)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"623c4bb608751cc28e59fde36ff388be779e7d6a","unresolved":false,"context_lines":[{"line_number":7,"context_line":"X.509 SSL certificate authentication"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Spec for X.509 SSL certificate authentication."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: Iada45a46ef48e3f6d2ce6d52dd529dd0dadaea7f"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"3a961159_22b24896","line":10,"updated":"2015-01-14 23:19:50.000000000","message":"bp x509-ssl-client-cert-authn","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"821d3bff7f6948388b17fe4f42bd9a84376f1e81","unresolved":false,"context_lines":[{"line_number":9,"context_line":"Spec for tokenless authorization with X.509 SSL client certificate"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"SecurityImpact"},{"line_number":12,"context_line":"bp x509-ssl-client-cert-authn"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Iada45a46ef48e3f6d2ce6d52dd529dd0dadaea7f"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":16,"id":"1a930d6b_8381b291","line":12,"updated":"2015-01-21 17:49:32.000000000","message":"switch to keystone-tokenless-authz-with-x509-ssl-client-cert","commit_id":"50e6178b406f958fc9ae314fe0bfa3516fef2a21"}],"specs/juno/x509-ssl-client-cert-authn.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ffd21d727fb070fc316f93c408d101d26ee9db41","unresolved":false,"context_lines":[{"line_number":48,"context_line":"Alternatives"},{"line_number":49,"context_line":"------------"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Use the existing external auth plugin. However, this requres the user"},{"line_number":52,"context_line":"information to be conveyed in a single attribute (i.e. SSL_CLIENT_S_DN_CN)"},{"line_number":53,"context_line":"as Apache allows us to designate only one certificate attribute for username."},{"line_number":54,"context_line":"This attribute will be populated as the REMOTE_USER. For example::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1abeadc6_17ba58de","line":51,"updated":"2014-08-18 14:23:43.000000000","message":"requires*","commit_id":"44cf3187a42816d5b367978b11279ce63a8608db"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"07a75064dff341aef7cc73e761d31e0de1ae7053","unresolved":false,"context_lines":[{"line_number":48,"context_line":"Alternatives"},{"line_number":49,"context_line":"------------"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Use the existing external auth plugin. However, this requres the user"},{"line_number":52,"context_line":"information to be conveyed in a single attribute (i.e. SSL_CLIENT_S_DN_CN)"},{"line_number":53,"context_line":"as Apache allows us to designate only one certificate attribute for username."},{"line_number":54,"context_line":"This attribute will be populated as the REMOTE_USER. For example::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1abeadc6_f64f67bc","line":51,"in_reply_to":"1abeadc6_17ba58de","updated":"2014-08-19 15:55:09.000000000","message":"good catch!","commit_id":"44cf3187a42816d5b367978b11279ce63a8608db"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ffd21d727fb070fc316f93c408d101d26ee9db41","unresolved":false,"context_lines":[{"line_number":60,"context_line":"encoded into a single string. i.e. username@domain. This could be problemic"},{"line_number":61,"context_line":"if username also contains the special ``@`` character. With the proposed new"},{"line_number":62,"context_line":"auth plugin, username and domain name can be unambiguously conveyed in two"},{"line_number":63,"context_line":"separate attributes."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Data Model Impact"},{"line_number":66,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1abeadc6_179fb853","line":63,"updated":"2014-08-18 14:23:43.000000000","message":"is conveying the username and domain name in separate attributes required, or can it be done in a single string as well?","commit_id":"44cf3187a42816d5b367978b11279ce63a8608db"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"07a75064dff341aef7cc73e761d31e0de1ae7053","unresolved":false,"context_lines":[{"line_number":60,"context_line":"encoded into a single string. i.e. username@domain. This could be problemic"},{"line_number":61,"context_line":"if username also contains the special ``@`` character. With the proposed new"},{"line_number":62,"context_line":"auth plugin, username and domain name can be unambiguously conveyed in two"},{"line_number":63,"context_line":"separate attributes."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Data Model Impact"},{"line_number":66,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1abeadc6_1935f4d9","line":63,"in_reply_to":"1abeadc6_179fb853","updated":"2014-08-19 15:55:09.000000000","message":"Yes. In fact, requiring username and domain name to be conveyed in separate attributes eliminates ambiguity. For example, say we support username and domain name in a single attribute and we come across something like this.\n\n user@thing1@thing2@thing3\n\nWe can\u0027t tell whether domain name is thing1@thing2@thing3 or thing2@thing3 or simply thing3.","commit_id":"44cf3187a42816d5b367978b11279ce63a8608db"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"ff00f4dc8540edea11ca79fac9569778bf2b0918","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp x509-ssl-client-cert-authn \u003chttps://blueprints.launchpad.net/keystone/+spec/x509-ssl-client-cert-authn\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Support X.509 client SSL certificate authentication to facilitate non-bearer"},{"line_number":14,"context_line":"tokens and simplify deployment."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"See `X.509 \u003chttp://en.wikipedia.org/wiki/X.509\u003e`_ for more information on X.509"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_a4bb740d","line":13,"updated":"2014-12-03 20:48:46.000000000","message":"So cool!  Great to see this as a option! Heard users request this as an option more than once!","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"ff00f4dc8540edea11ca79fac9569778bf2b0918","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"1. A two-way SSL session is successfully established between the client"},{"line_number":29,"context_line":"   and Keystone."},{"line_number":30,"context_line":"2. The attributes from the client certificate subject DN map to an existing"},{"line_number":31,"context_line":"   Keystone user."},{"line_number":32,"context_line":"3. The Keystone user account is enabled."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_a400d4ab","line":30,"updated":"2014-12-03 20:48:46.000000000","message":"Nice!!!","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"ff00f4dc8540edea11ca79fac9569778bf2b0918","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The benefits of X.509 certificate based authentication include the following:"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"* Security - couple with token binding, this should give us non-bearer tokens."},{"line_number":37,"context_line":"* Simplicity - no need for password. The same certificate can be used for both"},{"line_number":38,"context_line":"  authentication and secured communication."},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_af526ddb","line":36,"updated":"2014-12-03 20:48:46.000000000","message":"Can you please provide a more detailed explanation on how this can be combined with token binding to enable non-bearer tokens.","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7e2a873195ddaea96ee32a30d9c0cef2f6696b65","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The benefits of X.509 certificate based authentication include the following:"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"* Security - couple with token binding, this should give us non-bearer tokens."},{"line_number":37,"context_line":"* Simplicity - no need for password. The same certificate can be used for both"},{"line_number":38,"context_line":"  authentication and secured communication."},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_eb5e5fe8","line":36,"updated":"2014-12-02 20:15:00.000000000","message":"coupled*?","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b8d05ac80d93e2f8af6ced023bc17de3f014e1e1","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The benefits of X.509 certificate based authentication include the following:"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"* Security - couple with token binding, this should give us non-bearer tokens."},{"line_number":37,"context_line":"* Simplicity - no need for password. The same certificate can be used for both"},{"line_number":38,"context_line":"  authentication and secured communication."},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_ad824bfc","line":36,"in_reply_to":"5a890539_af526ddb","updated":"2014-12-04 18:44:53.000000000","message":"Sure, we have an option for binding a token to the subject DN of a client cert. But I\u0027ll add the example here.","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"ff00f4dc8540edea11ca79fac9569778bf2b0918","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"No API impact. However, we will be introducing a new authentication method"},{"line_number":74,"context_line":"``x509``. The payload for this method shall be empty as the attributes are"},{"line_number":75,"context_line":"conveyed in the request environment. We just need this to trigger the plugin."},{"line_number":76,"context_line":"For example::"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"    POST /v3/auth/tokens"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_64f98c7f","line":75,"updated":"2014-12-03 20:48:46.000000000","message":"To help make this more clear,  can describe a little more how the payload is conveyed in the request environment. For example, is it stored in certain request header values?  Perhaps make this more clear by repeating what you had below --\u003e convey X.509 client \tSSL certificate attributes in the request environment","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b8d05ac80d93e2f8af6ced023bc17de3f014e1e1","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"No API impact. However, we will be introducing a new authentication method"},{"line_number":74,"context_line":"``x509``. The payload for this method shall be empty as the attributes are"},{"line_number":75,"context_line":"conveyed in the request environment. We just need this to trigger the plugin."},{"line_number":76,"context_line":"For example::"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"    POST /v3/auth/tokens"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_2da57b9e","line":75,"in_reply_to":"5a890539_64f98c7f","updated":"2014-12-04 18:44:53.000000000","message":"Sure. As Heneef alluded to in his comments, we may have an option to do away with the payload.","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"08fa378d76206283dfa8c9fb7ee038644c060601","unresolved":false,"context_lines":[{"line_number":74,"context_line":"``x509``. The payload for this method shall be empty as the attributes are"},{"line_number":75,"context_line":"conveyed in the request environment. We just need this to trigger the plugin."},{"line_number":76,"context_line":"For example::"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"    POST /v3/auth/tokens"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    {\"auth\": {"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baa201ad_35037243","line":77,"updated":"2014-10-15 01:02:15.000000000","message":"This looks odd.  Why do I need to send request body, If I\u0027m authenticating with client cert?","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b8d05ac80d93e2f8af6ced023bc17de3f014e1e1","unresolved":false,"context_lines":[{"line_number":74,"context_line":"``x509``. The payload for this method shall be empty as the attributes are"},{"line_number":75,"context_line":"conveyed in the request environment. We just need this to trigger the plugin."},{"line_number":76,"context_line":"For example::"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"    POST /v3/auth/tokens"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    {\"auth\": {"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_cdca374e","line":77,"in_reply_to":"5a890539_6b26ef17","updated":"2014-12-04 18:44:53.000000000","message":"Sure. I\u0027ll expend on the options.","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7e2a873195ddaea96ee32a30d9c0cef2f6696b65","unresolved":false,"context_lines":[{"line_number":74,"context_line":"``x509``. The payload for this method shall be empty as the attributes are"},{"line_number":75,"context_line":"conveyed in the request environment. We just need this to trigger the plugin."},{"line_number":76,"context_line":"For example::"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"    POST /v3/auth/tokens"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    {\"auth\": {"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_6b26ef17","line":77,"in_reply_to":"baa201ad_1fb6563e","updated":"2014-12-02 20:15:00.000000000","message":"I think ^ that detail would be nice to include here too. By default, should the user/client have to send anything in the request or can it all be handled by middleware?","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"1bda15115f83d563174e7e9c9432dec5d5abcd6b","unresolved":false,"context_lines":[{"line_number":74,"context_line":"``x509``. The payload for this method shall be empty as the attributes are"},{"line_number":75,"context_line":"conveyed in the request environment. We just need this to trigger the plugin."},{"line_number":76,"context_line":"For example::"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"    POST /v3/auth/tokens"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    {\"auth\": {"}],"source_content_type":"text/x-rst","patch_set":6,"id":"baa201ad_1fb6563e","line":77,"in_reply_to":"baa201ad_35037243","updated":"2014-10-16 15:45:57.000000000","message":"This is for triggering the auth plugin at the backend. Clients does not need to necessarily send this. Translation can be done by middleware, just like federation.","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7e2a873195ddaea96ee32a30d9c0cef2f6696b65","unresolved":false,"context_lines":[{"line_number":90,"context_line":"Security Impact"},{"line_number":91,"context_line":"---------------"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"This may give us non-bear token capability by binding the token to the X.509"},{"line_number":94,"context_line":"client SSL certificate fingerprint."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_ab737714","line":93,"updated":"2014-12-02 20:15:00.000000000","message":"non-bearer*","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b8d05ac80d93e2f8af6ced023bc17de3f014e1e1","unresolved":false,"context_lines":[{"line_number":90,"context_line":"Security Impact"},{"line_number":91,"context_line":"---------------"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"This may give us non-bear token capability by binding the token to the X.509"},{"line_number":94,"context_line":"client SSL certificate fingerprint."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_2dbc9bb4","line":93,"in_reply_to":"5a890539_ab737714","updated":"2014-12-04 18:44:53.000000000","message":"ha, good catch!","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7e2a873195ddaea96ee32a30d9c0cef2f6696b65","unresolved":false,"context_lines":[{"line_number":188,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Update the Keystone v3 token auth API with the new `x509` method."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"References"},{"line_number":193,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":194,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_8bff9b33","line":191,"updated":"2014-12-02 20:15:00.000000000","message":"Additional documentation for setting up clients with x509 certs?","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"b8d05ac80d93e2f8af6ced023bc17de3f014e1e1","unresolved":false,"context_lines":[{"line_number":188,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Update the Keystone v3 token auth API with the new `x509` method."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"References"},{"line_number":193,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":194,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_edf3739c","line":191,"in_reply_to":"5a890539_8bff9b33","updated":"2014-12-04 18:44:53.000000000","message":"That\u0027s deployment-specific I think. Probably a combination of chef/puppet/certmonger/some other tool.","commit_id":"b1645e806a9d78367f5dac3f9347bec9752705f8"}],"specs/juno/x509_ssl_client_cert_authn.