For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: Ib1edeafd48098284cb54e45a417421cb29c7bca6

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I63eb0cc9e086318169bf458275017845382d468b

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: Idaf58de99b11881a31f9f50761561b8cef7ab718

This is to add missing ws separator between words.

Change-Id: Icfe0c1f6893b5c54dfa0ef7fe15499b3b50079ed

The `openstack_auth login` view uses `request.build_absolute_uri` function
to build an origin uri when websso is enabled and
the WEBSSO_DEFAULT_REDIRECT_PROTOCOL is set.
This function doesn't insert the `WEBROOT` variable into uri what causes an
error:
    http://domain.name/auth/websso/ is not a trusted dashboard host
Using the `build_absolute_uri` from `utils` module fixes this problem. It
generates the right uri:
    http://domain.name/dashboard/auth/websso/

Change-Id: I94100f66a9f07eb8da75d344cbd120838fe25d1e

openstack_dashboard/dashboards/project/cgroups/workflows.py:313:8: R1702: Too many nested blocks (6/5) (too-many-nested-blocks)
openstack_auth/plugin/base.py:221:12: R1704: Redefining argument with the local name 'domain_name' (redefined-argument-from-local)
horizon/tables/formset.py:59:16: R1704: Redefining argument with the local name 'column' (redefined-argument-from-local)

Change-Id: Ifeb192efac83c0b2d5399c51f66c8fb8f8969fc0

openstack_dashboard/context_processors.py:94:15: C0122: Comparison should be link['url'] != 'horizon:project:api_access:openrcv2' (misplaced-comparison-constant)
openstack_dashboard/settings.py:467:4: C0412: Imports from package horizon are not grouped (ungrouped-imports)
openstack_dashboard/enabled/_1370_project_vg_snapshots.py:9:0: C0301: Line too long (86/80) (line-too-long)
openstack_dashboard/enabled/_1360_project_volume_groups.py:9:0: C0301: Line too long (85/80) (line-too-long)
openstack_dashboard/usage/base.py:62:8: W0106: Expression "[instance_list.extend(u.server_usages) for u in self.usage_list]" is assigned to nothing (expression-not-assigned)
openstack_dashboard/dashboards/project/images/utils.py:43:12: W0106: Expression "[public_images.append(image) for image in images]" is assigned to nothing (expression-not-assigned)
openstack_dashboard/dashboards/project/images/utils.py:75:12: W0106: Expression "[community_images.append(image) for image in images]" is assigned to nothing (expression-not-assigned)
openstack_dashboard/api/glance.py:47:4: C0412: Imports from package glanceclient are not grouped (ungrouped-imports)
openstack_dashboard/api/cinder.py:60:4: C0412: Imports from package cinderclient are not grouped (ungrouped-imports)
openstack_auth/user.py:358:4: E0211: Method has no argument (no-method-argument)
openstack_auth/user.py:362:4: E0211: Method has no argument (no-method-argument)
openstack_dashboard/api/keystone.py:75:4: C0412: Imports from package keystoneclient are not grouped (ungrouped-imports)
horizon/loaders.py:43:16: W0706: The except handler raises immediately (try-except-raise)
horizon/themes.py:174:8: W0706: The except handler raises immediately (try-except-raise)

Change-Id: I40cf3ffbc4519657e11180d2e2fe7401387c5556

Change-Id: Ie2e5c6482a19553f6c73c50555d65834bb62ca9e

Change-Id: I9af66f886c47d3d2be61cba22b6c84460a178b8e

openstack_dashboard/hooks.py:16:0: E0611: No name 'command' in module 'distutils' (no-name-in-module)

openstack_dashboard/dashboards/project/networks/ports/sg_base.py:52:12: E1111: Assigning result of a function call, where the function has no return (assignment-from-no-return)
BaseSecurityGroupsAction._get_initial_security_groups() is now marked
as abstract method because this method must be implemented in subclasses.
BaseSecurityGroupsAction.handle() is now dropped because there is
no difference from the parent class (horizon.workflows.Action).

openstack_auth/views.py:211:4: E1206: Not enough arguments for logging format string (logging-too-few-args)
openstack_auth/views.py:269:8: E1206: Not enough arguments for logging format string (logging-too-few-args)
openstack_auth/plugin/base.py:237:20: E1206: Not enough arguments for logging format string (logging-too-few-args)

horizon/base.py:166:24: E1133: Non-iterable value self.policy_rules is used in an iterating context (not-an-iterable)
horizon/tabs/base.py:489:40: E1133: Non-iterable value self.table_classes is used in an iterating context (not-an-iterable)

