)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"48647b09a74e5e0f997bc8f2fbb9d5452d17ae32","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add an extension to store domain specific configuration in SQL."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Partially implements: bp domain-config-ext"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: Iddf27484822c06a1292ddb92584a0e3fe4f44494"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"da9df570_31cf27b2","line":9,"updated":"2014-09-24 15:19:34.000000000","message":"Where will the rest of the implementation for bp domain-config-ext live?","commit_id":"51e80974937ead87c39cdc235489fa942e20651b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"160a9c92f2dc98acf1c6f0444ad673cce245ce0e","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add an extension to store domain specific configuration in SQL."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Partially implements: bp domain-config-ext"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: Iddf27484822c06a1292ddb92584a0e3fe4f44494"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"da9df570_b18f97cb","line":9,"in_reply_to":"da9df570_31cf27b2","updated":"2014-10-01 14:38:59.000000000","message":"So I put partially since I didn\u0027t want the merge of this spec to mark the blueprint complete...that\u0027s for the code commit to do!","commit_id":"51e80974937ead87c39cdc235489fa942e20651b"}],"api/v3/identity-api-v3.rst":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"37f0114a5d68353d060a24cb3ba9bd4ab7f7a2a7","unresolved":false,"context_lines":[{"line_number":872,"context_line":"  Domain specific configuration options, structured within their group objects."},{"line_number":873,"context_line":"  Currently only the ``identity`` and ``ldap`` groups are supported, and these"},{"line_number":874,"context_line":"  will be used to override the default configuration settings for the storage"},{"line_number":875,"context_line":"  of users and groups by the identity server. Attempting to set configuration"},{"line_number":876,"context_line":"  options for groups other than ``identity`` and ``ldap`` will result in an"},{"line_number":877,"context_line":"  HTTP 403 Forbidden."},{"line_number":878,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_57dc7b74","line":875,"updated":"2015-01-14 18:41:14.000000000","message":"Think \"identity\" should be in upper case: https://wiki.openstack.org/wiki/Documentation/Conventions#Service_and_project_names","commit_id":"da032a2b6477e81610fb76197981eff88d69ad7f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"417205caf75ebf52dfa4555dce7b5a4daa5a3e1a","unresolved":false,"context_lines":[{"line_number":873,"context_line":"  Currently only the ``identity`` and ``ldap`` groups are supported, and these"},{"line_number":874,"context_line":"  will be used to override the default configuration settings for the storage"},{"line_number":875,"context_line":"  of users and groups by the identity server. Attempting to set configuration"},{"line_number":876,"context_line":"  options for groups other than ``identity`` and ``ldap`` will result in an"},{"line_number":877,"context_line":"  HTTP 403 Forbidden."},{"line_number":878,"context_line":""},{"line_number":879,"context_line":"- ``description`` (string)"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_39128858","line":876,"updated":"2015-01-14 17:43:00.000000000","message":"Don\u0027t we support assignment for LDAP?  Are we going to get rid off  assignment for LDAP?","commit_id":"da032a2b6477e81610fb76197981eff88d69ad7f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"424120e07ea207148108d759b73be3710cf79fe0","unresolved":false,"context_lines":[{"line_number":873,"context_line":"  Currently only the ``identity`` and ``ldap`` groups are supported, and these"},{"line_number":874,"context_line":"  will be used to override the default configuration settings for the storage"},{"line_number":875,"context_line":"  of users and groups by the identity server. Attempting to set configuration"},{"line_number":876,"context_line":"  options for groups other than ``identity`` and ``ldap`` will result in an"},{"line_number":877,"context_line":"  HTTP 403 Forbidden."},{"line_number":878,"context_line":""},{"line_number":879,"context_line":"- ``description`` (string)"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_4cd4741f","line":876,"in_reply_to":"3a961159_39128858","updated":"2015-01-19 15:30:37.000000000","message":"currently, I am only proposing that we support the domain-specifc parts of this...which is only supported for LDAP","commit_id":"da032a2b6477e81610fb76197981eff88d69ad7f"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"417205caf75ebf52dfa4555dce7b5a4daa5a3e1a","unresolved":false,"context_lines":[{"line_number":892,"context_line":"::"},{"line_number":893,"context_line":""},{"line_number":894,"context_line":"    {"},{"line_number":895,"context_line":"        \"domain\": {"},{"line_number":896,"context_line":"            \"config\": {"},{"line_number":897,"context_line":"                \"identity\": {"},{"line_number":898,"context_line":"                    \"driver\": \"keystone.identity.backends.ldap.Identity\""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_b9a038a6","line":895,"updated":"2015-01-14 17:43:00.000000000","message":"Is this the correct approach?\n\nDo we really want to expose config information to the caller?  \n\n1) A user who calls GET domains/\u003cdomain_id\u003e is going to get config information which is a security hole\n2) If it is configured to use SQL backend, I believe  you are not going to return the config  strucrture which may cause confusion.\n\n\nWhy can\u0027t we have a different resource for domain configuration?\n\n  GET domains/\u003cdomainId\u003e/config  \n1) If we separate this out as a different resource we can have different access control for it","commit_id":"da032a2b6477e81610fb76197981eff88d69ad7f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"424120e07ea207148108d759b73be3710cf79fe0","unresolved":false,"context_lines":[{"line_number":892,"context_line":"::"},{"line_number":893,"context_line":""},{"line_number":894,"context_line":"    {"},{"line_number":895,"context_line":"        \"domain\": {"},{"line_number":896,"context_line":"            \"config\": {"},{"line_number":897,"context_line":"                \"identity\": {"},{"line_number":898,"context_line":"                    \"driver\": \"keystone.identity.backends.ldap.Identity\""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_8c101c02","line":895,"in_reply_to":"3a961159_57c39b89","updated":"2015-01-19 15:30:37.000000000","message":"So I\u0027m happy to have this as a separate resource.....it was one of the alternatives I suggested","commit_id":"da032a2b6477e81610fb76197981eff88d69ad7f"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"37f0114a5d68353d060a24cb3ba9bd4ab7f7a2a7","unresolved":false,"context_lines":[{"line_number":892,"context_line":"::"},{"line_number":893,"context_line":""},{"line_number":894,"context_line":"    {"},{"line_number":895,"context_line":"        \"domain\": {"},{"line_number":896,"context_line":"            \"config\": {"},{"line_number":897,"context_line":"                \"identity\": {"},{"line_number":898,"context_line":"                    \"driver\": \"keystone.identity.backends.ldap.Identity\""}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_57c39b89","line":895,"in_reply_to":"3a961159_b9a038a6","updated":"2015-01-14 18:41:14.000000000","message":"+1\n\nMaybe I lost some discussions, but why this need to be part of the domain object? Why not be a separate object like mappings for federation?","commit_id":"da032a2b6477e81610fb76197981eff88d69ad7f"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"bf593dcadad0f47ac192885e15c936f535c3dd7f","unresolved":false,"context_lines":[{"line_number":3067,"context_line":"                \"driver\": \"keystone.identity.backends.ldap.Identity\""},{"line_number":3068,"context_line":"            },"},{"line_number":3069,"context_line":"            \"ldap\": {"},{"line_number":3070,"context_line":"                \"url\": \"http://myldap/root\""},{"line_number":3071,"context_line":"                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmyroot,dc\u003dorg\""},{"line_number":3072,"context_line":"            }"},{"line_number":3073,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a961159_a5131fb6","line":3070,"updated":"2015-01-19 22:40:42.000000000","message":"Missing a comma at the end of this line","commit_id":"ff495bfa2da8c00f43e2db33c55eb62415693cc8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c399c2937eb97f706cb70bacb8eb1fb1e17a2e47","unresolved":false,"context_lines":[{"line_number":3067,"context_line":"                \"driver\": \"keystone.identity.backends.ldap.Identity\""},{"line_number":3068,"context_line":"            },"},{"line_number":3069,"context_line":"            \"ldap\": {"},{"line_number":3070,"context_line":"                \"url\": \"http://myldap/root\""},{"line_number":3071,"context_line":"                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmyroot,dc\u003dorg\""},{"line_number":3072,"context_line":"            }"},{"line_number":3073,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a961159_e53c47e4","line":3070,"in_reply_to":"3a961159_a5131fb6","updated":"2015-01-19 22:52:48.000000000","message":"Done","commit_id":"ff495bfa2da8c00f43e2db33c55eb62415693cc8"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"bf593dcadad0f47ac192885e15c936f535c3dd7f","unresolved":false,"context_lines":[{"line_number":3080,"context_line":"configuration options for groups other than ``identity`` and ``ldap`` will"},{"line_number":3081,"context_line":"result in an HTTP 403 Forbidden."