)]}'
{"specs/juno/unscoped-catalog.rst":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d07cd315a4155062048f1f92ba9a38d2088a68c4","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`unscoped-catalog \u003chttps://blueprints.launchpad.net/keystone/+spec/unscoped-catalog\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"The flow of an unscoped token is to use it to communicate with the identity"},{"line_number":14,"context_line":"server. However we don\u0027t really know what identity server we should send it to"},{"line_number":15,"context_line":"we just send it to the auth_url."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_b75e8d11","line":14,"updated":"2014-07-18 19:36:38.000000000","message":"This sounds like a problem statement not a title, maybe change to:\n\nEnsure we can easily discover the appropriate identity service endpoint when we start with an unstopped token.","commit_id":"7fb36dd026073f15d8adceeb9c8b3f433eac13fc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"eff212ec019b93059b85f06687157f938f342298","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`unscoped-catalog \u003chttps://blueprints.launchpad.net/keystone/+spec/unscoped-catalog\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"The flow of an unscoped token is to use it to communicate with the identity"},{"line_number":14,"context_line":"server. However we don\u0027t really know what identity server we should send it to"},{"line_number":15,"context_line":"we just send it to the auth_url."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_55efd71c","line":14,"in_reply_to":"baada198_b75e8d11","updated":"2014-07-20 00:58:19.000000000","message":"Done","commit_id":"7fb36dd026073f15d8adceeb9c8b3f433eac13fc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f289c531e6c690bce7093508a4feb6995836d455","unresolved":false,"context_lines":[{"line_number":30,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"I propose we add a service catalog consisting purely of the identity endpoints"},{"line_number":33,"context_line":"to unscoped tokens."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Alternatives"},{"line_number":36,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_81022b3c","line":33,"updated":"2014-07-18 18:54:06.000000000","message":"So the workflow for this would be: \n\n    1.) I obtain an unscoped token\n    2.) I use that unscoped token to get a service catalog containing only Keystone endpoints? \n    3.) I then interact with the identity endpoint that I need/want? \n\nIs that right?","commit_id":"7fb36dd026073f15d8adceeb9c8b3f433eac13fc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"eff212ec019b93059b85f06687157f938f342298","unresolved":false,"context_lines":[{"line_number":30,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"I propose we add a service catalog consisting purely of the identity endpoints"},{"line_number":33,"context_line":"to unscoped tokens."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Alternatives"},{"line_number":36,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_f5df0b64","line":33,"in_reply_to":"baada198_81022b3c","updated":"2014-07-20 00:58:19.000000000","message":"No, it means that the unscoped token will include a service catalog containing the keystone endoints, then use that endpoint to list the projects you can scope to.","commit_id":"7fb36dd026073f15d8adceeb9c8b3f433eac13fc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f289c531e6c690bce7093508a4feb6995836d455","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"I propose we add a service catalog consisting purely of the identity endpoints"},{"line_number":33,"context_line":"to unscoped tokens."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Alternatives"},{"line_number":36,"context_line":"------------"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_810ceb43","line":34,"updated":"2014-07-18 18:54:06.000000000","message":"It would be nice to have a documented list of *how* this benefits the clients. \n\nFrom line 89 - 90, it says this will benefit the clients, but an explicit list of \"Hey, now that we can do service catalogs with unscoped tokens, you can do X, Y, and Z!\" \n\nThoughts?","commit_id":"7fb36dd026073f15d8adceeb9c8b3f433eac13fc"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"eff212ec019b93059b85f06687157f938f342298","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"I propose we add a service catalog consisting purely of the identity endpoints"},{"line_number":33,"context_line":"to unscoped tokens."