)]}'
{"doc/source/setup/audit.rst":[{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"fc3fe9cdd94b94b25f709f38eeb79088c3dac4ce","unresolved":false,"context_lines":[{"line_number":47,"context_line":"   Audit middleware filter should be included after Keystone middleware’s keystone_authtoken"},{"line_number":48,"context_line":"   middleware in request pipeline. This is needed so that audit middleware can utilize"},{"line_number":49,"context_line":"   environment variables set by keystone_authtoken middleware."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"* Steps"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"1. Turn off any active instances of Barbican."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a7e1126_b9ccca6a","line":50,"updated":"2015-12-21 07:31:43.000000000","message":"Make sure you also include setting up the \"notification_driver\" in barbican.conf","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"de744804d5b3e59bb792c78c8fb0bc1d19c261d4","unresolved":false,"context_lines":[{"line_number":47,"context_line":"   Audit middleware filter should be included after Keystone middleware’s keystone_authtoken"},{"line_number":48,"context_line":"   middleware in request pipeline. This is needed so that audit middleware can utilize"},{"line_number":49,"context_line":"   environment variables set by keystone_authtoken middleware."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"* Steps"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"1. Turn off any active instances of Barbican."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a7e1126_e6528d34","line":50,"in_reply_to":"3a7e1126_b9ccca6a","updated":"2015-12-21 19:09:52.000000000","message":"Okay. Will add as one of step in next patch.","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"fc3fe9cdd94b94b25f709f38eeb79088c3dac4ce","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"3a7e1126_b2229f50","line":68,"updated":"2015-12-21 07:31:43.000000000","message":"Add a Section explaining what a notification looks like.","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"de744804d5b3e59bb792c78c8fb0bc1d19c261d4","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"3a7e1126_6111a703","line":68,"in_reply_to":"3a7e1126_b2229f50","updated":"2015-12-21 19:09:52.000000000","message":"I will see if I can add sample event and field mapping information.","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"}],"etc/barbican/api_audit_map.conf":[{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"fc3fe9cdd94b94b25f709f38eeb79088c3dac4ce","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[DEFAULT]"},{"line_number":2,"context_line":"# default target endpoint type"},{"line_number":3,"context_line":"# should match the endpoint type defined in service catalog"},{"line_number":4,"context_line":"target_endpoint_type \u003d key-manager"}],"source_content_type":"text/plain","patch_set":4,"id":"3a7e1126_f90fb236","line":1,"updated":"2015-12-21 07:31:43.000000000","message":"Im sure you can try putting this file here -\u003e https://github.com/openstack/pycadf/tree/0357568a41e34bb8b5dc3e78dcf72949cc1d4c23/etc/pycadf as well :)","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"de744804d5b3e59bb792c78c8fb0bc1d19c261d4","unresolved":false,"context_lines":[{"line_number":1,"context_line":"[DEFAULT]"},{"line_number":2,"context_line":"# default target endpoint type"},{"line_number":3,"context_line":"# should match the endpoint type defined in service catalog"},{"line_number":4,"context_line":"target_endpoint_type \u003d key-manager"}],"source_content_type":"text/plain","patch_set":4,"id":"3a7e1126_0124635b","line":1,"in_reply_to":"3a7e1126_f90fb236","updated":"2015-12-21 19:09:52.000000000","message":"That\u0027s the plan once there is final version of this change (likely be done when this change is merged)","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"fc3fe9cdd94b94b25f709f38eeb79088c3dac4ce","unresolved":false,"context_lines":[{"line_number":3,"context_line":"# should match the endpoint type defined in service catalog"},{"line_number":4,"context_line":"target_endpoint_type \u003d key-manager"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"# map urls ending with specific text to a unique action"},{"line_number":7,"context_line":"[custom_actions]"},{"line_number":8,"context_line":"secrets/get \u003d read/list"},{"line_number":9,"context_line":"acl/get \u003d read"}],"source_content_type":"text/plain","patch_set":4,"id":"3a7e1126_992a2e8f","line":6,"updated":"2015-12-21 07:31:43.000000000","message":"I\u0027m guessing this is a WIP. Add the rest of the items:\n\ncontainers/get \u003d list/read, quotas/get \u003d list/read, etc....","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"de744804d5b3e59bb792c78c8fb0bc1d19c261d4","unresolved":false,"context_lines":[{"line_number":3,"context_line":"# should match the endpoint type defined in service catalog"},{"line_number":4,"context_line":"target_endpoint_type \u003d key-manager"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"# map urls ending with specific text to a unique action"},{"line_number":7,"context_line":"[custom_actions]"},{"line_number":8,"context_line":"secrets/get \u003d read/list"},{"line_number":9,"context_line":"acl/get \u003d read"}],"source_content_type":"text/plain","patch_set":4,"id":"3a7e1126_e1003704","line":6,"in_reply_to":"3a7e1126_992a2e8f","updated":"2015-12-21 19:09:52.000000000","message":"These are used to derive action type information for cadf event.