use the port when signing
-        #             requests, so try again without port.
-        elif ':' in credentials['signature']:
-            hostname, _port = credentials['host'].split(':')
-            credentials['host'] = hostname
-            signature = signer.generate(credentials)
-            if not utils.auth_str_equal(credentials.signature, signature):
-                raise exception.Unauthorized(message='Invalid EC2 signature.')
-        else:
-            raise exception.Unauthorized(message='EC2 signature not supplied.')
-
-    def authenticate(self, context, credentials=None,
-                         ec2Credentials=None):
-        """Validate a signed EC2 request and provide a token.
-
-        Other services (such as Nova) use this **admin** call to determine
-        if a request they signed received is from a valid user.
-
-        If it is a valid signature, an openstack token that maps
-        to the user/tenant is returned to the caller, along with
-        all the other details returned from a normal token validation
-        call.
-
-        The returned token is useful for making calls to other
-        OpenStack services within the context of the request.
-
-        :param context: standard context
-        :param credentials: dict of ec2 signature
-        :param ec2Credentials: DEPRECATED dict of ec2 signature
-        :returns: token: openstack token equivalent to access key along
-                         with the corresponding service catalog and roles
-        """
-
-        # FIXME(ja): validate that a service token was used!
-
-        # NOTE(termie): backwards compat hack
-        if not credentials and ec2Credentials:
-            credentials = ec2Credentials
-
-        if not 'access' in credentials:
-            raise exception.Unauthorized(message='EC2 signature not supplied.')
-
-        creds_ref = self._get_credentials(context,
-                                          credentials['access'])
-        self.check_signature(creds_ref, credentials)
-
-        # TODO(termie): don't create new tokens every time
-        # TODO(termie): this is copied from TokenController.authenticate
-        token_id = uuid.uuid4().hex
-        tenant_ref = self.identity_api.get_tenant(
-                context=context,
-                tenant_id=creds_ref['tenant_id'])
-        user_ref = self.identity_api.get_user(
-                context=context,
-                user_id=creds_ref['user_id'])
-        metadata_ref = self.identity_api.get_metadata(
-                context=context,
-                user_id=user_ref['id'],
-                tenant_id=tenant_ref['id'])
-        catalog_ref = self.catalog_api.get_catalog(
-                context=context,
-                user_id=user_ref['id'],
-                tenant_id=tenant_ref['id'],
-                    metadata=metadata_ref)
-
-        token_ref = self.token_api.create_token(
-                context, token_id, dict(id=token_id,
-                                        user=user_ref,
-                                        tenant=tenant_ref,
-                                        metadata=metadata_ref))
-
-        # TODO(termie): optimize this call at some point and put it into the
-        #               the return for metadata
-        # fill out the roles in the metadata
-        roles_ref = []
-        for role_id in metadata_ref.get('roles', []):
-            roles_ref.append(self.identity_api.get_role(context, role_id))
-
-        # TODO(termie): make this a util function or something
-        # TODO(termie): i don't think the ec2 middleware currently expects a
-        #               full return, but it contains a note saying that it
-        #               would be better to expect a full return
-        token_controller = service.TokenController()
-        return token_controller._format_authenticate(
-                token_ref, roles_ref, catalog_ref)
-
-    def create_credential(self, context, user_id, tenant_id):
-        """Create a secret/access pair for use with ec2 style auth.
-
-        Generates a new set of credentials that map the the user/tenant
-        pair.
-
-        :param context: standard context
-        :param user_id: id of user
-        :param tenant_id: id of tenant
-        :returns: credential: dict of ec2 credential
-        """
-        if not self._is_admin(context):
-            self._assert_identity(context, user_id)
-
-        self._assert_valid_user_id(context, user_id)
-        self._assert_valid_tenant_id(context, tenant_id)
-
-        cred_ref = {'user_id': user_id,
-                    'tenant_id': tenant_id,
-                    'access': uuid.uuid4().hex,
-                    'secret': uuid.uuid4().hex}
-        self.ec2_api.create_credential(context, cred_ref['access'], cred_ref)
-        return {'credential': cred_ref}
-
-    def get_credentials(self, context, user_id):
-        """List all credentials for a user.
-
-        :param context: standard context
-        :param user_id: id of user
-        :returns: credentials: list of ec2 credential dicts
-        """
-        if not self._is_admin(context):
-            self._assert_identity(context, user_id)
-        self._assert_valid_user_id(context, user_id)
-        return {'credentials': self.ec2_api.list_credentials(context, user_id)}
-
-    def get_credential(self, context, user_id, credential_id):
-        """Retreive a user's access/secret pair by the access key.
-
-        Grab the full access/secret pair for a given access key.
-
-        :param context: standard context
-        :param user_id: id of user
-        :param credential_id: access key for credentials
-        :returns: credential: dict of ec2 credential
-        """
-        if not self._is_admin(context):
-            self._assert_identity(context, user_id)
-        self._assert_valid_user_id(context, user_id)
-        creds = self._get_credentials(context, credential_id)
-        return {'credential': creds}
-
-    def delete_credential(self, context, user_id, credential_id):
-        """Delete a user's access/secret pair.
-
-        Used to revoke a user's access/secret pair
-
-        :param context: standard context
-        :param user_id: id of user
-        :param credential_id: access key for credentials
-        :returns: bool: success
-        """
-        if not self._is_admin(context):
-            self._assert_identity(context, user_id)
-            self._assert_owner(context, user_id, credential_id)
-
-        self._assert_valid_user_id(context, user_id)
-        self._get_credentials(context, credential_id)
-        return self.ec2_api.delete_credential(context, credential_id)
-
-    def _get_credentials(self, context, credential_id):
-        """Return credentials from an ID.
-
-        :param context: standard context
-        :param credential_id: id of credential
-        :raises exception.Unauthorized: when credential id is invalid
-        :returns: credential: dict of ec2 credential.
-        """
-        creds = self.ec2_api.get_credential(context,
-                                            credential_id)
-        if not creds:
-            raise exception.Unauthorized(message='EC2 access key not found.')
-        return creds
-
-    def _assert_identity(self, context, user_id):
-        """Check that the provided token belongs to the user.
-
-        :param context: standard context
-        :param user_id: id of user
-        :raises exception.Forbidden: when token is invalid
-
-        """
-        try:
-            token_ref = self.token_api.get_token(context=context,
-                    token_id=context['token_id'])
-        except exception.TokenNotFound:
-            raise exception.Unauthorized()
-        token_user_id = token_ref['user'].get('id')
-        if not token_user_id == user_id:
-            raise exception.Forbidden()
-
-    def _is_admin(self, context):
-        """Wrap admin assertion error return statement.
-
-        :param context: standard context
-        :returns: bool: success
-
-        """
-        try:
-            self.assert_admin(context)
-            return True
-        except exception.Forbidden:
-            return False
-
-    def _assert_owner(self, context, user_id, credential_id):
-        """Ensure the provided user owns the credential.
-
-        :param context: standard context
-        :param user_id: expected credential owner
-        :param credential_id: id of credential object
-        :raises exception.Forbidden: on failure
-
-        """
-        cred_ref = self.ec2_api.get_credential(context, credential_id)
-        if not user_id == cred_ref['user_id']:
-            raise exception.Forbidden()
-
-    def _assert_valid_user_id(self, context, user_id):
-        """Ensure a valid user id.
-
-        :param context: standard context
-        :param user_id: expected credential owner
-        :raises exception.UserNotFound: on failure
-
-        """
-        user_ref = self.identity_api.get_user(
-            context=context,
-            user_id=user_id)
-        if not user_ref:
-            raise exception.UserNotFound(user_id=user_id)
-
-    def _assert_valid_tenant_id(self, context, tenant_id):
-        """Ensure a valid tenant id.
-
-        :param context: standard context
-        :param user_id: expected credential owner
-        :raises exception.UserNotFound: on failure
-
-        """
-        tenant_ref = self.identity_api.get_tenant(
-            context=context,
-            tenant_id=tenant_id)
-        if not tenant_ref:
-            raise exception.TenantNotFound(tenant_id=tenant_id)

=== added file 'ChangeLog'
--- ChangeLog	1970-01-01 00:00:00 +0000
+++ ChangeLog	2012-12-18 13:48:25 +0000
@@ -0,0 +1,29735 @@
+commit c17a9992c8a94c7728bd762115874f125c0905b7
+Merge: 025b1d5 8735009
+Author: Jenkins <[e-mail]>
+Date:   Thu Nov 22 19:41:20 2012 +0000
+
+    Merge "Ensures User is member of tenant in ec2 validation" into stable/essex
+
+commit 025b1d52e61fff4dff913fc58d0de81712b808b6
+Author: Ionuț Arțăriși <[e-mail]>
+Date:   Wed Oct 31 14:32:04 2012 +0100
+
+    pin sqlalchemy to 0.7
+    
+    sqlalchemy 0.8.0b1 breaks some dependencies such as sqlalchemy-migrate, pin the version until we fix them
+    
+    Essex backport note: lower bound is not defined, Essex is known to work
+    with older sqlalchemy versions e.g. precise has 0.7.4
+    
+    Fixes bug #1073569
+    
+    Change-Id: I6620276bf8f0a7cbc1d51aa226cd33c512e59a48
+
+ tools/pip-requires |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 8735009dc5b895db265a1cd573f39f4acfca2a19
+Author: Vishvananda Ishaya <[e-mail]>
+Date:   Tue Nov 13 15:49:19 2012 -0800
+
+    Ensures User is member of tenant in ec2 validation
+    
+    It is possible that a user is no longer a member of a tenant when
+    they attempt to use an ec2 token. This checks to make sure that
+    the user still has at least one valid role in the tenant before
+    authenticating them. This should automatically work for the s3
+    version as well since it is a subclass.
+    
+    Fixes bug 1064914
+    
+    Change-Id: Ieb237bae936a7b00ce7ba4d4c59aec6c7a69ec21
+
+ keystone/contrib/ec2/core.py |   23 +++++++++++++----------
+ 1 file changed, 13 insertions(+), 10 deletions(-)
+
+commit ddb40198c9323ff8dc82a44a72e456a7bfe736b8
+Author: Mark McLoughlin <[e-mail]>
+Date:   Thu Oct 11 20:44:32 2012 +0100
+
+    Open 2012.1.4 development
+    
+    Bump version to 2012.1.4 to formally open development after the release
+    of 2012.1.3.
+    
+    See http://wiki.openstack.org/StableBranchRelease
+    
+    Note - 2012.1.3 is expected to be the final official release of Essex.
+    
+    Change-Id: I0de6fae1495deab60bd667e4653210b22b994b39
+
+ setup.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 0e1f05e7a851f5fb72742e4d3e4978d76fe23b55
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Sep 25 19:04:50 2012 +0000
+
+    utf-8 encode user keys in memcache (bug 1056373)
+    
+    (cherry picked from commit 431e50a7851d2e7dbb212d02647faeb958ed21e8)
+    
+    Change-Id: I026dd4282742213e69c7aa02e109439b07a73c8e
+
+ keystone/token/backends/memcache.py |    8 ++++++--
+ tests/test_backend_memcache.py      |   14 +++++++++++++-
+ 2 files changed, 19 insertions(+), 3 deletions(-)
+
+commit 176ee9bce7557937710c8ec8086ff61cc751cf0f
+Author: Dolph Mathews <[e-mail]>
+Date:   Thu Sep 13 11:59:11 2012 -0500
+
+    Limit token revocation to tenant (bug 1050025)
+    
+    Change-Id: I7ebe0192b4900ad9475119a6d582233b37b31fb4
+
+ keystone/identity/core.py           |    8 ++++----
+ keystone/token/backends/kvs.py      |   15 ++++++++++-----
+ keystone/token/backends/memcache.py |   11 ++++++++---
+ keystone/token/backends/sql.py      |    7 ++++++-
+ keystone/token/core.py              |   16 +++++++++++-----
+ tests/test_backend.py               |   22 +++++++++++++++++++++-
+ 6 files changed, 60 insertions(+), 19 deletions(-)
+
+commit 58ac6691a21675be9e2ffb0f84a05fc3cd4d2e2e
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Sep 7 14:55:31 2012 -0500
+
+    Delete user tokens after role grant/revoke
+    
+    Delete user tokens when a new role is granted or revoked, in order to
+    prevent old tokens to continue to be valid for the original set of
+    roles for the remainder of the token's lifespan.
