The part original code of keystone.common.validate_token_bind function is as follows
---
def validate_token_bind(context, token_ref):
...
bind = token_ref.bind
# permissive and strict modes don't require there to be a bind
permissive = bind_mode in ('permissive', 'strict')
# get the named mode if bind_mode is not one of the known
name = None if permissive or bind_mode == 'required' else bind_mode
if not bind:
if permissive:
# no bind provided and none required
return
else:
LOG.info(_LI("No bind information present in token"))
raise exception.Unauthorized()
...
---
If the bind is None, It is not necessary to execute the "name = None if permissive or bind_mode == 'required' else bind_mode".
So It had better to adjust the sequence about the above code.
The changed code is as follows:
---
def validate_token_bind(context, token_ref):
...
bind = token_ref.bind
# permissive and strict modes don't require there to be a bind
permissive = bind_mode in ('permissive', 'strict')
if not bind:
if permissive:
# no bind provided and none required
return
else:
LOG.info(_LI("No bind information present in token"))
raise exception.Unauthorized()
# get the named mode if bind_mode is not one of the known
name = None if permissive or bind_mode == 'required' else bind_mode
...
---
I've marked this as Low because there is no clear negative impact of the current code on end users (if there is some negative impact here, please describe it). If you're simply proposing a refactor, a bug report is unnecessary.