},{"line_number":3082,"context_line":""},{"line_number":3083,"context_line":"Domain specific configruation options can also be updated and deleted using"},{"line_number":3084,"context_line":"the PATCH and DELETE HTTP commands. When updating, it is only necessary to"},{"line_number":3085,"context_line":"include those options that are being updated, for example:"},{"line_number":3086,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a961159_85754302","line":3083,"updated":"2015-01-19 22:40:42.000000000","message":"s/configruation/configuration","commit_id":"ff495bfa2da8c00f43e2db33c55eb62415693cc8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c399c2937eb97f706cb70bacb8eb1fb1e17a2e47","unresolved":false,"context_lines":[{"line_number":3080,"context_line":"configuration options for groups other than ``identity`` and ``ldap`` will"},{"line_number":3081,"context_line":"result in an HTTP 403 Forbidden."},{"line_number":3082,"context_line":""},{"line_number":3083,"context_line":"Domain specific configruation options can also be updated and deleted using"},{"line_number":3084,"context_line":"the PATCH and DELETE HTTP commands. When updating, it is only necessary to"},{"line_number":3085,"context_line":"include those options that are being updated, for example:"},{"line_number":3086,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a961159_251e4f75","line":3083,"in_reply_to":"3a961159_85754302","updated":"2015-01-19 22:52:48.000000000","message":"Done","commit_id":"ff495bfa2da8c00f43e2db33c55eb62415693cc8"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"bf593dcadad0f47ac192885e15c936f535c3dd7f","unresolved":false,"context_lines":[{"line_number":3108,"context_line":"                \"driver\": \"keystone.identity.backends.ldap.Identity\""},{"line_number":3109,"context_line":"            },"},{"line_number":3110,"context_line":"            \"ldap\": {"},{"line_number":3111,"context_line":"                \"url\": \"http://myldap/my_new_root\""},{"line_number":3112,"context_line":"                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmyroot,dc\u003dorg\""},{"line_number":3113,"context_line":"            }"},{"line_number":3114,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a961159_e58447d5","line":3111,"updated":"2015-01-19 22:40:42.000000000","message":"Missing a comma at the end of this line","commit_id":"ff495bfa2da8c00f43e2db33c55eb62415693cc8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c399c2937eb97f706cb70bacb8eb1fb1e17a2e47","unresolved":false,"context_lines":[{"line_number":3108,"context_line":"                \"driver\": \"keystone.identity.backends.ldap.Identity\""},{"line_number":3109,"context_line":"            },"},{"line_number":3110,"context_line":"            \"ldap\": {"},{"line_number":3111,"context_line":"                \"url\": \"http://myldap/my_new_root\""},{"line_number":3112,"context_line":"                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmyroot,dc\u003dorg\""},{"line_number":3113,"context_line":"            }"},{"line_number":3114,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a961159_052153b5","line":3111,"in_reply_to":"3a961159_e58447d5","updated":"2015-01-19 22:52:48.000000000","message":"Done","commit_id":"ff495bfa2da8c00f43e2db33c55eb62415693cc8"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"37fe6076e12c992dd7c44f26d4cb57371df27008","unresolved":false,"context_lines":[{"line_number":3084,"context_line":""},{"line_number":3085,"context_line":"::"},{"line_number":3086,"context_line":""},{"line_number":3087,"context_line":"    GET /domains/{domain_id}/config/group/ldap"},{"line_number":3088,"context_line":""},{"line_number":3089,"context_line":"Response:"},{"line_number":3090,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_d983b201","line":3087,"updated":"2015-01-20 02:46:55.000000000","message":"I would suggest removing \u0027/group\u0027, since there is no \u0027group\u0027 inside the dict when we request\n\n    GET /domains/{domain_id}/config\n\nWe get:\n    {\n        \"config\": {\n            \"identity\": {\n                \"driver\": \"keystone.identity.backends.ldap.Identity\"\n            },\n            \"ldap\": {\n                \"url\": \"http://myldap/my_new_root\",\n                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmy_new_root,dc\u003dorg\"\n            }\n        }\n    }\n\nand not:\n\n    {\n        \"config\": {\n            \"groups\": {\n                \"identity\": {\n                    \"driver\": \"keystone.identity.backends.ldap.Identity\"\n                },\n                \"ldap\": {\n                    \"url\": \"http://myldap/my_new_root\",\n                    \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmy_new_root,dc\u003dorg\"\n                }\n            }\n        }\n    }\n\nSo it should be more consistent to call\n\n     GET /domains/{domain_id}/config/ldap\n\nand get the response below.","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b1ebefb0916811545bee4c6f1fafafafdc762ef7","unresolved":false,"context_lines":[{"line_number":3084,"context_line":""},{"line_number":3085,"context_line":"::"},{"line_number":3086,"context_line":""},{"line_number":3087,"context_line":"    GET /domains/{domain_id}/config/group/ldap"},{"line_number":3088,"context_line":""},{"line_number":3089,"context_line":"Response:"},{"line_number":3090,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_867a97b8","line":3087,"in_reply_to":"3a961159_d983b201","updated":"2015-01-20 13:46:23.000000000","message":"I think you are correct - nice suggestion","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"37fe6076e12c992dd7c44f26d4cb57371df27008","unresolved":false,"context_lines":[{"line_number":3103,"context_line":""},{"line_number":3104,"context_line":"::"},{"line_number":3105,"context_line":""},{"line_number":3106,"context_line":"    GET /domains/{domain_id}/config/group/ldap/url"},{"line_number":3107,"context_line":""},{"line_number":3108,"context_line":"Response:"},{"line_number":3109,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_f9d6aec3","line":3106,"updated":"2015-01-20 02:46:55.000000000","message":"I\u0027d suggest removing /group, as above.\nFurthermore, if we would keep that pattern, maybe we should add /option in this url, to make things consistent?\n\n    GET /domains/{domain_id}/config/group/ldap/option/url\n\nBut I am really for removing /group.","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b1ebefb0916811545bee4c6f1fafafafdc762ef7","unresolved":false,"context_lines":[{"line_number":3103,"context_line":""},{"line_number":3104,"context_line":"::"},{"line_number":3105,"context_line":""},{"line_number":3106,"context_line":"    GET /domains/{domain_id}/config/group/ldap/url"},{"line_number":3107,"context_line":""},{"line_number":3108,"context_line":"Response:"},{"line_number":3109,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_0646a77b","line":3106,"in_reply_to":"3a961159_f9d6aec3","updated":"2015-01-20 13:46:23.000000000","message":"Done","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"37fe6076e12c992dd7c44f26d4cb57371df27008","unresolved":false,"context_lines":[{"line_number":3152,"context_line":"                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmy_new_root,dc\u003dorg\""},{"line_number":3153,"context_line":"            }"},{"line_number":3154,"context_line":"        }"},{"line_number":3155,"context_line":"    }"},{"line_number":3156,"context_line":""},{"line_number":3157,"context_line":"In a similar case to GET, an indiviudal option can be updated, for example:"},{"line_number":3158,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_5951822f","line":3155,"updated":"2015-01-20 02:46:55.000000000","message":"Shouldn\u0027t we return only the updated config here? Instead of the whole set of configs?\nWhat if we had a big set of configs?","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b1ebefb0916811545bee4c6f1fafafafdc762ef7","unresolved":false,"context_lines":[{"line_number":3152,"context_line":"                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmy_new_root,dc\u003dorg\""},{"line_number":3153,"context_line":"            }"},{"line_number":3154,"context_line":"        }"},{"line_number":3155,"context_line":"    }"},{"line_number":3156,"context_line":""},{"line_number":3157,"context_line":"In a similar case to GET, an indiviudal option can be updated, for example:"},{"line_number":3158,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_e6b27b95","line":3155,"in_reply_to":"3a961159_5951822f","updated":"2015-01-20 13:46:23.000000000","message":"oops, true.","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"37fe6076e12c992dd7c44f26d4cb57371df27008","unresolved":false,"context_lines":[{"line_number":3158,"context_line":""},{"line_number":3159,"context_line":"::"},{"line_number":3160,"context_line":""},{"line_number":3161,"context_line":"    PATCH /domains/{domain_id}/config/group/ldap/url"},{"line_number":3162,"context_line":""},{"line_number":3163,"context_line":"Request:"},{"line_number":3164,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_59dee2db","line":3161,"updated":"2015-01-20 02:46:55.000000000","message":"/group again here.","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b1ebefb0916811545bee4c6f1fafafafdc762ef7","unresolved":false,"context_lines":[{"line_number":3158,"context_line":""},{"line_number":3159,"context_line":"::"},{"line_number":3160,"context_line":""},{"line_number":3161,"context_line":"    PATCH /domains/{domain_id}/config/group/ldap/url"},{"line_number":3162,"context_line":""},{"line_number":3163,"context_line":"Request:"},{"line_number":3164,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_4657cf27","line":3161,"in_reply_to":"3a961159_59dee2db","updated":"2015-01-20 13:46:23.000000000","message":"Done","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"37fe6076e12c992dd7c44f26d4cb57371df27008","unresolved":false,"context_lines":[{"line_number":3175,"context_line":"    Status: 200 OK"},{"line_number":3176,"context_line":""},{"line_number":3177,"context_line":"    {"},{"line_number":3178,"context_line":"        \"url\": \"http://myldap/my_other_root\","},{"line_number":3179,"context_line":"    }"},{"line_number":3180,"context_line":""},{"line_number":3181,"context_line":"In the above example, if the ``url`` option did not yet exist then a POST HTTP"}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_3954b621","line":3178,"updated":"2015-01-20 02:46:55.000000000","message":"Here I think we should return the updated config, as suggested for the previous example.