+    
+    Addresses CVE-2012-4413.
+    Fixes bug 1041396.
+    
+    Change-Id: Ib11b5b3a933c6000afe0c875c3f71f1f101bb202
+
+ keystone/identity/core.py    |    7 ++++++-
+ keystone/token/core.py       |   11 +++++++++++
+ tests/test_keystoneclient.py |   18 +++++++++---------
+ 3 files changed, 26 insertions(+), 10 deletions(-)
+
+commit cd1e48a7d60497c528af6d311bd5048821dc1c07
+Author: Adam Young <[e-mail]>
+Date:   Thu Sep 6 11:54:04 2012 -0400
+
+    List tokens for memcached backend
+    
+    Creates and updates an index of tokens in a memcache entry keyed
+    by the user id
+    
+    Bug 1046905
+    
+    Change-Id: I114810297009331f491dc069d667f358092f1e34
+
+ keystone/token/backends/memcache.py |   23 +++++++++++++++++++-
+ tests/test_backend.py               |   41 ++++++++++++++++++++++++++++++-----
+ tests/test_backend_memcache.py      |   17 ++++++++++++---
+ 3 files changed, 72 insertions(+), 9 deletions(-)
+
+commit 5438d3b5a219d7c8fa67e66e538d325a61617155
+Author: Dolph Mathews <[e-mail]>
+Date:   Thu Aug 23 07:39:20 2012 -0500
+
+    Require authz to update user's tenant (bug 1040626)
+    
+    Change-Id: I82f80b84af2bc4db00b3dcb87a2ec338816a82e9
+
+ keystone/identity/core.py |    1 +
+ 1 file changed, 1 insertion(+)
+
+commit a16a0ab997c3a406da2ccf0005534d5f9d81861f
+Merge: a130848 ff6df7c
+Author: Jenkins <[e-mail]>
+Date:   Thu Aug 23 06:17:45 2012 +0000
+
+    Merge "Returning roles from authenticate in ldap backend" into stable/essex
+
+commit ff6df7cdbeaed6a8784955ba866332ec5f082ad5
+Author: Ryan Lane <[e-mail]>
+Date:   Thu Jul 26 11:41:16 2012 -0700
+
+    Returning roles from authenticate in ldap backend
+    
+    Without this fix, the LDAP backend doesn't return
+    roles during the authentication phase.
+    
+    lp 1035428
+    
+    Change-Id: Ibd7e5a8f5475b56a4d3063c85ab634e4c0614e7e
+
+ AUTHORS                                 |    1 +
+ keystone/identity/backends/ldap/core.py |   24 +++++++++++++++---------
+ tests/test_backend.py                   |   10 ++++++++++
+ 3 files changed, 26 insertions(+), 9 deletions(-)
+
+commit a130848c71f1bc65dcf98c085dee0c4796748faa
+Author: Adam Young <[e-mail]>
+Date:   Thu Jul 26 15:30:39 2012 -0400
+
+    Allow overloading of username and tenant name in the config files.
+    
+    Includes documentation and sample config file values.
+    
+    Bug 997700
+    
+    Patchset adds DocImpact flag for notifying doc team about these new
+    config file values.
+    
+    (cherry picked from commit 4f3dcb6c9b23867e6049f24c851b12904aee3b76)
+    
+    Conflicts:
+    
+    	etc/keystone.conf.sample
+    	keystone/config.py
+    
+    Change-Id: I94a162be07c224c705333804a53910833df96b8e
+
+ doc/source/configuration.rst            |   13 +++++++++++++
+ keystone/config.py                      |    2 ++
+ keystone/identity/backends/ldap/core.py |    2 ++
+ 3 files changed, 17 insertions(+)
+
+commit 359c426f3009b6088efc364c035d104b089eb37a
+Author: Mark McLoughlin <[e-mail]>
+Date:   Fri Aug 10 06:54:48 2012 +0100
+
+    Open 2012.1.3 development
+    
+    Bump version to 2012.1.3 to formally open development of the next
+    Essex stable update release.
+    
+    See http://wiki.openstack.org/StableBranchRelease
+    
+    Change-Id: Ie3a82ed9b26d25a83b284d57e3d58ab6f4c31b30
+
+ setup.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit afc37aeb10638807c9839fcc6f403b34029662a5
+Author: Mark McLoughlin <[e-mail]>
+Date:   Wed Aug 8 00:45:22 2012 +0100
+
+    Open 2012.1.2 development
+    
+    Bump version to 2012.1.2 to formally open development of the next
+    Essex stable update release.
+    
+    See http://wiki.openstack.org/StableBranchRelease
+    
+    Change-Id: Id20de09f981f5389afbb9622ade9de7d4f3fd015
+
+ setup.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit f65604db7b504709fcb9aba2bcfd34a2aebffed3
+Merge: 46b3722 5373601
+Author: Jenkins <[e-mail]>
+Date:   Tue Jul 31 10:31:57 2012 +0000
+
+    Merge "Raise unauthorized if tenant disabled (bug 988920)" into stable/essex
+
+commit 46b3722245283858017cf4df83e2e1ca2311211d
+Merge: d56a3fb 708c80e
+Author: Jenkins <[e-mail]>
+Date:   Mon Jul 30 16:11:58 2012 +0000
+
+    Merge "fix variable names to coincide with the ones in common.ldap" into stable/essex
+
+commit 5373601bbdda10f879c08af1698852142b75f8d5
+Author: Dolph Mathews <[e-mail]>
+Date:   Mon Jul 16 16:08:32 2012 -0500
+
+    Raise unauthorized if tenant disabled (bug 988920)
+    
+    If the client attempts to explicitly authenticate against a disabled
+    tenant, keystone should return HTTP 401 Unauthorized.
+    
+    Change-Id: I49fe56b6ef8d9f2fc6b9357472dae8964bb9cb9c
+
+ keystone/service.py          |   11 ++++++++++
+ tests/test_keystoneclient.py |   47 ++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 58 insertions(+)
+
+commit d56a3fb026268e87bdd54b862be388d69d5a1266
+Author: Dmitry Khovyakov <[e-mail]>
+Date:   Wed Jul 11 14:17:46 2012 +0300
+
+    Import ec2 credentials from old keystone db
+    
+    Fix bug #1016056
+    
+    Change-Id: Iebf31ccbdeff274b2c8f265911d3411963dd4844
+
+ AUTHORS                       |    1 +
+ keystone/common/sql/legacy.py |   19 +++++++++++++++++++
+ 2 files changed, 20 insertions(+)
+
+commit 0b95c3cf66659a828de055b8d026c11e333cd8c8
+Author: J. Daniel Schmidt <[e-mail]>
+Date:   Thu Jul 12 11:22:33 2012 +0200
+
+    cleanup dependent data upon user/tenant deletion
+    
+    fixes bug 974199
+    fixes bug 973243
+    
+    * upon deletion of tenant also delete user tenant relations
+    * upon deletion of tenant or user also delete corresponding metadata
+    * add foreign keys in metadata to ensure consistency
+    
+    see also: https://bugs.launchpad.net/keystone/+bug/959294/comments/16
+    
+    Change-Id: I264714fe82b727e3e0f5273bcb781a580a3f3826
+
+ AUTHORS                           |    1 +
+ keystone/identity/backends/sql.py |   21 +++++++++++++++++++++
+ tests/test_backend_sql.py         |   35 +++++++++++++++++++++++++++++++++++
+ 3 files changed, 57 insertions(+)
+
+commit 708c80ea8e4ca1897b6815b559ad9437b36448ef
+Author: Ionuț Arțăriși <[e-mail]>
+Date:   Fri Jun 29 13:02:26 2012 +0200
+
+    fix variable names to coincide with the ones in common.ldap
+    
+    Change-Id: I148d8d9b0a67b8c45d06227829d0105935216c4d
+
+ keystone/identity/backends/ldap/core.py |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+commit f1762e6d81be38fc6f9b3e12735a868896ce931d
+Merge: d111d54 14b136a
+Author: Jenkins <[e-mail]>
+Date:   Thu Jul 5 16:04:40 2012 +0000
+
+    Merge "Require authz for user role list (bug 1006815)" into stable/essex
+
+commit d111d548767bfed1d2c892e7bb443155c166fdc5
+Merge: 1428278 24df3ad
+Author: Jenkins <[e-mail]>
+Date:   Thu Jul 5 15:43:54 2012 +0000
+
+    Merge "Require authz for service CRUD (bug 1006822)" into stable/essex
+
+commit 1428278b6202b7cb285f9e1bb278f894c05d31b0
+Merge: d8dbdbc 707b725
+Author: Jenkins <[e-mail]>
+Date:   Thu Jun 28 14:16:31 2012 +0000
+
+    Merge "Set defaultbranch in .gitreview to stable/essex" into stable/essex
+
+commit d8dbdbced061fa4a4e42ec33c4b7e7752b0ebc04
+Author: Rafael Durán Castañeda <[e-mail]>
+Date:   Tue Jun 19 20:35:43 2012 +0200
+
+    Monkey patching 'thread'.
+    
+    Fixes bug 1012381.
+    
+    Change-Id: Icb7b2372df96d647fc6dcd4c4ebe72c8aa607f9d
+
+ AUTHORS                 |    1 +
+ keystone/common/wsgi.py |    2 +-
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+commit 14b136aed9d988f5a8f3e699bd4577c9b874d6c1
+Author: Dolph Mathews <[e-mail]>
+Date:   Sun Jun 3 12:24:07 2012 -0500
+
+    Require authz for user role list (bug 1006815)
+    
+    Change-Id: I65f25dcca3e265f44746930917434b45e64de15e
+
+ keystone/identity/core.py   |    1 +
+ tests/test_content_types.py |   11 +++++++++++
+ 2 files changed, 12 insertions(+)
+
+commit 24df3adb3f50cbb5ada411bc67aba8a781e6a431
+Author: Dolph Mathews <[e-mail]>
+Date:   Sun Jun 3 11:00:54 2012 -0500
+
+    Require authz for service CRUD (bug 1006822)
+    
+    Change-Id: Ia90f0aa2b856b9a9874d4865fb92ee913e8125c5
+
+ keystone/catalog/core.py    |    7 +++++++
+ tests/test_content_types.py |   33 +++++++++++++++++++++++++++++++++
+ 2 files changed, 40 insertions(+)
+
+commit 707b7259f9772e5f498990297c65b68116bdc3c1
+Author: Mark McLoughlin <[e-mail]>
+Date:   Fri Jun 22 21:16:26 2012 +0100
+
+    Set defaultbranch in .gitreview to stable/essex
+    
+    This allows people run git-review without any arguments.
+    
+    Change-Id: I3f1c7ce22cbe40ed34f084fd3dbc0941ba787bcf
+
+ .gitreview |    2 ++
+ 1 file changed, 2 insertions(+)
+
+commit 29e74e73a6e51cffc0371b32354558391826a4aa
+Author: Derek Higgins <[e-mail]>
+Date:   Tue Jun 5 09:33:53 2012 +0100
+
+    Carrying over token expiry time when token chaining
+    
+    Fixes bug #998185
+    
+    This commit causes the token expiry time to be maintained when
+    one token is being created from another
+    
+    Change-Id: I7b61692a60d9227423b93c267864a5abe939ca33
+
+ keystone/service.py          |    3 ++-
+ tests/test_keystoneclient.py |   12 ++++++++++++
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+commit 9a841f3ba93d5a0bd1f56cc897415258ed6cf877
+Merge: 35d5ebd d960043
+Author: Jenkins <[e-mail]>
+Date:   Thu Jun 14 19:56:21 2012 +0000
+
+    Merge "Invalidate user tokens when a user is disabled" into stable/essex
+
+commit 35d5ebd54e02e4b79515e882506f0a518548d273
+Merge: 9695b86 ea03d05
+Author: Jenkins <[e-mail]>
+Date:   Thu Jun 14 16:58:30 2012 +0000
+
+    Merge "Invalidate user tokens when password is changed" into stable/essex
+
+commit 9695b8681801f3624b8f40dc06797aa171b5f30d
+Merge: 0dcfe7e f70505c
+Author: Jenkins <[e-mail]>
+Date:   Thu Jun 14 16:15:39 2012 +0000
+
+    Merge "Fix expired token tests" into stable/essex
+
+commit 0dcfe7ec2df5a45271847914997cbba92fdda330
+Merge: 18513c3 4265499
+Author: Jenkins <[e-mail]>
+Date:   Thu Jun 14 15:42:01 2012 +0000
+
+    Merge "Corrects url conversion in export_legacy_catalog" into stable/essex
+
+commit d9600434da14976463a0bd03abd8e0309f0db454
+Author: Derek Higgins <[e-mail]>
+Date:   Fri May 11 13:42:43 2012 +0100
+
+    Invalidate user tokens when a user is disabled
+    
+    Fixes Bug 997194
+    
+    Delete valid tokens for a user when they have been disabled
+    
+    Moved logic to delete tokens into update_user, as this can be called
+    directly form the REST API.