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"2937a95e56c4d070d2026e516d1ad61756866f19","unresolved":false,"context_lines":[{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"X.509 SSL Client Certificate Authentication"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"For the same reasons to support Kerberos based (external) authentication, we"},{"line_number":12,"context_line":"also need to support X.509 SSL client certificate authentication. Like"},{"line_number":13,"context_line":"Kerberos, it is also an authentication plugin which utilizes the external"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_7f02473f","line":10,"updated":"2014-07-10 15:15:31.000000000","message":"we\u0027re not automating the creation of blueprints yet - can you create one with the same id as this spec file?","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a1d706e5aba63335cd4b7df57f80eba0a7628e3e","unresolved":false,"context_lines":[{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"X.509 SSL Client Certificate Authentication"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"For the same reasons to support Kerberos based (external) authentication, we"},{"line_number":12,"context_line":"also need to support X.509 SSL client certificate authentication. Like"},{"line_number":13,"context_line":"Kerberos, it is also an authentication plugin which utilizes the external"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_4158dd89","line":10,"in_reply_to":"baada198_7f02473f","updated":"2014-07-21 19:07:32.000000000","message":"done","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"46e198420f981c045d8a855a831e5990059d65e3","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"For the same reasons to support Kerberos based (external) authentication, we"},{"line_number":12,"context_line":"also need to support X.509 SSL client certificate authentication. Like"},{"line_number":13,"context_line":"Kerberos, it is also an authentication plugin which utilizes the external"},{"line_number":14,"context_line":"authentication framework. "},{"line_number":15,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_0e972d3b","line":12,"updated":"2014-07-11 16:16:13.000000000","message":"would be helpful to provide some background information that the role of the X.509 certificate is to associate a public key with the identity contained in the X.509 certificate.  Also good to mention that this type of certificate must be signed by a certification authority (CA) to prevent impersonation","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a1d706e5aba63335cd4b7df57f80eba0a7628e3e","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"For the same reasons to support Kerberos based (external) authentication, we"},{"line_number":12,"context_line":"also need to support X.509 SSL client certificate authentication. Like"},{"line_number":13,"context_line":"Kerberos, it is also an authentication plugin which utilizes the external"},{"line_number":14,"context_line":"authentication framework. "},{"line_number":15,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_c17eadae","line":12,"in_reply_to":"baada198_0e972d3b","updated":"2014-07-21 19:07:32.000000000","message":"I think its a good idea. But probably would take more than a couple of paragraphs to sufficiently explain what they are and how they are being utilized. Perhaps I can add a link here, or maybe in the reference section?","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5e98c30ca60c2c43711e5d55b6cdf28c21b97d61","unresolved":false,"context_lines":[{"line_number":11,"context_line":"For the same reasons to support Kerberos based (external) authentication, we"},{"line_number":12,"context_line":"also need to support X.509 SSL client certificate authentication. Like"},{"line_number":13,"context_line":"Kerberos, it is also an authentication plugin which utilizes the external"},{"line_number":14,"context_line":"authentication framework. "},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_5571fe42","line":14,"updated":"2014-07-09 23:28:23.000000000","message":"I think those questions are to help author write the spec, and don\u0027t necesarilly need to be included.","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a1d706e5aba63335cd4b7df57f80eba0a7628e3e","unresolved":false,"context_lines":[{"line_number":11,"context_line":"For the same reasons to support Kerberos based (external) authentication, we"},{"line_number":12,"context_line":"also need to support X.509 SSL client certificate authentication. Like"},{"line_number":13,"context_line":"Kerberos, it is also an authentication plugin which utilizes the external"},{"line_number":14,"context_line":"authentication framework. "},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_c155cd1e","line":14,"in_reply_to":"baada198_5571fe42","updated":"2014-07-21 19:07:32.000000000","message":"You mean the questions at the later sections?","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5e98c30ca60c2c43711e5d55b6cdf28c21b97d61","unresolved":false,"context_lines":[{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"In a typical enterprise deployment, X.509 certificate based authentication is "},{"line_number":20,"context_line":"prevalent, especially for the non-interactive service accounts such as nova,"},{"line_number":21,"context_line":"swift, etc. However, X.509 certificate based authentication is not limited to"},{"line_number":22,"context_line":"the service identities. It can be any identity. An X.509 certificate based"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_75ba82e2","line":19,"updated":"2014-07-09 23:28:23.000000000","message":"whitespace","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"46e198420f981c045d8a855a831e5990059d65e3","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"The benefits of X.509 certificate based authentication include the following:"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"* Security - couple with token binding, this should give us non-bearer tokens."},{"line_number":34,"context_line":"* Simplicity - no need for password. The same certificate can be used for both"},{"line_number":35,"context_line":"  authentication and secured communication."},{"line_number":36,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_eee3d9d6","line":33,"updated":"2014-07-11 16:16:13.000000000","message":"excellent. But what is the token being bound to?  the certificate?","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a1d706e5aba63335cd4b7df57f80eba0a7628e3e","unresolved":false,"context_lines":[{"line_number":30,"context_line":""},{"line_number":31,"context_line":"The benefits of X.509 certificate based authentication include the following:"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"* Security - couple with token binding, this should give us non-bearer tokens."},{"line_number":34,"context_line":"* Simplicity - no need for password. The same certificate can be used for both"},{"line_number":35,"context_line":"  authentication and secured communication."},{"line_number":36,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_1c300a55","line":33,"in_reply_to":"baada198_eee3d9d6","updated":"2014-07-21 19:07:32.000000000","message":"Yes. It binds to the certificate\u0027s subject DN. We probably will need to make additional enhancement to the binding code to make that happen though.","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"46e198420f981c045d8a855a831e5990059d65e3","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"* Security - couple with token binding, this should give us non-bearer tokens."},{"line_number":34,"context_line":"* Simplicity - no need for password. The same certificate can be used for both"},{"line_number":35,"context_line":"  authentication and secured communication."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Proposed Change"},{"line_number":38,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_8ed89d1f","line":35,"updated":"2014-07-11 16:16:13.000000000","message":"excellent. very cool!!!","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5e98c30ca60c2c43711e5d55b6cdf28c21b97d61","unresolved":false,"context_lines":[{"line_number":90,"context_line":"Security Impact"},{"line_number":91,"context_line":"---------------"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"  As mentioned above, couple with token binding, this will give us non-bearer"},{"line_number":96,"context_line":"  tokens. Public Key Infrastructure (PKI) operations (i.e. X.509 SSL"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_75a1a2a8","line":93,"updated":"2014-07-09 23:28:23.000000000","message":"I think those questions are to help author write the spec, and don\u0027t necesarilly need to be included.","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"a1d706e5aba63335cd4b7df57f80eba0a7628e3e","unresolved":false,"context_lines":[{"line_number":90,"context_line":"Security Impact"},{"line_number":91,"context_line":"---------------"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"  As mentioned above, couple with token binding, this will give us non-bearer"},{"line_number":96,"context_line":"  tokens. Public Key Infrastructure (PKI) operations (i.e. X.509 SSL"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_1cde436d","line":93,"in_reply_to":"baada198_75a1a2a8","updated":"2014-07-21 19:07:32.000000000","message":"Sounds good. Let me rewrite this to make it more humanly readable.","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5e98c30ca60c2c43711e5d55b6cdf28c21b97d61","unresolved":false,"context_lines":[{"line_number":97,"context_line":"  certificate provisioning and management) are outside the scope of this spec."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":100,"context_line":"  a new way to access sensitive information or a new way to login?"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"  Yes. We are using X.509 SSL client certificate for both authentication and"},{"line_number":103,"context_line":"  secured communication."}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_d5aeee97","line":100,"updated":"2014-07-09 23:28:23.000000000","message":"I think those questions are to help author write the spec, and don\u0027t necesarilly need to be included.","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5e98c30ca60c2c43711e5d55b6cdf28c21b97d61","unresolved":false,"context_lines":[{"line_number":102,"context_line":"  Yes. We are using X.509 SSL client certificate for both authentication and"},{"line_number":103,"context_line":"  secured communication."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"  No. SSL session handling is being handled by Apache mod_ssl. The auth plugin"},{"line_number":108,"context_line":"  merely make use of the SSL request environment."}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_f594d245","line":105,"updated":"2014-07-09 23:28:23.000000000","message":"I think those questions are to help author write the spec, and don\u0027t necesarilly need to be included.","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5e98c30ca60c2c43711e5d55b6cdf28c21b97d61","unresolved":false,"context_lines":[{"line_number":107,"context_line":"  No. SSL session handling is being handled by Apache mod_ssl. The auth plugin"},{"line_number":108,"context_line":"  merely make use of the SSL request environment."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"  No."},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_1590664d","line":110,"updated":"2014-07-09 23:28:23.000000000","message":"I think those questions are to help author write the spec, and don\u0027t necesarilly need to be included.","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5e98c30ca60c2c43711e5d55b6cdf28c21b97d61","unresolved":false,"context_lines":[{"line_number":111,"context_line":""},{"line_number":112,"context_line":"  No."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":115,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  Yes. We are relying on the certificate attributes conveyed by Apache mod_ssl."}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_958b961d","line":114,"updated":"2014-07-09 23:28:23.000000000","message":"I think those questions are to help author write the spec, and don\u0027t necesarilly need to be included.","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5e98c30ca60c2c43711e5d55b6cdf28c21b97d61","unresolved":false,"context_lines":[{"line_number":117,"context_line":"  Yes. We are relying on the certificate attributes conveyed by Apache mod_ssl."},{"line_number":118,"context_line":"  We mapping them to an existing Keystone identity."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"* Can this change enable a resource exhaustion attack, such as allowing a"},{"line_number":121,"context_line":"  single API interaction to consume significant server resources? Some examples"},{"line_number":122,"context_line":"  of this include launching subprocesses for each connection, or entity"},{"line_number":123,"context_line":"  expansion attacks in XML."}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_f57bf226","line":120,"updated":"2014-07-09 23:28:23.000000000","message":"I think those questions are to help author write the spec, and don\u0027t necesarilly need to be included.","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5e98c30ca60c2c43711e5d55b6cdf28c21b97d61","unresolved":false,"context_lines":[{"line_number":136,"context_line":"management is outside the scope of this spec."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"* Does this change have an impact on python-keystoneclient? What does the user"},{"line_number":139,"context_line":"  interface there look like?"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"  Yes. There will be a X.509 SSL certificate auth plugin for"},{"line_number":142,"context_line":"  python-keystoneclient. This plugin should be able to make use of the existing"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_55c3be56","line":139,"updated":"2014-07-09 23:28:23.000000000","message":"I think those questions are to help author write the spec, and don\u0027t necesarilly need to be included.","commit_id":"e3a4392f81d0449d5342e899fc5721cd35a076de"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"1974b620e320dad28ffe4cb71d422a7a8d90a894","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp x509-ssl-client-cert-authn \u003chttps://blueprints.launchpad.net/keystone/+spec/x509-ssl-client-cert-authn\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"For the same reasons to support Kerberos based (external) authentication, we"},{"line_number":14,"context_line":"also need to support X.509 SSL client certificate authentication. Like"},{"line_number":15,"context_line":"Kerberos, it is also an authentication plugin which utilizes the external"},{"line_number":16,"context_line":"authentication framework."}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_58c7bd98","line":13,"updated":"2014-07-22 08:51:40.000000000","message":"Someone reading this not akin to the Kerberos work would struggle to hit the ground running reading this spec. I would vote on explicitly specifying the reasons here.","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"04d09b781d465b20e08d8640170be20940a21700","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp x509-ssl-client-cert-authn \u003chttps://blueprints.launchpad.net/keystone/+spec/x509-ssl-client-cert-authn\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"For the same reasons to support Kerberos based (external) authentication, we"},{"line_number":14,"context_line":"also need to support X.509 SSL client certificate authentication. Like"},{"line_number":15,"context_line":"Kerberos, it is also an authentication plugin which utilizes the external"},{"line_number":16,"context_line":"authentication framework."}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_dd91db47","line":13,"in_reply_to":"baada198_58c7bd98","updated":"2014-07-23 06:22:17.000000000","message":"Actually, the reasons are stated at the Problem Description section. :) Maybe I\u0027ll just remove this paragraph altogether.","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"1974b620e320dad28ffe4cb71d422a7a8d90a894","unresolved":false,"context_lines":[{"line_number":25,"context_line":"prevalent, especially for the non-interactive service accounts such as nova,"},{"line_number":26,"context_line":"swift, etc. However, X.509 certificate based authentication is not limited to"},{"line_number":27,"context_line":"the service identities. It can be any identity. An X.509 certificate based"},{"line_number":28,"context_line":"authentication is successful if all of the following conditions are satisfied."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"1. A two-way SSL session is successfully established between the client"},{"line_number":31,"context_line":"   and Keystone."}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_58a25dfd","line":28,"updated":"2014-07-22 08:51:40.000000000","message":"colon?","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"04d09b781d465b20e08d8640170be20940a21700","unresolved":false,"context_lines":[{"line_number":25,"context_line":"prevalent, especially for the non-interactive service accounts such as nova,"},{"line_number":26,"context_line":"swift, etc. However, X.509 certificate based authentication is not limited to"},{"line_number":27,"context_line":"the service identities. It can be any identity. An X.509 certificate based"},{"line_number":28,"context_line":"authentication is successful if all of the following conditions are satisfied."