)]}'
{"specs/juno/vo_management.rst":[{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bc8e1990f938c4f6fd862f9ffe8651497f9e3d09","unresolved":false,"context_lines":[{"line_number":342,"context_line":"                \"user_id\": \"xyz@idp\","},{"line_number":343,"context_line":"                \"identity_p\": \"64ef2a\""},{"line_number":344,"context_line":"            }"},{"line_number":345,"context_line":"        ]"},{"line_number":346,"context_line":"    }"},{"line_number":347,"context_line":""},{"line_number":348,"context_line":"### Remove VO role from user: `DELETE /OS-FEDERATION/vo_roles/{vo_role_id}/members/{user-id}/identity_providers/{idp_id}`"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_8520ac4a","line":345,"updated":"2014-07-10 15:46:10.000000000","message":"missing links","commit_id":"af9d7ebc250b95fb4c51e1f4d6347cb99f615769"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bc8e1990f938c4f6fd862f9ffe8651497f9e3d09","unresolved":false,"context_lines":[{"line_number":384,"context_line":"                \"vo_role\": \"admin\","},{"line_number":385,"context_line":"                \"user_id\": \"efg@idp\""},{"line_number":386,"context_line":"            }"},{"line_number":387,"context_line":"        ]"},{"line_number":388,"context_line":"    }"},{"line_number":389,"context_line":""},{"line_number":390,"context_line":"### Approve VO role membership user request: `GET /OS-FEDERATION/vo_roles/{vo_role_id}/requests/{vo_request_id}`"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_85e7cc11","line":387,"updated":"2014-07-10 15:46:10.000000000","message":"missing links","commit_id":"af9d7ebc250b95fb4c51e1f4d6347cb99f615769"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bc8e1990f938c4f6fd862f9ffe8651497f9e3d09","unresolved":false,"context_lines":[{"line_number":422,"context_line":"                \"idp\": \"64ef2a\","},{"line_number":423,"context_line":"                \"vo_role\": \"66bb3e\""},{"line_number":424,"context_line":"            }"},{"line_number":425,"context_line":"        ]"},{"line_number":426,"context_line":"    }"},{"line_number":427,"context_line":""},{"line_number":428,"context_line":"### List blacklisted users for all VO roles: `GET /OS-FEDERATION/vo_blacklist`"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_c5f1c4ce","line":425,"updated":"2014-07-10 15:46:10.000000000","message":"missing links","commit_id":"af9d7ebc250b95fb4c51e1f4d6347cb99f615769"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bc8e1990f938c4f6fd862f9ffe8651497f9e3d09","unresolved":false,"context_lines":[{"line_number":443,"context_line":"                \"idp\": \"64ef2a\","},{"line_number":444,"context_line":"                \"vo_role\": \"7feab4\""},{"line_number":445,"context_line":"            }"},{"line_number":446,"context_line":"        ]"},{"line_number":447,"context_line":"    }"},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"### Delete blacklist entry: `DELETE /OS-FEDERATION/vo_roles/{vo_role_id}/blacklist/{vo_blacklist_id}`"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_e5ec08f6","line":446,"updated":"2014-07-10 15:46:10.000000000","message":"missing links","commit_id":"af9d7ebc250b95fb4c51e1f4d6347cb99f615769"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bc8e1990f938c4f6fd862f9ffe8651497f9e3d09","unresolved":false,"context_lines":[{"line_number":487,"context_line":"            \"status\": \"pending\","},{"line_number":488,"context_line":"            \"vo_name\": \"keystone-dev\","},{"line_number":489,"context_line":"            \"vo_role\": \"member\""},{"line_number":490,"context_line":"        }"},{"line_number":491,"context_line":"    }"},{"line_number":492,"context_line":""},{"line_number":493,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_25be00d5","line":490,"updated":"2014-07-10 15:46:10.000000000","message":"missing links","commit_id":"af9d7ebc250b95fb4c51e1f4d6347cb99f615769"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bc8e1990f938c4f6fd862f9ffe8651497f9e3d09","unresolved":false,"context_lines":[{"line_number":527,"context_line":"           \"secret\": \"1234\","},{"line_number":528,"context_line":"           \"vo_name\": \"keystone-dev\","},{"line_number":529,"context_line":"           \"vo_role\": \"member\""},{"line_number":530,"context_line":"        }"},{"line_number":531,"context_line":"    }"},{"line_number":532,"context_line":""},{"line_number":533,"context_line":"Response: ::"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_85ceec81","line":530,"updated":"2014-07-10 15:46:10.000000000","message":"missing links","commit_id":"af9d7ebc250b95fb4c51e1f4d6347cb99f615769"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4a9bfd2cd253ea239d606b5ef092aedb431dc649","unresolved":false,"context_lines":[{"line_number":35,"context_line":"privileges assigned to it."