+    
+    Also checks if a user is enabled when creating a token from another
+    token, this helps in cases there the backend didn't support listing of
+    tokens (and as a result weren't deleted)
+    
+    Change-Id: Ib5ed73a7873bfa66ef31bf6d0f0322f50e677688
+
+ keystone/identity/core.py    |   22 ++++++++++++----------
+ keystone/service.py          |   14 +++++++++++++-
+ tests/test_keystoneclient.py |   21 +++++++++++++++++++--
+ 3 files changed, 44 insertions(+), 13 deletions(-)
+
+commit ea03d05ed5de0c015042876100d37a6a14bf56de
+Author: Derek Higgins <[e-mail]>
+Date:   Wed May 9 15:55:46 2012 +0100
+
+    Invalidate user tokens when password is changed
+    
+    Fixes bug 996595
+    
+    This commit will cause all valid tokens to be deleted for a user
+    who's password is changed (implemented for the sql and kvs backends)
+    
+    Change-Id: I6ad7da8957b7041983a3fc91d9ba9368667d06ac
+
+ AUTHORS                        |    1 +
+ keystone/identity/core.py      |   14 +++++++++++++-
+ keystone/token/backends/kvs.py |   15 +++++++++++++++
+ keystone/token/backends/sql.py |   14 ++++++++++++++
+ keystone/token/core.py         |   10 ++++++++++
+ tests/test_keystoneclient.py   |   23 +++++++++++++++++++++++
+ 6 files changed, 76 insertions(+), 1 deletion(-)
+
+commit 18513c36e63ee2da417f1125cfa05ea9d525b6ee
+Author: Mark McLoughlin <[e-mail]>
+Date:   Thu Jun 14 10:59:33 2012 +0100
+
+    Open 2012.1.1 development
+    
+    Bump version to 2012.1.1 to formally open development of the next
+    Essex stable update release.
+    
+    See http://wiki.openstack.org/StableBranchRelease
+    
+    Change-Id: I845e8abca87751bbe4ebfa9414add247f2afdc1f
+
+ setup.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit f70505ced12ae7319dedaf75bedb964c7469c6dd
+Author: Mark McLoughlin <[e-mail]>
+Date:   Tue Apr 10 13:35:30 2012 +0100
+
+    Fix expired token tests
+    
+    Fixes bug #983800
+    
+    The expiration timestamps are expressed in UTC time, so ensure:
+    
+     1) The timestamp of the token created by the test is UTC time (i.e.
+        utcnow() vs now())
+    
+     2) The expiration check in the dummy memcache client properly
+        accounts for UTC (i.e. utctimetuple() vs timetuple())
+    
+    Change-Id: Ie7356456f79ab5a8070a79771bb7d210b1cedd47
+
+ tests/test_backend.py          |    2 +-
+ tests/test_backend_memcache.py |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+commit aa7e7b96e7bd05819c899906091b9121385dc125
+Author: Dan Prince <[e-mail]>
+Date:   Wed Apr 11 10:57:56 2012 -0400
+
+    Add ChangeLog to tarball.
+    
+    Fixes LP Bug #978981.
+    
+    Change-Id: I5b98df88673422cfc39c471fd77eecd77fa0cf2c
+
+ MANIFEST.in |    1 +
+ 1 file changed, 1 insertion(+)
+
+commit d0a73669369d86ff4c7b9de715fa4eec9bc58b59
+Author: Adam Gandelman <[e-mail]>
+Date:   Mon Jun 11 10:35:16 2012 -0700
+
+    Flush tenant membership deletion before user
+    
+    Ensure user tenant membership is *actually* removed before deleting
+    user.
+    
+    Applied to 'stable/essex', originally committed to trunk via
+    https://review.openstack.org/#/c/7353/
+    
+    Fixes bug 998137.
+    
+    Change-Id: Ib52970d68f288b8742c3e060c7040838a1c738c2
+
+ keystone/identity/backends/sql.py |    1 +
+ 1 file changed, 1 insertion(+)
+
+commit 426549934e323a9bc435b9ec58163e88f5e74a32
+Author: Sam Morrison <[e-mail]>
+Date:   Mon May 7 09:09:57 2012 +1000
+
+    Corrects url conversion in export_legacy_catalog
+    
+    Fixes bug 994936
+    
+    Change-Id: Ia63fdae7d0bcd7f8b0b587da588404765e22fb8f
+
+ AUTHORS                       |    1 +
+ keystone/common/sql/legacy.py |    2 +-
+ tests/test_import_legacy.py   |    2 +-
+ 3 files changed, 3 insertions(+), 2 deletions(-)
+
+commit 7715d6cd72477af83d95563b69a5f0273bdb719b
+Author: Alan Pevec <[e-mail]>
+Date:   Mon Jun 11 20:19:50 2012 +0200
+
+    Fix test env for the stable branch
+    
+    Need both changes in one commit to pass the gate!
+    
+    * Nail pep8 dependencies to 1.0.1.
+    
+    Nails the pep8 deps for tox and test-requires to 1.0.1.
+    Fixes an issues causing pep8 failures due to a new pep8 release.
+    
+    (cherry picked from Nova stable)
+    
+    * Switch to 1000 rounds during unit tests
+    
+    Fixes bug 992918
+    
+    passlib 1.6 introduced a minimum number of rounds for sha512_crypt. As
+    a result, increase the rounds used during testing to the minimum
+    
+    Change-Id: Ic0c635e92b4f13180a047904a6efa490ab599012
+
+ tests/test_overrides.conf |    2 +-
+ tools/test-requires       |    2 +-
+ tox.ini                   |    2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+commit aff45d69a73033241531f5e3542a8d1782ddd859
+Author: Mark McLoughlin <[e-mail]>
+Date:   Fri Mar 30 12:17:48 2012 +0100
+
+    Make import_nova_auth only create roles which don't already exist
+    
+    Fixes bug #969088
+    
+    If a role already exists, there's no particular need for import_nova_auth
+    to barf. Instead, we should just use the existing role.
+    
+    Change-Id: I18ae38af62b4c2b2423e20e436611fc30f844ae1
+
+ keystone/common/sql/nova.py     |    5 ++++-
+ tests/test_migrate_nova_auth.py |    9 +++++++++
+ 2 files changed, 13 insertions(+), 1 deletion(-)
+
+commit 7d08d12cea96910145f05499ba7d124603d7c4f6
+Author: Adam Gandelman <[e-mail]>
+Date:   Mon Apr 2 14:21:43 2012 -0700
+
+    Remove tenant membership during user deletion
+    
+    Remove users' tenant membership on user deletion.  Resolves a FK constraint
+    issue that previously went unnoticed due to testing against database
+    configurations that do not support FK constraints (MyISAM).
+    
+    Fixes LP bug 959294.
+    
+    Update: * Move tenant membership cleanup to the sql identity backend
+            * Add a test case to test_backend_sql
+    
+    Change-Id: Ib4f5da03033f7886b36d1ab3b8b4ac37f08b2e0e
+
+ keystone/identity/backends/sql.py |    8 ++++++++
+ tests/test_backend_sql.py         |   11 +++++++++++
+ 2 files changed, 19 insertions(+)
+
+commit aa542c420aa283968a0154a29038ec0bb1be9326
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Mon Apr 2 17:15:47 2012 +0200
+
+    Add a _ at the end of reseller_prefix default.
+    
+    - Fixes bug 971592.
+    
+    Change-Id: Ic9edb2b8b0043413e4ec16de9c669646ae4230a6
+
+ keystone/middleware/swift_auth.py |   11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+commit 0a0513d9fb1b84d5b998ff47088aee7f121dc794
+Merge: a05daf5 89e8dc0
+Author: Jenkins <[e-mail]>
+Date:   Tue Apr 3 19:39:43 2012 +0000
+
+    Merge "Add support to swift_auth for tokenless authz" into milestone-proposed
+
+commit a05daf5f53fbf0084e0f19ed4a8b686ff60bcb90
+Merge: bc153d5 4314ae6
+Author: Jenkins <[e-mail]>
+Date:   Tue Apr 3 19:29:19 2012 +0000
+
+    Merge "additional logging to support debugging auth issue" into milestone-proposed
+
+commit 89e8dc075151acc85d8c4f8972d3910c7f33bd25
+Author: Maru Newby <[e-mail]>
+Date:   Tue Mar 20 22:19:36 2012 -0700
+
+    Add support to swift_auth for tokenless authz
+    
+     * Updates keystone.middleware.swift_auth to allow token-less
+       (unauthenticated) access for container sync (bug 954030) and
+       permitted referrers (bug 924578).