Change-Id: I0b045d04af251854b5017c9f698e3b40503a0724

openstack_dashboard/theme_settings.py:63:8: W1201: Specify string format arguments as logging function parameters (logging-not-lazy)
openstack_dashboard/settings.py:412:24: W0122: Use of exec (exec-used)
openstack_dashboard/dashboards/identity/domains/workflows.py:476:44: W0640: Cell variable group_id defined in loop (cell-var-from-loop)
openstack_dashboard/dashboards/identity/projects/workflows.py:906:49: W0640: Cell variable group_id defined in loop (cell-var-from-loop)
openstack_dashboard/dashboards/admin/networks/views.py:42:0: W0404: Reimport 'views' (imported line 28) (reimported)
openstack_dashboard/api/swift.py:204:0: W0102: Dangerous default value {} as argument (dangerous-default-value)
openstack_dashboard/api/swift.py:214:0: W0102: Dangerous default value {} as argument (dangerous-default-value)
openstack_dashboard/api/cinder.py:248:30: W0631: Using possibly undefined loop variable 'cinder_url' (undefined-loop-variable)
openstack_auth/backend.py:123:28: W0631: Using possibly undefined loop variable 'plugin' (undefined-loop-variable)
openstack_auth/backend.py:129:39: W0631: Using possibly undefined loop variable 'plugin' (undefined-loop-variable)
openstack_auth/backend.py:131:39: W0631: Using possibly undefined loop variable 'plugin' (undefined-loop-variable)
openstack_auth/views.py:39:0: W0611: Unused Login imported from openstack_auth.forms (unused-import)
horizon/exceptions.py:348:8: W0125: Using a conditional statement with a constant value (using-constant-test)
horizon/tables/base.py:353:12: W0715: Exception arguments suggest string formatting might be intended (raising-format-tuple)

Change-Id: Icf4f22abda77c9dbf98c780de876b7836c31d669

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I7f23fc512069d8e0c10804a4acd32bc91fddba62

enforcer for policy can be loaded from a single file or from multiple
files (policy_dir). so checking for policy_file is not good enough.

If a policy is loaded it will have some rules, if not loaded then,
oslo_policy rejects all acccess, but it is not saved to the
_ENFORCER object, which is holds the objects used for enforcing
policies. So checking for existance of rules is a better check.

Some refactoring for better logging
added tests: test_nonexisting_policy_file_load

Change-Id: Id1f65058014ef5b14449b502d6741da9d34767b3
Closes-Bug: 1804174

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I2aec9a9385ed9c63dda91ebd5bd58980cd741b65

Closes-Bug: #1806621

Change-Id: Ice5b56777967566770454bfbd6800bf3b8c57a37

PKI Tokens got removed from Keystone in 2016[1] so this check is no
longer needed.

OPENSTACK_TOKEN_HASH_ALGORITHM setting is dropped
as it is used only in PKI token check.

[1] https://review.openstack.org/#/c/374479/

Change-Id: I2de02fe6fab531842752b03c5e17af2bcf502cd8

for x in some_dict.keys() can be written as for x in some_dict

Change-Id: If5436647a30c02d0dab7daa23b2290456c66d654

Fix the following new errors:
* E305 expected 2 blank lines after class or function definition, found 1
* E126 continuation line over-indented for hanging indent

max_line_length is set to 80 as the default value in pycodestyle is 79
but horizon uses 80 as max_line_length.

Ignore W504 and F405 by configurations.
Reasons of disabling them are explained as comments in tox.ini.

Change-Id: Iee8bcd60c30883fc8c74f08cf20af853cbb5e271

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: Ic2c9268c7e2af73ed399d6a25925734cf1840295

The "request" attribute is not available in
openstack_auth.backend.KeystoneBackend.get_user when session data is restored
and it's the first request to happen after a server restart.

As stated by the function document, the "request" attribute needs to be
monkey-patched by openstack_auth.utils.patch_middleware_get_user
for this function to work properly.

This should happen in openstack_auth.urls at import time. But there is nowhere
in Horizon where this module is imported at startup. It's only introspected
by openstack_dashboard.urls due to AUTHENTICATION_URLS setting.

Without this monkey-patching, the whole authentication mechanism falls back
to "AnonymousUser" and you will get redirected to the login page due
to horizon.exceptions.NotAuthenticated being raised by
horizon.decorators.require_auth as request.user.is_authenticated will be False.

But if a user requests a page under auth/, it will have the side-effect of
monkey-patching django.contrib.auth.middleware as expected. This means that
once this request is completed, all following requests to pages other than
the ones under auth/ will have there sessions properly restored and
you will be properly authenticated.

Therefore this change introduces a dummy middleware which sole purpose is
to perform this monkey-patching as early as possible.

There is also some cleanup to get rid of the previous attempts at
monkeypatching.

Closes-bug: #1764622
Change-Id: Ib9912090a87b716e7f5710f6f360b0df168ec2e3

The redirect for WEBSSO takes its data directly from the request's
POST data, and the format of that data has changed, so now we need
to convert it for it to work correctly.

