{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/62681239","id":62681239,"diff_hunk":"@@ -45,18 +50,74 @@ func (keystoneAuthenticator *KeystoneAuthenticator) AuthenticatePassword(usernam\n \t\tglog.Info(\"Failed: Starting openstack authenticate client\")\n \t\treturn nil, false, errors.New(\"Failed to authenticate\")\n \t}\n-\n+//FIXME user_id, not user_name...\n \treturn &user.DefaultInfo{Name: username}, true, nil\n }\n \n-// NewKeystoneAuthenticator returns a password authenticator that validates credentials using openstack keystone\n-func NewKeystoneAuthenticator(authURL string) (*KeystoneAuthenticator, error) {\n-\tif !strings.HasPrefix(authURL, \"https\") {\n-\t\treturn nil, errors.New(\"Auth URL should be secure and start with https\")\n+func (keystoneAuthenticator *KeystoneAuthenticator) AuthenticateToken(value string) (user.Info, bool, error) {\n+//FIXME kfox1111: To enhance performance, cache admin token/client.\n+\tcfg, provider, err := loadConfig(keystoneAuthenticator.configPath)\n+\tif err != nil {\n+\t\treturn nil, false, errors.New(\"Internal error getting the Keystone provider\")\n+\t}\n+\n+\tclient, err := openstack.NewIdentityAdminV3(provider, gophercloud.EndpointOpts{\n+\t\tRegion: cfg.Global.Region,\n+\t})\n+\tif err != nil {\n+\t\treturn nil, false, err\n+\t}\n+\tresponse, err := client.Request(\"GET\", client.ServiceURL(\"auth\", \"tokens\"), gophercloud.RequestOpts{\n+\t        MoreHeaders: map[string]string{\"X-Subject-Token\": value},\n+\t        OkCodes:     []int{200},\n+\t})\n+\tif err != nil {\n+\t\treturn nil, false, err\n+\t}\n+\tdefer response.Body.Close()\n+\tbodyBytes, err := ioutil.ReadAll(response.Body)\n+\tif err != nil {\n+\t\tglog.V(3).Infof(\"Cannot get HTTP response body from keystone token validate: %v\", err)\n+\t\treturn nil, false, err\n+\t}\n+\tobj := struct{ Token struct { User struct { Id string }}}{}\n+\terr = json.Unmarshal(bodyBytes, &obj)\n+\tif err != nil {\n+\t\treturn nil, false, err\n+\t}\n+\treturn &user.DefaultInfo{Name: obj.Token.User.Id}, response.StatusCode == 200, nil","path":"plugin/pkg/auth/authenticator/password/keystone/keystone.go","position":70,"original_position":70,"commit_id":"ec50493540af0ba5f41ffd129d815797f32b5d18","original_commit_id":"ec50493540af0ba5f41ffd129d815797f32b5d18","user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"body":"does this mean k8s authz policy would have to be written against keystone user uuids?","created_at":"2016-05-10T14:27:45Z","updated_at":"2016-05-10T14:27:45Z","html_url":"https://github.com/kubernetes/kubernetes/pull/25391#discussion_r62681239","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/25391","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/62681239"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/25391#discussion_r62681239"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/25391"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/25391","id":69440822,"html_url":"https://github.com/kubernetes/kubernetes/pull/25391","diff_url":"https://github.com/kubernetes/kubernetes/pull/25391.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/25391.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/25391","number":25391,"state":"open","locked":false,"title":"OpenStack Keystone Token Validation","user":{"login":"kfox1111","id":1513154,"avatar_url":"https://avatars.githubusercontent.com/u/1513154?v=3","gravatar_id":"","url":"https://api.github.com/users/kfox1111","html_url":"https://github.com/kfox1111","followers_url":"https://api.github.com/users/kfox1111/followers","following_url":"https://api.github.com/users/kfox1111/following{/other_user}","gists_url":"https://api.github.com/users/kfox1111/gists{/gist_id}","starred_url":"https://api.github.com/users/kfox1111/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kfox1111/subscriptions","organizations_url":"https://api.github.com/users/kfox1111/orgs","repos_url":"https://api.github.com/users/kfox1111/repos","events_url":"https://api.github.com/users/kfox1111/events{/privacy}","received_events_url":"https://api.github.com/users/kfox1111/received_events","type":"User","site_admin":false},"body":"This change modifies the api-server to support validation of\r\nOpenStack Keystone tokens, allowing many different types of\r\nKeystone supported authentication plugins to be used.","created_at":"2016-05-10T02:33:50Z","updated_at":"2016-05-10T14:27:45Z","closed_at":null,"merged_at":null,"merge_commit_sha":"e6ab61db0bc00923cdc79f2356f82f68e86774e3","assignee":{"login":"smarterclayton","id":1163175,"avatar_url":"https://avatars.githubusercontent.com/u/1163175?v=3","gravatar_id":"","url":"https://api.github.com/users/smarterclayton","html_url":"https://github.com/smarterclayton","followers_url":"https://api.github.com/users/smarterclayton/followers","following_url":"https://api.github.com/users/smarterclayton/following{/other_user}","gists_url":"https://api.github.com/users/smarterclayton/gists{/gist_id}","starred_url":"https://api.github.com/users/smarterclayton/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/smarterclayton/subscriptions","organizations_url":"https://api.github.com/users/smarterclayton/orgs","repos_url":"https://api.github.com/users/smarterclayton/repos","events_url":"https://api.github.com/users/smarterclayton/events{/privacy}","received_events_url":"https://api.github.com/users/smarterclayton/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/25391/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/25391/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/25391/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/ec50493540af0ba5f41ffd129d815797f32b5d18","head":{"label":"kfox1111:keystonetoken","ref":"keystonetoken","sha":"ec50493