+    
+    Change-Id: Ieccf458c44dfe55f546dc15c79704800dad59ac0
+
+ doc/source/configuringservices.rst  |    3 +
+ keystone/middleware/swift_auth.py   |  106 +++++++++++++++++++++++++----------
+ tests/test_swift_auth_middleware.py |   56 +++++++++---------
+ 3 files changed, 104 insertions(+), 61 deletions(-)
+
+commit 4314ae6c038b96c080dfd13938678e358e5574e7
+Author: Joe Heck <[e-mail]>
+Date:   Fri Mar 30 22:04:16 2012 -0700
+
+    additional logging to support debugging auth issue
+    
+    fixes bug 969801
+    
+    Change-Id: Iaf752e5f3692c91030cfd8575114f2c3293d1dba
+
+ keystone/middleware/auth_token.py |    8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+commit bc153d5ad9b32737dd55c33fd12468e89189eded
+Author: Maru Newby <[e-mail]>
+Date:   Mon Mar 26 16:08:56 2012 -0700
+
+    Fixed misc errors in configuration.rst
+    
+     * Addresses bug 965788
+    
+    Change-Id: I5aa276589a9818c7f523e6da9531af363139adbb
+
+ doc/source/configuration.rst |   10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+commit ada402155acf5bda83d1b0fbedfbb0d7e4144b58
+Author: termie <[e-mail]>
+Date:   Thu Mar 29 16:03:17 2012 -0700
+
+    don't duplicate the extra dict in extra
+    
+    fixes bug 929815
+    
+    Change-Id: Icfbe9a4b0eb2ef9b24bcf41113a6ec8e636210a9
+
+ keystone/catalog/backends/sql.py  |    4 ++--
+ keystone/identity/backends/sql.py |    4 ++--
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+commit 1b7aa15ae425e68c15588ba738e9b701b62d995a
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Mar 27 10:57:04 2012 -0700
+
+    Raise keystone.exception for HTTP 401 (bug 962563)
+    
+    Change-Id: I22e3b6769c69ef5917028980007d3295fed99fb7
+
+ keystone/contrib/s3/core.py |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+commit b1336b0a3921621741ff8ba2adbc44113357e175
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Mar 23 10:46:16 2012 -0500
+
+    Validate object refs (return 404 instead of 500)
+    
+    Combined fix for bug 963056:
+    user-crud 404
+    service-crud 404
+    ec2-credential-crud 404
+    user-role-crud 404
+    endpoint-crud 404
+    
+    Change-Id: I7762aaaae9817ea7426039e4700e16b59e18cba1
+
+ keystone/catalog/core.py          |    5 +-
+ keystone/contrib/ec2/core.py      |    2 +
+ keystone/exception.py             |    2 +-
+ keystone/identity/backends/kvs.py |    4 +
+ keystone/identity/backends/sql.py |    4 +
+ keystone/identity/core.py         |   26 +++++-
+ tests/test_keystoneclient.py      |  175 +++++++++++++++++++++++++++++++++++++
+ tests/test_keystoneclient_sql.py  |    7 ++
+ 8 files changed, 222 insertions(+), 3 deletions(-)
+
+commit 80afa04f6e031207e6a7003843852b37c81eacc6
+Merge: f745dae d9959d8
+Author: Jenkins <[e-mail]>
+Date:   Tue Apr 3 14:45:36 2012 +0000
+
+    Merge "tenant-crud 404 (bug 963056)" into milestone-proposed
+
+commit f745dae9a6d9c68140476daa8403d0efc09826ab
+Merge: 8037722 b56e326
+Author: Jenkins <[e-mail]>
+Date:   Tue Apr 3 13:30:07 2012 +0000
+
+    Merge "role-crud 404 (bug 963056)" into milestone-proposed
+
+commit d9959d85a759b4acdff52c25f20a9462d66b185d
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Mar 23 10:23:06 2012 -0500
+
+    tenant-crud 404 (bug 963056)
+    
+    tenant-get
+    tenant-update
+    tenant-delete
+    
+    Change-Id: I9e67cea985f546c9ddf6ce6d82a11486099bd524
+
+ keystone/identity/core.py    |   10 +++++++++-
+ tests/test_keystoneclient.py |   21 +++++++++++++++++++++
+ 2 files changed, 30 insertions(+), 1 deletion(-)
+
+commit b56e32645fa88cd21f4b5289cfb68d51fcbf740c
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Mar 23 09:10:59 2012 -0500
+
+    role-crud 404 (bug 963056)
+    
+    role-get
+    role-delete
+    role-list
+    
+    Change-Id: I099b1e1e5bd2cd77a2ea3b72fb0f14b88a3af26e
+
+ keystone/identity/backends/kvs.py |    3 +--
+ keystone/identity/backends/sql.py |    3 +--
+ keystone/identity/core.py         |   13 ++++++++++--
+ tests/test_keystoneclient.py      |   41 +++++++++++++++++++++++++++++++++++--
+ 4 files changed, 52 insertions(+), 8 deletions(-)
+
+commit 8037722264668d9b66326cdfac25f6cf84d2b7d4
+Author: Maru Newby <[e-mail]>
+Date:   Tue Mar 20 18:47:19 2012 -0700
+
+    Improve swift_auth test coverage + Minor fixes
+    
+     * Isolates authorize() tests from wsgi tests
+     * Adds coverage for authorize()
+     * Adds support for a blank reseller_prefix
+     * Adds swift_auth test dependencies to tools/test-requires
+     * Cleans up authorize()'s use of tenant_id/tenant_name
+       (addresses bug 963546)
+    
+    Change-Id: I603b89ab4fe8559b0f5d72528afd659ee0f0bce1
+
+ AUTHORS                             |    1 +
+ keystone/middleware/swift_auth.py   |   18 +--
+ tests/test_swift_auth_middleware.py |  281 ++++++++++++++++++-----------------
+ tools/test-requires                 |    4 +
+ 4 files changed, 158 insertions(+), 146 deletions(-)
+
+commit f3ce326a8c9ab85f60145e6a198e061fd9ccf431
+Merge: 7abe0aa 1904228
+Author: Jenkins <[e-mail]>
+Date:   Fri Mar 23 17:59:24 2012 +0000
+
+    Merge "Check values for EC2."
+
+commit 7abe0aa3845459b95a7d4e401e51d4ab8c4c0280
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Wed Mar 21 16:59:15 2012 +0000
+
+    S3 tokens cleanups.
+    
+    - Cleanups.
+    - Remove reference about config admin_username/password/token.
+    - Return proper http error on errors.
+    - Add unittests (skip them for now when swift is not installed).
+    - Fixes bug 956983.
+    
+    Change-Id: I392fc274f3b01a5a0b5779dd13f9cd3b819ee65a
+
+ doc/source/configuringservices.rst |    6 +-
+ keystone/middleware/s3_token.py    |  124 ++++++++++++++++++++++------------
+ tests/test_s3_token_middleware.py  |  130 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 213 insertions(+), 47 deletions(-)
+
+commit 1904228a5a3fef549c5b9294eba5c39f9f6f72bd
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Thu Mar 22 21:34:39 2012 +0000
+
+    Check values for EC2.
+    
+    - Add multiple check to methods to make sure we have a proper
+      tenant_id/user_id/credentials.
+    - Fixes bug 958135.
+    
+    Change-Id: I4dd171e3db32d6ebdc70bb1a83492c8ecd09c21c
+
+ keystone/contrib/ec2/core.py |   61 +++++++++++++++++++++++++++++++++++++-----
+ 1 file changed, 55 insertions(+), 6 deletions(-)
+
+commit 9feb00085f75ea2697fd2225e6003c2384904d08
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Mar 21 13:11:31 2012 -0500
+
+    Fix critical typo in endpoint_create (bug 961412)
+    
+    It looks like catalog crud was previously untested.
+    
+    Change-Id: I8e3060b6d6c737d3d97a5bd9076e9a5fdf9945e2
+
+ keystone/catalog/core.py         |    2 +-
+ tests/test_keystoneclient_sql.py |   43 ++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 44 insertions(+), 1 deletion(-)
+
+commit 885f8d5950f8441e857d860b4e1cd4fd996440cd
+Merge: d61aeda 94904e4
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 23:59:16 2012 +0000
+
+    Merge "Rename tokenauth to authtoken."
+
+commit d61aedaf868d984f1c317a73b362a2e7a366ef89
+Author: Yong Sheng Gong <[e-mail]>
+Date:   Sun Mar 18 23:56:35 2012 +0800
+
+    unique role name constraint
+    
+      For SQL identity backend, add unique constraint with column definition;
+    for kvs and ldap backend, use python code to apply this constraint.
+    Test cases test_create_duplicate_role_name_fails and test_rename_duplicate_role_name_fails are added to guard it.
+    python run_tests.py test_backend_ldap test_backend_kvs test_backend_sql pass.
+    
+    bug 932258.
+    
+    Change-Id: I990f17a270e84d35c078f215c587a81d6784c192
+
+ AUTHORS                                 |    1 +
+ keystone/identity/backends/kvs.py       |   23 +++++++++++++++++++-
+ keystone/identity/backends/ldap/core.py |   14 ++++++++++++-
+ keystone/identity/backends/sql.py       |    2 +-
+ tests/test_backend.py                   |   35 +++++++++++++++++++++++++------
+ 5 files changed, 66 insertions(+), 9 deletions(-)
+
+commit f98cd4f27d68c47a003b529bbcfeffa9140e090d
+Merge: 53b3d44 3a296a4
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 23:17:30 2012 +0000
+
+    Merge "Spring cleaning, fix PEP8 violations."
+
+commit 53b3d4498848ae2fff58751f9a791a9ebc00b742
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Sat Feb 25 11:37:17 2012 +0100
+
+    Add test for swift middleware.
+    
+    - skip the tests if we don't have swift installed.
+    
+    Change-Id: I3647538f3e7a32cbfce97b181c532371cef963da
+
+ tests/test_swift_auth_middleware.py |  203 +++++++++++++++++++++++++++++++++++
+ 1 file changed, 203 insertions(+)
+
+commit 3a296a458c4e2f9465ddc0330d03c3e7ec0e3c50
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Tue Mar 20 10:09:25 2012 +0000
+
+    Spring cleaning, fix PEP8 violations.
+    
+    Change-Id: Ide832cd64c9b285213e23901eaf81946d504e726
+
+ doc/source/conf.py                  |   33 +++++++++++--------
+ run_tests.py                        |    1 -
+ tests/default_fixtures.py           |    6 ++--
+ tests/test_auth_token_middleware.py |    6 ++--
+ tests/test_backend.py               |   61 +++++++++++++++++------------------
+ tests/test_backend_kvs.py           |   58 ++++++++++++++++-----------------
+ tests/test_backend_sql.py           |   30 ++++++++---------
+ tests/test_content_types.py         |    6 ++--
+ tests/test_import_legacy.py         |    2 --
+ tests/test_keystoneclient.py        |    6 ++--
+ tests/test_middleware.py            |    3 +-
+ 11 files changed, 108 insertions(+), 104 deletions(-)
+
+commit 5ea232a09f88d621980cbd5ef4655f9c9a2e2da1
+Merge: da04fc0 009d661
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 22:40:51 2012 +0000
+
+    Merge "Wrapped unexpected exceptions (bug 955411)"
+
+commit da04fc0de4b7f46a5559f3c81e54b5402e4876e3
+Merge: 57f1cb2 e677327
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 22:34:37 2012 +0000
+
+    Merge "Support PyPAM in pam backend, update to latest API"
+
+commit 94904e45e3276e1c274a25c785c0143cd6d6fec1
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Tue Mar 20 17:08:46 2012 +0000
+
+    Rename tokenauth to authtoken.
+    
+    - Avoid confusing by using the authtoken name for auth_token middleware.
+    - Improve swift_auth middleware doc.
+    
+    Change-Id: I287860eba067b99a1d89f8f17200820340836ff9
+
+ doc/source/configuringservices.rst |   10 +++++-----
+ keystone/middleware/swift_auth.py  |    9 +++++++--
+ 2 files changed, 12 insertions(+), 7 deletions(-)
+
+commit 57f1cb2c4a37ef0040321732fb64fc6cde02126d
+Merge: 80c7936 3e4653a
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 18:04:22 2012 +0000
+
+    Merge "fix keystone-all's usage of options vs conf"
+
+commit 80c7936b3147d53659025a76ac232de986f5ce64
+Author: termie <[e-mail]>
+Date:   Tue Mar 20 10:41:03 2012 -0700
+
+    pass the arguments in when starting keystone-all
+    
+    fixes bug 942793
+    
+    Change-Id: I044a56c1eedae2ecef04dd3aa60b91414b7abc14
+
+ bin/keystone-all |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 3e4653a3914e84aec72ba159c4d23edba8ced48f
+Author: termie <[e-mail]>
+Date:   Tue Mar 20 10:47:31 2012 -0700
+
+    fix keystone-all's usage of options vs conf
+    
+    we shouldn't be using options at all, that was a leftover piece of code
+    from a long time ago.
+    
+    invalidates bug 949373
+    
+    Change-Id: I29fcbd5f641464bda985900172b55bca45843f81
+
+ bin/keystone-all  |    8 ++++----
+ etc/keystone.conf |    2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+commit 9c823977baca9944074c62cedf32f5107a95a443
+Merge: 3263f45 6f8752b
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 17:19:51 2012 +0000
+
+    Merge "Clean up sql connection args"
+
+commit 3263f45926f054c759caa10e391777e7372e73a1
+Merge: 5d07cdf ee57716
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 16:59:17 2012 +0000
+
+    Merge "Improved file logging example (bug 959610)"
+
+commit 009d661a7e06ad72ab39b93433839bf567755ece
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Mar 14 15:06:16 2012 -0500
+
+    Wrapped unexpected exceptions (bug 955411)
+    
+    - Replaced all webob.exc's (outside of middleware) with
+      keystone.exception's
+    - Raised 409 Conflict when creating/updating existing
+      user/tenant ID/names (bug 955464)
+    - Raised 501 Not Implemented for user-role-add w/o tenant_id
+      (bug 955548)
+    
+    Change-Id: I9f16cac502c20dd35a6b8da778e85bf3d9cfae49
+
+ keystone/catalog/backends/sql.py        |    2 +-
+ keystone/catalog/core.py                |   11 ++-----
+ keystone/common/ldap/core.py            |   11 ++++---
+ keystone/common/sql/core.py             |    1 +
+ keystone/common/wsgi.py                 |    3 ++
+ keystone/contrib/ec2/core.py            |   20 +++++--------
+ keystone/exception.py                   |   50 +++++++++++++++++++++++++++----
+ keystone/identity/backends/kvs.py       |   19 ++++++++----
+ keystone/identity/backends/ldap/core.py |    2 +-
+ keystone/identity/backends/sql.py       |   23 ++++++++++++++
+ keystone/identity/core.py               |   24 ++++++++-------
+ keystone/policy/backends/rules.py       |    2 +-
+ keystone/service.py                     |    4 +--
+ tests/test_exception.py                 |    4 +--
+ 14 files changed, 121 insertions(+), 55 deletions(-)
+
+commit 5d07cdf438b97ec2fdc4685b2f1559f3258da102
+Author: Michael Basnight <[e-mail]>
+Date:   Tue Mar 20 08:53:31 2012 -0500
+
+    Changing belongsTo validation back to ID
+    
+    * Fixes lp#960218
+    
+    Change-Id: I6296413c211da92a4d0e07a544ca812d3544cb73
+
+ keystone/service.py         |    2 +-
+ tests/test_content_types.py |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+commit 3a70a2f9281fdfec6f770cfb60fcd2dce5a77c5f
+Merge: 632fb0a 193374a
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 04:55:46 2012 +0000
+
+    Merge "Fixes LP #954089 - Service list templated catalog"
+
+commit 632fb0a8cb4eddf76ce0695472601d69115149a9
+Merge: 4f3dade 2324247
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 04:49:56 2012 +0000
+
+    Merge "Swift middleware doc update."