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"1. A two-way SSL session is successfully established between the client"},{"line_number":31,"context_line":"   and Keystone."}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_fd969f3d","line":28,"in_reply_to":"baada198_58a25dfd","updated":"2014-07-23 06:22:17.000000000","message":"good call","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"1974b620e320dad28ffe4cb71d422a7a8d90a894","unresolved":false,"context_lines":[{"line_number":119,"context_line":"  certificate auth plugin because both username and domain name must be"},{"line_number":120,"context_line":"  encoded into a single string. i.e. username@domain. This could be problemic"},{"line_number":121,"context_line":"  if username also contains the special `@` character. With the proposed new"},{"line_number":122,"context_line":"  auth plugin, username and domainname can be unambiguously conveyed in two"},{"line_number":123,"context_line":"  separate attributes."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"Data Model Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_9bf5cfce","line":122,"updated":"2014-07-22 08:51:40.000000000","message":"s/domainname/\"domain name\"","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"04d09b781d465b20e08d8640170be20940a21700","unresolved":false,"context_lines":[{"line_number":119,"context_line":"  certificate auth plugin because both username and domain name must be"},{"line_number":120,"context_line":"  encoded into a single string. i.e. username@domain. This could be problemic"},{"line_number":121,"context_line":"  if username also contains the special `@` character. With the proposed new"},{"line_number":122,"context_line":"  auth plugin, username and domainname can be unambiguously conveyed in two"},{"line_number":123,"context_line":"  separate attributes."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"Data Model Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_3738193d","line":122,"in_reply_to":"baada198_9bf5cfce","updated":"2014-07-23 06:22:17.000000000","message":"sounds good","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"1974b620e320dad28ffe4cb71d422a7a8d90a894","unresolved":false,"context_lines":[{"line_number":150,"context_line":"Security Impact"},{"line_number":151,"context_line":"---------------"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"As mentioned above, couple with token binding, this will give us non-bearer"},{"line_number":154,"context_line":"tokens."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Since Apache mod_ssl is a requirement, and it is responsible for validating and"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_bbf1b398","line":153,"updated":"2014-07-22 08:51:40.000000000","message":"What mentioned above? It\u0027s late but I don\u0027t remember reading any security impact related information above. Also could you re-phrase \"couple with token binding\".","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"04d09b781d465b20e08d8640170be20940a21700","unresolved":false,"context_lines":[{"line_number":150,"context_line":"Security Impact"},{"line_number":151,"context_line":"---------------"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"As mentioned above, couple with token binding, this will give us non-bearer"},{"line_number":154,"context_line":"tokens."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Since Apache mod_ssl is a requirement, and it is responsible for validating and"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_7720d1f8","line":153,"in_reply_to":"baada198_bbf1b398","updated":"2014-07-23 06:22:17.000000000","message":"Its mention in the Problem Description section","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"1974b620e320dad28ffe4cb71d422a7a8d90a894","unresolved":false,"context_lines":[{"line_number":154,"context_line":"tokens."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Since Apache mod_ssl is a requirement, and it is responsible for validating and"},{"line_number":157,"context_line":"parsing the client SSL certificate, we strong recommend users to follow the"},{"line_number":158,"context_line":"security guildlines for Apache. However, they are outside the scope of this"},{"line_number":159,"context_line":"proposal."},{"line_number":160,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_7b371b4e","line":157,"updated":"2014-07-22 08:51:40.000000000","message":"s/strong/strongly","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"04d09b781d465b20e08d8640170be20940a21700","unresolved":false,"context_lines":[{"line_number":154,"context_line":"tokens."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Since Apache mod_ssl is a requirement, and it is responsible for validating and"},{"line_number":157,"context_line":"parsing the client SSL certificate, we strong recommend users to follow the"},{"line_number":158,"context_line":"security guildlines for Apache. However, they are outside the scope of this"},{"line_number":159,"context_line":"proposal."},{"line_number":160,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_37d499bc","line":157,"in_reply_to":"baada198_7b371b4e","updated":"2014-07-23 06:22:17.000000000","message":"good catch!","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"1974b620e320dad28ffe4cb71d422a7a8d90a894","unresolved":false,"context_lines":[{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Since Apache mod_ssl is a requirement, and it is responsible for validating and"},{"line_number":157,"context_line":"parsing the client SSL certificate, we strong recommend users to follow the"},{"line_number":158,"context_line":"security guildlines for Apache. However, they are outside the scope of this"},{"line_number":159,"context_line":"proposal."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_5b097783","line":158,"updated":"2014-07-22 08:51:40.000000000","message":"s/guildlines/guidelines\n\nInstead of saying \"However, they are outside the scope\" … perhaps provide an explicit reference to them. For example: \"For more details, please refer to …\"","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"04d09b781d465b20e08d8640170be20940a21700","unresolved":false,"context_lines":[{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Since Apache mod_ssl is a requirement, and it is responsible for validating and"},{"line_number":157,"context_line":"parsing the client SSL certificate, we strong recommend users to follow the"},{"line_number":158,"context_line":"security guildlines for Apache. However, they are outside the scope of this"},{"line_number":159,"context_line":"proposal."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_179dd50a","line":158,"in_reply_to":"baada198_5b097783","updated":"2014-07-23 06:22:17.000000000","message":"Don\u0027t have a reference. The hardening guidelines are different, depending on user\u0027s security policy.","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"1974b620e320dad28ffe4cb71d422a7a8d90a894","unresolved":false,"context_lines":[{"line_number":184,"context_line":"This feature only works in conjunction with Apache mod_ssl. Therefore, Keystone"},{"line_number":185,"context_line":"must be running in Apache mod_wsgi."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"In order for Apache mod_ssl to convey the SSL client certifciate information in"},{"line_number":188,"context_line":"the request environment, the `SSLOptions` directive must contains `+StdEnvVars`"},{"line_number":189,"context_line":"and the `SSLUserName` directive must set to a valid SSL requirement enviroment"},{"line_number":190,"context_line":"attribute."}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_7beabb75","line":187,"updated":"2014-07-22 08:51:40.000000000","message":"s/certifciate/certificate","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"04d09b781d465b20e08d8640170be20940a21700","unresolved":false,"context_lines":[{"line_number":184,"context_line":"This feature only works in conjunction with Apache mod_ssl. Therefore, Keystone"},{"line_number":185,"context_line":"must be running in Apache mod_wsgi."},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"In order for Apache mod_ssl to convey the SSL client certifciate information in"},{"line_number":188,"context_line":"the request environment, the `SSLOptions` directive must contains `+StdEnvVars`"},{"line_number":189,"context_line":"and the `SSLUserName` directive must set to a valid SSL requirement enviroment"},{"line_number":190,"context_line":"attribute."}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_7767f151","line":187,"in_reply_to":"baada198_7beabb75","updated":"2014-07-23 06:22:17.000000000","message":"good catch!","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"1974b620e320dad28ffe4cb71d422a7a8d90a894","unresolved":false,"context_lines":[{"line_number":186,"context_line":""},{"line_number":187,"context_line":"In order for Apache mod_ssl to convey the SSL client certifciate information in"},{"line_number":188,"context_line":"the request environment, the `SSLOptions` directive must contains `+StdEnvVars`"},{"line_number":189,"context_line":"and the `SSLUserName` directive must set to a valid SSL requirement enviroment"},{"line_number":190,"context_line":"attribute."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"For example::"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_db8f47cc","line":189,"updated":"2014-07-22 08:51:40.000000000","message":"\"must set to a\" … missing \"be\"","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"04d09b781d465b20e08d8640170be20940a21700","unresolved":false,"context_lines":[{"line_number":186,"context_line":""},{"line_number":187,"context_line":"In order for Apache mod_ssl to convey the SSL client certifciate information in"},{"line_number":188,"context_line":"the request environment, the `SSLOptions` directive must contains `+StdEnvVars`"},{"line_number":189,"context_line":"and the `SSLUserName` directive must set to a valid SSL requirement enviroment"},{"line_number":190,"context_line":"attribute."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"For example::"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_17587589","line":189,"in_reply_to":"baada198_db8f47cc","updated":"2014-07-23 06:22:17.000000000","message":"good catch!","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"1974b620e320dad28ffe4cb71d422a7a8d90a894","unresolved":false,"context_lines":[{"line_number":228,"context_line":"----------"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"1. Keystone X.509 SSL certificate authentication plugin. See"},{"line_number":231,"context_line":"   (https://review.openstack.org/#/c/103736/)."},{"line_number":232,"context_line":"2. New identity auth plugin for python-keystoneclient to handle X.509"},{"line_number":233,"context_line":"   certificate based authentication."},{"line_number":234,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_9e64dde7","line":231,"updated":"2014-07-22 08:51:40.000000000","message":"The work items should be explicitly defined to keep the spec self sufficient.","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"04d09b781d465b20e08d8640170be20940a21700","unresolved":false,"context_lines":[{"line_number":228,"context_line":"----------"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"1. Keystone X.509 SSL certificate authentication plugin. See"},{"line_number":231,"context_line":"   (https://review.openstack.org/#/c/103736/)."},{"line_number":232,"context_line":"2. New identity auth plugin for python-keystoneclient to handle X.509"},{"line_number":233,"context_line":"   certificate based authentication."},{"line_number":234,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_f7c94126","line":231,"in_reply_to":"baada198_9e64dde7","updated":"2014-07-23 06:22:17.000000000","message":"sure, I\u0027ll keep it generic","commit_id":"304b06f38c15313a8ffe38d1c25faf46a13f6904"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c1df2ae856ae5dbb49e3d2bb1cc603ac81cf7874","unresolved":false,"context_lines":[{"line_number":8,"context_line":"X.509 Client SSL Certificate Authentication"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp x509-ssl-client-cert-authn \u003chttps://blueprints.launchpad.net/keystone/+spec/x509-ssl-client-cert-authn\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Support X.509 client SSL certificate authentication to facilitate non-bearer"},{"line_number":14,"context_line":"tokens and simplify deployment."}],"source_content_type":"text/x-rst","patch_set":4,"id":"baada198_a2283498","line":11,"updated":"2014-07-24 09:29:56.000000000","message":"i think you should unify and either use \u0027_\u0027 or \u0027-\u0027 in the link and the filename.","commit_id":"e518e9a4a3ffcb6629462574a4b85fb53b604161"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"caa4e7eff9d276990176b112ae0a0bcff0566225","unresolved":false,"context_lines":[{"line_number":8,"context_line":"X.509 Client SSL Certificate Authentication"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp x509-ssl-client-cert-authn \u003chttps://blueprints.launchpad.net/keystone/+spec/x509-ssl-client-cert-authn\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Support X.509 client SSL certificate authentication to facilitate non-bearer"},{"line_number":14,"context_line":"tokens and simplify deployment."}],"source_content_type":"text/x-rst","patch_set":4,"id":"baada198_b7514210","line":11,"in_reply_to":"baada198_a2283498","updated":"2014-07-24 15:54:20.000000000","message":"good observation! will rename the file","commit_id":"e518e9a4a3ffcb6629462574a4b85fb53b604161"}],"specs/kilo/keystone-tokenless-authz-with-x509-ssl-client-cert.rst":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b3e328a10a8209ea7a75e489f06186770e7006ed","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"In a typical enterprise deployment, two-way SSL is required for services talking"},{"line_number":23,"context_line":"to Keystone for token validation. For example, we configure a client"},{"line_number":24,"context_line":"certificate for the ``auth_token`` middleware running at the service to"},{"line_number":25,"context_line":"establish the two-way SSL session with Keystone when validating a user token."}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_ff2752b3","line":22,"updated":"2015-01-20 18:19:40.000000000","message":"\"two-way\" SSL isn\u0027t very descriptive -- I\u0027d prefer SSL client certificate authentication.","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"c4d35c9fa2859a0ee5258ac3fe945907a135b394","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"In a typical enterprise deployment, two-way SSL is required for services talking"},{"line_number":23,"context_line":"to Keystone for token validation. For example, we configure a client"},{"line_number":24,"context_line":"certificate for the ``auth_token`` middleware running at the service to"},{"line_number":25,"context_line":"establish the two-way SSL session with Keystone when validating a user token."}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a930d6b_2ed56743","line":22,"in_reply_to":"3a961159_ff2752b3","updated":"2015-01-20 20:33:39.000000000","message":"done","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b3e328a10a8209ea7a75e489f06186770e7006ed","unresolved":false,"context_lines":[{"line_number":22,"context_line":"In a typical enterprise deployment, two-way SSL is required for services talking"},{"line_number":23,"context_line":"to Keystone for token validation. For example, we configure a client"},{"line_number":24,"context_line":"certificate for the ``auth_token`` middleware running at the service to"},{"line_number":25,"context_line":"establish the two-way SSL session with Keystone when validating a user token."},{"line_number":26,"context_line":"In this case, there\u0027s no need for the service to take the extra unnecessary"},{"line_number":27,"context_line":"step to obtain a service token in order to authorize the token validation"},{"line_number":28,"context_line":"call. We can effectively identify the service by its X.509 SSL client"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_df49b667","line":25,"updated":"2015-01-20 18:19:40.000000000","message":"auth_token does more than validate tokens. I assume this can be used for everything that auth_token does.","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"c4d35c9fa2859a0ee5258ac3fe945907a135b394","unresolved":false,"context_lines":[{"line_number":22,"context_line":"In a typical enterprise deployment, two-way SSL is required for services talking"},{"line_number":23,"context_line":"to Keystone for token validation. For example, we configure a client"},{"line_number":24,"context_line":"certificate for the ``auth_token`` middleware running at the service to"},{"line_number":25,"context_line":"establish the two-way SSL session with Keystone when validating a user token."