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"When working with a centralised (non-federated) system, the administrator"},{"line_number":38,"context_line":"is aware of the user ID assigned to each user and can simply use the in built"},{"line_number":39,"context_line":"groups API to manage access to the correct resources."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"However, in a federated system, it is likely that both users and administrators"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aa7fdbe_1ed8baee","line":38,"updated":"2014-10-20 14:29:17.000000000","message":"s/built/build/ ?","commit_id":"29a09f08f15ed2290c556cc4647fa78aa9c4d3c0"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"93b724a2953fdf9d2833047fecc02836b369997a","unresolved":false,"context_lines":[{"line_number":35,"context_line":"privileges assigned to it."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"When working with a centralised (non-federated) system, the administrator"},{"line_number":38,"context_line":"is aware of the user ID assigned to each user and can simply use the in built"},{"line_number":39,"context_line":"groups API to manage access to the correct resources."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"However, in a federated system, it is likely that both users and administrators"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_41ea800f","line":38,"in_reply_to":"9aa7fdbe_1ed8baee","updated":"2015-01-19 13:39:05.000000000","message":"in-built","commit_id":"29a09f08f15ed2290c556cc4647fa78aa9c4d3c0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4a9bfd2cd253ea239d606b5ef092aedb431dc649","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"We propose a new API should be added to facilitate this management. We call this"},{"line_number":51,"context_line":"API the \"VO Management API\". In the VO Management API there should be functions"},{"line_number":52,"context_line":"to allow administrators to create, list and delete VO roles. We define a VO role"},{"line_number":53,"context_line":"as a group protected by a secret (which could be a PIN or a password). This"},{"line_number":54,"context_line":"secret is required by users for joining and leaving the group."},{"line_number":55,"context_line":"This secret along with the VO name and VO role can then be issued to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aa7fdbe_79d00054","line":52,"updated":"2014-10-20 14:29:17.000000000","message":"How will these roles be enforced? Currently Keystone uses the policy enforcement from oslo. Is this going to use the same of a different enforcement mechanism?","commit_id":"29a09f08f15ed2290c556cc4647fa78aa9c4d3c0"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"122bb143f52cab1430b984e8da514b6c4facca42","unresolved":false,"context_lines":[{"line_number":49,"context_line":""},{"line_number":50,"context_line":"We propose a new API should be added to facilitate this management. We call this"},{"line_number":51,"context_line":"API the \"VO Management API\". In the VO Management API there should be functions"},{"line_number":52,"context_line":"to allow administrators to create, list and delete VO roles. We define a VO role"},{"line_number":53,"context_line":"as a group protected by a secret (which could be a PIN or a password). This"},{"line_number":54,"context_line":"secret is required by users for joining and leaving the group."},{"line_number":55,"context_line":"This secret along with the VO name and VO role can then be issued to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aa7fdbe_ed6329db","line":52,"in_reply_to":"9aa7fdbe_79d00054","updated":"2014-10-21 14:24:21.000000000","message":"VO roles are different from Keystone roles. So we have\nVO roles which are automatically turned into Keystone groups, and then the normal mechanism of assigning roles to groups is used, and the latter roles are enforced as normal.\n\nSo VO Roles are simply a way of grouping users together, when you dont know the ID of the user.","commit_id":"29a09f08f15ed2290c556cc4647fa78aa9c4d3c0"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d66318b2b0dc1b0fa0dd3c0d8b54c7f054765824","unresolved":false,"context_lines":[{"line_number":80,"context_line":"Additionally, users should be able to view details about the VO roles they have"},{"line_number":81,"context_line":"joined or requested to join."