+
+commit 4f3dade2367270442b685426befd6d6de665797b
+Merge: ed231ff 678dcad
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 04:44:01 2012 +0000
+
+    Merge "Refactor keystone.common.logging use (bug 948224)"
+
+commit ed231ffa8c3e90125bc73c528d1db8b46f3f5381
+Merge: 36b2b22 00a2392
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 04:37:59 2012 +0000
+
+    Merge "Installing keystone docs"
+
+commit 6f8752bf6ea74fb8841dac1a1d6b62af019b48e5
+Author: Brian Waldon <[e-mail]>
+Date:   Mon Mar 19 14:21:02 2012 -0700
+
+    Clean up sql connection args
+    
+    * Convert idle_timeout (pool_recycle) to integer
+    * Drop min_pool_size, max_pool_size, pool_timeout
+    * Fixes bug 959916
+    
+    Change-Id: Ie124b3abdf00358d6b722e1c2e2a2fb22967ca5a
+
+ doc/source/configuration.rst |    3 ---
+ etc/keystone.conf            |    3 ---
+ keystone/config.py           |    5 +----
+ tests/backend_sql.conf       |    3 ---
+ 4 files changed, 1 insertion(+), 13 deletions(-)
+
+commit 36b2b228daabd07e185e70800863991cbde6ba95
+Merge: 83bc8c0 6f2c858
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 20 04:15:44 2012 +0000
+
+    Merge "Update get_metadata to return {}"
+
+commit ee577163e32b88ca1345124c96ae3113d9a5ccdd
+Author: Dolph Mathews <[e-mail]>
+Date:   Mon Mar 19 14:49:18 2012 -0500
+
+    Improved file logging example (bug 959610)
+    
+    - Root logger w/ file handler will log WARNING, ERROR, CRITICAL by default
+    
+    Change-Id: I36cd07cec85712640daa013563401a3bc52f290c
+
+ .gitignore              |    2 +-
+ etc/keystone.conf       |    2 +-
+ etc/logging.conf.sample |   23 ++++-------------------
+ 3 files changed, 6 insertions(+), 21 deletions(-)
+
+commit 83bc8c088ec66a858afce9a889a4407c59b9d48e
+Merge: 5027c9d 773f0f8
+Author: Jenkins <[e-mail]>
+Date:   Mon Mar 19 18:07:20 2012 +0000
+
+    Merge "Fix default port for identity.internalURL"
+
+commit 5027c9d7150815abe1dde7e4d85d41eb2d0fad4d
+Merge: 7c1e32b 56e4103
+Author: Jenkins <[e-mail]>
+Date:   Mon Mar 19 18:01:19 2012 +0000
+
+    Merge "docstring cleanup to remove sphinx warnings"
+
+commit 2324247baac2ba620da1f6cdc540462e6f0b6a5f
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Mon Mar 19 14:53:36 2012 +0000
+
+    Swift middleware doc update.
+    
+    Change-Id: I01ecc4d602b5e887f66d32676f11a92d022f693f
+
+ doc/source/configuringservices.rst |   13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+commit 7c1e32bba6837eb0937e6e7567aa5e7981db7fec
+Merge: 43a84e3 2146119
+Author: Jenkins <[e-mail]>
+Date:   Mon Mar 19 16:26:45 2012 +0000
+
+    Merge "Remove nova-specific middlewares"
+
+commit 43a84e3b96450d29b7f3139a6e830583038c1d24
+Merge: 2c6a232 239e4f6
+Author: Jenkins <[e-mail]>
+Date:   Mon Mar 19 16:20:55 2012 +0000
+
+    Merge "Add check for MAX_PASSWORD_LENGTH to utils."
+
+commit 193374af3860e17ed03bb0431d823046079ae444
+Author: Jay Pipes <[e-mail]>
+Date:   Tue Mar 13 17:30:07 2012 -0400
+
+    Fixes LP #954089 - Service list templated catalog
+    
+    * Adds missing test cases for the TemplatedCatalog
+    * Adds a base CatalogTest that different backends
+      can use
+    * Updates kvs.Catalog to raise ServiceNotFound where
+      appropriate
+    * Updates the tests.test_keystoneclient_sql to actually
+      test the SQL catalog backend
+    * Removes old test for incorrect endpoints listing
+    * Removes the keystone.catalog.core.Driver.service_exists
+      method since it was only implemented in the SQL driver
+      and wasn't required now that get_service and delete_service
+      properly raise ServiceNotFound exception.
+    
+    Change-Id: I35690cc147e56007be27bacf94eeff360e727e5d
+
+ keystone/catalog/backends/kvs.py       |    9 +++-
+ keystone/catalog/backends/sql.py       |   10 ++---
+ keystone/catalog/backends/templated.py |    3 ++
+ keystone/catalog/core.py               |   12 ++---
+ keystone/exception.py                  |    4 ++
+ keystone/test.py                       |   75 ++++++++++++++++++++------------
+ tests/backend_sql.conf                 |    3 ++
+ tests/default_fixtures.py              |   21 +++++++++
+ tests/test_backend.py                  |   20 +++++++++
+ tests/test_backend_kvs.py              |    7 +--
+ tests/test_backend_templated.py        |   57 ++++++++++++++++++++++++
+ tests/test_keystoneclient.py           |    8 ----
+ 12 files changed, 174 insertions(+), 55 deletions(-)
+
+commit 2146119eaddaa5b3e375fef6590458a77932a58b
+Author: Brian Waldon <[e-mail]>
+Date:   Mon Mar 19 08:31:26 2012 -0700
+
+    Remove nova-specific middlewares
+    
+    * Nova now ships with nova.api.auth.NovaKeystoneContext
+    * Nova does not depend on either of the middlewares being removed
+    
+    Change-Id: I9546e5c84ea1453f5dfd2dd7bf9924ccda57f87a
+
+ doc/source/configuringservices.rst           |   11 +-
+ doc/source/nova-api-paste.rst                |  143 --------------------------
+ keystone/middleware/nova_auth_token.py       |  103 -------------------
+ keystone/middleware/nova_keystone_context.py |   71 -------------
+ 4 files changed, 1 insertion(+), 327 deletions(-)
+
+commit 239e4f64c2134338b32ffd6d42c0b6ff70cd040c
+Author: Dan Prince <[e-mail]>
+Date:   Fri Mar 16 21:46:31 2012 -0400
+
+    Add check for MAX_PASSWORD_LENGTH to utils.
+    
+    Updates to keystone password hashing and checking functions so
+    that a max password length is enforced.
+    
+    Fixes LP Bug #959288.
+    
+    Change-Id: Id3048f3c916e92c59ac5b063d09c3d612d51c97c
+
+ keystone/common/utils.py |   17 +++++++++++++----
+ tests/test_utils.py      |    5 +++++
+ 2 files changed, 18 insertions(+), 4 deletions(-)
+
+commit 2c6a232c38cf6bbd969421b2fe2fe7d410da327a
+Author: Brian Waldon <[e-mail]>
+Date:   Fri Mar 16 15:55:22 2012 -0700
+
+    Remove glance_auth_token middleware
+    
+    * Fixes bug 957501
+    
+    Change-Id: I2ae6ec7b391dd41587f2246940a8d392c12c91fe
+
+ keystone/middleware/glance_auth_token.py |   78 ------------------------------
+ 1 file changed, 78 deletions(-)
+
+commit e67732748c7ad4656f6ef5d9da3ff4789199bf9a
+Author: Russell Bryant <[e-mail]>
+Date:   Wed Mar 14 16:55:24 2012 -0400
+
+    Support PyPAM in pam backend, update to latest API
+    
+    Fix bug 938801.
+    
+    This bug pointed out that some distros don't have the same pam Python
+    module packaged that this backend was expecting.  In my case, on Fedora,
+    it's PAM and the API is not compatible with the pam module that was
+    used.  This patch makes the backend support PyPAM, as well as the
+    original pam module that was used.
+    
+    In order to test this, I updated the pam backend to the latest backend
+    API.  Even though the base class will raise NotImplementedError, I
+    included all functions here to make it more clear all of the things
+    this backend does not do.
+    
+    Change-Id: I74144f4e63b6830c8224bc87e1662eb5df8728a0
+
+ keystone/identity/backends/pam.py |  137 +++++++++++++++++++++++++++++++++----
+ 1 file changed, 125 insertions(+), 12 deletions(-)
+
+commit 88ac1edec0b62fe5b18b2b0ffce3798f63f21351
+Merge: c93f663 f8cbd61
+Author: Jenkins <[e-mail]>
+Date:   Fri Mar 16 02:34:15 2012 +0000
+
+    Merge "sample_data.sh: check file paths for packaged installations"
+
+commit c93f6633cdcde89c346054a478fa17b12940b395
+Merge: 2415b17 9363d5f
+Author: Jenkins <[e-mail]>
+Date:   Thu Mar 15 22:34:02 2012 +0000
+
+    Merge "Properly return 501 for unsupported Catalog calls"
+
+commit 2415b171b113aea4f4fbec5856b92cec36d44709
+Merge: 096300d e7bb737
+Author: Jenkins <[e-mail]>
+Date:   Thu Mar 15 17:23:52 2012 +0000
+
+    Merge "Add automatically generated code docs."
+
+commit 096300d072d8545f899586af44968c9ba43d380b
+Merge: fdca62c ab6be05
+Author: Jenkins <[e-mail]>
+Date:   Thu Mar 15 14:46:48 2012 +0000
+
+    Merge "Update username -> name in token response."
+
+commit 773f0f84af282cd3e53650ccbb99284c37677b6a
+Author: Julien Danjou <[e-mail]>
+Date:   Thu Mar 15 11:38:29 2012 +0100
+
+    Fix default port for identity.internalURL
+    
+    This should be the public_port and not the admin one.
+    
+    Change-Id: Ib09e7479c0507797532e6bb91d76b7d3083cc761
+    Signed-off-by: Julien Danjou <[e-mail]>
+
+ etc/default_catalog.templates |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit fdca62c93858e5bac09e5e20e0818585946a598d
+Merge: 9a2010b d2c6e88
+Author: Jenkins <[e-mail]>
+Date:   Thu Mar 15 07:49:17 2012 +0000
+
+    Merge "Raising unauthorized instead of 500 (bug 954547)"
+
+commit 00a239278553fd357e56da35b559ec329dc9796a
+Author: Joe Heck <[e-mail]>
+Date:   Wed Mar 14 19:03:59 2012 -0700
+
+    Installing keystone docs
+    
+    fixes bug 954217
+    
+    Change-Id: Iba79d2d5bae836037d5b0e10169d9bbdba8603dc
+
+ doc/source/index.rst      |    5 +-
+ doc/source/installing.rst |  115 +++++++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 118 insertions(+), 2 deletions(-)
+
+commit ab6be05068068b0902db44b1d60f56eea4fe1215
+Author: Brian Lamar <[e-mail]>
+Date:   Wed Mar 14 18:30:13 2012 -0400
+
+    Update username -> name in token response.
+    
+    Tokens validation responses contain user information. The API docs
+    seem to indicate token["user"]["name"] contains the username but
+    currently the auth_token.py middleware checks for
+    token["user"]["username"]. This updates that check and the tests.
