)]}'
{"specs/juno/keystone-websso.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"506aef42e1f6bb897aaa6d2b4cdce069591f283b","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Keystone Web Single Sign On"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp example \u003chttps://blueprints.launchpad.net/keystone/+spec/keystone-websso\u003e`_"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_43adec31","line":8,"updated":"2014-07-23 02:47:12.000000000","message":"sign-on","commit_id":"0b289f15cd9ba9c90a074acc0f417f5d58146280"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"506aef42e1f6bb897aaa6d2b4cdce069591f283b","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Keystone Web Single Sign On"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp example \u003chttps://blueprints.launchpad.net/keystone/+spec/keystone-websso\u003e`_"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_a3a4084c","line":9,"updated":"2014-07-23 02:47:12.000000000","message":"wrong amount of \u003d\u0027s","commit_id":"0b289f15cd9ba9c90a074acc0f417f5d58146280"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"506aef42e1f6bb897aaa6d2b4cdce069591f283b","unresolved":false,"context_lines":[{"line_number":25,"context_line":"SAML protocol extension ``Enhanced Client or Proxy (ECP)``."},{"line_number":26,"context_line":"As the ``ECP`` extension was designed for HTTP only clients, it is SAML2 (and"},{"line_number":27,"context_line":"similar protocols like OpenId Connect) that allow for authentication with"},{"line_number":28,"context_line":"webbrowsers.  Pure API access is important, but cloud users should also be able"},{"line_number":29,"context_line":"to fully benefit from webinterfaces."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_958f282e","line":28,"updated":"2014-07-23 02:47:12.000000000","message":"web browsers","commit_id":"0b289f15cd9ba9c90a074acc0f417f5d58146280"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"506aef42e1f6bb897aaa6d2b4cdce069591f283b","unresolved":false,"context_lines":[{"line_number":26,"context_line":"As the ``ECP`` extension was designed for HTTP only clients, it is SAML2 (and"},{"line_number":27,"context_line":"similar protocols like OpenId Connect) that allow for authentication with"},{"line_number":28,"context_line":"webbrowsers.  Pure API access is important, but cloud users should also be able"},{"line_number":29,"context_line":"to fully benefit from webinterfaces."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Proposed Change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_35801cf7","line":29,"updated":"2014-07-23 02:47:12.000000000","message":"web interfaces","commit_id":"0b289f15cd9ba9c90a074acc0f417f5d58146280"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"506aef42e1f6bb897aaa6d2b4cdce069591f283b","unresolved":false,"context_lines":[{"line_number":58,"context_line":"Alternatives"},{"line_number":59,"context_line":"------------"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"There is already proposed solution relying on oAuth2.0 potocol."},{"line_number":62,"context_line":"The full specification can be found `here \u003chttps://review.openstack.org/#/c/96867/\u003e`_"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baada198_f5da241c","line":61,"updated":"2014-07-23 02:47:12.000000000","message":"s/oAuth2.0 potocol./OAuth2.0 protocol.","commit_id":"0b289f15cd9ba9c90a074acc0f417f5d58146280"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0d5dd398a1b27ba983552617019973b5121f1499","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":" 1. With the browser, user enters the dashboard website and chooses his"},{"line_number":34,"context_line":"    authentication mechanism (federation)."},{"line_number":35,"context_line":" 2. Dashboard application redirects the user to a protected Keystone URL,"},{"line_number":36,"context_line":"    preferably ``/v3/OS-FEDERATION/websso/{protocol}``."},{"line_number":37,"context_line":" 3. Apache module initiates federated authentication workflow."