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Alternatives"},{"line_number":36,"context_line":"------------"},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_95716f79","line":34,"in_reply_to":"baada198_810ceb43","updated":"2014-07-20 00:58:19.000000000","message":"I meant more from this that the existing keystoneclient and CLI already do some dumb things in assuming that there is always going to be a URL from the service catalog. If we do add it then it will be improved automatically there.","commit_id":"7fb36dd026073f15d8adceeb9c8b3f433eac13fc"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f289c531e6c690bce7093508a4feb6995836d455","unresolved":false,"context_lines":[{"line_number":55,"context_line":"There is a very serious problem here as to whether people use the presence of a"},{"line_number":56,"context_line":"service catalog within a token to tell if a token is scoped or not. I\u0027m not"},{"line_number":57,"context_line":"sure as to how the repercussions of changing this expectation would impact"},{"line_number":58,"context_line":"users."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"Performance Impact"},{"line_number":61,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_c17d03b4","line":58,"updated":"2014-07-18 18:54:06.000000000","message":"Can we post something to the mailing list (or maybe we already have) on this, and link it here?","commit_id":"7fb36dd026073f15d8adceeb9c8b3f433eac13fc"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dba541df5f959ddd9ad74bfdbb27e68057251851","unresolved":false,"context_lines":[{"line_number":56,"context_line":"Other End User Impact"},{"line_number":57,"context_line":"---------------------"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"There is a very serious problem here as to whether people use the presence of a"},{"line_number":60,"context_line":"service catalog within a token to tell if a token is scoped or not. I\u0027m not"},{"line_number":61,"context_line":"sure as to how the repercussions of changing this expectation would impact"},{"line_number":62,"context_line":"users."}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_b0c0417d","line":59,"updated":"2014-07-20 05:14:03.000000000","message":"do we really think this is true? (it sounds, as written, scary)...most of the time I\u0027ve seen, the code looks to see if there is project_id in the token....I guess there is  small risk here, just not sure it is as serious as this is written...","commit_id":"cb4ea522a475b9d768b3e616392009c033bd1186"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"6f96ddd60420a1f4eba5681a7d67c80a1f5c6c2a","unresolved":false,"context_lines":[{"line_number":56,"context_line":"Other End User Impact"},{"line_number":57,"context_line":"---------------------"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"There is a very serious problem here as to whether people use the presence of a"},{"line_number":60,"context_line":"service catalog within a token to tell if a token is scoped or not. I\u0027m not"},{"line_number":61,"context_line":"sure as to how the repercussions of changing this expectation would impact"},{"line_number":62,"context_line":"users."}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_4bbd73b0","line":59,"in_reply_to":"baada198_b0c0417d","updated":"2014-07-21 00:31:15.000000000","message":"Probably not, I was basing this from memory on:\n\nhttps://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/access.py#n464\n\nand\n\nhttps://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/access.py#n659 (which is just wrong) \n\nThere is somewhere else i remember seeing a similar catalog check that i don\u0027t quite remember.\n\nBoth check for the presence of a catalog as part of the scoped check. It appears that they also do other stuff though so we should be ok.","commit_id":"cb4ea522a475b9d768b3e616392009c033bd1186"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bb94b2e3f485ec03cb81d01926f71f735462ffd2","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"The flow of an unscoped token is to use it to communicate with the identity"},{"line_number":14,"context_line":"server. Ensure that we can easily discover the appropriate identity service"},{"line_number":15,"context_line":"endpoint when we start with an unstopped token."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"baada198_6855c11c","line":15,"updated":"2014-07-21 17:01:09.000000000","message":"unstopped or unscoped?","commit_id":"74abfc3487450e79d017cc7251606550472cba2b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"8fddb81fab0cd60e8c1bcb12e83194a126537bb9","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This is really a pain from a client usability perspective because it means that"},{"line_number":26,"context_line":"for certain requests if no catalog is available we should issue it against the"},{"line_number":27,"context_line":"auth_url."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Proposed Change"},{"line_number":30,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"baada198_fc8a0819","line":27,"updated":"2014-07-23 05:59:44.000000000","message":"I don\u0027t understand why we need this. The flow is exactly the same as any other services.