\n\nMy rationale is that in both cases we are patching a config, and then return the modified config.","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b1ebefb0916811545bee4c6f1fafafafdc762ef7","unresolved":false,"context_lines":[{"line_number":3175,"context_line":"    Status: 200 OK"},{"line_number":3176,"context_line":""},{"line_number":3177,"context_line":"    {"},{"line_number":3178,"context_line":"        \"url\": \"http://myldap/my_other_root\","},{"line_number":3179,"context_line":"    }"},{"line_number":3180,"context_line":""},{"line_number":3181,"context_line":"In the above example, if the ``url`` option did not yet exist then a POST HTTP"}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_410c193a","line":3178,"in_reply_to":"3a961159_3954b621","updated":"2015-01-20 13:46:23.000000000","message":"again, I think you are right...since that is what we do for regular entities...","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"37fe6076e12c992dd7c44f26d4cb57371df27008","unresolved":false,"context_lines":[{"line_number":3184,"context_line":"The Keystone API will not return options that are considered sensitive,"},{"line_number":3185,"context_line":"although these can be written/updated. The only option currently considered"},{"line_number":3186,"context_line":"sensitive is the ``password`` option within the ``ldap`` group. To aid those"},{"line_number":3187,"context_line":"situations where sensitive options are requried to be included in other"},{"line_number":3188,"context_line":"options that otherwise would not considered sensitive, the API supports a"},{"line_number":3189,"context_line":"substitution ability for any sensitive options. For example, to include the"},{"line_number":3190,"context_line":"password as part of the ``url`` option, it would be specified as:"}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_59ffc202","line":3187,"updated":"2015-01-20 02:46:55.000000000","message":"nit: s/requried/required","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b1ebefb0916811545bee4c6f1fafafafdc762ef7","unresolved":false,"context_lines":[{"line_number":3184,"context_line":"The Keystone API will not return options that are considered sensitive,"},{"line_number":3185,"context_line":"although these can be written/updated. The only option currently considered"},{"line_number":3186,"context_line":"sensitive is the ``password`` option within the ``ldap`` group. To aid those"},{"line_number":3187,"context_line":"situations where sensitive options are requried to be included in other"},{"line_number":3188,"context_line":"options that otherwise would not considered sensitive, the API supports a"},{"line_number":3189,"context_line":"substitution ability for any sensitive options. For example, to include the"},{"line_number":3190,"context_line":"password as part of the ``url`` option, it would be specified as:"}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_c19c89c2","line":3187,"in_reply_to":"3a961159_59ffc202","updated":"2015-01-20 13:46:23.000000000","message":"Done","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"37fe6076e12c992dd7c44f26d4cb57371df27008","unresolved":false,"context_lines":[{"line_number":3191,"context_line":""},{"line_number":3192,"context_line":"::"},{"line_number":3193,"context_line":""},{"line_number":3194,"context_line":"    PATCH /domains/{domain_id}/config/group/ldap/url"},{"line_number":3195,"context_line":""},{"line_number":3196,"context_line":"Request:"},{"line_number":3197,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_34303be9","line":3194,"updated":"2015-01-20 02:46:55.000000000","message":"/group again","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b1ebefb0916811545bee4c6f1fafafafdc762ef7","unresolved":false,"context_lines":[{"line_number":3191,"context_line":""},{"line_number":3192,"context_line":"::"},{"line_number":3193,"context_line":""},{"line_number":3194,"context_line":"    PATCH /domains/{domain_id}/config/group/ldap/url"},{"line_number":3195,"context_line":""},{"line_number":3196,"context_line":"Request:"},{"line_number":3197,"context_line":""}],"source_content_type":"text/x-rst","patch_set":17,"id":"3a961159_6119157a","line":3194,"in_reply_to":"3a961159_34303be9","updated":"2015-01-20 13:46:23.000000000","message":"Done","commit_id":"46eb81df99eb731ac05d0b98703691945a4ec4c1"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"5fa619de20cf4f83f700fc6953bfb3f5a458aebd","unresolved":false,"context_lines":[{"line_number":3095,"context_line":"    {"},{"line_number":3096,"context_line":"        \"ldap\": {"},{"line_number":3097,"context_line":"            \"url\": \"http://myldap/root\","},{"line_number":3098,"context_line":"            \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmyroot,dc\u003dorg\""},{"line_number":3099,"context_line":"        }"},{"line_number":3100,"context_line":"    }"},{"line_number":3101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"3a961159_41c33939","line":3098,"updated":"2015-01-20 13:53:50.000000000","message":"(nit): maybe s/myroot/root\nfor consistency with the next example","commit_id":"6e90e7982de6103edd12a0d8beb9b711aff87d7b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"42048e0ff44cd28011f6a71894986fbe31c28861","unresolved":false,"context_lines":[{"line_number":3095,"context_line":"    {"},{"line_number":3096,"context_line":"        \"ldap\": {"},{"line_number":3097,"context_line":"            \"url\": \"http://myldap/root\","},{"line_number":3098,"context_line":"            \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmyroot,dc\u003dorg\""},{"line_number":3099,"context_line":"        }"},{"line_number":3100,"context_line":"    }"},{"line_number":3101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"3a961159_bca242ab","line":3098,"in_reply_to":"3a961159_41c33939","updated":"2015-01-20 14:12:44.000000000","message":"Done","commit_id":"6e90e7982de6103edd12a0d8beb9b711aff87d7b"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"5fa619de20cf4f83f700fc6953bfb3f5a458aebd","unresolved":false,"context_lines":[{"line_number":3130,"context_line":"    {"},{"line_number":3131,"context_line":"        \"config\": {"},{"line_number":3132,"context_line":"            \"ldap\": {"},{"line_number":3133,"context_line":"                \"url\": \"http://myldap/my_new_root\","},{"line_number":3134,"context_line":"                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmy_new_root,dc\u003dorg\""},{"line_number":3135,"context_line":"            }"},{"line_number":3136,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3a961159_614595b3","line":3133,"updated":"2015-01-20 13:53:50.000000000","message":"This one is fine.","commit_id":"6e90e7982de6103edd12a0d8beb9b711aff87d7b"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"5fa619de20cf4f83f700fc6953bfb3f5a458aebd","unresolved":false,"context_lines":[{"line_number":3181,"context_line":"            },"},{"line_number":3182,"context_line":"            \"ldap\": {"},{"line_number":3183,"context_line":"                \"url\": \"http://myldap/my_other_root\","},{"line_number":3184,"context_line":"                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmy_new_root,dc\u003dorg\""},{"line_number":3185,"context_line":"            }"},{"line_number":3186,"context_line":"        }"},{"line_number":3187,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3a961159_e1e345d6","line":3184,"updated":"2015-01-20 13:53:50.000000000","message":"(nit): maybe s/my_new_root/my_other_root for consistency with other examples","commit_id":"6e90e7982de6103edd12a0d8beb9b711aff87d7b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"42048e0ff44cd28011f6a71894986fbe31c28861","unresolved":false,"context_lines":[{"line_number":3181,"context_line":"            },"},{"line_number":3182,"context_line":"            \"ldap\": {"},{"line_number":3183,"context_line":"                \"url\": \"http://myldap/my_other_root\","},{"line_number":3184,"context_line":"                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmy_new_root,dc\u003dorg\""},{"line_number":3185,"context_line":"            }"},{"line_number":3186,"context_line":"        }"},{"line_number":3187,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3a961159_1cca766f","line":3184,"in_reply_to":"3a961159_e1e345d6","updated":"2015-01-20 14:12:44.000000000","message":"Ok so logically someone might change them together...but in this example, only the url has been updated.","commit_id":"6e90e7982de6103edd12a0d8beb9b711aff87d7b"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"5fa619de20cf4f83f700fc6953bfb3f5a458aebd","unresolved":false,"context_lines":[{"line_number":3222,"context_line":"            },"},{"line_number":3223,"context_line":"            \"ldap\": {"},{"line_number":3224,"context_line":"                \"url\": \"http://myldap/my_other_root/my_user/${password}\","},{"line_number":3225,"context_line":"                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmy_new_root,dc\u003dorg\""},{"line_number":3226,"context_line":"            }"},{"line_number":3227,"context_line":"        }"},{"line_number":3228,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3a961159_01005165","line":3225,"updated":"2015-01-20 13:53:50.000000000","message":"(nit): s/my_new_root/my_other_root","commit_id":"6e90e7982de6103edd12a0d8beb9b711aff87d7b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"42048e0ff44cd28011f6a71894986fbe31c28861","unresolved":false,"context_lines":[{"line_number":3222,"context_line":"            },"},{"line_number":3223,"context_line":"            \"ldap\": {"},{"line_number":3224,"context_line":"                \"url\": \"http://myldap/my_other_root/my_user/${password}\","},{"line_number":3225,"context_line":"                \"user_tree_dn\": \"ou\u003dUsers,dc\u003dmy_new_root,dc\u003dorg\""},{"line_number":3226,"context_line":"            }"},{"line_number":3227,"context_line":"        }"},{"line_number":3228,"context_line":"    }"}],"source_content_type":"text/x-rst","patch_set":18,"id":"3a961159_1ccd165f","line":3225,"in_reply_to":"3a961159_01005165","updated":"2015-01-20 14:12:44.000000000","message":"see above","commit_id":"6e90e7982de6103edd12a0d8beb9b711aff87d7b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"33126a97691622c3cbd215f820e17fa5b761a6ae","unresolved":false,"context_lines":[{"line_number":3051,"context_line":"Keystone optionally supports the ability to manage domain specific"},{"line_number":3052,"context_line":"configuration options via the API. For example:"},{"line_number":3053,"context_line":""},{"line_number":3054,"context_line":"::"},{"line_number":3055,"context_line":""},{"line_number":3056,"context_line":"    GET /domains/{domain_id}/config"},{"line_number":3057,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_b15a984e","line":3054,"updated":"2015-01-20 21:15:01.000000000","message":"For rst, get rid of this and put :: after \"For example:\"","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"25a05d9a06980ee95add6c7dd00c8588212157bd","unresolved":false,"context_lines":[{"line_number":3051,"context_line":"Keystone optionally supports the ability to manage domain specific"},{"line_number":3052,"context_line":"configuration options via the API. For example:"},{"line_number":3053,"context_line":""},{"line_number":3054,"context_line":"::"},{"line_number":3055,"context_line":""},{"line_number":3056,"context_line":"    GET /domains/{domain_id}/config"},{"line_number":3057,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_94a2ea98","line":3054,"in_reply_to":"1a930d6b_b15a984e","updated":"2015-01-20 21:53:52.000000000","message":"Done","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"33126a97691622c3cbd215f820e17fa5b761a6ae","unresolved":false,"context_lines":[{"line_number":3053,"context_line":""},{"line_number":3054,"context_line":"::"},{"line_number":3055,"context_line":""},{"line_number":3056,"context_line":"    GET /domains/{domain_id}/config"},{"line_number":3057,"context_line":""},{"line_number":3058,"context_line":"Response:"},{"line_number":3059,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_71403057","line":3056,"updated":"2015-01-20 21:15:01.000000000","message":"We have support for JSON Home in the v3 API, so the resources here should all have a relationship defined that does in the JSON Home document.\n\nAlso, it could just be the .../config resource that has a relationship and then assume the client knows how to add the sub-elements.","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"25a05d9a06980ee95add6c7dd00c8588212157bd","unresolved":false,"context_lines":[{"line_number":3053,"context_line":""},{"line_number":3054,"context_line":"::"},{"line_number":3055,"context_line":""},{"line_number":3056,"context_line":"    GET /domains/{domain_id}/config"},{"line_number":3057,"context_line":""},{"line_number":3058,"context_line":"Response:"},{"line_number":3059,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_9f95a38a","line":3056,"in_reply_to":"1a930d6b_71403057","updated":"2015-01-20 21:53:52.000000000","message":"Done","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"33126a97691622c3cbd215f820e17fa5b761a6ae","unresolved":false,"context_lines":[{"line_number":3099,"context_line":"        }"},{"line_number":3100,"context_line":"    }"},{"line_number":3101,"context_line":""},{"line_number":3102,"context_line":"An indiviudal option may also be requested:"},{"line_number":3103,"context_line":""},{"line_number":3104,"context_line":"::"},{"line_number":3105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_b121b8b6","line":3102,"updated":"2015-01-20 21:15:01.000000000","message":"change \"indiviudal\" to \"individual\"","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"193f3a3c5991ad33fcf67d8ce1cf5fadebb185a8","unresolved":false,"context_lines":[{"line_number":3099,"context_line":"        }"},{"line_number":3100,"context_line":"    }"},{"line_number":3101,"context_line":""},{"line_number":3102,"context_line":"An indiviudal option may also be requested:"},{"line_number":3103,"context_line":""},{"line_number":3104,"context_line":"::"},{"line_number":3105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_d48f1274","line":3102,"in_reply_to":"1a930d6b_b121b8b6","updated":"2015-01-20 21:25:51.000000000","message":"Done","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"251825461b046a59d7a10a81f3468cd47ecb65c4","unresolved":false,"context_lines":[{"line_number":3186,"context_line":"        }"},{"line_number":3187,"context_line":"    }"},{"line_number":3188,"context_line":""},{"line_number":3189,"context_line":"In the above example, if the ``url`` option did not yet exist then a POST HTTP"},{"line_number":3190,"context_line":"command would be required."},{"line_number":3191,"context_line":""},{"line_number":3192,"context_line":"The Keystone API will not return options that are considered sensitive,"}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_1118cc83","line":3189,"updated":"2015-01-20 21:14:14.000000000","message":"POST HTTP or HTTP POST?","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"193f3a3c5991ad33fcf67d8ce1cf5fadebb185a8","unresolved":false,"context_lines":[{"line_number":3186,"context_line":"        }"},{"line_number":3187,"context_line":"    }"},{"line_number":3188,"context_line":""},{"line_number":3189,"context_line":"In the above example, if the ``url`` option did not yet exist then a POST HTTP"},{"line_number":3190,"context_line":"command would be required."},{"line_number":3191,"context_line":""},{"line_number":3192,"context_line":"The Keystone API will not return options that are considered sensitive,"}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_540fa2e1","line":3189,"in_reply_to":"1a930d6b_1118cc83","updated":"2015-01-20 21:25:51.000000000","message":"Done","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"251825461b046a59d7a10a81f3468cd47ecb65c4","unresolved":false,"context_lines":[{"line_number":3191,"context_line":""},{"line_number":3192,"context_line":"The Keystone API will not return options that are considered sensitive,"},{"line_number":3193,"context_line":"although these can be written/updated. The only option currently considered"},{"line_number":3194,"context_line":"sensitive is the ``password`` option within the ``ldap`` group. To aid those"},{"line_number":3195,"context_line":"situations where sensitive options are required to be included in other"},{"line_number":3196,"context_line":"options that otherwise would not considered sensitive, the API supports a"},{"line_number":3197,"context_line":"substitution ability for any sensitive options. For example, to include the"}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_9412ea56","line":3194,"updated":"2015-01-20 21:14:14.000000000","message":"What about database URL?","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"25a05d9a06980ee95add6c7dd00c8588212157bd","unresolved":false,"context_lines":[{"line_number":3191,"context_line":""},{"line_number":3192,"context_line":"The Keystone API will not return options that are considered sensitive,"},{"line_number":3193,"context_line":"although these can be written/updated. The only option currently considered"},{"line_number":3194,"context_line":"sensitive is the ``password`` option within the ``ldap`` group. To aid those"},{"line_number":3195,"context_line":"situations where sensitive options are required to be included in other"},{"line_number":3196,"context_line":"options that otherwise would not considered sensitive, the API supports a"},{"line_number":3197,"context_line":"substitution ability for any sensitive options. For example, to include the"}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_b45a864e","line":3194,"in_reply_to":"1a930d6b_9412ea56","updated":"2015-01-20 21:53:52.000000000","message":"maybe...although today since you can only have one SQL driver....the only sql thing that might be in here is the driver name, not the database url. If in the future we enable support for multiple SQL backends, then we add the [sql] group in here and then decide which of those options would be sensitive.","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0f7300d3aeeebdab521bcbb8e633b50b8d5bbad0","unresolved":false,"context_lines":[{"line_number":3206,"context_line":"::"},{"line_number":3207,"context_line":""},{"line_number":3208,"context_line":"    {"},{"line_number":3209,"context_line":"        \"url\": \"http://myldap/my_other_root/my_user/${password}\","},{"line_number":3210,"context_line":"    }"},{"line_number":3211,"context_line":""},{"line_number":3212,"context_line":"Response:"}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_91767cd7","line":3209,"updated":"2015-01-20 21:11:42.000000000","message":"Suggest using \"%(password)s\" instead of the bash notation style of \"${password}\"","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"193f3a3c5991ad33fcf67d8ce1cf5fadebb185a8","unresolved":false,"context_lines":[{"line_number":3206,"context_line":"::"},{"line_number":3207,"context_line":""},{"line_number":3208,"context_line":"    {"},{"line_number":3209,"context_line":"        \"url\": \"http://myldap/my_other_root/my_user/${password}\","},{"line_number":3210,"context_line":"    }"},{"line_number":3211,"context_line":""},{"line_number":3212,"context_line":"Response:"}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_74149ef5","line":3209,"in_reply_to":"1a930d6b_91767cd7","updated":"2015-01-20 21:25:51.000000000","message":"Done","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"}],"specs/kilo/domain-config-ext.