},{"line_number":26,"context_line":"In this case, there\u0027s no need for the service to take the extra unnecessary"},{"line_number":27,"context_line":"step to obtain a service token in order to authorize the token validation"},{"line_number":28,"context_line":"call. We can effectively identify the service by its X.509 SSL client"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a930d6b_0e37cbb1","line":25,"in_reply_to":"3a961159_df49b667","updated":"2015-01-20 20:33:39.000000000","message":"yes, it is essentially an alternative to service token","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b3e328a10a8209ea7a75e489f06186770e7006ed","unresolved":false,"context_lines":[{"line_number":26,"context_line":"In this case, there\u0027s no need for the service to take the extra unnecessary"},{"line_number":27,"context_line":"step to obtain a service token in order to authorize the token validation"},{"line_number":28,"context_line":"call. We can effectively identify the service by its X.509 SSL client"},{"line_number":29,"context_line":"certificate. With the X.509 SSL client certificate attributes, couple with"},{"line_number":30,"context_line":"the scope information conveyed in the request headers, we can directly create"},{"line_number":31,"context_line":"the authorization ``credential`` by looking up the necessary identity data"},{"line_number":32,"context_line":"without having to issue a token. The authorization ``credential`` is"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_df70d6a9","line":29,"updated":"2015-01-20 18:19:40.000000000","message":"change \"couple\" to \"coupled\"","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"c4d35c9fa2859a0ee5258ac3fe945907a135b394","unresolved":false,"context_lines":[{"line_number":26,"context_line":"In this case, there\u0027s no need for the service to take the extra unnecessary"},{"line_number":27,"context_line":"step to obtain a service token in order to authorize the token validation"},{"line_number":28,"context_line":"call. We can effectively identify the service by its X.509 SSL client"},{"line_number":29,"context_line":"certificate. With the X.509 SSL client certificate attributes, couple with"},{"line_number":30,"context_line":"the scope information conveyed in the request headers, we can directly create"},{"line_number":31,"context_line":"the authorization ``credential`` by looking up the necessary identity data"},{"line_number":32,"context_line":"without having to issue a token. The authorization ``credential`` is"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a930d6b_aecdd75f","line":29,"in_reply_to":"3a961159_df70d6a9","updated":"2015-01-20 20:33:39.000000000","message":"done","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b3e328a10a8209ea7a75e489f06186770e7006ed","unresolved":false,"context_lines":[{"line_number":30,"context_line":"the scope information conveyed in the request headers, we can directly create"},{"line_number":31,"context_line":"the authorization ``credential`` by looking up the necessary identity data"},{"line_number":32,"context_line":"without having to issue a token. The authorization ``credential`` is"},{"line_number":33,"context_line":"successfully created if all of the following conditions are true: "},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"1. A two-way SSL session is successfully established between the service"},{"line_number":36,"context_line":"   and Keystone."}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_4ca1a645","line":33,"updated":"2015-01-20 18:19:40.000000000","message":"fix trailing whitespace.","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"c4d35c9fa2859a0ee5258ac3fe945907a135b394","unresolved":false,"context_lines":[{"line_number":30,"context_line":"the scope information conveyed in the request headers, we can directly create"},{"line_number":31,"context_line":"the authorization ``credential`` by looking up the necessary identity data"},{"line_number":32,"context_line":"without having to issue a token. The authorization ``credential`` is"},{"line_number":33,"context_line":"successfully created if all of the following conditions are true: "},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"1. A two-way SSL session is successfully established between the service"},{"line_number":36,"context_line":"   and Keystone."}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a930d6b_ceda2317","line":33,"in_reply_to":"3a961159_4ca1a645","updated":"2015-01-20 20:33:39.000000000","message":"done","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b3e328a10a8209ea7a75e489f06186770e7006ed","unresolved":false,"context_lines":[{"line_number":33,"context_line":"successfully created if all of the following conditions are true: "},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"1. A two-way SSL session is successfully established between the service"},{"line_number":36,"context_line":"   and Keystone."},{"line_number":37,"context_line":"2. The attributes from the client certificate subject DN map to an existing"},{"line_number":38,"context_line":"   Keystone user."},{"line_number":39,"context_line":"3. The Keystone user account is enabled."}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_dfe5363f","line":36,"updated":"2015-01-20 18:19:40.000000000","message":"I think this should say \"The client certificate is valid\"","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b3e328a10a8209ea7a75e489f06186770e7006ed","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This middleware shall allow the following configurable attributes maps::"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    user_id \u003d SSL_CLIENT_S_DN_OID"},{"line_number":76,"context_line":"    user_name \u003d SSL_CLIENT_S_DN_CN"},{"line_number":77,"context_line":"    user_domain_name \u003d SSL_CLIENT_S_DN_OU"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_1f3ede8b","line":75,"updated":"2015-01-20 18:19:40.000000000","message":"what section are these options in?","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"c4d35c9fa2859a0ee5258ac3fe945907a135b394","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This middleware shall allow the following configurable attributes maps::"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"    user_id \u003d SSL_CLIENT_S_DN_OID"},{"line_number":76,"context_line":"    user_name \u003d SSL_CLIENT_S_DN_CN"},{"line_number":77,"context_line":"    user_domain_name \u003d SSL_CLIENT_S_DN_OU"},{"line_number":78,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a930d6b_ce4863cf","line":75,"in_reply_to":"3a961159_1f3ede8b","updated":"2015-01-20 20:33:39.000000000","message":"the new middleware configuration section in keystone-paste.ini","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b3e328a10a8209ea7a75e489f06186770e7006ed","unresolved":false,"context_lines":[{"line_number":77,"context_line":"    user_domain_name \u003d SSL_CLIENT_S_DN_OU"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"In addition, this middleware shall expect the following request headers to"},{"line_number":80,"context_line":"convey the scope information:"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"    HTTP_X_PROJECT_ID"},{"line_number":83,"context_line":"    HTTP_X_PROJECT_NAME"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_7fc7e265","line":80,"updated":"2015-01-20 18:19:40.000000000","message":"use :: for rst","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b3e328a10a8209ea7a75e489f06186770e7006ed","unresolved":false,"context_lines":[{"line_number":191,"context_line":"Documentation Impact"},{"line_number":192,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"1. Update the Keystone v3 token auth API with the new `x509` method."},{"line_number":195,"context_line":"2. Update deployment doc on how to set it up."},{"line_number":196,"context_line":"3. Document the new auth plugin for python-keystoneclient."},{"line_number":197,"context_line":"4. Update Keystone middleware doc on how to use the new components."}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_ffb752d5","line":194,"updated":"2015-01-20 18:19:40.000000000","message":"why is this needed? The rest of the spec only mentions middleware.","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"c4d35c9fa2859a0ee5258ac3fe945907a135b394","unresolved":false,"context_lines":[{"line_number":191,"context_line":"Documentation Impact"},{"line_number":192,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"1. Update the Keystone v3 token auth API with the new `x509` method."},{"line_number":195,"context_line":"2. Update deployment doc on how to set it up."},{"line_number":196,"context_line":"3. Document the new auth plugin for python-keystoneclient."},{"line_number":197,"context_line":"4. Update Keystone middleware doc on how to use the new components."}],"source_content_type":"text/x-rst","patch_set":10,"id":"1a930d6b_0e318b0b","line":194,"in_reply_to":"3a961159_ffb752d5","updated":"2015-01-20 20:33:39.000000000","message":"good catch! I\u0027ll take them out.","commit_id":"f28f4ba60c62e45aa49ae852d32f15f7e9d7f41e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9eff913f71b26dd035bed47d3dab2d93bd3f730b","unresolved":false,"context_lines":[{"line_number":70,"context_line":"    SSL_CLIENT_S_DN_OU"},{"line_number":71,"context_line":"    SSL_CLIENT_I_DN"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"See `\u003chttp://httpd.apache.org/docs/current/mod/mod_ssl.html\u003e`_ for more details."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"This middleware shall allow the following configurable attributes maps,"},{"line_number":76,"context_line":"specified in the new middleware configuration section in keystone-paste.ini::"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1a930d6b_510fb4e1","line":73,"updated":"2015-01-20 20:51:34.000000000","message":"add text here for linking?","commit_id":"0e5b9738366163f4ec823580b375409d1a0a4142"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"975b50e8f7940b14329c6685a9221960433202a4","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Tokenless Authorization with X.509 Client SSL Certificate"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp x509-ssl-client-cert-authn \u003chttps://blueprints.launchpad.net/keystone/+spec/keystone-tokenless-authz-with-x509-ssl-client-cert\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Support tokenless authorization with X.509 client SSL certificate to improve"},{"line_number":14,"context_line":"security and simplify deployment."}],"source_content_type":"text/x-rst","patch_set":13,"id":"1a930d6b_5ad189cc","line":11,"updated":"2015-01-20 23:13:53.000000000","message":"the bp name has to match on both the text and the link.","commit_id":"126830af41c973a8be6726332b72375b58492cc0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"f2a912d3ef9203c1894047a2583ff023d990eb15","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Tokenless Authorization with X.509 Client SSL Certificate"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp x509-ssl-client-cert-authn \u003chttps://blueprints.launchpad.net/keystone/+spec/keystone-tokenless-authz-with-x509-ssl-client-cert\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Support tokenless authorization with X.509 client SSL certificate to improve"},{"line_number":14,"context_line":"security and simplify deployment."}],"source_content_type":"text/x-rst","patch_set":13,"id":"1a930d6b_cd506061","line":11,"in_reply_to":"1a930d6b_5ad189cc","updated":"2015-01-21 04:59:10.000000000","message":"ah good catch!","commit_id":"126830af41c973a8be6726332b72375b58492cc0"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb74d0bab7a6c5bac8908a04e6c70c9c0adf7346","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Tokenless Authorization with X.509 Client SSL Certificate"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp keystone-tokenless-authz-with-x509-ssl-client-cert  \u003chttps://blueprints.launchpad.net/keystone/+spec/keystone-tokenless-authz-with-x509-ssl-client-cert\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Support tokenless authorization with X.509 client SSL certificate to improve"},{"line_number":14,"context_line":"security and simplify deployment."}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_d040e358","line":11,"updated":"2015-01-21 15:34:52.000000000","message":"NIT: Line wrap at 79 columns (applies to all lines)","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Tokenless Authorization with X.509 Client SSL Certificate"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp keystone-tokenless-authz-with-x509-ssl-client-cert  \u003chttps://blueprints.launchpad.net/keystone/+spec/keystone-tokenless-authz-with-x509-ssl-client-cert\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Support tokenless authorization with X.509 client SSL certificate to improve"},{"line_number":14,"context_line":"security and simplify deployment."}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_cfa041f7","line":11,"in_reply_to":"1a930d6b_d040e358","updated":"2015-01-21 16:19:24.000000000","message":"done","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"2598cc48869bd78702b0ee3b504737fdfea83824","unresolved":false,"context_lines":[{"line_number":36,"context_line":"1. A SSL client certificate authentication session is successfully established"},{"line_number":37,"context_line":"   between the service and Keystone. This implies the client certificate is"},{"line_number":38,"context_line":"   valid."},{"line_number":39,"context_line":"2. The certificate meet our filter requirements. i.e. the certificate issuer"},{"line_number":40,"context_line":"   matches one of the issuers that we trust."},{"line_number":41,"context_line":"3. The attributes from the client certificate map to an existing Keystone user."},{"line_number":42,"context_line":"4. The Keystone user account is enabled."}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_4bf9a64c","line":39,"updated":"2015-01-21 15:55:30.000000000","message":"NIT: meet should be meets","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":36,"context_line":"1. A SSL client certificate authentication session is successfully established"},{"line_number":37,"context_line":"   between the service and Keystone. This implies the client certificate is"},{"line_number":38,"context_line":"   valid."},{"line_number":39,"context_line":"2. The certificate meet our filter requirements. i.e. the certificate issuer"},{"line_number":40,"context_line":"   matches one of the issuers that we trust."},{"line_number":41,"context_line":"3. The attributes from the client certificate map to an existing Keystone user."},{"line_number":42,"context_line":"4. The Keystone user account is enabled."}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_1288ae1e","line":39,"in_reply_to":"1a930d6b_4bf9a64c","updated":"2015-01-21 16:19:24.000000000","message":"good catch!","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"2598cc48869bd78702b0ee3b504737fdfea83824","unresolved":false,"context_lines":[{"line_number":53,"context_line":"  authentication and secured communication."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"* Flexibility - this mechanism is not limited to X.509 certificate auth. It can"},{"line_number":56,"context_line":"  be expended to support other external auth mechanisms via different mappings."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Proposed Change"},{"line_number":59,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_0b5b1e55","line":56,"updated":"2015-01-21 15:55:30.000000000","message":"NIT: give an example of other auth mechanisms you are thinking of","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":53,"context_line":"  authentication and secured communication."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"* Flexibility - this mechanism is not limited to X.509 certificate auth. It can"},{"line_number":56,"context_line":"  be expended to support other external auth mechanisms via different mappings."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Proposed Change"},{"line_number":59,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_f2e8827e","line":56,"in_reply_to":"1a930d6b_0b5b1e55","updated":"2015-01-21 16:19:24.000000000","message":"sure thing","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb74d0bab7a6c5bac8908a04e6c70c9c0adf7346","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"This is accomplished by implementing a middleware filter which builds the"},{"line_number":62,"context_line":"authorization ``credential`` based on the certificate attributes and scope"},{"line_number":63,"context_line":"information from the request headers. Authorization ``credential`` is basically"},{"line_number":64,"context_line":"a Python dictionary which represents the ``credential`` used in Oslo policy"},{"line_number":65,"context_line":"enforcement."