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"In order to prevent users from attempting brute force methods to join a VO, a"},{"line_number":84,"context_line":"blacklisting system should be added to block users after a configurable number"},{"line_number":85,"context_line":"of incorrect attempts have been made (i.e. the wrong secret has been presented)."},{"line_number":86,"context_line":"An administrator should be able to view and remove these blacklisted users"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_4751d4d7","line":83,"updated":"2015-01-19 13:14:44.000000000","message":"Doesn\u0027t this create an easy way to DOS a VO? Have you thought about other types of secrets like one-line, per-user passwords.","commit_id":"29a09f08f15ed2290c556cc4647fa78aa9c4d3c0"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"93b724a2953fdf9d2833047fecc02836b369997a","unresolved":false,"context_lines":[{"line_number":80,"context_line":"Additionally, users should be able to view details about the VO roles they have"},{"line_number":81,"context_line":"joined or requested to join."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"In order to prevent users from attempting brute force methods to join a VO, a"},{"line_number":84,"context_line":"blacklisting system should be added to block users after a configurable number"},{"line_number":85,"context_line":"of incorrect attempts have been made (i.e. the wrong secret has been presented)."},{"line_number":86,"context_line":"An administrator should be able to view and remove these blacklisted users"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_412d2045","line":83,"in_reply_to":"3a961159_4751d4d7","updated":"2015-01-19 13:39:05.000000000","message":"I dont think so, since after 3 or 4 wrong PW attempts the user is blacklisted for VO self management. After this, the user will still have to go via his IDP and be authenticated before he can perform any actions on Keystone (so bots wont be able to access the keystone URL as they wont have a valid IDP un/pw) and after authenticating they wont be authorised to do anything on VO management, since they will be blacklisted.\nHence this functionality is no more open to DDOS attacks than normal federated keystone.","commit_id":"29a09f08f15ed2290c556cc4647fa78aa9c4d3c0"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d66318b2b0dc1b0fa0dd3c0d8b54c7f054765824","unresolved":false,"context_lines":[{"line_number":86,"context_line":"An administrator should be able to view and remove these blacklisted users"},{"line_number":87,"context_line":"manually in order to unblock the users ability to join the VO role."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"When a VO role is deleted by the administrator, all the mapping rules comprising"},{"line_number":90,"context_line":"an IdP name and user ID will be automatically deleted, the assumption being that"},{"line_number":91,"context_line":"all these rules were automatically created through user self registration. The"},{"line_number":92,"context_line":"group will also be automatically deleted if no mapping rules remain for it. Any"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_4768f487","line":89,"updated":"2015-01-19 13:14:44.000000000","message":"Does this mean if I have already joined a cloud using the federated IdP I can\u0027t join a VO because my other data could be affected if the VO is deleted?\n\nShouldn\u0027t this just delete the rules created for a group instead of all rules for that user?","commit_id":"29a09f08f15ed2290c556cc4647fa78aa9c4d3c0"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"93b724a2953fdf9d2833047fecc02836b369997a","unresolved":false,"context_lines":[{"line_number":86,"context_line":"An administrator should be able to view and remove these blacklisted users"},{"line_number":87,"context_line":"manually in order to unblock the users ability to join the VO role."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"When a VO role is deleted by the administrator, all the mapping rules comprising"},{"line_number":90,"context_line":"an IdP name and user ID will be automatically deleted, the assumption being that"},{"line_number":91,"context_line":"all these rules were automatically created through user self registration. The"},{"line_number":92,"context_line":"group will also be automatically deleted if no mapping rules remain for it. Any"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_215c9480","line":89,"in_reply_to":"3a961159_4768f487","updated":"2015-01-19 13:39:05.000000000","message":"Yes correct. This was badly written. It should have said that all the mapping rules for for this VO role comprising an IdP name....etc.","commit_id":"29a09f08f15ed2290c556cc4647fa78aa9c4d3c0"}]}