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"48647b09a74e5e0f997bc8f2fbb9d5452d17ae32","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Domain specific configuration files are used to specify the unique options"},{"line_number":23,"context_line":"for a given domain with regard its identity backend (e.g. ldap url to be used"},{"line_number":24,"context_line":"for that domain). This use of a separate configuration file for each domain"},{"line_number":25,"context_line":"leads to some complexity in the choreography of on-boarding a new domain, e.g.:"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da9df570_11430315","line":23,"updated":"2014-09-24 15:19:34.000000000","message":"regard to*?","commit_id":"51e80974937ead87c39cdc235489fa942e20651b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"160a9c92f2dc98acf1c6f0444ad673cce245ce0e","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Domain specific configuration files are used to specify the unique options"},{"line_number":23,"context_line":"for a given domain with regard its identity backend (e.g. ldap url to be used"},{"line_number":24,"context_line":"for that domain). This use of a separate configuration file for each domain"},{"line_number":25,"context_line":"leads to some complexity in the choreography of on-boarding a new domain, e.g.:"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"da9df570_e4307ba0","line":23,"in_reply_to":"da9df570_11430315","updated":"2014-10-01 14:38:59.000000000","message":"Done","commit_id":"51e80974937ead87c39cdc235489fa942e20651b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"48647b09a74e5e0f997bc8f2fbb9d5452d17ae32","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"This extension will provide the ability to store the configuration options in"},{"line_number":42,"context_line":"an SQL backend, indexed by domain ID. A main configuration option will dictate"},{"line_number":43,"context_line":"whether Keystone uses this extension is used to obtain domain specific"},{"line_number":44,"context_line":"configuration data or the existing domain specific configuration files"},{"line_number":45,"context_line":"approach. It will be an all or nothing option - there will be no mixing of some"},{"line_number":46,"context_line":"options in the extension and some in configuration files. Keystone will go"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da9df570_f1091fde","line":43,"updated":"2014-09-24 15:19:34.000000000","message":"s/is used//","commit_id":"51e80974937ead87c39cdc235489fa942e20651b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"160a9c92f2dc98acf1c6f0444ad673cce245ce0e","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"This extension will provide the ability to store the configuration options in"},{"line_number":42,"context_line":"an SQL backend, indexed by domain ID. A main configuration option will dictate"},{"line_number":43,"context_line":"whether Keystone uses this extension is used to obtain domain specific"},{"line_number":44,"context_line":"configuration data or the existing domain specific configuration files"},{"line_number":45,"context_line":"approach. It will be an all or nothing option - there will be no mixing of some"},{"line_number":46,"context_line":"options in the extension and some in configuration files. Keystone will go"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da9df570_04281f33","line":43,"in_reply_to":"da9df570_f1091fde","updated":"2014-10-01 14:38:59.000000000","message":"Done","commit_id":"51e80974937ead87c39cdc235489fa942e20651b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"48647b09a74e5e0f997bc8f2fbb9d5452d17ae32","unresolved":false,"context_lines":[{"line_number":109,"context_line":"Other Deployer Impact"},{"line_number":110,"context_line":"---------------------"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"None"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Developer Impact"},{"line_number":115,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da9df570_91c9b37a","line":112,"updated":"2014-09-24 15:19:34.000000000","message":"Just double checking here, but this won\u0027t have an effect on existing deployments will it? How about documentation for moving to this extension from a current deployment?","commit_id":"51e80974937ead87c39cdc235489fa942e20651b"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"160a9c92f2dc98acf1c6f0444ad673cce245ce0e","unresolved":false,"context_lines":[{"line_number":109,"context_line":"Other Deployer Impact"},{"line_number":110,"context_line":"---------------------"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"None"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Developer Impact"},{"line_number":115,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da9df570_a4ff53a9","line":112,"in_reply_to":"da9df570_91c9b37a","updated":"2014-10-01 14:38:59.000000000","message":"That\u0027s a fair point.  I think I might actually add support via keystone-manage to migrate from the old method to the new.","commit_id":"51e80974937ead87c39cdc235489fa942e20651b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"703ddeb54a74cbdca80134a5685c09f9069f1b21","unresolved":false,"context_lines":[{"line_number":47,"context_line":"options in the extension and some in configuration files. Keystone will go"},{"line_number":48,"context_line":"through the logic of building the domain configurations in the same way as it"},{"line_number":49,"context_line":"does today, either reading the configurations options from the extension or"},{"line_number":50,"context_line":"from the set files."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"An additional option will be supported by the extension to initiate a"},{"line_number":53,"context_line":"re-loading of the identity backend for a given domain (using whatever new"}],"source_content_type":"text/x-rst","patch_set":4,"id":"baa201ad_6fe1dbfd","line":50,"updated":"2014-10-01 22:31:19.000000000","message":"What happens if the extension is enabled and the configuration files exist? Does the extension take precedence?","commit_id":"7040b17f112ffc8ad87c65706923e65d1b2bea26"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d939339f8a73c781d51244266ab8de4ffb68ccc8","unresolved":false,"context_lines":[{"line_number":47,"context_line":"options in the extension and some in configuration files. Keystone will go"},{"line_number":48,"context_line":"through the logic of building the domain configurations in the same way as it"},{"line_number":49,"context_line":"does today, either reading the configurations options from the extension or"},{"line_number":50,"context_line":"from the set files."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"An additional option will be supported by the extension to initiate a"},{"line_number":53,"context_line":"re-loading of the identity backend for a given domain (using whatever new"}],"source_content_type":"text/x-rst","patch_set":4,"id":"baa201ad_edef8985","line":50,"in_reply_to":"baa201ad_6fe1dbfd","updated":"2014-10-02 12:55:04.000000000","message":"Yes, the extension takes precedence (if you feel I need to make that clear, then let me know)","commit_id":"7040b17f112ffc8ad87c65706923e65d1b2bea26"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"d5c7c2393f10d64e66a262eb97c8cfc71b05fed2","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp domain-config-ext \u003chttps://blueprints.launchpad.net/keystone/+spec/domain-config-ext\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Extension ``OS-DOMAIN-CONFIG`` provides the means to store the configuration"},{"line_number":15,"context_line":"options that would normally stored in domain-specific configuration files"},{"line_number":16,"context_line":"in an SQL table instead."},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_7dc0de2a","line":14,"updated":"2014-11-19 16:22:52.000000000","message":"We no longer use the term extension correct? This is experimental or stable?","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2e7e6afbcdc8a00a4d3cc7e9c5194a6df2e5f9f4","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp domain-config-ext \u003chttps://blueprints.launchpad.net/keystone/+spec/domain-config-ext\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Extension ``OS-DOMAIN-CONFIG`` provides the means to store the configuration"},{"line_number":15,"context_line":"options that would normally stored in domain-specific configuration files"},{"line_number":16,"context_line":"in an SQL table instead."},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_ff0ca73b","line":14,"in_reply_to":"5a890539_7dc0de2a","updated":"2014-11-30 09:54:37.000000000","message":"Agreed. It will start as experimental, with a hope to flip it to stable for Kilo-3 if possible.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"d5c7c2393f10d64e66a262eb97c8cfc71b05fed2","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This extension will provide the ability to store the configuration options in"},{"line_number":43,"context_line":"an SQL backend, indexed by domain ID. A main configuration option will dictate"},{"line_number":44,"context_line":"whether Keystone uses this extension is to obtain domain specific"},{"line_number":45,"context_line":"configuration data or the existing domain specific configuration files"},{"line_number":46,"context_line":"approach. It will be an all or nothing option - there will be no mixing of some"},{"line_number":47,"context_line":"options in the extension and some in configuration files. If the extension is"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_fd392e42","line":44,"updated":"2014-11-19 16:22:52.000000000","message":"typo, remove \"is\" between extension and to","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2e7e6afbcdc8a00a4d3cc7e9c5194a6df2e5f9f4","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"This extension will provide the ability to store the configuration options in"},{"line_number":43,"context_line":"an SQL backend, indexed by domain ID. A main configuration option will dictate"},{"line_number":44,"context_line":"whether Keystone uses this extension is to obtain domain specific"},{"line_number":45,"context_line":"configuration data or the existing domain specific configuration files"},{"line_number":46,"context_line":"approach. It will be an all or nothing option - there will be no mixing of some"},{"line_number":47,"context_line":"options in the extension and some in configuration files. If the extension is"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_1f1c136a","line":44,"in_reply_to":"5a890539_fd392e42","updated":"2014-11-30 09:54:37.000000000","message":"Done","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"d5c7c2393f10d64e66a262eb97c8cfc71b05fed2","unresolved":false,"context_lines":[{"line_number":47,"context_line":"options in the extension and some in configuration files. If the extension is"},{"line_number":48,"context_line":"specified as the store of configuration data, then any domain-specific"},{"line_number":49,"context_line":"configuration files will be ignored. Keystone will go through the logic of"},{"line_number":50,"context_line":"building the domain configurations in the same way as it does today, either"},{"line_number":51,"context_line":"reading the configurations options from the extension or from the set files."