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_8b046e16","line":63,"updated":"2015-01-21 15:34:52.000000000","message":"NIT: don\u0027t use \"basically\"","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"This is accomplished by implementing a middleware filter which builds the"},{"line_number":62,"context_line":"authorization ``credential`` based on the certificate attributes and scope"},{"line_number":63,"context_line":"information from the request headers. Authorization ``credential`` is basically"},{"line_number":64,"context_line":"a Python dictionary which represents the ``credential`` used in Oslo policy"},{"line_number":65,"context_line":"enforcement."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_8fb6393c","line":63,"in_reply_to":"1a930d6b_8b046e16","updated":"2015-01-21 16:19:24.000000000","message":"done","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb74d0bab7a6c5bac8908a04e6c70c9c0adf7346","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"This middleware shall use the mapping functionality, implemented for"},{"line_number":80,"context_line":"Federation, to formulate the Keystone identity from the SSL environment"},{"line_number":81,"context_line":"variables. We shall use the mapping with mapping ID ``x509``. Needless to say"},{"line_number":82,"context_line":"we need to document the fact that mapping ID ``x509`` is reserved for this"},{"line_number":83,"context_line":"purpose. In the future, if we need to support additional"},{"line_number":84,"context_line":"mechanisms (i.e. kerberos), we shall define additional mappings with specific"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_ebaed2e6","line":81,"updated":"2015-01-21 15:34:52.000000000","message":"NIT: don\u0027t use \"needless to say\", if saying it is needless, don\u0027t include it.","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"This middleware shall use the mapping functionality, implemented for"},{"line_number":80,"context_line":"Federation, to formulate the Keystone identity from the SSL environment"},{"line_number":81,"context_line":"variables. We shall use the mapping with mapping ID ``x509``. Needless to say"},{"line_number":82,"context_line":"we need to document the fact that mapping ID ``x509`` is reserved for this"},{"line_number":83,"context_line":"purpose. In the future, if we need to support additional"},{"line_number":84,"context_line":"mechanisms (i.e. kerberos), we shall define additional mappings with specific"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_ef7c1d75","line":81,"in_reply_to":"1a930d6b_ebaed2e6","updated":"2015-01-21 16:19:24.000000000","message":"done","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb74d0bab7a6c5bac8908a04e6c70c9c0adf7346","unresolved":false,"context_lines":[{"line_number":79,"context_line":"This middleware shall use the mapping functionality, implemented for"},{"line_number":80,"context_line":"Federation, to formulate the Keystone identity from the SSL environment"},{"line_number":81,"context_line":"variables. We shall use the mapping with mapping ID ``x509``. Needless to say"},{"line_number":82,"context_line":"we need to document the fact that mapping ID ``x509`` is reserved for this"},{"line_number":83,"context_line":"purpose. In the future, if we need to support additional"},{"line_number":84,"context_line":"mechanisms (i.e. kerberos), we shall define additional mappings with specific"},{"line_number":85,"context_line":"mapping IDs."}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_ebc33288","line":82,"updated":"2015-01-21 15:34:52.000000000","message":"The ID is not meant to be x509, the protocol is x509, and the IDP is the cert issuer (CA?) - in most cases this will be your centralized ca or something tied to keystone. This is based on the discussion at the mid-cycle.","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":79,"context_line":"This middleware shall use the mapping functionality, implemented for"},{"line_number":80,"context_line":"Federation, to formulate the Keystone identity from the SSL environment"},{"line_number":81,"context_line":"variables. We shall use the mapping with mapping ID ``x509``. Needless to say"},{"line_number":82,"context_line":"we need to document the fact that mapping ID ``x509`` is reserved for this"},{"line_number":83,"context_line":"purpose. In the future, if we need to support additional"},{"line_number":84,"context_line":"mechanisms (i.e. kerberos), we shall define additional mappings with specific"},{"line_number":85,"context_line":"mapping IDs."}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_4fc1b17f","line":82,"in_reply_to":"1a930d6b_ebc33288","updated":"2015-01-21 16:19:24.000000000","message":"but that means the protocol has to be different for each issuer. It\u0027ll still work but the protocol name would be irrelevant. In this case, each IdP (issuer CA) would have exactly one protocol and one mapping.","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb74d0bab7a6c5bac8908a04e6c70c9c0adf7346","unresolved":false,"context_lines":[{"line_number":82,"context_line":"we need to document the fact that mapping ID ``x509`` is reserved for this"},{"line_number":83,"context_line":"purpose. In the future, if we need to support additional"},{"line_number":84,"context_line":"mechanisms (i.e. kerberos), we shall define additional mappings with specific"},{"line_number":85,"context_line":"mapping IDs."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"In addition, this middleware shall accept the following configurable option,"},{"line_number":88,"context_line":"defined in a new middleware configration section in keystone.conf, to further"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_eb717278","line":85,"updated":"2015-01-21 15:34:52.000000000","message":"Please do not hard-code ids for mapping types.","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":82,"context_line":"we need to document the fact that mapping ID ``x509`` is reserved for this"},{"line_number":83,"context_line":"purpose. In the future, if we need to support additional"},{"line_number":84,"context_line":"mechanisms (i.e. kerberos), we shall define additional mappings with specific"},{"line_number":85,"context_line":"mapping IDs."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"In addition, this middleware shall accept the following configurable option,"},{"line_number":88,"context_line":"defined in a new middleware configration section in keystone.conf, to further"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_4f6ff192","line":85,"in_reply_to":"1a930d6b_eb717278","updated":"2015-01-21 16:19:24.000000000","message":"sure, we\u0027ll just use the unique IdP IDs","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb74d0bab7a6c5bac8908a04e6c70c9c0adf7346","unresolved":false,"context_lines":[{"line_number":89,"context_line":"filter the certificates that are allowed to participate in tokenless"},{"line_number":90,"context_line":"authorization::"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    trusted_issuers \u003d [\u003clist of trust issuer DNs\u003e]"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"If ``trusted_issers`` is absent, all valid X.509 client certificates are"},{"line_number":95,"context_line":"implicitly trusted."}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_6b2ca24b","line":92,"updated":"2015-01-21 15:34:52.000000000","message":"This should be specifically called out as part of the [Auth] section or where it belongs.","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":89,"context_line":"filter the certificates that are allowed to participate in tokenless"},{"line_number":90,"context_line":"authorization::"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    trusted_issuers \u003d [\u003clist of trust issuer DNs\u003e]"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"If ``trusted_issers`` is absent, all valid X.509 client certificates are"},{"line_number":95,"context_line":"implicitly trusted."}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_af05b5c3","line":92,"in_reply_to":"1a930d6b_6b2ca24b","updated":"2015-01-21 16:19:24.000000000","message":"done","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"77e6d4364bd7f4299a28b02f869099550086f44b","unresolved":false,"context_lines":[{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    trusted_issuers \u003d [\u003clist of trust issuer DNs\u003e]"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"If ``trusted_issers`` is absent, all valid X.509 client certificates are"},{"line_number":95,"context_line":"implicitly trusted."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Furthermore, this middleware shall expect the following request headers to"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_03e79941","line":94,"updated":"2015-01-21 06:27:37.000000000","message":"typo: trusted_issuers","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    trusted_issuers \u003d [\u003clist of trust issuer DNs\u003e]"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"If ``trusted_issers`` is absent, all valid X.509 client certificates are"},{"line_number":95,"context_line":"implicitly trusted."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Furthermore, this middleware shall expect the following request headers to"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_52acf6ed","line":94,"in_reply_to":"1a930d6b_03e79941","updated":"2015-01-21 16:19:24.000000000","message":"done","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb74d0bab7a6c5bac8908a04e6c70c9c0adf7346","unresolved":false,"context_lines":[{"line_number":92,"context_line":"    trusted_issuers \u003d [\u003clist of trust issuer DNs\u003e]"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"If ``trusted_issers`` is absent, all valid X.509 client certificates are"},{"line_number":95,"context_line":"implicitly trusted."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Furthermore, this middleware shall expect the following request headers to"},{"line_number":98,"context_line":"convey the scope information::"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_6bd3c238","line":95,"updated":"2015-01-21 15:34:52.000000000","message":"Do not implicitly trust certs, only explicitly trusted issuers.","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"77e6d4364bd7f4299a28b02f869099550086f44b","unresolved":false,"context_lines":[{"line_number":102,"context_line":"    HTTP_X_PROJECT_DOMAIN_ID"},{"line_number":103,"context_line":"    HTTP_X_PROJECT_DOMAIN_NAME"},{"line_number":104,"context_line":"    HTTP_X_DOMAIN_ID"},{"line_number":105,"context_line":"    HTTP_X_DOMAIN_NAME"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Absense of the scope headers is equivalent to an unscoped token."},{"line_number":108,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_23bbb50f","line":105,"updated":"2015-01-21 06:27:37.000000000","message":"are we supporting domain scope token too? For that case only the HTTP_X_DOMAIN_* will be set right?","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":102,"context_line":"    HTTP_X_PROJECT_DOMAIN_ID"},{"line_number":103,"context_line":"    HTTP_X_PROJECT_DOMAIN_NAME"},{"line_number":104,"context_line":"    HTTP_X_DOMAIN_ID"},{"line_number":105,"context_line":"    HTTP_X_DOMAIN_NAME"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Absense of the scope headers is equivalent to an unscoped token."},{"line_number":108,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_529316a3","line":105,"in_reply_to":"1a930d6b_23bbb50f","updated":"2015-01-21 16:19:24.000000000","message":"yes, we support both project and domain scope. But only one scope can be specified for a given request. If both project and domain scope are specified, that would constitute an error.","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"77e6d4364bd7f4299a28b02f869099550086f44b","unresolved":false,"context_lines":[{"line_number":104,"context_line":"    HTTP_X_DOMAIN_ID"},{"line_number":105,"context_line":"    HTTP_X_DOMAIN_NAME"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Absense of the scope headers is equivalent to an unscoped token."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Alternatives"},{"line_number":110,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_2352d5dd","line":107,"updated":"2015-01-21 06:27:37.000000000","message":"absence","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":104,"context_line":"    HTTP_X_DOMAIN_ID"},{"line_number":105,"context_line":"    HTTP_X_DOMAIN_NAME"},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Absense of the scope headers is equivalent to an unscoped token."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Alternatives"},{"line_number":110,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_b22c3a4c","line":107,"in_reply_to":"1a930d6b_2352d5dd","updated":"2015-01-21 16:19:24.000000000","message":"good catch!","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"2598cc48869bd78702b0ee3b504737fdfea83824","unresolved":false,"context_lines":[{"line_number":109,"context_line":"Alternatives"},{"line_number":110,"context_line":"------------"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"None. Use the existing mechanism, which is to use the service token for"},{"line_number":113,"context_line":"authorization."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Data Model Impact"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_8f31d9ee","line":112,"updated":"2015-01-21 15:55:30.000000000","message":"NIT: Remove None. The existing mechanism is the alternative","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":109,"context_line":"Alternatives"},{"line_number":110,"context_line":"------------"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"None. Use the existing mechanism, which is to use the service token for"},{"line_number":113,"context_line":"authorization."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"Data Model Impact"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_92f9fe4f","line":112,"in_reply_to":"1a930d6b_8f31d9ee","updated":"2015-01-21 16:19:24.000000000","message":"good call!","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"2598cc48869bd78702b0ee3b504737fdfea83824","unresolved":false,"context_lines":[{"line_number":125,"context_line":"Security Impact"},{"line_number":126,"context_line":"---------------"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"This mechanism has the effect of non-bearer token as the SSL client must"},{"line_number":129,"context_line":"possess the corresponding private key for its SSL certificate."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_0fd0894f","line":128,"updated":"2015-01-21 15:55:30.000000000","message":"NIT: did you mention somewhere above this that this results in us having a non-bearer token option available?  That\u0027s a cool feature that should be highlighted in a section in the above description and not just buried in the Security Impact session","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":125,"context_line":"Security Impact"},{"line_number":126,"context_line":"---------------"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"This mechanism has the effect of non-bearer token as the SSL client must"},{"line_number":129,"context_line":"possess the corresponding private key for its SSL certificate."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_72aad21a","line":128,"in_reply_to":"1a930d6b_0fd0894f","updated":"2015-01-21 16:19:24.000000000","message":"yes, I did mention that in the above section as well","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"cb74d0bab7a6c5bac8908a04e6c70c9c0adf7346","unresolved":false,"context_lines":[{"line_number":126,"context_line":"---------------"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"This mechanism has the effect of non-bearer token as the SSL client must"},{"line_number":129,"context_line":"possess the corresponding private key for its SSL certificate."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Notifications Impact"},{"line_number":132,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_6bbae2e2","line":129,"updated":"2015-01-21 15:34:52.000000000","message":"This needs review by the Security team. (SecurityImpact)","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":126,"context_line":"---------------"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"This mechanism has the effect of non-bearer token as the SSL client must"},{"line_number":129,"context_line":"possess the corresponding private key for its SSL certificate."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Notifications Impact"},{"line_number":132,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_f226c267","line":129,"in_reply_to":"1a930d6b_6bbae2e2","updated":"2015-01-21 16:19:24.000000000","message":"got it","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"2598cc48869bd78702b0ee3b504737fdfea83824","unresolved":false,"context_lines":[{"line_number":136,"context_line":"Other End User Impact"},{"line_number":137,"context_line":"---------------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"In other to use this functionality, service must have a valid X.509 client SSL"},{"line_number":140,"context_line":"certificate. However, certificate management is outside the scope of this spec."