},{"line_number":38,"context_line":" 4. User is being redirected to the IdP where he authenticates himself"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_77da35ea","line":35,"updated":"2014-07-25 03:48:58.000000000","message":"This implies it is mostly a Horizon use case and BP.  Does Keystone really need to morph to support this?","commit_id":"2bbd63e1e8c4f999de284a163cf4cde09bf8ce4b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3c89c7421abc23851ab0e487963de060152796ca","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":" 1. With the browser, user enters the dashboard website and chooses his"},{"line_number":34,"context_line":"    authentication mechanism (federation)."},{"line_number":35,"context_line":" 2. Dashboard application redirects the user to a protected Keystone URL,"},{"line_number":36,"context_line":"    preferably ``/v3/OS-FEDERATION/websso/{protocol}``."},{"line_number":37,"context_line":" 3. Apache module initiates federated authentication workflow."},{"line_number":38,"context_line":" 4. User is being redirected to the IdP where he authenticates himself"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_6fa7d2a8","line":35,"in_reply_to":"baada198_77da35ea","updated":"2014-08-01 01:27:01.000000000","message":"Yes. You don\u0027t want Horizon to act on behalf of yourself, you don\u0027t want pass your Red Hat credentials to Horizon operated by Rackspace. That\u0027s why you need to somehow start authN workflow directly with the Keystone, so Keystone later receives SAML assertion, maps it and produces an unscoped token. Keystone needs somehow pass that token to the Horizon. Simple HTTP redirect will not work, as HTTP headers are not persisted between the HTTP calls (which simply means X-Subject-Token header is lost)","commit_id":"2bbd63e1e8c4f999de284a163cf4cde09bf8ce4b"},{"author":{"_account_id":5956,"name":"Kristy Siu","email":"kwss@kent.ac.uk","username":"kwss"},"change_message_id":"08233a735dc57f1e531719a4e9d1ac1ab317b6f4","unresolved":false,"context_lines":[{"line_number":33,"context_line":" 1. With the browser, user enters the dashboard website and chooses his"},{"line_number":34,"context_line":"    authentication mechanism (federation)."},{"line_number":35,"context_line":" 2. Dashboard application redirects the user to a protected Keystone URL,"},{"line_number":36,"context_line":"    preferably ``/v3/OS-FEDERATION/websso/{protocol}``."},{"line_number":37,"context_line":" 3. Apache module initiates federated authentication workflow."},{"line_number":38,"context_line":" 4. User is being redirected to the IdP where he authenticates himself"},{"line_number":39,"context_line":"    (authentication method is out of scope of this blueprint)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_46614c37","line":36,"updated":"2014-07-23 14:19:16.000000000","message":"Does Keystone work as a WAYF service at this point? If so, does the protocol need to be passed or should the user have a choice of all available IdPs?","commit_id":"2bbd63e1e8c4f999de284a163cf4cde09bf8ce4b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"6cbb0351988c83285005322c7368fb7e9afab262","unresolved":false,"context_lines":[{"line_number":33,"context_line":" 1. With the browser, user enters the dashboard website and chooses his"},{"line_number":34,"context_line":"    authentication mechanism (federation)."},{"line_number":35,"context_line":" 2. Dashboard application redirects the user to a protected Keystone URL,"},{"line_number":36,"context_line":"    preferably ``/v3/OS-FEDERATION/websso/{protocol}``."},{"line_number":37,"context_line":" 3. Apache module initiates federated authentication workflow."},{"line_number":38,"context_line":" 4. User is being redirected to the IdP where he authenticates himself"},{"line_number":39,"context_line":"    (authentication method is out of scope of this blueprint)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_819a6e60","line":36,"in_reply_to":"baada198_46614c37","updated":"2014-07-23 14:32:31.000000000","message":"No, WAYF/Discovery Service would be configured with mod_shib etc. Separate service, just like it is done by design.","commit_id":"2bbd63e1e8c4f999de284a163cf4cde09bf8ce4b"},{"author":{"_account_id":5956,"name":"Kristy Siu","email":"kwss@kent.ac.uk","username":"kwss"},"change_message_id":"0aa2f5c0f9950ae5db92f57faf41f3b80f241ed0","unresolved":false,"context_lines":[{"line_number":33,"context_line":" 1. With the browser, user enters the dashboard website and chooses his"},{"line_number":34,"context_line":"    authentication mechanism (federation)."