From a8cca7e889a244b1bbdf90cce85fd6cb56b79a22 Mon Sep 17 00:00:00 2001
From: Jamie Lennox <jamielennox@redhat.com>
Date: Thu, 7 Aug 2014 13:40:05 +1000
Subject: [PATCH] Mark auth plugin options as secret

By marking the options as secret they don't get printed out in things
like the debug log when loading the application.

Change-Id: Iadab479a896bc4b1682ee8d207cc50a01dca8255
---
 keystoneclient/auth/identity/v2.py    | 4 ++--
 keystoneclient/auth/identity/v3.py    | 6 ++++--
 keystoneclient/auth/token_endpoint.py | 4 +++-
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/keystoneclient/auth/identity/v2.py b/keystoneclient/auth/identity/v2.py
index 72f6259ef..a8e7ac1d7 100644
--- a/keystoneclient/auth/identity/v2.py
+++ b/keystoneclient/auth/identity/v2.py
@@ -121,7 +121,7 @@ class Password(Auth):
                        dest='username',
                        deprecated_name='username',
                        help='Username to login with'),
-            cfg.StrOpt('password', help='Password to use'),
+            cfg.StrOpt('password', secret=True, help='Password to use'),
         ])
 
         return options
@@ -148,7 +148,7 @@ class Token(Auth):
         options = super(Token, cls).get_options()
 
         options.extend([
-            cfg.StrOpt('token', help='Token'),
+            cfg.StrOpt('token', secret=True, help='Token'),
         ])
 
         return options
diff --git a/keystoneclient/auth/identity/v3.py b/keystoneclient/auth/identity/v3.py
index b385ba627..cd4f9c58a 100644
--- a/keystoneclient/auth/identity/v3.py
+++ b/keystoneclient/auth/identity/v3.py
@@ -249,7 +249,7 @@ class Password(AuthConstructor):
                        deprecated_name='username'),
             cfg.StrOpt('user-domain-id', help="User's domain id"),
             cfg.StrOpt('user-domain-name', help="User's domain name"),
-            cfg.StrOpt('password', help="User's password"),
+            cfg.StrOpt('password', secret=True, help="User's password"),
         ])
 
         return options
@@ -282,7 +282,9 @@ class Token(AuthConstructor):
         options = super(Token, cls).get_options()
 
         options.extend([
-            cfg.StrOpt('token', help='Token to authenticate with'),
+            cfg.StrOpt('token',
+                       secret=True,
+                       help='Token to authenticate with'),
         ])
 
         return options
diff --git a/keystoneclient/auth/token_endpoint.py b/keystoneclient/auth/token_endpoint.py
index 9c22d441e..1f031d229 100644
--- a/keystoneclient/auth/token_endpoint.py
+++ b/keystoneclient/auth/token_endpoint.py
@@ -44,7 +44,9 @@ class Token(base.BaseAuthPlugin):
         options.extend([
             cfg.StrOpt('endpoint',
                        help='The endpoint that will always be used'),
-            cfg.StrOpt('token', help='The token that will always be used'),
+            cfg.StrOpt('token',
+                       secret=True,
+                       help='The token that will always be used'),
         ])
 
         return options