540af0ba5f41ffd129d815797f32b5d18","user":{"login":"kfox1111","id":1513154,"avatar_url":"https://avatars.githubusercontent.com/u/1513154?v=3","gravatar_id":"","url":"https://api.github.com/users/kfox1111","html_url":"https://github.com/kfox1111","followers_url":"https://api.github.com/users/kfox1111/followers","following_url":"https://api.github.com/users/kfox1111/following{/other_user}","gists_url":"https://api.github.com/users/kfox1111/gists{/gist_id}","starred_url":"https://api.github.com/users/kfox1111/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kfox1111/subscriptions","organizations_url":"https://api.github.com/users/kfox1111/orgs","repos_url":"https://api.github.com/users/kfox1111/repos","events_url":"https://api.github.com/users/kfox1111/events{/privacy}","received_events_url":"https://api.github.com/users/kfox1111/received_events","type":"User","site_admin":false},"repo":{"id":58422659,"name":"kubernetes","full_name":"kfox1111/kubernetes","owner":{"login":"kfox1111","id":1513154,"avatar_url":"https://avatars.githubusercontent.com/u/1513154?v=3","gravatar_id":"","url":"https://api.github.com/users/kfox1111","html_url":"https://github.com/kfox1111","followers_url":"https://api.github.com/users/kfox1111/followers","following_url":"https://api.github.com/users/kfox1111/following{/other_user}","gists_url":"https://api.github.com/users/kfox1111/gists{/gist_id}","starred_url":"https://api.github.com/users/kfox1111/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kfox1111/subscriptions","organizations_url":"https://api.github.com/users/kfox1111/orgs","repos_url":"https://api.github.com/users/kfox1111/repos","events_url":"https://api.github.com/users/kfox1111/events{/privacy}","received_events_url":"https://api.github.com/users/kfox1111/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/kfox1111/kubernetes","description":"Container Cluster Manager from Google","fork":true,"url":"https://api.github.com/repos/kfox1111/kubernetes","forks_url":"https://api.github.com/repos/kfox1111/kubernetes/forks","keys_url":"https://api.github.com/repos/kfox1111/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kfox1111/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kfox1111/kubernetes/teams","hooks_url":"https://api.github.com/repos/kfox1111/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kfox1111/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kfox1111/kubernetes/events","assignees_url":"https://api.github.com/repos/kfox1111/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kfox1111/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kfox1111/kubernetes/tags","blobs_url":"https://api.github.com/repos/kfox1111/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kfox1111/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kfox1111/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kfox1111/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kfox1111/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kfox1111/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kfox1111/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kfox1111/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kfox1111/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kfox1111/kubernetes/subscription","commits_url":"https://api.github.com/repos/kfox1111/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kfox1111/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kfox1111/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kfox1111/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kfox1111/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kfox1111/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kfox1111/kubernetes/merges","archive_url":"https://api.github.com/repos/kfox1111/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kfox1111/kubernetes/downloads","issues_url":"https://api.github.com/repos/kfox1111/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kfox1111/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kfox1111/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kfox1111/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kfox1111/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kfox1111/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/kfox1111/kubernetes/deployments","created_at":"2016-05-10T02:15:02Z","updated_at":"2016-05-10T02:15:16Z","pushed_at":"2016-05-10T14:07:19Z","git_url":"git://github.com/kfox1111/kubernetes.git","ssh_url":"git@github.com:kfox1111/kubernetes.git","clone_url":"https://github.com/kfox1111/kubernetes.git","svn_url":"https://github.com/kfox1111/kubernetes","homepage":"http://kubernetes.io","size":192111,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"dee24333ffe6942519476bb1db4c7d6eadf65cdb","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Container Cluster Manager from Google","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes/deployments","created_at":"2014-06-06T22:56:04Z","updated_at":"2016-05-10T14:12:27Z","pushed_at":"2016-05-10T14:15:12Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":391765,"stargazers_count":14294,"watchers_count":14294,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":4288,"mirror_url":null,"open_issues_count":3573,"forks":4288,"open_issues":3573,"watchers":14294,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/25391"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/25391"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/25391"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/25391/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/25391/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/25391/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/ec50493540af0ba5f41ffd129d815797f32b5d18"}}}}