\n\nActually we don\u0027t need secrets/get, containers/get, quotas/get etc..as those are covered via path_keywords. I had them here to show them as sample around how to change them if you have to.\n\nhttps://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/audit.py#L187\n\nI will add some more comments to illustrate the point or may be just remove secrets/get ?\n\nacl/get is needed to reflect existing ACL information. From user perspective, there is single ACL defined and not a list (internally in barbican this maps to list of ACL per operation).","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"fc3fe9cdd94b94b25f709f38eeb79088c3dac4ce","unresolved":false,"context_lines":[{"line_number":9,"context_line":"acl/get \u003d read"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"# possible end path of api requests"},{"line_number":13,"context_line":"[path_keywords]"},{"line_number":14,"context_line":"#defaults \u003d None"},{"line_number":15,"context_line":"secrets\u003d"}],"source_content_type":"text/plain","patch_set":4,"id":"3a7e1126_b9604a02","line":12,"updated":"2015-12-21 07:31:43.000000000","message":"Set a default value for all of these.","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"de744804d5b3e59bb792c78c8fb0bc1d19c261d4","unresolved":false,"context_lines":[{"line_number":9,"context_line":"acl/get \u003d read"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"# possible end path of api requests"},{"line_number":13,"context_line":"[path_keywords]"},{"line_number":14,"context_line":"#defaults \u003d None"},{"line_number":15,"context_line":"secrets\u003d"}],"source_content_type":"text/plain","patch_set":4,"id":"3a7e1126_dcd5e0e4","line":12,"in_reply_to":"3a7e1126_b9604a02","updated":"2015-12-21 19:09:52.000000000","message":"Its used for getting typURI information. There is no default needed, just need to add them to include them as base resource names. \n\nhttps://github.com/openstack/keystonemiddleware/blob/master/keystonemiddleware/audit.py#L229","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"}],"etc/barbican/barbican-api-paste.ini":[{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"fc3fe9cdd94b94b25f709f38eeb79088c3dac4ce","unresolved":false,"context_lines":[{"line_number":2,"context_line":"use \u003d egg:Paste#urlmap"},{"line_number":3,"context_line":"/: barbican_version"},{"line_number":4,"context_line":"/v1: barbican_api"},{"line_number":5,"context_line":"#/v1: barbican-api-keystone-audit"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"# Use this pipeline for Barbican API - versions no authentication"},{"line_number":8,"context_line":"[pipeline:barbican_version]"}],"source_content_type":"text/x-properties","patch_set":4,"id":"3a7e1126_60747367","line":5,"updated":"2015-12-21 07:31:43.000000000","message":"Remove this.","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"de744804d5b3e59bb792c78c8fb0bc1d19c261d4","unresolved":false,"context_lines":[{"line_number":2,"context_line":"use \u003d egg:Paste#urlmap"},{"line_number":3,"context_line":"/: barbican_version"},{"line_number":4,"context_line":"/v1: barbican_api"},{"line_number":5,"context_line":"#/v1: barbican-api-keystone-audit"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"# Use this pipeline for Barbican API - versions no authentication"},{"line_number":8,"context_line":"[pipeline:barbican_version]"}],"source_content_type":"text/x-properties","patch_set":4,"id":"3a7e1126_3cfd046e","line":5,"in_reply_to":"3a7e1126_60747367","updated":"2015-12-21 19:09:52.000000000","message":"Okay. Will do in next patch","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"}],"etc/barbican/barbican.conf":[{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"fc3fe9cdd94b94b25f709f38eeb79088c3dac4ce","unresolved":false,"context_lines":[{"line_number":138,"context_line":"#   DO NOT USE THIS, due to \u0027# FIXME(markmc): support multiple hosts\u0027 in oslo/messaging/_drivers/amqpdriver.py"},{"line_number":139,"context_line":"# transport_url \u003d rabbit://guest@localhost:5672/"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"# oslo notification driver for sending audit events via audit middleware"},{"line_number":142,"context_line":"# when enabled in barbican paste ini file"},{"line_number":143,"context_line":"# notification_driver \u003d messagingv2"},{"line_number":144,"context_line":"notification_driver \u003d