+    
+    Fixes bug 955563
+    
+    Change-Id: Ib2fbf6fcea87f7066394cf14c18158f1e5eeaf06
+
+ keystone/middleware/auth_token.py   |    2 +-
+ tests/test_auth_token_middleware.py |    8 ++++----
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+commit 678dcad410b2496eb1ed34bb91c0d0914a9c6b0d
+Author: Dolph Mathews <[e-mail]>
+Date:   Wed Mar 14 14:28:04 2012 -0500
+
+    Refactor keystone.common.logging use (bug 948224)
+    
+    Change-Id: I01b2b5748a2524273bb8c2b734ab22415652f739
+
+ HACKING.rst                            |   20 ++++++++++++++++
+ keystone/catalog/backends/templated.py |    2 +-
+ keystone/common/bufferedhttp.py        |    8 +++++--
+ keystone/common/ldap/core.py           |    5 ++--
+ keystone/common/ldap/fakeldap.py       |    4 ++--
+ keystone/common/sql/nova.py            |   16 ++++++-------
+ keystone/common/utils.py               |   15 ++++++------
+ keystone/common/wsgi.py                |   37 +++++++++++++++--------------
+ keystone/middleware/auth_token.py      |   40 ++++++++++++++++----------------
+ keystone/policy/backends/rules.py      |    2 +-
+ keystone/test.py                       |    3 ++-
+ 11 files changed, 90 insertions(+), 62 deletions(-)
+
+commit 9a2010bfe81a386610a294d0b29c31e12db79773
+Merge: acc9f89 f4915af
+Author: Jenkins <[e-mail]>
+Date:   Wed Mar 14 20:45:40 2012 +0000
+
+    Merge "Allow connect to another tenant."
+
+commit e7bb73767ba9b538bdab85cdb4edb2549c02427f
+Author: Russell Bryant <[e-mail]>
+Date:   Wed Mar 14 16:05:46 2012 -0400
+
+    Add automatically generated code docs.
+    
+    Fix bug 954734.
+    
+    Fix "python setup.py build_sphinx" to build the code documentation via
+    sphinx-apidoc.
+    
+    Change-Id: I18eced31aab424b7c808697324cbf6cfede442a7
+
+ setup.py |    3 +++
+ 1 file changed, 3 insertions(+)
+
+commit 9363d5fea676e1e083c5afe5287ef30c806046bf
+Author: Adam Gandelman <[e-mail]>
+Date:   Tue Mar 13 16:23:45 2012 -0700
+
+    Properly return 501 for unsupported Catalog calls
+    
+    Similar to the other APIs, this creates a Driver class that describes
+    expected functionality of the catalog driver and raises NotImplemented
+    accordingly. NotImplementedError()'s are caught and returned as proper
+    501s instead of AttributeErrors.
+    
+    Also fixes some inconsistent paramters names in the sql backend.
+    
+    Fixes bug 954087
+    
+    Update: Convert usage of NotImplementedError() to new
+            keystone.exception.NotImplemented() for all
+            unimplemented driver actions.
+    
+    Change-Id: I69d8e21a6f651e69b724ec5ed5784645bad80c00
+
+ doc/source/architecture.rst      |    2 +-
+ keystone/catalog/backends/kvs.py |    3 +-
+ keystone/catalog/backends/sql.py |    6 +--
+ keystone/catalog/core.py         |   79 ++++++++++++++++++++++++++++++++++++++
+ keystone/exception.py            |    6 +++
+ keystone/identity/core.py        |   56 +++++++++++++--------------
+ keystone/policy/core.py          |    3 +-
+ keystone/service.py              |    4 +-
+ keystone/token/core.py           |    7 ++--
+ 9 files changed, 127 insertions(+), 39 deletions(-)
+
+commit acc9f892b36aa7315ac84d1e7f6506a6fea9fbad
+Merge: b03c204 a1e0174
+Author: Jenkins <[e-mail]>
+Date:   Wed Mar 14 18:22:30 2012 +0000
+
+    Merge "Update docs for keystone client cli args"
+
+commit 56e41037ba41b2507722dcbc54157cfe4cf4535f
+Author: Joe Heck <[e-mail]>
+Date:   Wed Mar 14 17:19:37 2012 +0000
+
+    docstring cleanup to remove sphinx warnings
+    
+    Change-Id: Icfc273f2466f48307d2addd22b70f1759d23fd97
+
+ keystone/common/policy.py         |   17 ++++++++++-------
+ keystone/policy/backends/rules.py |    6 ++++--
+ 2 files changed, 14 insertions(+), 9 deletions(-)
+
+commit b03c2047815ff341547d2d9792dfd392148d277a
+Author: Joe Heck <[e-mail]>
+Date:   Wed Mar 14 05:08:58 2012 +0000
+
+    updating documentation for rewrite of auth_token.
+    
+    fixes bug 944372
+    
+    Change-Id: Ifac365a6eb141e0ca4701cf139d6ea66a0b3ffbc
+
+ doc/source/configuringservices.rst                 |    3 +-
+ doc/source/images/graphs_305.svg                   |   41 --
+ doc/source/images/graphs_both.svg                  |   36 --
+ .../images/graphs_delegate_forbiden_basic.svg      |   53 --
+ .../images/graphs_delegate_forbiden_proxy.svg      |   52 --
+ doc/source/images/graphs_delegate_reject_basic.svg |   55 --
+ doc/source/images/graphs_delegate_reject_oauth.svg |   56 --
+ .../images/graphs_delegate_unimplemented.svg       |   53 --
+ doc/source/images/graphs_mapper.svg                |   73 ---
+ doc/source/images/graphs_proxyAuth.svg             |   51 --
+ doc/source/images/images_layouts.svg               |  200 -------
+ doc/source/index.rst                               |    3 +-
+ doc/source/middleware_architecture.rst             |  555 +++++---------------
+ doc/source/old/middleware.rst                      |  169 ------
+ doc/source/setup.rst                               |   28 +-
+ 15 files changed, 148 insertions(+), 1280 deletions(-)
+
+commit f4915afc5af0d1252e7779fcc30ffff892a69d91
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Wed Mar 14 16:19:12 2012 +0000
+
+    Allow connect to another tenant.
+    
+    - Works with nova s3_affix_tenant.
+    - This would only be allowed for user who has reselleradmin rights.
+    - Fixes bug 954505.
+    
+    Change-Id: Iea84f1c61f6c725982c8bee95889ce084d9ffd82
+
+ keystone/middleware/s3_token.py |   26 +++++++++++++++++++++-----
+ 1 file changed, 21 insertions(+), 5 deletions(-)
+
+commit fb4cbe9d3766ac0ccbe746114d5c6745bc91e002
+Merge: 5b3e05b dc41cb5
+Author: Jenkins <[e-mail]>
+Date:   Wed Mar 14 06:08:00 2012 +0000
+
+    Merge "Failing to update tenants (bug 953678, bug 954673)"
+
+commit a1e01747ea81fc128d08c02d449b477f52003680
+Author: Dean Troyer <[e-mail]>
+Date:   Wed Mar 14 00:35:47 2012 -0500
+
+    Update docs for keystone client cli args
+    
+    Changes CLI args in keystone command per updated http://wiki.openstack.org/CLIAuth
+    
+    Change-Id: I097181c418f6cc2226fceb5c79d87fde36026594
+
+ doc/source/configuration.rst |   12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+commit d2c6e88200bb33708a0861da4d1a10c0f7984895
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Mar 13 22:06:34 2012 -0500
+
+    Raising unauthorized instead of 500 (bug 954547)
+    
+    Change-Id: I557ff1ca51261edf0824aeb4565816216c59c76e
+
+ keystone/common/wsgi.py |   21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+commit dc41cb5c11951b416d3e379bc944ac85737b979a
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Mar 13 16:11:27 2012 -0500
+
+    Failing to update tenants (bug 953678, bug 954673)
+    
+    - GET /tenants: Enabled attribute was being overridden
+    - "POST" /tenants/{tenant_id}: was failing to update KVS
+    
+    Change-Id: Icc1efef52d35777d73e6010bdfc0409e24570aa2
+
+ keystone/identity/backends/kvs.py |    3 +-
+ keystone/identity/core.py         |    3 +-
+ tests/test_keystoneclient.py      |   56 ++++++++++++++++++++++++++++---------
+ 3 files changed, 47 insertions(+), 15 deletions(-)
+
+commit 5b3e05bbabd5366461630327e4498fe582ff8ab7
+Author: Adam Young <[e-mail]>
+Date:   Wed Mar 7 16:04:32 2012 -0500
+
+    added LDAP section to architecture and architecture
+    
+    https://bugs.launchpad.net/keystone/+bug/949521
+    
+    Bug 949521
+    
+    Change-Id: I2e37c0d946e3d97a2c4bc4bf4a50bd94466f70c2
+
+ doc/source/architecture.rst  |    6 ++++++
+ doc/source/configuration.rst |   42 +++++++++++++++++++++++++++++++++++++++---
+ 2 files changed, 45 insertions(+), 3 deletions(-)
+
+commit e65a22c43a7fe44621080cee01f394c90b54320d
+Author: Peng Yong <[e-mail]>
+Date:   Sun Mar 11 10:35:15 2012 +0800
+
+    Bug #943031 MySQL Server has gone away
+    added docnotes of error messages caught for mysql and reference
+    
+    Change-Id: I147b32193436be891e54e36c6adc1b16fda886d3
+
+ AUTHORS                     |    1 +
+ keystone/common/sql/core.py |   43 +++++++++++++++++++++++++++++++++++++++----
+ 2 files changed, 40 insertions(+), 4 deletions(-)
+
+commit 97460ef70b7a8008a27f73384c389c2b4c23dded
+Merge: dee8153 73af033
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 13 21:28:39 2012 +0000
+
+    Merge "Improved legacy tenancy resolution (bug 951933)"
+
+commit dee81534cb2743262e2287da35e9b5970bd9cc12
+Author: Joe Heck <[e-mail]>
+Date:   Tue Mar 13 13:53:40 2012 -0700
+
+    making all use of time follow datetime.utcnow()
+    fixes bug 954057
+    
+    Change-Id: I14fa475dc03410b8843ab028d30fbc8802c4be30
+
+ keystone/token/backends/kvs.py |    2 +-
+ keystone/token/backends/sql.py |    2 +-
+ keystone/token/core.py         |    4 ++--
+ tests/test_backend_memcache.py |    2 +-
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+commit 73af033ded8fe9ba54c37ab4f2a7553b3be1e450
+Author: Dolph Mathews <[e-mail]>
+Date:   Tue Mar 13 12:27:53 2012 -0500
+
+    Improved legacy tenancy resolution (bug 951933)
+    
+    Change-Id: Ia6fd5eb57e8d7f90328117351f7b814b1b4495dc
+
+ keystone/middleware/auth_token.py   |   33 ++++--
+ tests/test_auth_token_middleware.py |  201 ++++++++++++++++++++++++++---------
+ 2 files changed, 174 insertions(+), 60 deletions(-)
+
+commit f8cbd611cfa258f75051e41ebd83501cfec06630
+Author: Alan Pevec <[e-mail]>
+Date:   Mon Feb 27 17:59:33 2012 +0100
+
+    sample_data.sh: check file paths for packaged installations
+    
+    v4: try to use system-wide configuration first
+        then fallback to assuming git checkout
+    
+    Change-Id: I6916f554cb9848fcb2d090e142b8915ad19a7486
+
+ tools/sample_data.sh |   19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+commit 1e07b98d77a6ccb254e6f4411682235a47dab137
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Sat Mar 10 17:22:06 2012 +0100
+
+    Fix iso8601 import/use and date comparaison.
+    
+    - Store the unix time from iso8601.parse_date to compare against
+      time.time.
+    - on a WSGI environement the import don't get passed to the methods from
+      __init__ use a self. variable.
+    - Fixes bug 951603.
+    - Add unit tests.
+    - Add iso8601 to test-requires.
+    
+    Change-Id: Ia8af8b203d1310d5ae6868c3a14dfdf68d6e5331
+
+ keystone/middleware/auth_token.py   |    6 ++-
+ tests/test_auth_token_middleware.py |   93 ++++++++++++++++++++++++++++-------
+ tools/test-requires                 |    1 +
+ 3 files changed, 79 insertions(+), 21 deletions(-)
+
+commit a036b3f77ba39301d0a5d44afe6c4253c0db8b15
+Author: Dean Troyer <[e-mail]>
+Date:   Mon Mar 12 14:45:34 2012 -0500
+
+    Fix double-quoted service names
+    
+    The Keystone service template parser doesn't do any quote interpolation,
+    it just splits on ' = ' and passes the two parts on. So we just remove
+    the quotes for now.