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_cf63e1af","line":139,"updated":"2015-01-21 15:55:30.000000000","message":"NIT: other should be order","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":136,"context_line":"Other End User Impact"},{"line_number":137,"context_line":"---------------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"In other to use this functionality, service must have a valid X.509 client SSL"},{"line_number":140,"context_line":"certificate. However, certificate management is outside the scope of this spec."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_927e5ead","line":139,"in_reply_to":"1a930d6b_cf63e1af","updated":"2015-01-21 16:19:24.000000000","message":"done","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"2598cc48869bd78702b0ee3b504737fdfea83824","unresolved":false,"context_lines":[{"line_number":137,"context_line":"---------------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"In other to use this functionality, service must have a valid X.509 client SSL"},{"line_number":140,"context_line":"certificate. However, certificate management is outside the scope of this spec."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Performance Impact"},{"line_number":143,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_ef26dd67","line":140,"updated":"2015-01-21 15:55:30.000000000","message":"certificate management is outside of the spec but hopefully the doc you include with this feature provides adequate detail on how a user can configure this option","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":137,"context_line":"---------------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"In other to use this functionality, service must have a valid X.509 client SSL"},{"line_number":140,"context_line":"certificate. However, certificate management is outside the scope of this spec."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Performance Impact"},{"line_number":143,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_124a6e80","line":140,"in_reply_to":"1a930d6b_ef26dd67","updated":"2015-01-21 16:19:24.000000000","message":"yes, absolutely","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"2598cc48869bd78702b0ee3b504737fdfea83824","unresolved":false,"context_lines":[{"line_number":206,"context_line":"Testing"},{"line_number":207,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"There will be unit tests. For integration tests, we may need both X.509"},{"line_number":210,"context_line":"certificate management capability (i.e. Barbican + DogTag) and Apache enabled"},{"line_number":211,"context_line":"in Jenkins."},{"line_number":212,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_4f929158","line":209,"updated":"2015-01-21 15:55:30.000000000","message":"Will these be functional tests following the new functional test spec or are these going in Tempest?  Can you clarify?","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":206,"context_line":"Testing"},{"line_number":207,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"There will be unit tests. For integration tests, we may need both X.509"},{"line_number":210,"context_line":"certificate management capability (i.e. Barbican + DogTag) and Apache enabled"},{"line_number":211,"context_line":"in Jenkins."},{"line_number":212,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_52095630","line":209,"in_reply_to":"1a930d6b_4f929158","updated":"2015-01-21 16:19:24.000000000","message":"I am thinking we can utility David\u0027s new functional test framework for this. Tempest probably not a good candidate as it is for integration tests only.","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"2598cc48869bd78702b0ee3b504737fdfea83824","unresolved":false,"context_lines":[{"line_number":213,"context_line":"Documentation Impact"},{"line_number":214,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"1. Update Keystone configuration doc on how to use the new middleware."},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"References"},{"line_number":219,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_4fce115c","line":216,"updated":"2015-01-21 15:55:30.000000000","message":"Will you cover some basic cert configuration or at least point the user to know docs on how to configure all the cert stuff?","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"39172ccd75c3d3700c48621d75e02a1b58ba7f50","unresolved":false,"context_lines":[{"line_number":213,"context_line":"Documentation Impact"},{"line_number":214,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"1. Update Keystone configuration doc on how to use the new middleware."},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"References"},{"line_number":219,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":14,"id":"1a930d6b_d5045017","line":216,"in_reply_to":"1a930d6b_4fce115c","updated":"2015-01-21 16:19:24.000000000","message":"Yes. I\u0027ll provide an example in the doc. Like what the DN looks like and how the mapping works with the given DN.","commit_id":"e33c8cf680fb37fa7064d14f08e8979b872421e3"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"821d3bff7f6948388b17fe4f42bd9a84376f1e81","unresolved":false,"context_lines":[{"line_number":39,"context_line":"   between the service and Keystone. This implies the client certificate is"},{"line_number":40,"context_line":"   valid."},{"line_number":41,"context_line":"2. The certificate meets our filter requirements. i.e. the certificate issuer"},{"line_number":42,"context_line":"   matches one of the issuers that we trust."},{"line_number":43,"context_line":"3. The attributes from the client certificate map to an existing Keystone user."},{"line_number":44,"context_line":"4. The Keystone user account is enabled."},{"line_number":45,"context_line":"5. Scope information is conveyed in the request header (i.e. X-Project-Id)"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a930d6b_9ea7454f","line":42,"updated":"2015-01-21 17:49:32.000000000","message":"Is this in addition to the SSL handshake?","commit_id":"50e6178b406f958fc9ae314fe0bfa3516fef2a21"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"98acffe7f4e224d9fd2e77eee4fae0935e8ad047","unresolved":false,"context_lines":[{"line_number":39,"context_line":"   between the service and Keystone. This implies the client certificate is"},{"line_number":40,"context_line":"   valid."},{"line_number":41,"context_line":"2. The certificate meets our filter requirements. i.e. the certificate issuer"},{"line_number":42,"context_line":"   matches one of the issuers that we trust."},{"line_number":43,"context_line":"3. The attributes from the client certificate map to an existing Keystone user."},{"line_number":44,"context_line":"4. The Keystone user account is enabled."},{"line_number":45,"context_line":"5. Scope information is conveyed in the request header (i.e. X-Project-Id)"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a930d6b_c7a65dc1","line":42,"in_reply_to":"1a930d6b_9ea7454f","updated":"2015-01-21 22:16:09.000000000","message":"Yes it is. This is to further filter the certificates that are allowed to participate in tokenless authorization.","commit_id":"50e6178b406f958fc9ae314fe0bfa3516fef2a21"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"821d3bff7f6948388b17fe4f42bd9a84376f1e81","unresolved":false,"context_lines":[{"line_number":42,"context_line":"   matches one of the issuers that we trust."},{"line_number":43,"context_line":"3. The attributes from the client certificate map to an existing Keystone user."},{"line_number":44,"context_line":"4. The Keystone user account is enabled."},{"line_number":45,"context_line":"5. Scope information is conveyed in the request header (i.e. X-Project-Id)"},{"line_number":46,"context_line":"6. User have one or more roles for the given scope."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The benefits of tokenless authorization with X.509 SSL client certificate are:"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a930d6b_fe44c975","line":45,"updated":"2015-01-21 17:49:32.000000000","message":"A new header requires an update to the V3 API spec.","commit_id":"50e6178b406f958fc9ae314fe0bfa3516fef2a21"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"98acffe7f4e224d9fd2e77eee4fae0935e8ad047","unresolved":false,"context_lines":[{"line_number":42,"context_line":"   matches one of the issuers that we trust."},{"line_number":43,"context_line":"3. The attributes from the client certificate map to an existing Keystone user."},{"line_number":44,"context_line":"4. The Keystone user account is enabled."},{"line_number":45,"context_line":"5. Scope information is conveyed in the request header (i.e. X-Project-Id)"},{"line_number":46,"context_line":"6. User have one or more roles for the given scope."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The benefits of tokenless authorization with X.509 SSL client certificate are:"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a930d6b_e7ab5987","line":45,"in_reply_to":"1a930d6b_fe44c975","updated":"2015-01-21 22:16:09.000000000","message":"Yes indeed. Thanks for the reminder. I\u0027ll update the spec.","commit_id":"50e6178b406f958fc9ae314fe0bfa3516fef2a21"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"821d3bff7f6948388b17fe4f42bd9a84376f1e81","unresolved":false,"context_lines":[{"line_number":43,"context_line":"3. The attributes from the client certificate map to an existing Keystone user."},{"line_number":44,"context_line":"4. The Keystone user account is enabled."},{"line_number":45,"context_line":"5. Scope information is conveyed in the request header (i.e. X-Project-Id)"},{"line_number":46,"context_line":"6. User have one or more roles for the given scope."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The benefits of tokenless authorization with X.509 SSL client certificate are:"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a930d6b_5e5b1d54","line":46,"updated":"2015-01-21 17:49:32.000000000","message":"change \"have\" to \"has\"","commit_id":"50e6178b406f958fc9ae314fe0bfa3516fef2a21"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"98acffe7f4e224d9fd2e77eee4fae0935e8ad047","unresolved":false,"context_lines":[{"line_number":43,"context_line":"3. The attributes from the client certificate map to an existing Keystone user."},{"line_number":44,"context_line":"4. The Keystone user account is enabled."},{"line_number":45,"context_line":"5. Scope information is conveyed in the request header (i.e. X-Project-Id)"},{"line_number":46,"context_line":"6. User have one or more roles for the given scope."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The benefits of tokenless authorization with X.509 SSL client certificate are:"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a930d6b_a78f9122","line":46,"in_reply_to":"1a930d6b_5e5b1d54","updated":"2015-01-21 22:16:09.000000000","message":"done","commit_id":"50e6178b406f958fc9ae314fe0bfa3516fef2a21"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"821d3bff7f6948388b17fe4f42bd9a84376f1e81","unresolved":false,"context_lines":[{"line_number":93,"context_line":"filter the certificates that are allowed to participate in tokenless"},{"line_number":94,"context_line":"authorization::"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    trusted_issuers \u003d [\u003clist of trust issuer DNs\u003e]"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"If ``trusted_issuers`` is absent, no certificates will be allowed in tokenless"},{"line_number":99,"context_line":"authorization."}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a930d6b_e9041517","line":96,"updated":"2015-01-21 17:49:32.000000000","message":"This should be a CA certificate file or a directory containing CA certificates. Then the SSL library can verify that the client cert is trusted or not.","commit_id":"50e6178b406f958fc9ae314fe0bfa3516fef2a21"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"98acffe7f4e224d9fd2e77eee4fae0935e8ad047","unresolved":false,"context_lines":[{"line_number":93,"context_line":"filter the certificates that are allowed to participate in tokenless"},{"line_number":94,"context_line":"authorization::"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    trusted_issuers \u003d [\u003clist of trust issuer DNs\u003e]"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"If ``trusted_issuers`` is absent, no certificates will be allowed in tokenless"},{"line_number":99,"context_line":"authorization."}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a930d6b_07b6a5d9","line":96,"in_reply_to":"1a930d6b_e9041517","updated":"2015-01-21 22:16:09.000000000","message":"No. By the time it gets to the middleware, the certificate has already been validated by Apache mod_ssl. This attribute is used to further restrict a set of certificates that can participate in tokenless authorization. We want to mitigate the situation where a user can get a SSL client certificate from a different issuer with the same subject DN.","commit_id":"50e6178b406f958fc9ae314fe0bfa3516fef2a21"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"821d3bff7f6948388b17fe4f42bd9a84376f1e81","unresolved":false,"context_lines":[{"line_number":200,"context_line":""},{"line_number":201,"context_line":"1. Implement new middleware to create auth context from X.509 certificate"},{"line_number":202,"context_line":"   attributes for tokenless authorization."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"Dependencies"},{"line_number":206,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a930d6b_29745d98","line":203,"updated":"2015-01-21 17:49:32.000000000","message":"Is the work to change the keystoneclient and auth_token middleware part of this?","commit_id":"50e6178b406f958fc9ae314fe0bfa3516fef2a21"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"98acffe7f4e224d9fd2e77eee4fae0935e8ad047","unresolved":false,"context_lines":[{"line_number":200,"context_line":""},{"line_number":201,"context_line":"1. Implement new middleware to create auth context from X.509 certificate"},{"line_number":202,"context_line":"   attributes for tokenless authorization."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"Dependencies"},{"line_number":206,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":16,"id":"1a930d6b_073b053b","line":203,"in_reply_to":"1a930d6b_29745d98","updated":"2015-01-21 22:16:09.000000000","message":"Good point! Yes, we need to update auth_token middleware to make service token optional.","commit_id":"50e6178b406f958fc9ae314fe0bfa3516fef2a21"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"601f3cbb7201d5079ed0a398fa036db0acddab1e","unresolved":false,"context_lines":[{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"In a typical enterprise deployment, SSL client certificate authentication is"},{"line_number":25,"context_line":"required for services talking to Keystone for things such as token validation"},{"line_number":26,"context_line":"and resource lookup. For example, we configure a client certificate for the"},{"line_number":27,"context_line":"``auth_token`` middleware running at the service to establish the SSL client"},{"line_number":28,"context_line":"certificate authentication session with Keystone when validating a user token."}],"source_content_type":"text/x-rst","patch_set":17,"id":"1a930d6b_9da8988e","line":25,"updated":"2015-01-26 18:50:32.000000000","message":"IMO, it is good to mention these are trusted services.\nNot mandatory though.","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"afbe584220686e62157cda22a489e0ae5578065f","unresolved":false,"context_lines":[{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"In a typical enterprise deployment, SSL client certificate authentication is"},{"line_number":25,"context_line":"required for services talking to Keystone for things such as token validation"},{"line_number":26,"context_line":"and resource lookup. For example, we configure a client certificate for the"},{"line_number":27,"context_line":"``auth_token`` middleware running at the service to establish the SSL client"},{"line_number":28,"context_line":"certificate authentication session with Keystone when validating a user token."}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa81d914_7f63821a","line":25,"in_reply_to":"1a930d6b_9da8988e","updated":"2015-01-28 06:14:35.000000000","message":"Yes. The \"trusted_issuers\" configuration will further harden the certs that can participate in tokenless authz.","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"9919e934832548a151b93aa931f2c1cb6664b055","unresolved":false,"context_lines":[{"line_number":25,"context_line":"required for services talking to Keystone for things such as token validation"},{"line_number":26,"context_line":"and resource lookup. For example, we configure a client certificate for the"},{"line_number":27,"context_line":"``auth_token`` middleware running at the service to establish the SSL client"},{"line_number":28,"context_line":"certificate authentication session with Keystone when validating a user token."