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"An additional option will be supported by the extension to initiate a"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_fda3ee4c","line":50,"updated":"2014-11-19 16:22:52.000000000","message":"How does one debug configs when this option is used?  Will there be a way to dump the config data out of the database without knowing how to do SQL queries? What keeps a user from mistakenly thinking the system is using config files when in this option they are ignored?  Will you add some form of warning message in the debug logs to help people understand whats going on when this option is enabled?","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2e7e6afbcdc8a00a4d3cc7e9c5194a6df2e5f9f4","unresolved":false,"context_lines":[{"line_number":47,"context_line":"options in the extension and some in configuration files. If the extension is"},{"line_number":48,"context_line":"specified as the store of configuration data, then any domain-specific"},{"line_number":49,"context_line":"configuration files will be ignored. Keystone will go through the logic of"},{"line_number":50,"context_line":"building the domain configurations in the same way as it does today, either"},{"line_number":51,"context_line":"reading the configurations options from the extension or from the set files."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"An additional option will be supported by the extension to initiate a"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_5f25bbac","line":50,"in_reply_to":"5a890539_fda3ee4c","updated":"2014-11-30 09:54:37.000000000","message":"You\u0027ll be able to see the options through openstack client just like any other attributes.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"77db575caad83628b5f5ebcde1a1bc5f0037d7dc","unresolved":false,"context_lines":[{"line_number":48,"context_line":"specified as the store of configuration data, then any domain-specific"},{"line_number":49,"context_line":"configuration files will be ignored. Keystone will go through the logic of"},{"line_number":50,"context_line":"building the domain configurations in the same way as it does today, either"},{"line_number":51,"context_line":"reading the configurations options from the extension or from the set files."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"An additional option will be supported by the extension to initiate a"},{"line_number":54,"context_line":"re-loading of the identity backend for a given domain (using whatever new"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_557d8fb0","line":51,"updated":"2014-10-21 21:57:25.000000000","message":"I presume we\u0027ll be providing a utility to migrate the existing domain-specific conf files into SQL?","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"2b3d72d495410b76faa8baf83c3a8995beec5bf3","unresolved":false,"context_lines":[{"line_number":48,"context_line":"specified as the store of configuration data, then any domain-specific"},{"line_number":49,"context_line":"configuration files will be ignored. Keystone will go through the logic of"},{"line_number":50,"context_line":"building the domain configurations in the same way as it does today, either"},{"line_number":51,"context_line":"reading the configurations options from the extension or from the set files."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"An additional option will be supported by the extension to initiate a"},{"line_number":54,"context_line":"re-loading of the identity backend for a given domain (using whatever new"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_af2fc73d","line":51,"in_reply_to":"9aa7fdbe_16edc3ef","updated":"2014-10-27 15:58:43.000000000","message":"I am not sure this should be an extension but be a top-level capability of the domain assignment CRUD layer. This is because the per-domain-identity work isn\u0027t \"an extension\".","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d4ca93292d313e718174768d806ba0f7cab80da9","unresolved":false,"context_lines":[{"line_number":48,"context_line":"specified as the store of configuration data, then any domain-specific"},{"line_number":49,"context_line":"configuration files will be ignored. Keystone will go through the logic of"},{"line_number":50,"context_line":"building the domain configurations in the same way as it does today, either"},{"line_number":51,"context_line":"reading the configurations options from the extension or from the set files."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"An additional option will be supported by the extension to initiate a"},{"line_number":54,"context_line":"re-loading of the identity backend for a given domain (using whatever new"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_16edc3ef","line":51,"in_reply_to":"9aa7fdbe_557d8fb0","updated":"2014-10-22 08:30:52.000000000","message":"yes - this is mentioned under \"Other Deployer Impact\" later in this spec.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2e7e6afbcdc8a00a4d3cc7e9c5194a6df2e5f9f4","unresolved":false,"context_lines":[{"line_number":48,"context_line":"specified as the store of configuration data, then any domain-specific"},{"line_number":49,"context_line":"configuration files will be ignored. Keystone will go through the logic of"},{"line_number":50,"context_line":"building the domain configurations in the same way as it does today, either"},{"line_number":51,"context_line":"reading the configurations options from the extension or from the set files."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"An additional option will be supported by the extension to initiate a"},{"line_number":54,"context_line":"re-loading of the identity backend for a given domain (using whatever new"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_7f28b785","line":51,"in_reply_to":"9aa7fdbe_928f8374","updated":"2014-11-30 09:54:37.000000000","message":"As indicated above, this will start as experimental code functionality, with a hop to graduate to stable in Kilo-3.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dfa3c65f3e0a843af58a974ab6de0dc56c43375f","unresolved":false,"context_lines":[{"line_number":48,"context_line":"specified as the store of configuration data, then any domain-specific"},{"line_number":49,"context_line":"configuration files will be ignored. Keystone will go through the logic of"},{"line_number":50,"context_line":"building the domain configurations in the same way as it does today, either"},{"line_number":51,"context_line":"reading the configurations options from the extension or from the set files."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"An additional option will be supported by the extension to initiate a"},{"line_number":54,"context_line":"re-loading of the identity backend for a given domain (using whatever new"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_be0a9387","line":51,"in_reply_to":"9aa7fdbe_af2fc73d","updated":"2014-10-27 18:21:44.000000000","message":"So I\u0027d be OK with that....I just made it an extension since we are not removing the existing domain-specific config file method of doing things...but if there is sufficient support for direct SQL, then I\u0027m cool with that","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"88f14c913f74d9c391f43169ff221564abbeaf5e","unresolved":false,"context_lines":[{"line_number":48,"context_line":"specified as the store of configuration data, then any domain-specific"},{"line_number":49,"context_line":"configuration files will be ignored. Keystone will go through the logic of"},{"line_number":50,"context_line":"building the domain configurations in the same way as it does today, either"},{"line_number":51,"context_line":"reading the configurations options from the extension or from the set files."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"An additional option will be supported by the extension to initiate a"},{"line_number":54,"context_line":"re-loading of the identity backend for a given domain (using whatever new"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_928f8374","line":51,"in_reply_to":"9aa7fdbe_be0a9387","updated":"2014-10-27 18:48:08.000000000","message":"The rules and regulations for extensions versus core need to be more crisp. I am fine with it either way. We need this capability.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"77db575caad83628b5f5ebcde1a1bc5f0037d7dc","unresolved":false,"context_lines":[{"line_number":56,"context_line":"domain. While such a re-load could perhaps be triggered by an update request"},{"line_number":57,"context_line":"to the configuration information itself for a domain, it is more likely a"},{"line_number":58,"context_line":"cloud provider might want to chose the moment the new domain configuration"},{"line_number":59,"context_line":"data is enabled."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The extension can only be used to replace options that would have appeared in"},{"line_number":62,"context_line":"a domain specific file - it will not allow options to be specified that would"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_1508672c","line":59,"updated":"2014-10-21 21:57:25.000000000","message":"Why an option, not a separate API? Overloading update API seem unhygienic.