},{"line_number":35,"context_line":" 2. Dashboard application redirects the user to a protected Keystone URL,"},{"line_number":36,"context_line":"    preferably ``/v3/OS-FEDERATION/websso/{protocol}``."},{"line_number":37,"context_line":" 3. Apache module initiates federated authentication workflow."},{"line_number":38,"context_line":" 4. User is being redirected to the IdP where he authenticates himself"},{"line_number":39,"context_line":"    (authentication method is out of scope of this blueprint)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_ec48815e","line":36,"in_reply_to":"baada198_819a6e60","updated":"2014-07-23 14:44:30.000000000","message":"So how does the user know which protocols are available? As a user, I might know my IdP to select from the WAYF list, but not which protocol it uses. If my Keystone is protected by mod_shib and the openidc plugin for example, should the user already know which protocol he wants to use or should he be able to choose from a list of all available IdPs from which the protocol can be determined?","commit_id":"2bbd63e1e8c4f999de284a163cf4cde09bf8ce4b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3c89c7421abc23851ab0e487963de060152796ca","unresolved":false,"context_lines":[{"line_number":33,"context_line":" 1. With the browser, user enters the dashboard website and chooses his"},{"line_number":34,"context_line":"    authentication mechanism (federation)."},{"line_number":35,"context_line":" 2. Dashboard application redirects the user to a protected Keystone URL,"},{"line_number":36,"context_line":"    preferably ``/v3/OS-FEDERATION/websso/{protocol}``."},{"line_number":37,"context_line":" 3. Apache module initiates federated authentication workflow."},{"line_number":38,"context_line":" 4. User is being redirected to the IdP where he authenticates himself"},{"line_number":39,"context_line":"    (authentication method is out of scope of this blueprint)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_4f3a0e35","line":36,"in_reply_to":"baada198_b7e04d98","updated":"2014-08-01 01:27:01.000000000","message":"I think it\u0027s not a super common user case where company uses multiple federated protocols.It\u0027s up to the Horizon admins to add coresponding links saying: go there and use protocol X and go here in order to use protocol Y. And I believe in most of the cases there would be only one such link.","commit_id":"2bbd63e1e8c4f999de284a163cf4cde09bf8ce4b"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0d5dd398a1b27ba983552617019973b5121f1499","unresolved":false,"context_lines":[{"line_number":33,"context_line":" 1. With the browser, user enters the dashboard website and chooses his"},{"line_number":34,"context_line":"    authentication mechanism (federation)."},{"line_number":35,"context_line":" 2. Dashboard application redirects the user to a protected Keystone URL,"},{"line_number":36,"context_line":"    preferably ``/v3/OS-FEDERATION/websso/{protocol}``."},{"line_number":37,"context_line":" 3. Apache module initiates federated authentication workflow."},{"line_number":38,"context_line":" 4. User is being redirected to the IdP where he authenticates himself"},{"line_number":39,"context_line":"    (authentication method is out of scope of this blueprint)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_b7e04d98","line":36,"in_reply_to":"baada198_ec48815e","updated":"2014-07-25 03:48:58.000000000","message":"++","commit_id":"2bbd63e1e8c4f999de284a163cf4cde09bf8ce4b"},{"author":{"_account_id":5956,"name":"Kristy Siu","email":"kwss@kent.ac.uk","username":"kwss"},"change_message_id":"08233a735dc57f1e531719a4e9d1ac1ab317b6f4","unresolved":false,"context_lines":[{"line_number":38,"context_line":" 4. User is being redirected to the IdP where he authenticates himself"},{"line_number":39,"context_line":"    (authentication method is out of scope of this blueprint)"},{"line_number":40,"context_line":" 5. Upon successful authentication, the user is redirected to the"},{"line_number":41,"context_line":"    Keystone\u0027s URL endpoint ``/v3/OS-FEDERATION/websso/{protocol}`` again."