+    
+    Fixes bug 943523
+    
+    Change-Id: Ib9e17e70926339ab67f9c50a52a5036eeb7bfb65
+
+ etc/default_catalog.templates |   10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+commit f6fd0c79219e0b4f8108aba73553b120f763af54
+Merge: 0c3c27c 1b64c84
+Author: Jenkins <[e-mail]>
+Date:   Sun Mar 11 06:42:37 2012 +0000
+
+    Merge "Remove Nova Diablo reference from migrate docs"
+
+commit 1b64c8405381000b8738195b265c6c81690d8e9e
+Author: Brian Waldon <[e-mail]>
+Date:   Sat Mar 10 20:59:40 2012 -0800
+
+    Remove Nova Diablo reference from migrate docs
+    
+    Change-Id: Ic8e07197db0b926c2ac7ee0ad6fcc936314ffe6f
+
+ doc/source/configuration.rst |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 0c3c27c7dbf8a4d359e8cae7f80fcaad5d8582e9
+Author: Deepak Garg <[e-mail]>
+Date:   Thu Mar 8 09:16:26 2012 +0530
+
+    Fixes the cli documentation of user/tenant/roles
+    
+    Fixed the subcommands and basic misconfiguration mentioned in bug #948211
+    
+    Note: deleted the old commands after the review comments.
+    
+    Change-Id: I2a8491c35f346d120581156ae1743d07c3c11fd0
+
+ AUTHORS                      |    1 +
+ doc/source/configuration.rst |  103 +++++++++++++-----------------------------
+ 2 files changed, 32 insertions(+), 72 deletions(-)
+
+commit 9d245f8b6867bb7cb2b1230055de1230a483f0cb
+Merge: a863c13 2f4fb46
+Author: Jenkins <[e-mail]>
+Date:   Sun Mar 11 01:54:48 2012 +0000
+
+    Merge "create service endpoints in sample data"
+
+commit a863c136720a1e3ddc098588afd171dc10ffb308
+Author: Brian Waldon <[e-mail]>
+Date:   Sat Mar 10 13:59:44 2012 -0800
+
+    Add simple set of tests for auth_token middleware
+    
+    Change-Id: Ie959e91dc555e35b8e5ba4b01c68a3f232efc115
+
+ keystone/middleware/auth_token.py   |    7 +-
+ tests/test_auth_token_middleware.py |  162 +++++++++++++++++++++++++++++++++++
+ 2 files changed, 168 insertions(+), 1 deletion(-)
+
+commit 7ee2a4618314217c1b5bae15e9346be4d9cb8107
+Merge: c373132 d6631d8
+Author: Jenkins <[e-mail]>
+Date:   Sat Mar 10 19:21:04 2012 +0000
+
+    Merge "update documention on changing user password"
+
+commit c373132e7fc720690d0f7531e1f5871632984c4f
+Merge: 6db0067 259d938
+Author: Jenkins <[e-mail]>
+Date:   Sat Mar 10 19:01:34 2012 +0000
+
+    Merge "enables run_test option to skip integration"
+
+commit 6db00670ea33c39c408d657525ebd778c8932ce1
+Merge: ee5083d 48f2c7d
+Author: Jenkins <[e-mail]>
+Date:   Sat Mar 10 11:29:31 2012 +0000
+
+    Merge "Add AUTHORS to the tarball."
+
+commit d6631d81d5f469415aed2023367adccb529ea656
+Author: Yaguang Tang <[e-mail]>
+Date:   Sat Mar 10 15:51:56 2012 +0800
+
+    update documention on changing user password
+    
+    Change-Id: I73be30eed4d2eed7a53c9dbdb5f29ec9c8f6eb6f
+
+ doc/source/configuration.rst |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit ee5083d7b4d7c9f3d687ccba6fe652af0966b9e0
+Merge: b5c8b3a 94abc7e
+Author: Jenkins <[e-mail]>
+Date:   Sat Mar 10 07:35:54 2012 +0000
+
+    Merge "Make sure we have a port number before int it."
+
+commit 259d9380e835d03d7358e4d953404b8207b8e8d7
+Author: Joe Heck <[e-mail]>
+Date:   Fri Mar 9 22:41:47 2012 -0800
+
+    enables run_test option to skip integration
+    
+    * fixes bug 948495
+    
+    Change-Id: I274bfe9611d677c44117a0d9ff67394790794fc4
+
+ run_tests.sh |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+commit b5c8b3a81911491c97ee95e741c75ffd269f382a
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Fri Mar 2 15:31:54 2012 +0000
+
+    Add token caching via memcache.
+    
+    - Fixes bug 938253
+    - caching requires both python-memcache and iso8601
+    
+    Change-Id: I23d5849aad4c6a2333b903eaca6d4f00be8615d3
+
+ doc/source/nova-api-paste.rst     |    2 +-
+ doc/source/old/middleware.rst     |    2 +-
+ keystone/middleware/auth_token.py |   70 +++++++++++++++++++++++++++++++++++++
+ 3 files changed, 72 insertions(+), 2 deletions(-)
+
+commit 6f2c858f4382395bd4b4232e7ba3dd509327e4c6
+Author: Brian Lamar <[e-mail]>
+Date:   Fri Mar 9 15:24:25 2012 -0500
+
+    Update get_metadata to return {}
+    
+    Fixes bug 951093
+    
+    While the actual issue was encountered in keystone/service.py,
+    the underlying issue is that all identity backends seems to be
+    returning None when no metadata is found for a user. I would argue
+    that returning {} makes it easier on clients.
+    
+    Change-Id: I06faf755cc0dbe45b5d0a0f86c6235b27c856047
+
+ keystone/identity/backends/kvs.py       |    2 +-
+ keystone/identity/backends/ldap/core.py |    8 +++-----
+ keystone/identity/backends/sql.py       |    2 +-
+ tests/default_fixtures.py               |    4 ++++
+ tests/test_backend.py                   |   19 +++++++++++++++++--
+ 5 files changed, 26 insertions(+), 9 deletions(-)
+
+commit e05bc6a6edeee5e1430e6c36fb38c911821800f5
+Author: Dolph Mathews <[e-mail]>
+Date:   Thu Mar 1 12:31:53 2012 -0600
+
+    Diablo to Essex migration docs (bug 934328)
+    
+    - Also includes notes to address bug 947060
+    
+    Change-Id: I2756457861f3e84334a7d37aed31372a3b02dd40
+
+ doc/source/configuration.rst       |  408 ++++++++++++++++++++++--------------
+ doc/source/man/keystone-manage.rst |    9 +-
+ 2 files changed, 260 insertions(+), 157 deletions(-)
+
+commit 5720730c2e55259f1894368e766256cded51a1df
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Mar 2 13:38:39 2012 -0600
+
+    Added license header (bug 929663)
+    
+    Change-Id: Ia36a22f2d6bba411e4fad81ea2d6fa1f0465a733
+
+ keystone/catalog/__init__.py                |   16 ++++++++++++++++
+ keystone/common/kvs.py                      |   14 ++++++++++++++
+ keystone/common/ldap/__init__.py            |   16 ++++++++++++++++
+ keystone/common/ldap/core.py                |   14 ++++++++++++++
+ keystone/common/logging.py                  |   14 ++++++++++++++
+ keystone/common/manager.py                  |   14 ++++++++++++++
+ keystone/common/serializer.py               |   16 ++++++++++++++++
+ keystone/common/sql/__init__.py             |   16 ++++++++++++++++
+ keystone/common/sql/core.py                 |   14 ++++++++++++++
+ keystone/common/sql/legacy.py               |   14 ++++++++++++++
+ keystone/common/sql/nova.py                 |   14 ++++++++++++++
+ keystone/common/sql/util.py                 |   14 ++++++++++++++
+ keystone/contrib/admin_crud/__init__.py     |   16 ++++++++++++++++
+ keystone/contrib/ec2/__init__.py            |   16 ++++++++++++++++
+ keystone/contrib/s3/__init__.py             |   16 ++++++++++++++++
+ keystone/identity/__init__.py               |   16 ++++++++++++++++
+ keystone/identity/backends/ldap/__init__.py |   16 ++++++++++++++++
+ keystone/identity/backends/ldap/core.py     |   14 ++++++++++++++
+ keystone/middleware/__init__.py             |   16 ++++++++++++++++
+ keystone/policy/__init__.py                 |   16 ++++++++++++++++
+ keystone/token/__init__.py                  |   16 ++++++++++++++++
+ run_tests.sh                                |   14 ++++++++++++++
+ setup.py                                    |    3 +--
+ tests/_ldap_livetest.py                     |   14 ++++++++++++++
+ tests/default_fixtures.py                   |   16 ++++++++++++++++
+ tests/test_backend_ldap.py                  |   14 ++++++++++++++
+ tests/test_content_types.py                 |   14 ++++++++++++++
+ tests/test_serializer.py                    |   14 ++++++++++++++
+ tools/sample_data.sh                        |   14 ++++++++++++++
+ 29 files changed, 419 insertions(+), 2 deletions(-)
+
+commit 48f2c7d4efb5e4691802fa5124523590b6321975
+Author: Dan Prince <[e-mail]>
+Date:   Fri Mar 9 12:54:06 2012 -0500
+
+    Add AUTHORS to the tarball.
+    
+    Fixes LP Bug #950998.
+    
+    Change-Id: Ia521a9d013ef4fb332df4dc5576cc3e5f13651bc
+
+ MANIFEST.in |    1 +
+ 1 file changed, 1 insertion(+)
+
+commit 2f4fb46159e8b73c8aba231ec2239b41bb53183c
+Author: Alan Pevec <[e-mail]>
+Date:   Wed Mar 7 21:31:37 2012 +0100
+
+    create service endpoints in sample data
+    
+    Enable creation of endpoints by setting ENABLE_ENDPOINTS environment
+    variable. Works with Catalog SQL backend.
+    
+    Change-Id: I9ba0ea1b3cf35720fb338e91f48fcbddc326971b
+
+ keystone/catalog/backends/sql.py |    8 +++++-
+ tools/sample_data.sh             |   51 +++++++++++++++++++++++++++++++++-----
+ 2 files changed, 52 insertions(+), 7 deletions(-)
+
+commit 303a10b9460c506455a74e890567031cf4c9cdef
+Author: Dean Troyer <[e-mail]>
+Date:   Fri Mar 9 00:03:46 2012 -0600
+
+    Fix EC2 credentials crud after policy backend change
+    
+    https://review.openstack.org/4659 implemented the common policy code
+    but made a change to the exception thrown by wsgi.Application.assert_admin()
+    and Ec2Controller._is_admin() needed updating.
+    
+    Fixes bug 950557
+    
+    Change-Id: I0e27aeeabd1be5a6012e34aa71efdfc2f2d5a726
+
+ keystone/contrib/ec2/core.py |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+commit 0a124fa6a114ba357f6aec9ba4da5eb503483a95
+Merge: a2f2274 524cbd5
+Author: Jenkins <[e-mail]>
+Date:   Thu Mar 8 22:29:04 2012 +0000
+
+    Merge "add more default catalog templates"
+
+commit a2f2274c69df2ca5b040a69173f3eb7eb030c561
+Author: termie <[e-mail]>
+Date:   Tue Feb 28 16:50:48 2012 -0800
+
+    port common policy code to keystone
+    
+    keystone.common.policy is copied from nova
+    
+    leave simple backend in as a shim until devstack stops referencing it
+    
+    Change-Id: Ibd579cfeb99465706d525b6565818a2d8f5f3b7c
+
+ etc/keystone.conf                  |    2 +-
+ etc/policy.json                    |    3 +
+ keystone/common/policy.py          |  207 ++++++++++++++++++++++++++++++++++++
+ keystone/common/utils.py           |   43 ++++++++
+ keystone/common/wsgi.py            |    7 +-
+ keystone/policy/backends/rules.py  |  104 ++++++++++++++++++
+ keystone/policy/backends/simple.py |   22 +---
+ keystone/policy/core.py            |   10 ++
+ keystone/test.py                   |   22 ++--
+ tests/policy.json                  |    3 +
+ tests/test_policy.py               |  180 +++++++++++++++++++++++++++++++
+ 11 files changed, 575 insertions(+), 28 deletions(-)
+
+commit e5254d48b133f3ec9798cc8eb48a03cb69ff2d97
+Merge: e422567 71aa1db
+Author: Jenkins <[e-mail]>
+Date:   Thu Mar 8 21:38:24 2012 +0000
+
+    Merge "fix Nova Volume Service in sample data"
+
+commit e4225671cf9c5f3bac5a0f061fa90ad73a6ee673
+Author: Michael Basnight <[e-mail]>
+Date:   Wed Mar 7 22:32:23 2012 -0600
+
+    rename belongs_to to belongsTo as per the API spec.