\n\nFlow where authentication is needed:\n\n 1) user supply username/password/project and auth_url to auth plugin\n 2) auth plugin talk to Keystone to authenticate and get a scoped token, service URL then extracted from the service catalog\n 3) keystone session uses the acquired token and service URL to talk to the service to do stuff\n\nFlow where authentication is not needed:\n\n 1) user supply a scoped token and service URL to (token) auth plugin\n 2) keystone session uses the service URL and the supplied token to talk to the service to do stuff\n\nKeystone is just another service. If user supply an unscoped token and service URL (in this case same as auth_url), Keystone client should be able to use them to talk to Keystone to do stuff. Like list the users projects and domains associated with the user.","commit_id":"a5be2bfb5f2cd74a2a2293892440f0d5f8a56bce"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"0243911f49b98ef7ea0a7d979a59a93f8feee739","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This is really a pain from a client usability perspective because it means that"},{"line_number":26,"context_line":"for certain requests if no catalog is available we should issue it against the"},{"line_number":27,"context_line":"auth_url."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Proposed Change"},{"line_number":30,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa98f980_9bf0a5ff","line":27,"in_reply_to":"baada198_af872a11","updated":"2014-09-04 05:15:26.000000000","message":"I\u0027m not exactly sure - if we do the service catalog then it will be version discovered in the same way as all the other services. I don\u0027t think we can do service discovery on the AUTH_URL.\n\nTake for example i create a v2.Password(\u0027http://host/v2.0/\u0027, ...) there is no reason that i shouldn\u0027t be able to call /v3/auth/projects and list what i can scope to with that token. Every other v3 service accepts a v2 token. There\u0027s no good way that i can do discovery from the auth_url and figure out where to send that.","commit_id":"a5be2bfb5f2cd74a2a2293892440f0d5f8a56bce"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"9d78cee10190dc970bc7a848346aa7e76c46b701","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This is really a pain from a client usability perspective because it means that"},{"line_number":26,"context_line":"for certain requests if no catalog is available we should issue it against the"},{"line_number":27,"context_line":"auth_url."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Proposed Change"},{"line_number":30,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"baada198_af872a11","line":27,"in_reply_to":"baada198_b9d4f4e9","updated":"2014-07-24 16:54:28.000000000","message":"Jamie, I think I understand what the problem is. Your last point is interesting though. But yeah, if we ever have a non-token auth like Kerberos, we\u0027d be screwed. How is this thing play our with version discovery? Keystoneclient does version discovery based of auth_url and exchange it for a version-specific URL. But with non-token auth, this won\u0027t work would it?","commit_id":"a5be2bfb5f2cd74a2a2293892440f0d5f8a56bce"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"372312c56af2e08e2456a7107fc10c1447499e75","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"This is really a pain from a client usability perspective because it means that"},{"line_number":26,"context_line":"for certain requests if no catalog is available we should issue it against the"},{"line_number":27,"context_line":"auth_url."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Proposed Change"},{"line_number":30,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"baada198_b9d4f4e9","line":27,"in_reply_to":"baada198_fc8a0819","updated":"2014-07-24 01:42:22.000000000","message":"The target here is not whether or not you are given a service url for example by OS_SERVICE_URL. It\u0027s the difference in dealing with a scoped and unscoped token in a normal authentication flow.\n\nIn the standard workflow i just say get me this path from service X eg, /images from glance, or /users from keystone. In the unscoped instance there are calls that we need to make against keystone, like list the projects that i can be scoped to, and because of default_project_ids this is allowed from a scoped token.\n\nThe scoped token flow is easy because it\u0027s the same as every other call, just get /users/{user_id}/projects from keystone. The unscoped token flow means i need to dig out the auth_url and make the request to a full URL. This leads to nasty hacks like: https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/v2_0/tenants.py#L117-L125 where if you have a service url well then you can use that otherwise let\u0027s replace the service url with the auth url for just this one call. I know we\u0027ll have to support this case forever but that\u0027s not a reason not to improve it.\n\nIt also causes problems when your AUTH_URL is specific to a httpd module like we had with kerberos. If your AUTH_URL is http://keystone.host:5000/v3/kerb and you try the above hack you\u0027re going to end up asking for projects at /v3/kerb/users/... which is probably not implemented.","commit_id":"a5be2bfb5f2cd74a2a2293892440f0d5f8a56bce"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"481332fc5e6798aea89911a7d60b046485970a77","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"There is a possible concern as in that users may be using the presence of a"},{"line_number":60,"context_line":"service catalog within a token to tell if a token is scoped or not. This can be"},{"line_number":61,"context_line":"considered bad practice and scope should be correctly determined."