},{"line_number":42,"context_line":" 6. Keystone discovers what IdP the user had authenticated with by reading"},{"line_number":43,"context_line":"    pre-configured variable passed in the SAML2 assertion issued by an IdP as"},{"line_number":44,"context_line":"    well as protocol by reading value specified in the URL."}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_66b49082","line":41,"updated":"2014-07-23 14:19:16.000000000","message":"This redirect will be under control of the IdP (at least in SAML2) as it is specified in the SP metadata.\n\nSo my question is, can the IdP distinguish between WebSSO and ECP and perform a different redirect for each?","commit_id":"2bbd63e1e8c4f999de284a163cf4cde09bf8ce4b"},{"author":{"_account_id":5956,"name":"Kristy Siu","email":"kwss@kent.ac.uk","username":"kwss"},"change_message_id":"0aa2f5c0f9950ae5db92f57faf41f3b80f241ed0","unresolved":false,"context_lines":[{"line_number":38,"context_line":" 4. User is being redirected to the IdP where he authenticates himself"},{"line_number":39,"context_line":"    (authentication method is out of scope of this blueprint)"},{"line_number":40,"context_line":" 5. Upon successful authentication, the user is redirected to the"},{"line_number":41,"context_line":"    Keystone\u0027s URL endpoint ``/v3/OS-FEDERATION/websso/{protocol}`` again."},{"line_number":42,"context_line":" 6. Keystone discovers what IdP the user had authenticated with by reading"},{"line_number":43,"context_line":"    pre-configured variable passed in the SAML2 assertion issued by an IdP as"},{"line_number":44,"context_line":"    well as protocol by reading value specified in the URL."}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_4164d620","line":41,"in_reply_to":"baada198_61ae3a83","updated":"2014-07-23 14:44:30.000000000","message":"Ok I think so, I think I was confused and my question was irrelevant now I think about it.","commit_id":"2bbd63e1e8c4f999de284a163cf4cde09bf8ce4b"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"6cbb0351988c83285005322c7368fb7e9afab262","unresolved":false,"context_lines":[{"line_number":38,"context_line":" 4. User is being redirected to the IdP where he authenticates himself"},{"line_number":39,"context_line":"    (authentication method is out of scope of this blueprint)"},{"line_number":40,"context_line":" 5. Upon successful authentication, the user is redirected to the"},{"line_number":41,"context_line":"    Keystone\u0027s URL endpoint ``/v3/OS-FEDERATION/websso/{protocol}`` again."},{"line_number":42,"context_line":" 6. Keystone discovers what IdP the user had authenticated with by reading"},{"line_number":43,"context_line":"    pre-configured variable passed in the SAML2 assertion issued by an IdP as"},{"line_number":44,"context_line":"    well as protocol by reading value specified in the URL."}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_61ae3a83","line":41,"in_reply_to":"baada198_66b49082","updated":"2014-07-23 14:32:31.000000000","message":"Usually you need to put some values in your HTTP headers to indicate you want to use ECP, does it answer your question?","commit_id":"2bbd63e1e8c4f999de284a163cf4cde09bf8ce4b"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"0d5dd398a1b27ba983552617019973b5121f1499","unresolved":false,"context_lines":[{"line_number":144,"context_line":""},{"line_number":145,"context_line":"References"},{"line_number":146,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"* `Proof of concept for django-openstack-auth PoC for handling dashboard"},{"line_number":149,"context_line":"  federated authentication \u003chttps://review.openstack.org/#/c/106131\u003e`_"},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"baada198_7753156c","line":147,"updated":"2014-07-25 03:48:58.000000000","message":"Add a link to the WebSSO spec that you are looking to support.","commit_id":"2bbd63e1e8c4f999de284a163cf4cde09bf8ce4b"}]}