},{"line_number":29,"context_line":"In this case, there\u0027s no need for the service to take the extra unnecessary"},{"line_number":30,"context_line":"step to obtain a service token in order to authorize the token validation call."},{"line_number":31,"context_line":"We can effectively identify the service by its X.509 SSL client certificate."}],"source_content_type":"text/x-rst","patch_set":17,"id":"1a930d6b_4f34d649","line":28,"updated":"2015-01-26 04:03:45.000000000","message":"When you do the docs, it might be nice to have some diagrams that show the difference in the flows between the new flow that uses X.509 and the standard one that obtains a service token.  Something like the diagrams/description found in http://bodenr.blogspot.com/2014/03/openstack-keystone-workflow-token.html  I have always found helpful","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"afbe584220686e62157cda22a489e0ae5578065f","unresolved":false,"context_lines":[{"line_number":25,"context_line":"required for services talking to Keystone for things such as token validation"},{"line_number":26,"context_line":"and resource lookup. For example, we configure a client certificate for the"},{"line_number":27,"context_line":"``auth_token`` middleware running at the service to establish the SSL client"},{"line_number":28,"context_line":"certificate authentication session with Keystone when validating a user token."},{"line_number":29,"context_line":"In this case, there\u0027s no need for the service to take the extra unnecessary"},{"line_number":30,"context_line":"step to obtain a service token in order to authorize the token validation call."},{"line_number":31,"context_line":"We can effectively identify the service by its X.509 SSL client certificate."}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa81d914_1f7446ce","line":28,"in_reply_to":"1a930d6b_4f34d649","updated":"2015-01-28 06:14:35.000000000","message":"Good suggestion. Will do.","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"},{"author":{"_account_id":994,"name":"Arvind Tiwari","email":"arvindt7@gmail.com","username":"arvind-tiwari"},"change_message_id":"601f3cbb7201d5079ed0a398fa036db0acddab1e","unresolved":false,"context_lines":[{"line_number":42,"context_line":"   matches one of the issuers that we trust."},{"line_number":43,"context_line":"3. The attributes from the client certificate map to an existing Keystone user."},{"line_number":44,"context_line":"4. The Keystone user account is enabled."},{"line_number":45,"context_line":"5. Scope information is conveyed in the request header (i.e. X-Project-Id)"},{"line_number":46,"context_line":"6. User has one or more roles for the given scope."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The benefits of tokenless authorization with X.509 SSL client certificate are:"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1a930d6b_7ddf6c0d","line":45,"updated":"2015-01-26 18:50:32.000000000","message":"Not sure why not mapping certificate attribute (e.g. OU) to project, that will make life more easy.\nIs that any security issue?","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"f56b8385c669d15ddfa8ec96ef16c3699506e203","unresolved":false,"context_lines":[{"line_number":42,"context_line":"   matches one of the issuers that we trust."},{"line_number":43,"context_line":"3. The attributes from the client certificate map to an existing Keystone user."},{"line_number":44,"context_line":"4. The Keystone user account is enabled."},{"line_number":45,"context_line":"5. Scope information is conveyed in the request header (i.e. X-Project-Id)"},{"line_number":46,"context_line":"6. User has one or more roles for the given scope."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The benefits of tokenless authorization with X.509 SSL client certificate are:"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1a930d6b_5c7aa9bd","line":45,"in_reply_to":"1a930d6b_7ddf6c0d","updated":"2015-01-26 23:22:26.000000000","message":"We don\u0027t want to force the need for custom certificates. Many orgs will not issue non-standard certs and mandating it is a bad idea in that case.","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"3b2189a6a981d93f1eb5ec9b3a9a570c6309d533","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    trusted_issuers \u003d [\u003clist of trust issuer DNs\u003e]"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"If ``trusted_issuers`` is absent, no certificates will be allowed in tokenless"},{"line_number":99,"context_line":"authorization."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"Furthermore, this middleware shall expect the following request headers to"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1a930d6b_329fc104","line":98,"updated":"2015-01-27 03:42:33.000000000","message":"Is it double authenticate?  Apache itself will validate issuer.  Do you want to do one more filter for issuer?\\\n\nAs per your proposal, will Apache check issuer\u0027s cert?  If  it is going to do that, then what is the additional benefit we are getting from this config setting.\n\nIf  you are going to configure Apache to allow all certs irrespective of the issuer and do the checking via config file, then please don\u0027t do that., It is way more complicated and you will more likely introduce security holes. Certificate involves chains. You can\u0027t trust the  issuer unless you validate the whole chain.  Also we have CRLS for issuers.  How can the middleware validate cert chains and CRLS.","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"afbe584220686e62157cda22a489e0ae5578065f","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    trusted_issuers \u003d [\u003clist of trust issuer DNs\u003e]"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"If ``trusted_issuers`` is absent, no certificates will be allowed in tokenless"},{"line_number":99,"context_line":"authorization."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"Furthermore, this middleware shall expect the following request headers to"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa81d914_5f74fefc","line":98,"in_reply_to":"1a930d6b_329fc104","updated":"2015-01-28 06:14:35.000000000","message":"This is not double authenticate. This is to differentiate SSL certs and SSL certs that can participate in tokenless authz. Apache can be configured to trust a number of CAs. In fact, this will allow further hardening which lead to a more secured deployment.\n\n\"trusted_issuers\" in this case are the immediate issuer DNs passed in from the request environment, after Apache mod_ssl had successfully validated the whole chain.","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"3b2189a6a981d93f1eb5ec9b3a9a570c6309d533","unresolved":false,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":"Furthermore, this middleware shall expect the following request headers to"},{"line_number":102,"context_line":"convey the scope information::"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    HTTP_X_PROJECT_ID"},{"line_number":105,"context_line":"    HTTP_X_PROJECT_NAME"},{"line_number":106,"context_line":"    HTTP_X_PROJECT_DOMAIN_ID"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1a930d6b_7516934d","line":103,"updated":"2015-01-27 03:42:33.000000000","message":"I think you are missing   HTTP_USER_DOMAIN_ID and HTTP_USER_DOMAIN_NAME?","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"afbe584220686e62157cda22a489e0ae5578065f","unresolved":false,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":"Furthermore, this middleware shall expect the following request headers to"},{"line_number":102,"context_line":"convey the scope information::"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    HTTP_X_PROJECT_ID"},{"line_number":105,"context_line":"    HTTP_X_PROJECT_NAME"},{"line_number":106,"context_line":"    HTTP_X_PROJECT_DOMAIN_ID"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa81d914_bfe89a7d","line":103,"in_reply_to":"1a930d6b_7516934d","updated":"2015-01-28 06:14:35.000000000","message":"No. This is for conveying the scope only. The mapping will yield the user information.","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"3b2189a6a981d93f1eb5ec9b3a9a570c6309d533","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"None"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Other Deployer Impact"},{"line_number":154,"context_line":"---------------------"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"This feature only works in conjunction with Apache mod_ssl or mod_nss as"}],"source_content_type":"text/x-rst","patch_set":17,"id":"1a930d6b_759933c3","line":153,"updated":"2015-01-27 03:42:33.000000000","message":"if the deployment  terminates the SSL, in a load balancer then the load balancer should be configured to forward client certs","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"afbe584220686e62157cda22a489e0ae5578065f","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"None"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Other Deployer Impact"},{"line_number":154,"context_line":"---------------------"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"This feature only works in conjunction with Apache mod_ssl or mod_nss as"}],"source_content_type":"text/x-rst","patch_set":17,"id":"fa81d914_3ffcaa3e","line":153,"in_reply_to":"1a930d6b_759933c3","updated":"2015-01-28 06:14:35.000000000","message":"Good point! Will add that.","commit_id":"ef189cedcc4f89ad11a14b4f021634e08adf42f0"}],"specs/kilo/x509-ssl-client-cert-authn.rst":[{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"36e91d39494a90799c3ccd5c23c4777c6d37c6d0","unresolved":false,"context_lines":[{"line_number":38,"context_line":"  authentication mechanism. For example, when requesting a token, user may"},{"line_number":39,"context_line":"  optionally ask Keystone to bind the token to the Subject DN, serial number,"},{"line_number":40,"context_line":"  and issuer of user\u0027s X.509 SSL client certificate. Like Kerberose, binding"},{"line_number":41,"context_line":"  will be enforced by either auth_token middleware or, in the case of token"},{"line_number":42,"context_line":"  rescope, by Keystone token auth plugin. For example:"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_299f5d04","line":41,"updated":"2014-12-12 16:28:40.000000000","message":"Great explanation!","commit_id":"d02d253b5d506540304aea57509b2c0e7f524aa3"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"a8c5eb863cfda7ff9cbcf87d21e3719d5dd9cdae","unresolved":false,"context_lines":[{"line_number":49,"context_line":"            \"issued_at\": \"2013-02-27T16:30:59.999999Z\","},{"line_number":50,"context_line":"            \"audit_ids\": [\"VcxU2JYqT8OzfUVvrjEITQ\", \"qNUTIJntTzO1-XUk5STybw\"],"},{"line_number":51,"context_line":"            \"methods\": ["},{"line_number":52,"context_line":"                \"password\""},{"line_number":53,"context_line":"            ],"},{"line_number":54,"context_line":"            \"bind\": {"},{"line_number":55,"context_line":"                \"x509\": {"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_ce287835","line":52,"updated":"2014-12-15 07:51:14.000000000","message":"x509 instead of password?","commit_id":"d02d253b5d506540304aea57509b2c0e7f524aa3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"91ed24181ed70c9b36adce1d5924fc4f2c9ce6ab","unresolved":false,"context_lines":[{"line_number":49,"context_line":"            \"issued_at\": \"2013-02-27T16:30:59.999999Z\","},{"line_number":50,"context_line":"            \"audit_ids\": [\"VcxU2JYqT8OzfUVvrjEITQ\", \"qNUTIJntTzO1-XUk5STybw\"],"},{"line_number":51,"context_line":"            \"methods\": ["},{"line_number":52,"context_line":"                \"password\""},{"line_number":53,"context_line":"            ],"},{"line_number":54,"context_line":"            \"bind\": {"},{"line_number":55,"context_line":"                \"x509\": {"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_867cfbb7","line":52,"in_reply_to":"3a961159_ce287835","updated":"2015-01-14 17:32:31.000000000","message":"good catch!","commit_id":"d02d253b5d506540304aea57509b2c0e7f524aa3"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"36e91d39494a90799c3ccd5c23c4777c6d37c6d0","unresolved":false,"context_lines":[{"line_number":82,"context_line":"   middleware filter which build an auth context based on the certificate"},{"line_number":83,"context_line":"   attributes. Auth context is basically a Python dictionary, which represents"},{"line_number":84,"context_line":"   the ``credential`` used in Oslo policy enforcement. This functionality is"},{"line_number":85,"context_line":"   particular useful for the service users because those accounts are highly"},{"line_number":86,"context_line":"   static. Furthermore, most, if not all production deployments use two-way"},{"line_number":87,"context_line":"   SSL for service-to-service communication."},{"line_number":88,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_db177c43","line":85,"updated":"2014-12-12 16:28:40.000000000","message":"nit: \"particular\" should be \"particularly\"","commit_id":"d02d253b5d506540304aea57509b2c0e7f524aa3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"91ed24181ed70c9b36adce1d5924fc4f2c9ce6ab","unresolved":false,"context_lines":[{"line_number":82,"context_line":"   middleware filter which build an auth context based on the certificate"},{"line_number":83,"context_line":"   attributes. Auth context is basically a Python dictionary, which represents"},{"line_number":84,"context_line":"   the ``credential`` used in Oslo policy enforcement. This functionality is"},{"line_number":85,"context_line":"   particular useful for the service users because those accounts are highly"},{"line_number":86,"context_line":"   static. Furthermore, most, if not all production deployments use two-way"},{"line_number":87,"context_line":"   SSL for service-to-service communication."},{"line_number":88,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_2645076f","line":85,"in_reply_to":"3a961159_db177c43","updated":"2015-01-14 17:32:31.000000000","message":"good catch!","commit_id":"d02d253b5d506540304aea57509b2c0e7f524aa3"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"a8c5eb863cfda7ff9cbcf87d21e3719d5dd9cdae","unresolved":false,"context_lines":[{"line_number":91,"context_line":"   certificate authentication. The payload for this method shall be empty as"},{"line_number":92,"context_line":"   the attributes are conveyed in the request environment. We just need the"},{"line_number":93,"context_line":"   new method to trigger the appropriate auth plugin. Like Federation, we\u0027ll"},{"line_number":94,"context_line":"   also need to define a new protocol and its corresponding mapping."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Since we are using Apache mod_ssl to handle the SSL requests, Apache will"},{"line_number":97,"context_line":"convey the client certificate information in the WSGI request environment."}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_eefb74be","line":94,"updated":"2014-12-15 07:51:14.000000000","message":"What kind of protocol? \nProtocol and IdP in Federation are usually used for choosing an appopriate mapping, but since the user exists in the backend already I doubt you need it.","commit_id":"d02d253b5d506540304aea57509b2c0e7f524aa3"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"91ed24181ed70c9b36adce1d5924fc4f2c9ce6ab","unresolved":false,"context_lines":[{"line_number":91,"context_line":"   certificate authentication. The payload for this method shall be empty as"},{"line_number":92,"context_line":"   the attributes are conveyed in the request environment. We just need the"},{"line_number":93,"context_line":"   new method to trigger the appropriate auth plugin. Like Federation, we\u0027ll"},{"line_number":94,"context_line":"   also need to define a new protocol and its corresponding mapping."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Since we are using Apache mod_ssl to handle the SSL requests, Apache will"},{"line_number":97,"context_line":"convey the client certificate information in the WSGI request environment."