log"}],"source_content_type":"text/plain","patch_set":4,"id":"3a7e1126_a00c9bec","line":141,"updated":"2015-12-21 07:31:43.000000000","message":"Here it would be good to list the possible values. It would also be useful to specify that this can set it more than once.","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"de744804d5b3e59bb792c78c8fb0bc1d19c261d4","unresolved":false,"context_lines":[{"line_number":138,"context_line":"#   DO NOT USE THIS, due to \u0027# FIXME(markmc): support multiple hosts\u0027 in oslo/messaging/_drivers/amqpdriver.py"},{"line_number":139,"context_line":"# transport_url \u003d rabbit://guest@localhost:5672/"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"# oslo notification driver for sending audit events via audit middleware"},{"line_number":142,"context_line":"# when enabled in barbican paste ini file"},{"line_number":143,"context_line":"# notification_driver \u003d messagingv2"},{"line_number":144,"context_line":"notification_driver \u003d log"}],"source_content_type":"text/plain","patch_set":4,"id":"3a7e1126_bcfb3446","line":141,"in_reply_to":"3a7e1126_a00c9bec","updated":"2015-12-21 19:09:52.000000000","message":"I did list the two values, messagingv2 and log. Its multi str option so yes both values can be used (cannot see when someone wants to write to both log and queue ). This is more of oslo messaging related detail. Will update comment.","commit_id":"63cd1f07da4961177ce414ae824625f4f8f26d60"},{"author":{"_account_id":16046,"name":"Fernando Diaz","email":"diazjf@us.ibm.com","username":"diazjf"},"change_message_id":"1ccf1ae42c9c80ef897b5e2252a282ce8e9ecec7","unresolved":false,"context_lines":[{"line_number":139,"context_line":"# transport_url \u003d rabbit://guest@localhost:5672/"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"# oslo notification driver for sending audit events via audit middleware."},{"line_number":142,"context_line":"# Meaningful only when middleware is enabled in barbican paste ini file."},{"line_number":143,"context_line":"# This is oslo config MultiStrOpt so can be defined multiple times in case"},{"line_number":144,"context_line":"# there is need to route audit event to messaging as well as log."},{"line_number":145,"context_line":"# notification_driver \u003d messagingv2"}],"source_content_type":"text/plain","patch_set":5,"id":"fa69d971_8bd3945f","line":142,"updated":"2016-01-06 17:00:55.000000000","message":"Perfect!","commit_id":"f2173adf0b91c5af515686a874e72bd23171507e"},{"author":{"_account_id":9914,"name":"Ade Lee","email":"alee@redhat.com","username":"alee"},"change_message_id":"8d964468451e4be1fa0a4f43d36771f5f3765ade","unresolved":false,"context_lines":[{"line_number":143,"context_line":"# This is oslo config MultiStrOpt so can be defined multiple times in case"},{"line_number":144,"context_line":"# there is need to route audit event to messaging as well as log."},{"line_number":145,"context_line":"# notification_driver \u003d messagingv2"},{"line_number":146,"context_line":"# notification_driver \u003d log"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"# \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d OpenStack policy - oslo_policy \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":149,"context_line":""}],"source_content_type":"text/plain","patch_set":5,"id":"da6ed579_3b10264e","line":146,"updated":"2016-01-13 16:00:57.000000000","message":"Where do the audit messages log to when log is enabled?  Where does it get sent when messaging is enabled?  Are there other log directives that are required?\n\nNot suggesting that they be put here, but it might be good to document/have links to the relevant docs.","commit_id":"f2173adf0b91c5af515686a874e72bd23171507e"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"d54440d914e498ff6b807e61b4164cb65ec1ac4b","unresolved":false,"context_lines":[{"line_number":143,"context_line":"# This is oslo config MultiStrOpt so can be defined multiple times in case"},{"line_number":144,"context_line":"# there is need to route audit event to messaging as well as log."},{"line_number":145,"context_line":"# notification_driver \u003d messagingv2"},{"line_number":146,"context_line":"# notification_driver \u003d log"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"# \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d OpenStack policy - oslo_policy \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":149,"context_line":""}],"source_content_type":"text/plain","patch_set":5,"id":"ba63e191_25814990","line":146,"in_reply_to":"da6ed579_3b10264e","updated":"2016-01-18 20:23:44.000000000","message":"In case of logger, the logs go to file as defined in application logger configuration. If needed, they can be routed to different file to differentiate audit logs from service logs. That\u0027s a deployment choice/configuration.\n\nIn case of messagingv2, it will go to the message queue as a oslo notification.\n\nAdded docs have some of that information.","commit_id":"f2173adf0b91c5af515686a874e72bd23171507e"}]}