Change-Id: I5b18e555a9bc6b24be1e59465f07e73e99739e22
closes-bug: #1794710

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I202c08a2b391afa627b7600c1482a4483e44fc04

Add a new optional WEBSSO_KEYSTONE_URL property to facilitate WEBSSO
deployments where network segmentation is used per security requirement.
In this case, the controllers are not reachable from public network.
Therefore, user's browser will not be able to reach OPENSTACK_KEYSTONE_URL
if it is set to the internal endpoint.

If WEBSSO_KEYSTONE_URL is set, it will be used instead of
OPENSTACK_KEYSTONE_URL.

Change-Id: I05ea4227aa4c2cb0a73015ed7fd29cf1a96e696a
Closes-bug: #1544703

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I331c4f3f193608fd2edaba3c271e6ce04487658a

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I30c4ff7dbda78781c32b27e455b9d75c7f4ddac2

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I0dd9942e24328ce254095854aadc60f3b3aad55b

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: Ic9ca661b5bea5dc431c26231d9b9b0830c9d155c

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I25534c6ee169158059296a73c1dfba5b7ef10824

Instead of using endpoint URLs to designate regions in the login
form and its cookies, use numbers. This way, if internal URLs are
configured, they won't be exposed to the outside.

Change-Id: Ifed089e7cee3075bf2dc5d1ce77b0e1b1d091ca0
Closes-bug: #1787943

We no longer use port 35357 for keystone v3 API admin operation
and it is recommended to use port 5000.
This commit updates keystone catalog for keystone v3 API.
It also replace keystone v2 URL with v3 one.
Note that keystone v2 data is kept as-is.

Change-Id: Ia152d602b80ae418e0020b3ba30a11016a83da6a

In scenarios where the cloud operators have only a single Identity Provider,
we can have a default redirection to remove unnecessary user clicks and
improve user experience.

Closes-bug: #1784368

Change-Id: I251703dcaeac43174fbcba7e0658c6f92098b2e0

For more information about this automatic import see:
https://docs.openstack.org/i18n/latest/reviewing-translation-import.html

Change-Id: I0659c08f9ca463059fff764d05a523cae5886a23

The django form field default is "required=True", so this patch
remove the redundant "required=True" in the form.

Change-Id: I3d91ae0638b69d56c1f1b72913ee4995db249007

DEFAULT_SERVICE_REGIONS is cumbersome when you have
more than one keystone endpoint and all you want to do
is set a global default service region.

This adds '*' as an optional fallback key to mean global default.
If an endpoint matches it will take precedence over the '*' value.

This also fixes the precedence order for DEFAULT_SERVICE_REGIONS
so that a user controlled cookie is used instead when that cookie
is valid for the given catalog. This changes the way the setting
works, but retains the intended result the setting was originally
intended for.

Change-Id: Ieefbd642d853fcfcf22a17d9edcc7daae72790a4
blueprint: global-default-service-region
Closes-Bug: #1772345
Related-Bugs: #1359774 #1703390

Multi-line literal misses a space

Change-Id: I6c076c5e886f518f14e6bd756071b662484895a1

Horizon can support several auth mechanisms, i.e. Keystone creds and
OpenID. User allowed to choose proper way of auth and disclaimer is
shown. But it is possible to allow choose from the only variant, and in
this case disclaimer also shown, which is confusing. Proposed patch fix
disclaimer display and makes it reasonable

Closes-bug: #1774623
Change-Id: Ib039c6fdf1e4cd21b5ebe426fe2a15355a37353c

There was a typo in keystone's policy files, and it has been fixed in
Keystone already, we should also fix it to match.

Change-Id: I41e4381765f3bfc5988ca235e6cbeb6d1ba62fc2
Closes-bug: #1703369

W503 line break before binary operator

Looking at the code base, it sounds okay to follow this check.

Change-Id: Id511e0104dc6de5b204021661d4a8776ca6d3658

- HORIZON_IMAGES_ALLOW_UPLOAD (deprecated in Newton)
- CUSTOM_THEME_PATH (deprecated in Mitaka)
- DEFAULT_THEME_PATH (deprecated in Mitaka)
- OPENSTACK_TOKEN_HASH_ENABLED (deprecated in Mitaka)
- TOKEN_DELETION_DISABLED
  (not documented but it was marked as deprecated in Ocata
   in django-openstack-auth commit 5810f9c6)

The related logics related to dropped deprecated settings
have been dropped too.

- custom_path and default_path of get_available_themes() were
  dropped as they are no longer needed in favor of
  the removal of CUSTOM_THEME_PATH and DEFAULT_THEME_PATH.
- Unused remove_project_cache(), is_token_deletion_disabled()
  and delete_token() have been dropped.

Change-Id: Ic9406623cc092884c4136f78fb967b129bfda487

fix_auth_url_version is deprecated and not used anywhere. It's safe to
remove it.

Change-Id: Icb0745dcd98c28da5a33e564624bf11cb2570427