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d4ca93292d313e718174768d806ba0f7cab80da9","unresolved":false,"context_lines":[{"line_number":56,"context_line":"domain. While such a re-load could perhaps be triggered by an update request"},{"line_number":57,"context_line":"to the configuration information itself for a domain, it is more likely a"},{"line_number":58,"context_line":"cloud provider might want to chose the moment the new domain configuration"},{"line_number":59,"context_line":"data is enabled."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The extension can only be used to replace options that would have appeared in"},{"line_number":62,"context_line":"a domain specific file - it will not allow options to be specified that would"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_36de4712","line":59,"in_reply_to":"9aa7fdbe_1508672c","updated":"2014-10-22 08:30:52.000000000","message":"sorry - my bad choice words...I didn\u0027t mean that we would add an option to an existing API - rather it\u0027s use would be optional....I agree, as separate API call is prefereable.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"2b3d72d495410b76faa8baf83c3a8995beec5bf3","unresolved":false,"context_lines":[{"line_number":56,"context_line":"domain. While such a re-load could perhaps be triggered by an update request"},{"line_number":57,"context_line":"to the configuration information itself for a domain, it is more likely a"},{"line_number":58,"context_line":"cloud provider might want to chose the moment the new domain configuration"},{"line_number":59,"context_line":"data is enabled."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The extension can only be used to replace options that would have appeared in"},{"line_number":62,"context_line":"a domain specific file - it will not allow options to be specified that would"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_cfd96b58","line":59,"in_reply_to":"9aa7fdbe_36de4712","updated":"2014-10-27 15:58:43.000000000","message":"I would be clear that this should only occur with the new SQL / CRUD based system. the disk bask system will be made obsoltete/deprecated.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"dfa3c65f3e0a843af58a974ab6de0dc56c43375f","unresolved":false,"context_lines":[{"line_number":56,"context_line":"domain. While such a re-load could perhaps be triggered by an update request"},{"line_number":57,"context_line":"to the configuration information itself for a domain, it is more likely a"},{"line_number":58,"context_line":"cloud provider might want to chose the moment the new domain configuration"},{"line_number":59,"context_line":"data is enabled."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The extension can only be used to replace options that would have appeared in"},{"line_number":62,"context_line":"a domain specific file - it will not allow options to be specified that would"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_fe009b67","line":59,"in_reply_to":"9aa7fdbe_cfd96b58","updated":"2014-10-27 18:21:44.000000000","message":"Again, if people that we should go that far and deprecate, then yep, fine","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2e7e6afbcdc8a00a4d3cc7e9c5194a6df2e5f9f4","unresolved":false,"context_lines":[{"line_number":56,"context_line":"domain. While such a re-load could perhaps be triggered by an update request"},{"line_number":57,"context_line":"to the configuration information itself for a domain, it is more likely a"},{"line_number":58,"context_line":"cloud provider might want to chose the moment the new domain configuration"},{"line_number":59,"context_line":"data is enabled."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The extension can only be used to replace options that would have appeared in"},{"line_number":62,"context_line":"a domain specific file - it will not allow options to be specified that would"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_9f1f235b","line":59,"in_reply_to":"9aa7fdbe_f2d60f4e","updated":"2014-11-30 09:54:37.000000000","message":"Agreed.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"88f14c913f74d9c391f43169ff221564abbeaf5e","unresolved":false,"context_lines":[{"line_number":56,"context_line":"domain. While such a re-load could perhaps be triggered by an update request"},{"line_number":57,"context_line":"to the configuration information itself for a domain, it is more likely a"},{"line_number":58,"context_line":"cloud provider might want to chose the moment the new domain configuration"},{"line_number":59,"context_line":"data is enabled."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The extension can only be used to replace options that would have appeared in"},{"line_number":62,"context_line":"a domain specific file - it will not allow options to be specified that would"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_f2d60f4e","line":59,"in_reply_to":"9aa7fdbe_fe009b67","updated":"2014-10-27 18:48:08.000000000","message":"Isn\u0027t config a *public facing* functionality? If so, I would think we\u0027ll have to go through the OpenStack feature life cycle, whatever it is.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"2b3d72d495410b76faa8baf83c3a8995beec5bf3","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The extension can only be used to replace options that would have appeared in"},{"line_number":62,"context_line":"a domain specific file - it will not allow options to be specified that would"},{"line_number":63,"context_line":"normally appear in the main Keystone configuration file."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Although the extension will store the configuration options in SQL, this does"},{"line_number":66,"context_line":"not imply anything about the medium of the identity backends themselves (which"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_2f983777","line":63,"updated":"2014-10-27 15:58:43.000000000","message":"See above, this is likely *not* an extension. During the Kilo summit there is some discussion that needs to be had about \"extensions\".","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"77db575caad83628b5f5ebcde1a1bc5f0037d7dc","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Although the extension will store the configuration options in SQL, this does"},{"line_number":66,"context_line":"not imply anything about the medium of the identity backends themselves (which"},{"line_number":67,"context_line":"could be all LDAP if required)."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Alternatives"},{"line_number":70,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_b935d5dc","line":67,"updated":"2014-10-21 21:57:25.000000000","message":"this is highly static data so LDAP is idea for the stuff","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d4ca93292d313e718174768d806ba0f7cab80da9","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Although the extension will store the configuration options in SQL, this does"},{"line_number":66,"context_line":"not imply anything about the medium of the identity backends themselves (which"},{"line_number":67,"context_line":"could be all LDAP if required)."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Alternatives"},{"line_number":70,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_16a9437b","line":67,"in_reply_to":"9aa7fdbe_b935d5dc","updated":"2014-10-22 08:30:52.000000000","message":"So that\u0027s probably true for all parameters of a domain....but unfortunately our current support in assignment is mono-domain...i.e. you can only have the default domain (this is a limitation of assignment, not identity - and it is identity that domain-specific config solves).  So as it stands, the capability of domain-specific configs as well as this extension can only be used with an SQL assignment backend.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"2b3d72d495410b76faa8baf83c3a8995beec5bf3","unresolved":false,"context_lines":[{"line_number":84,"context_line":"changes to the Identity API. This will include:"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"- API to provide CRUD operations for the configuration data"},{"line_number":87,"context_line":"- API to re-load a domain backend based on new configuration data."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Security Impact"},{"line_number":90,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_af8b471d","line":87,"updated":"2014-10-27 15:58:43.000000000","message":"Is this something that should be automatic if the data changes?","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2e7e6afbcdc8a00a4d3cc7e9c5194a6df2e5f9f4","unresolved":false,"context_lines":[{"line_number":84,"context_line":"changes to the Identity API. This will include:"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"- API to provide CRUD operations for the configuration data"},{"line_number":87,"context_line":"- API to re-load a domain backend based on new configuration data."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Security Impact"},{"line_number":90,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_da11b954","line":87,"in_reply_to":"9aa7fdbe_af8b471d","updated":"2014-11-30 09:54:37.000000000","message":"Done","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"6e3e2b6caa3de0fa38c72f1f5b9e1399fbd141c6","unresolved":false,"context_lines":[{"line_number":85,"context_line":""},{"line_number":86,"context_line":"- API to provide CRUD operations for the configuration data"},{"line_number":87,"context_line":"- API to re-load a domain backend based on new configuration data."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Security Impact"},{"line_number":90,"context_line":"---------------"},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_99a15ffa","line":88,"updated":"2014-10-28 03:41:01.000000000","message":"Is the domain going to be created automatically?  It will be great if the domain is created automatically if it is not already there.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fcbf1d4758e72f914a1094db77557243093b3f8c","unresolved":false,"context_lines":[{"line_number":85,"context_line":""},{"line_number":86,"context_line":"- API to provide CRUD operations for the configuration data"},{"line_number":87,"context_line":"- API to re-load a domain backend based on new configuration data."