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Performance Impact"},{"line_number":64,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"da9df570_0e14be4c","line":61,"updated":"2014-09-24 15:07:55.000000000","message":"Will refactoring this code be a work item of this blueprint?","commit_id":"a5be2bfb5f2cd74a2a2293892440f0d5f8a56bce"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"927f07c3f5cbcbbcd3a5933e53138d7cc6e7ada1","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"There is a possible concern as in that users may be using the presence of a"},{"line_number":60,"context_line":"service catalog within a token to tell if a token is scoped or not. This can be"},{"line_number":61,"context_line":"considered bad practice and scope should be correctly determined."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Performance Impact"},{"line_number":64,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9aa7fdbe_4727b6b6","line":61,"in_reply_to":"da9df570_0e14be4c","updated":"2014-10-21 13:25:43.000000000","message":"The only thing i\u0027m aware of at this time is that tempest has a test which ensures that an unscoped catalog doesn\u0027t have a catalog. \n\nMost of this work would be in other repositories so it doesn\u0027t really matter which blueprint it\u0027s under i would think.","commit_id":"a5be2bfb5f2cd74a2a2293892440f0d5f8a56bce"}],"specs/kilo/unscoped-catalog.rst":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5f9a6b58701242490596ae3b2641757db23bc853","unresolved":false,"context_lines":[{"line_number":34,"context_line":"token, then list available projects (or domains) that can be scoped to then"},{"line_number":35,"context_line":"retrieve a scoped token still applies, however now the URL that we use to"},{"line_number":36,"context_line":"contact the identity service to list projects should be retrieved from the"},{"line_number":37,"context_line":"service catalog rather than the original authentication URL."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Alternatives"},{"line_number":40,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_97668db9","line":37,"updated":"2014-10-28 00:38:35.000000000","message":"As long as the /v3/auth/catalog interface also works for unstopped tokens, I think this is 100% reasonable.\n\nIs there a benefit to including the unstopped token catalog directly or requesting the data separately -- or one step further, providing the catalog in the response to getting the token but not in the token body itself:\n\n     { \"token\": \u003ctoken_body\u003e,\n        \"catalog\": \u003ccatalog\u003e\n     }\n\nOr should *all* tokens contain the identity endpoint information and the catalog is sourced independently (e.g. as above or as an explicit call to /v3/auth/catalog)?","commit_id":"58175b29b84f7a9cf3c65d85eeaf4b12ac78ccff"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0711c94d811b3949c56adfa8029f17fc834698b6","unresolved":false,"context_lines":[{"line_number":34,"context_line":"token, then list available projects (or domains) that can be scoped to then"},{"line_number":35,"context_line":"retrieve a scoped token still applies, however now the URL that we use to"},{"line_number":36,"context_line":"contact the identity service to list projects should be retrieved from the"},{"line_number":37,"context_line":"service catalog rather than the original authentication URL."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Alternatives"},{"line_number":40,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_56bfa1d0","line":37,"in_reply_to":"5a890539_54ef6287","updated":"2014-12-07 19:29:48.000000000","message":"Wow, autocorrect unscoped -\u003e unstopped somehow...\n\n@marek, my point was that as long as the catalog API works for unscoped tokens the change is reasonable.\n\nI am still curious if it would benefit us to supply the catalog as shown in my previous comment (with either a query-param or such) and make the new form of unscoped tokens that need the catalog to work like that (same w/ keystoneclient/osc for all requests going forward if keystone).","commit_id":"58175b29b84f7a9cf3c65d85eeaf4b12ac78ccff"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"4e7c16a5cdb026054cfa4826d56a7124daff4116","unresolved":false,"context_lines":[{"line_number":34,"context_line":"token, then list available projects (or domains) that can be scoped to then"},{"line_number":35,"context_line":"retrieve a scoped token still applies, however now the URL that we use to"},{"line_number":36,"context_line":"contact the identity service to list projects should be retrieved from the"},{"line_number":37,"context_line":"service catalog rather than the original authentication URL."