}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_f91ba06c","line":94,"in_reply_to":"3a961159_eefb74be","updated":"2015-01-14 17:32:31.000000000","message":"Marek, you\u0027re correct. Turns out we can\u0027t use the federation route as you correctly pointed out that federation is based on discrete user. We\u0027ll need to do this via a traditional auth plugin instead. I\u0027ll update the spec to reflect that.","commit_id":"d02d253b5d506540304aea57509b2c0e7f524aa3"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"36e91d39494a90799c3ccd5c23c4777c6d37c6d0","unresolved":false,"context_lines":[{"line_number":175,"context_line":"---------------------"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"This feature only works in conjunction with Apache mod_ssl or mod_nss as"},{"line_number":178,"context_line":"standalone eventlet-based Keystone does not parse or convey X.509 client"},{"line_number":179,"context_line":"SSL certificate attributes in the request environment. Therefore, Keystone"},{"line_number":180,"context_line":"must be running in Apache mod_wsgi."},{"line_number":181,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_7be04829","line":178,"updated":"2014-12-12 16:28:40.000000000","message":"Yes. yes. The standard disclaimer of not working in standalone eventlet-based Keystone :-)","commit_id":"d02d253b5d506540304aea57509b2c0e7f524aa3"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"623c4bb608751cc28e59fde36ff388be779e7d6a","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  Keystone supports token-binding, which binds a given token to a secondary"},{"line_number":38,"context_line":"  authentication mechanism. For example, when requesting a token, user may"},{"line_number":39,"context_line":"  optionally ask Keystone to bind the token to the Subject DN, serial number,"},{"line_number":40,"context_line":"  and issuer of user\u0027s X.509 SSL client certificate. Like Kerberose, binding"},{"line_number":41,"context_line":"  will be enforced by either auth_token middleware or, in the case of token"},{"line_number":42,"context_line":"  rescope, by Keystone token auth plugin. For example:"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_e2620015","line":40,"updated":"2015-01-14 23:19:50.000000000","message":"change \"Kerberose\" to \"Kerberos\"","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"623c4bb608751cc28e59fde36ff388be779e7d6a","unresolved":false,"context_lines":[{"line_number":76,"context_line":"Proposed Change"},{"line_number":77,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"We may consider implementing the following:"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"1. Tokenless authorization. This can be accomplished by implementing a"},{"line_number":82,"context_line":"   middleware filter which build an auth context based on the certificate"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_a27c78b7","line":79,"updated":"2015-01-14 23:19:50.000000000","message":"this makes it seem like everything here is optional... what\u0027s actually going to be done?","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"623c4bb608751cc28e59fde36ff388be779e7d6a","unresolved":false,"context_lines":[{"line_number":79,"context_line":"We may consider implementing the following:"},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"1. Tokenless authorization. This can be accomplished by implementing a"},{"line_number":82,"context_line":"   middleware filter which build an auth context based on the certificate"},{"line_number":83,"context_line":"   attributes. Auth context is basically a Python dictionary, which represents"},{"line_number":84,"context_line":"   the ``credential`` used in Oslo policy enforcement. This functionality is"},{"line_number":85,"context_line":"   particularly useful for the service users because those accounts are highly"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_e249208f","line":82,"updated":"2015-01-14 23:19:50.000000000","message":"change \"build\" to \"builds\"","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"e2829985414693a8714fef86283400ced93d6302","unresolved":false,"context_lines":[{"line_number":84,"context_line":"   the ``credential`` used in Oslo policy enforcement. This functionality is"},{"line_number":85,"context_line":"   particularly useful for the service users because those accounts are highly"},{"line_number":86,"context_line":"   static. Furthermore, most, if not all production deployments use two-way"},{"line_number":87,"context_line":"   SSL for service-to-service communication."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"2. Token request. We shall define a new ``x509`` auth method to handle X.509"},{"line_number":90,"context_line":"   client SSL certificate authentication. The payload for this method shall be"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_510d648e","line":87,"updated":"2015-01-14 21:43:47.000000000","message":"For tokenless authorization, it would be good to have more details. From given description, it was not quite obvious (only after talking with you separately) that there is need to have cert attribute mapping within openstack service configuration. And that attribute mapping is used to derive project, roles data to enforce authorization (without going to keystone).\n\nAlso, might be useful to clarify that middleware needs to use this only when X-Auth-Token header is not present.","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"623c4bb608751cc28e59fde36ff388be779e7d6a","unresolved":false,"context_lines":[{"line_number":91,"context_line":"   empty as the attributes are conveyed in the request environment. We just"},{"line_number":92,"context_line":"   need the new method to trigger the appropriate auth plugin."},{"line_number":93,"context_line":"   New auth plugin should be able to leverage most of the existing"},{"line_number":94,"context_line":"   `generic mapping \u003chttps://github.com/openstack/keystone-specs/blob/master/specs/juno/generic-mapping-federation.rst\u003e`_ logic."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Since we are using Apache mod_ssl to handle the SSL requests, Apache will"},{"line_number":97,"context_line":"convey the client certificate information in the WSGI request environment."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_3d0a6920","line":94,"updated":"2015-01-14 23:19:50.000000000","message":"link to http://specs.openstack.org/openstack/keystone-specs/specs/juno/generic-mapping-federation.html since that\u0027s the rendered doc.","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"623c4bb608751cc28e59fde36ff388be779e7d6a","unresolved":false,"context_lines":[{"line_number":93,"context_line":"   New auth plugin should be able to leverage most of the existing"},{"line_number":94,"context_line":"   `generic mapping \u003chttps://github.com/openstack/keystone-specs/blob/master/specs/juno/generic-mapping-federation.rst\u003e`_ logic."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Since we are using Apache mod_ssl to handle the SSL requests, Apache will"},{"line_number":97,"context_line":"convey the client certificate information in the WSGI request environment."},{"line_number":98,"context_line":"For example::"},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_622450c6","line":96,"updated":"2015-01-14 23:19:50.000000000","message":"eventlet isn\u0027t supported?","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"623c4bb608751cc28e59fde36ff388be779e7d6a","unresolved":false,"context_lines":[{"line_number":204,"context_line":"* For python-keystoneclient, use the new X.509 certificate auth plugin."},{"line_number":205,"context_line":"  For example::"},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"    x509_auth \u003d keystoneclient.auth.identity.v3.X509SSLCert(cacert, cert, key)"},{"line_number":208,"context_line":"    ks_session \u003d keystoneclient.session.Session(auth\u003dx509_auth, ...)"},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_fd51c10e","line":207,"updated":"2015-01-14 23:19:50.000000000","message":"don\u0027t you already set the client cert on the session?","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"e2829985414693a8714fef86283400ced93d6302","unresolved":false,"context_lines":[{"line_number":223,"context_line":"----------"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"1. Define a standard default map for Apache mod_ssl. Potentially, one for"},{"line_number":226,"context_line":"   Apache mod_nss as well."},{"line_number":227,"context_line":"2. Implement new x.509 auth plugin."},{"line_number":228,"context_line":"3. Implement new middleware to create auth context from X.509 certificate"},{"line_number":229,"context_line":"   attributes for tokenless authorization."}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_f44c7e78","line":226,"updated":"2015-01-14 21:43:47.000000000","message":"Is this attribute mapping configuration expected to be same for both token and tokenless cases?","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"623c4bb608751cc28e59fde36ff388be779e7d6a","unresolved":false,"context_lines":[{"line_number":224,"context_line":""},{"line_number":225,"context_line":"1. Define a standard default map for Apache mod_ssl. Potentially, one for"},{"line_number":226,"context_line":"   Apache mod_nss as well."},{"line_number":227,"context_line":"2. Implement new x.509 auth plugin."},{"line_number":228,"context_line":"3. Implement new middleware to create auth context from X.509 certificate"},{"line_number":229,"context_line":"   attributes for tokenless authorization."},{"line_number":230,"context_line":"4. Implement new identity auth plugin for python-keystoneclient to handle X.509"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_1d784d7d","line":227,"updated":"2015-01-14 23:19:50.000000000","message":"change \"x.509\" to \"`x509`\"","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"623c4bb608751cc28e59fde36ff388be779e7d6a","unresolved":false,"context_lines":[{"line_number":228,"context_line":"3. Implement new middleware to create auth context from X.509 certificate"},{"line_number":229,"context_line":"   attributes for tokenless authorization."},{"line_number":230,"context_line":"4. Implement new identity auth plugin for python-keystoneclient to handle X.509"},{"line_number":231,"context_line":"   certificate based authentication."},{"line_number":232,"context_line":""},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_7d64f1e4","line":231,"updated":"2015-01-14 23:19:50.000000000","message":"also, implement in auth_token middleware","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"623c4bb608751cc28e59fde36ff388be779e7d6a","unresolved":false,"context_lines":[{"line_number":248,"context_line":"Documentation Impact"},{"line_number":249,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"Update the Keystone v3 token auth API with the new `x509` method."},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"References"},{"line_number":254,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":8,"id":"3a961159_9de27d2e","line":251,"updated":"2015-01-14 23:19:50.000000000","message":"also, python-keystoneclient and auth_token config\n\nAlso, how to set this up in keystone.","commit_id":"505b660e084cf7bd3369076391db9ddbf6b1cf57"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"084bb212e94b51e7669510bc9ae5a6698a52fb50","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"X.509 Client SSL Certificate Authentication"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp x509-ssl-client-cert-authn \u003chttps://blueprints.launchpad.net/keystone/+spec/x509-ssl-client-cert-authn\u003e`_"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_6bb2cfe6","line":8,"updated":"2015-01-20 15:53:52.000000000","message":"As a general point, maybe you should consider replacing \u0027SSL\u0027 with \u0027TLS\u0027, the last version of SSL was written in 1998 and is pretty damned awful. The security documentation for OpenStack recently went through a global replacement, not only s/SSL/TLS/g but also removing SSL3 guidance.","commit_id":"2fb25ef15af36b5dc8cc1621ae51babc466bc291"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"084bb212e94b51e7669510bc9ae5a6698a52fb50","unresolved":false,"context_lines":[{"line_number":23,"context_line":"prevalent, especially for the non-interactive service accounts such as nova,"},{"line_number":24,"context_line":"swift, etc. However, X.509 certificate based authentication is not limited to"},{"line_number":25,"context_line":"the service identities. It can be any identity. An X.509 certificate based"},{"line_number":26,"context_line":"authentication is successful if all of the following conditions are satisfied:"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"1. A two-way SSL session is successfully established between the client"},{"line_number":29,"context_line":"   and Keystone."}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_8550ca60","line":26,"updated":"2015-01-20 15:53:52.000000000","message":"I\u0027m not sure I agree with the assertion of the prevalence of client certificates, particularly throughout server architecture, however they\u0027re certainly widely enough used to justify addng this functionality to Keystone.","commit_id":"2fb25ef15af36b5dc8cc1621ae51babc466bc291"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"084bb212e94b51e7669510bc9ae5a6698a52fb50","unresolved":false,"context_lines":[{"line_number":29,"context_line":"   and Keystone."},{"line_number":30,"context_line":"2. The attributes from the client certificate subject DN map to an existing"},{"line_number":31,"context_line":"   Keystone user."},{"line_number":32,"context_line":"3. The Keystone user account is enabled."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The benefits of X.509 certificate based authentication include the following:"},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_e816c548","line":32,"updated":"2015-01-20 15:53:52.000000000","message":"It might be a good idea to be up-front about some of the other constraints here. Who signs client certs, what other properties in the client cert are verified (e.g check the expiry not just the DN) by keystone etc.","commit_id":"2fb25ef15af36b5dc8cc1621ae51babc466bc291"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"c2afdf6e27bbcca4b3f462090ca3bcc8509968ee","unresolved":false,"context_lines":[{"line_number":37,"context_line":"  Keystone supports token-binding, which binds a given token to a secondary"},{"line_number":38,"context_line":"  authentication mechanism. For example, when requesting a token, user may"},{"line_number":39,"context_line":"  optionally ask Keystone to bind the token to the Subject DN, serial number,"},{"line_number":40,"context_line":"  and issuer of user\u0027s X.509 SSL client certificate. Like Kerberose, binding"},{"line_number":41,"context_line":"  will be enforced by either auth_token middleware or, in the case of token"},{"line_number":42,"context_line":"  rescope, by Keystone token auth plugin. For example:"},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_08e32a07","line":40,"updated":"2015-01-19 23:12:55.000000000","message":"change \"Kerberose\" to \"Kerberos\"","commit_id":"2fb25ef15af36b5dc8cc1621ae51babc466bc291"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"084bb212e94b51e7669510bc9ae5a6698a52fb50","unresolved":false,"context_lines":[{"line_number":83,"context_line":"   attributes. Auth context is basically a Python dictionary, which represents"},{"line_number":84,"context_line":"   the ``credential`` used in Oslo policy enforcement. This functionality is"},{"line_number":85,"context_line":"   particularly useful for the service users because those accounts are highly"},{"line_number":86,"context_line":"   static. Furthermore, most, if not all production deployments use two-way"},{"line_number":87,"context_line":"   SSL for service-to-service communication. When deploying this middleware"},{"line_number":88,"context_line":"   at the service side, it can optionally map the certificate attributes"},{"line_number":89,"context_line":"   directly into identity headers (i.e. X-User-Name, X-Project-Name, etc)."}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_8bca9b6d","line":86,"updated":"2015-01-20 15:53:52.000000000","message":"perhaps \u0027mutually authenticated\u0027 is a more appropriate term than \u0027two-way\u0027","commit_id":"2fb25ef15af36b5dc8cc1621ae51babc466bc291"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"084bb212e94b51e7669510bc9ae5a6698a52fb50","unresolved":false,"context_lines":[{"line_number":162,"context_line":"---------------------"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"End user must have a valid X.509 client SSL certificate. However, end user"},{"line_number":165,"context_line":"certificate management is outside the scope of this spec."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"There will be a X.509 client SSL certificate auth plugin for"},{"line_number":168,"context_line":"python-keystoneclient. This plugin should be able to make use of the existing"}],"source_content_type":"text/x-rst","patch_set":9,"id":"3a961159_cbe1039d","line":165,"updated":"2015-01-20 15:53:52.000000000","message":"End user certificate management should indeed be outside the scope of this spec but specifying exactly what will be considered as a \u0027Valid\u0027 certificate by the server side should be discussed somewhere.","commit_id":"2fb25ef15af36b5dc8cc1621ae51babc466bc291"}]}