+    
+    fixes lp#949554
+    
+    Change-Id: Ia24dda7e9aa8e075861029dd5edeafd01c9d89c2
+
+ keystone/service.py         |    4 ++--
+ tests/test_content_types.py |    2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+commit 5231d3cc022d7a894e41f03a53eadd9ec4f16220
+Merge: 5c6bccf a7472f1
+Author: Jenkins <[e-mail]>
+Date:   Thu Mar 8 20:26:21 2012 +0000
+
+    Merge "HTTP_AUTHORIZATION was used in proxy mode"
+
+commit 94abc7ed3e8105cf80ad60558d01fc0839adc027
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Fri Mar 2 11:34:16 2012 +0000
+
+    Make sure we have a port number before int it.
+    
+    - Remove unused auth_location in s3_token along the way.
+    - Fixes bug 944720.
+    
+    Change-Id: Ib6e48511d09798868c5ca3fa00472525bc9f8823
+
+ keystone/middleware/auth_token.py |    3 +--
+ keystone/middleware/s3_token.py   |    9 +--------
+ 2 files changed, 2 insertions(+), 10 deletions(-)
+
+commit 5c6bccf1c57b06a19845c696c19274ae9f080104
+Author: Michael Basnight <[e-mail]>
+Date:   Wed Mar 7 22:32:23 2012 -0600
+
+    fixes lp#949648 change belongsTo validate to name
+    
+    Change-Id: I3d36290ad95a0440c006e2daff5b831be62957ae
+
+ keystone/service.py         |    2 +-
+ tests/test_content_types.py |    2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+commit 4e4f793e0becb19d77cf137587adb9944a15f5f8
+Merge: 161c658 5c7f3cf
+Author: Jenkins <[e-mail]>
+Date:   Thu Mar 8 04:00:28 2012 +0000
+
+    Merge "Set default identity driver to sql (bug 934332)"
+
+commit 161c6587af3908a1e6f23c398bc2221395e4466c
+Merge: 07985e4 989d62f
+Author: Jenkins <[e-mail]>
+Date:   Thu Mar 8 03:54:52 2012 +0000
+
+    Merge "Improve auth_str_equal()."
+
+commit 07985e4349dcead9f5487910020f5dec07351e5e
+Merge: d0429ea 98170a7
+Author: Jenkins <[e-mail]>
+Date:   Thu Mar 8 00:34:28 2012 +0000
+
+    Merge "fixes bug lp#948439 belongs_to and serviceCatalog behavior * removing belongs_to as a kwarg and getting from the context * adding a serviceCatalog for belongs_to calls to tokens * adding test to validate belongs_to behavior in tokens"
+
+commit a7472f139d7f1c4b40906e66302db720efdb19a7
+Author: Jesse Andrews <[e-mail]>
+Date:   Wed Mar 7 16:00:45 2012 -0800
+
+    HTTP_AUTHORIZATION was used in proxy mode
+    
+    Change-Id: I72eae79bd1991321eac224777fb186c5022f2c12
+
+ keystone/middleware/auth_token.py |    6 ------
+ 1 file changed, 6 deletions(-)
+
+commit 71aa1db60ff4f83599819f1d86aea411bfc9f4ae
+Author: Alan Pevec <[e-mail]>
+Date:   Wed Mar 7 13:52:36 2012 +0100
+
+    fix Nova Volume Service in sample data
+    
+    Change-Id: Ic6bb8ddea1ab894076d1580f5dbbe535aa668a8a
+
+ tools/sample_data.sh |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 98170a73dd28cebf9737c012d03554ffce5fd1f5
+Author: Michael Basnight <[e-mail]>
+Date:   Tue Mar 6 21:36:01 2012 -0600
+
+    fixes bug lp#948439 belongs_to and serviceCatalog behavior
+    * removing belongs_to as a kwarg and getting from the context
+    * adding a serviceCatalog for belongs_to calls to tokens
+    * adding test to validate belongs_to behavior in tokens
+    
+    Change-Id: If6f6a7007a6830c57a5ac71aef0090e57a064232
+
+ AUTHORS                     |    1 +
+ keystone/service.py         |   22 ++++++++++++++++++----
+ tests/test_content_types.py |   22 +++++++++++++++++++---
+ 3 files changed, 38 insertions(+), 7 deletions(-)
+
+commit d0429ea9b8849f99aa170cd09aef7776e2651dbf
+Author: Devin Carlen <[e-mail]>
+Date:   Sat Mar 3 14:01:46 2012 -0800
+
+    Make bind host configurable
+    
+    * fixes bug 945868
+    
+    Change-Id: Ib33dc9ad1878a9215c1a1ab10814fa7d0905cbdb
+
+ bin/keystone-all        |    6 ++++--
+ etc/keystone.conf       |    1 +
+ keystone/common/wsgi.py |   11 ++++++-----
+ keystone/config.py      |    1 +
+ 4 files changed, 12 insertions(+), 7 deletions(-)
+
+commit fe6414c8c1f769e6cc87fc001b6c52c5fea0f160
+Merge: 358ecca ec35ea8
+Author: Jenkins <[e-mail]>
+Date:   Wed Mar 7 18:11:04 2012 +0000
+
+    Merge "Fix coverage jobs for Jenkins."
+
+commit 358eccac110f0ae315382043386296f27a871a73
+Merge: b68051c fd4e961
+Author: Jenkins <[e-mail]>
+Date:   Wed Mar 7 18:05:42 2012 +0000
+
+    Merge "Isolating backtraces to DEBUG (bug 947060)"
+
+commit 524cbd58acd0c47664e164f72f25524cb95b09f0
+Author: Alan Pevec <[e-mail]>
+Date:   Tue Mar 6 21:46:52 2012 +0100
+
+    add more default catalog templates
+    
+    Image, Volume and Ec2 services were missing
+    
+    Change-Id: I409b0b587b0019dc97bf46760e8f732aa13b88de
+
+ etc/default_catalog.templates |   15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+commit ec35ea8b9e3b9ef3422ca8119e743de974099a68
+Author: Monty Taylor <[e-mail]>
+Date:   Tue Mar 6 22:11:38 2012 -0800
+
+    Fix coverage jobs for Jenkins.
+    
+    Change-Id: I9a97ac7b997f531d05d4a6beab7d6c16ced7016a
+
+ tox.ini |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+commit 989d62fe8f606cb4fecaaaf1395e1cd9c3d81d67
+Author: Russell Bryant <[e-mail]>
+Date:   Tue Mar 6 13:18:58 2012 -0500
+
+    Improve auth_str_equal().
+    
+    This patch is to improve auth_str_equal() a bit.  The whole point of
+    this function is to do a string comparison in constant time to help
+    protect against timing attacks.  The original implementation had a bit
+    of a silly property in that it would exit early if the strings were not
+    of the same length.  This would theoretically still allow someone to
+    discover the proper length of a password.
+    
+    This patch moves the length verification to the end.  It also makes it
+    so the main loop time to run is a function of the provided password
+    length instead of the length of the shorter of the two strings.
+    
+    Change-Id: I6dbe076818b7e3e8a313544ebd5c5734b5a025e5
+
+ keystone/common/utils.py     |   22 +++++++++++++---------
+ keystone/contrib/ec2/core.py |    4 ++--
+ tests/test_utils.py          |    1 +
+ 3 files changed, 16 insertions(+), 11 deletions(-)
+
+commit 5c7f3cff8d489fefbc34dadbefea6dc9604c4a4a
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Mar 2 11:26:29 2012 -0600
+
+    Set default identity driver to sql (bug 934332)
+    
+    Change-Id: Ibc5502f0feb2bcc9583ccd1aa9bf9bd94fef43ca
+
+ etc/keystone.conf         |    2 +-
+ tests/test_overrides.conf |    3 +++
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+commit b68051cd13cc71ebd15cd478afedf0c5d07ebd4e
+Author: Dolph Mathews <[e-mail]>
+Date:   Fri Mar 2 10:50:57 2012 -0600
+
+    Renamed sqlite files (bug 944951)
+    
+    Change-Id: Iae7aa34de0bf68da9e422719605753634cc0d113
+
+ etc/keystone.conf           |    2 +-
+ keystone/common/sql/util.py |    2 +-
+ tests/backend_sql.conf      |    2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+commit 6621c79b06fc2848072e59d22d1224ae3a0c593a
+Merge: a18b3f2 e8fb989
+Author: Jenkins <[e-mail]>
+Date:   Tue Mar 6 17:07:45 2012 +0000
+
+    Merge "Add reseller admin capability."
+
+commit fd4e9616ddca4dbd0c4f0545c376167b966eae8d
+Author: Dolph Mathews <[e-mail]>
+Date:   Mon Mar 5 16:47:58 2012 -0600
+
+    Isolating backtraces to DEBUG (bug 947060)
+    
+    Debug mode on: http://pastie.org/3529520
+      (full backtrace to stdout)
+    
+    Debug mode off: http://pastie.org/3529526
+      (Just an error message to stdout)
+    
+    Change-Id: I1d4e17cf73e7777c3cbaef7c5d7fd18a4f6e53dc
+
+ keystone/catalog/backends/templated.py |    8 +++++++-
+ keystone/common/logging.py             |   18 ++++++++++++++++++
+ keystone/service.py                    |    4 ++++
+ 3 files changed, 29 insertions(+), 1 deletion(-)
+
+commit a18b3f29c4a977977e6bf29d1edcba43d5e6005b
+Merge: f8d7bbd 460c3f3
+Author: Jenkins <[e-mail]>
+Date:   Mon Mar 5 20:45:05 2012 +0000
+
+    Merge "Remove trailing whitespaces in regular file"
+
+commit f8d7bbd45b3e4d4fb3a77a74b1bd54f196dacda0
+Merge: fad1a38 bc34635
+Author: Jenkins <[e-mail]>
+Date:   Mon Mar 5 20:39:47 2012 +0000
+
+    Merge "LDAP get_user_by_name"
+
+commit fad1a388f89681a0f487ad5bb1aba2a58ea14b47
+Author: Joe Heck <[e-mail]>
+Date:   Fri Mar 2 16:39:10 2012 -0800
+
+    updating readme to point to developer setup docs
+    * fixes bug 945274
+    
+    Change-Id: I6caf8da9fd0bd5647ae913efd752dd6651abcb85
+
+ README.rst |    7 +++++++
+ 1 file changed, 7 insertions(+)
+
+commit e8fb989b8b07f3209300ecba043bdf14c94d497f
+Author: Chmouel Boudjnah <[e-mail]>
+Date:   Mon Feb 13 23:29:49 2012 +0000
+
+    Add reseller admin capability.
+    
+    - A user with the reseller admin role will be able to access to every
+      other accounts.
+    - Rename name groups to roles.
+    
+    Change-Id: I8e86d8280a8fcdefbd4f9386bec11afdad797167
+
+ keystone/middleware/swift_auth.py |   45 ++++++++++++++++++++++++-------------
+ 1 file changed, 29 insertions(+), 16 deletions(-)
+
+commit 460c3f389185f352c36ccbe5e9f11579de334643
+Author: Hengqing Hu <[e-mail]>
+Date:   Sat Mar 3 13:10:06 2012 +0800
+
+    Remove trailing whitespaces in regular file
+    
+    Change-Id: I8d05fbb7a372bf9a813da9165cd40af71a1ae4c2
+
+ AUTHORS                            |    1 +
+ doc/source/index.rst               |    2 +-
+ doc/source/man/keystone-manage.rst |    2 +-