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Alternatives"},{"line_number":40,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_54ef6287","line":37,"in_reply_to":"9aa7fdbe_97668db9","updated":"2014-11-12 08:38:45.000000000","message":"@Mogan, did you mean to write \"[...] I think this is 100% reasonable\" or rather \"I *don\u0027t* think this is 100% reasonable\" ?","commit_id":"58175b29b84f7a9cf3c65d85eeaf4b12ac78ccff"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"4e7c16a5cdb026054cfa4826d56a7124daff4116","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"We continue to keep unscoped tokens without a catalog. There will be some"},{"line_number":43,"context_line":"requests that may need to be issued differently depending on the presence of a"},{"line_number":44,"context_line":"service catalog."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Security Impact"},{"line_number":47,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_94e9ca82","line":44,"updated":"2014-11-12 08:38:45.000000000","message":"How about listing possibility of using /v3/auth/catalog and writing some new code in keystoneclient here?","commit_id":"58175b29b84f7a9cf3c65d85eeaf4b12ac78ccff"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0711c94d811b3949c56adfa8029f17fc834698b6","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"We continue to keep unscoped tokens without a catalog. There will be some"},{"line_number":43,"context_line":"requests that may need to be issued differently depending on the presence of a"},{"line_number":44,"context_line":"service catalog."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Security Impact"},{"line_number":47,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3a961159_36a135aa","line":44,"in_reply_to":"5a890539_94e9ca82","updated":"2014-12-07 19:29:48.000000000","message":"Sure, if another patch is required, this should be added as an alternative.","commit_id":"58175b29b84f7a9cf3c65d85eeaf4b12ac78ccff"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"58b8075cdbfc3e847ad30d303eaf89c74f075ff9","unresolved":false,"context_lines":[{"line_number":56,"context_line":"Other End User Impact"},{"line_number":57,"context_line":"---------------------"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"There is a possible concern as in that users may be using the presence of a"},{"line_number":60,"context_line":"service catalog within a token to tell if a token is scoped or not. This can be"},{"line_number":61,"context_line":"considered bad practice and scope should be correctly determined."},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a930d6b_932d17ab","line":59,"updated":"2015-01-24 06:54:02.000000000","message":"So if this occurs and someone complains that we broke backward compatibility I wanted to make sure we had a good answer. I went back and read the token session of https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst  It clearly states that catalog is an optional attribute and there is no language that states that with an unscoped token that you are guaranteed to not get a catalog back.  So I think we have a very good answer should someone complain this broke them.","commit_id":"58175b29b84f7a9cf3c65d85eeaf4b12ac78ccff"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"87874ff6721e6877a74158568fc2af127b9a5a2e","unresolved":false,"context_lines":[{"line_number":56,"context_line":"Other End User Impact"},{"line_number":57,"context_line":"---------------------"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"There is a possible concern as in that users may be using the presence of a"},{"line_number":60,"context_line":"service catalog within a token to tell if a token is scoped or not. This can be"},{"line_number":61,"context_line":"considered bad practice and scope should be correctly determined."},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa81d914_945ba253","line":59,"in_reply_to":"1a930d6b_932d17ab","updated":"2015-01-28 16:26:02.000000000","message":"This covers my concerns. We should add this to the API docs to clearly say a catalog is going to come back now. I\u0027m going to approve this as-is and will either have you, jamie, or myself circle back with the API change.","commit_id":"58175b29b84f7a9cf3c65d85eeaf4b12ac78ccff"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"58e5a4f6ce5931791ba3515d00e23a9c1645e5de","unresolved":false,"context_lines":[{"line_number":56,"context_line":"Other End User Impact"},{"line_number":57,"context_line":"---------------------"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"There is a possible concern as in that users may be using the presence of a"},{"line_number":60,"context_line":"service catalog within a token to tell if a token is scoped or not. This can be"},{"line_number":61,"context_line":"considered bad practice and scope should be correctly determined."},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa81d914_a82f65a0","line":59,"in_reply_to":"fa81d914_945ba253","updated":"2015-01-28 17:40:17.000000000","message":"Sounds like a plan. I am happy to do the API change","commit_id":"58175b29b84f7a9cf3c65d85eeaf4b12ac78ccff"}]}