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Security Impact"},{"line_number":90,"context_line":"---------------"},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_30083d2d","line":88,"in_reply_to":"5a890539_866b7c84","updated":"2014-11-19 16:43:05.000000000","message":"Agree with Morgan, auto domain creation should be deployer-specific workflow.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"f3bff4c0f2595ceec46bc840d9b50ca5e58dd978","unresolved":false,"context_lines":[{"line_number":85,"context_line":""},{"line_number":86,"context_line":"- API to provide CRUD operations for the configuration data"},{"line_number":87,"context_line":"- API to re-load a domain backend based on new configuration data."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Security Impact"},{"line_number":90,"context_line":"---------------"},{"line_number":91,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_866b7c84","line":88,"in_reply_to":"9aa7fdbe_99a15ffa","updated":"2014-11-19 15:18:12.000000000","message":"I could see this as an enhancement down the line, but I\u0027d like to keep there scope of this spec narrow, so that it replaces what we do now. Automatic domain creation potentially has extra concerns (oops, got the wrong domain, now I suddenly have an extra domain I didn\u0027t want).","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"6e3e2b6caa3de0fa38c72f1f5b9e1399fbd141c6","unresolved":false,"context_lines":[{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Work Items"},{"line_number":132,"context_line":"----------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"- Get agreement of API specifications"},{"line_number":135,"context_line":"- Implement the domain configuration code"},{"line_number":136,"context_line":"- Implement the domain re-loading code"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_f998abc1","line":133,"updated":"2014-10-28 03:41:01.000000000","message":"- Can we add domain creation too?","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"f3bff4c0f2595ceec46bc840d9b50ca5e58dd978","unresolved":false,"context_lines":[{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Work Items"},{"line_number":132,"context_line":"----------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"- Get agreement of API specifications"},{"line_number":135,"context_line":"- Implement the domain configuration code"},{"line_number":136,"context_line":"- Implement the domain re-loading code"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_c63664b4","line":133,"in_reply_to":"9aa7fdbe_f998abc1","updated":"2014-11-19 15:18:12.000000000","message":"I\u0027m unsure what is needed from a domain creation standpoint here. We already have an API to create domains.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"77db575caad83628b5f5ebcde1a1bc5f0037d7dc","unresolved":false,"context_lines":[{"line_number":133,"context_line":""},{"line_number":134,"context_line":"- Get agreement of API specifications"},{"line_number":135,"context_line":"- Implement the domain configuration code"},{"line_number":136,"context_line":"- Implement the domain re-loading code"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Dependencies"},{"line_number":139,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_994bb12a","line":136,"updated":"2014-10-21 21:57:25.000000000","message":"What about the clients? Horizon? It would be super awesome if we can configure the stuff from Horizon. I guess its out of the scope and need a separate spec for Horizon?","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2e7e6afbcdc8a00a4d3cc7e9c5194a6df2e5f9f4","unresolved":false,"context_lines":[{"line_number":133,"context_line":""},{"line_number":134,"context_line":"- Get agreement of API specifications"},{"line_number":135,"context_line":"- Implement the domain configuration code"},{"line_number":136,"context_line":"- Implement the domain re-loading code"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Dependencies"},{"line_number":139,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_da38d9d6","line":136,"in_reply_to":"5a890539_06ca2ca1","updated":"2014-11-30 09:54:37.000000000","message":"no plans!","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"f3bff4c0f2595ceec46bc840d9b50ca5e58dd978","unresolved":false,"context_lines":[{"line_number":133,"context_line":""},{"line_number":134,"context_line":"- Get agreement of API specifications"},{"line_number":135,"context_line":"- Implement the domain configuration code"},{"line_number":136,"context_line":"- Implement the domain re-loading code"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Dependencies"},{"line_number":139,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_06ca2ca1","line":136,"in_reply_to":"5a890539_7cbd89d7","updated":"2014-11-19 15:18:12.000000000","message":"Please do not add magic file handlers. A keystone-mange option should be sufficient.\n\nThough based upon the data from above (e.g.) that a one-shot code would be added, it seems to be missing from the spec.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"834d505921224f2de7e69c5e51d47147dd84ca01","unresolved":false,"context_lines":[{"line_number":133,"context_line":""},{"line_number":134,"context_line":"- Get agreement of API specifications"},{"line_number":135,"context_line":"- Implement the domain configuration code"},{"line_number":136,"context_line":"- Implement the domain re-loading code"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Dependencies"},{"line_number":139,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_7cbd89d7","line":136,"in_reply_to":"5a890539_9937a7fe","updated":"2014-11-17 22:53:37.000000000","message":"i\u0027d rather see the create and show endpoints just output json blobs, similar to the policy API.\n\ni think having anything to do with file handlers will promote bad user behaviour that we are trying to avoid/deprecate","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"d4ca93292d313e718174768d806ba0f7cab80da9","unresolved":false,"context_lines":[{"line_number":133,"context_line":""},{"line_number":134,"context_line":"- Get agreement of API specifications"},{"line_number":135,"context_line":"- Implement the domain configuration code"},{"line_number":136,"context_line":"- Implement the domain re-loading code"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Dependencies"},{"line_number":139,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9aa7fdbe_b6d157fd","line":136,"in_reply_to":"9aa7fdbe_994bb12a","updated":"2014-10-22 08:30:52.000000000","message":"I agree - that would be awesome, but needs to be the subject of a separate spec","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"823d0c5ea10a9c8a143ff6330eb146327d121f33","unresolved":false,"context_lines":[{"line_number":133,"context_line":""},{"line_number":134,"context_line":"- Get agreement of API specifications"},{"line_number":135,"context_line":"- Implement the domain configuration code"},{"line_number":136,"context_line":"- Implement the domain re-loading code"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Dependencies"},{"line_number":139,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_9937a7fe","line":136,"in_reply_to":"9aa7fdbe_b6d157fd","updated":"2014-11-17 22:40:32.000000000","message":"what about the one-off code to migrate the existing config file into the SQL backend?\n\nI wonder if there should have an API that can import a config file into SQL and export SQL into a config file. But that can be discussed on the API spec.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"f3bff4c0f2595ceec46bc840d9b50ca5e58dd978","unresolved":false,"context_lines":[{"line_number":143,"context_line":"Testing"},{"line_number":144,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"None"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"Documentation Impact"},{"line_number":149,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_c62bc431","line":146,"updated":"2014-11-19 15:18:12.000000000","message":"My guess is that there will in-fact be testing.","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2e7e6afbcdc8a00a4d3cc7e9c5194a6df2e5f9f4","unresolved":false,"context_lines":[{"line_number":143,"context_line":"Testing"},{"line_number":144,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"None"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"Documentation Impact"},{"line_number":149,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a890539_3a2e3d8d","line":146,"in_reply_to":"5a890539_c62bc431","updated":"2014-11-30 09:54:37.000000000","message":"Done","commit_id":"009c5442ee36bcef81d6b227e9595be1136a4ec9"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"28cda901ba1a406ca06c77a4311b312288d5ab07","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Provide the means to store the configuration options that would normally stored"},{"line_number":15,"context_line":"in domain-specific configuration files in an SQL table instead."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_6b880fe8","line":15,"updated":"2014-12-16 22:48:43.000000000","message":"i just went on an adventure learning that \"an SQL\" is perhaps more correct than \"a SQL\" http://i.ytimg.com/vi/GD6qtc2_AQA/maxresdefault.jpg","commit_id":"06278a71d88337c00111d06599035378865d7419"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"28cda901ba1a406ca06c77a4311b312288d5ab07","unresolved":false,"context_lines":[{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Domain specific configuration files are used to specify the unique options"},{"line_number":22,"context_line":"for a given domain with regard to its identity backend (e.g. ldap url to be"},{"line_number":23,"context_line":"used for that domain). This use of a separate configuration file for each"},{"line_number":24,"context_line":"domain leads to some complexity in the choreography of on-boarding a new"},{"line_number":25,"context_line":"domain, e.g.:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_0b8f8b24","line":22,"updated":"2014-12-16 22:48:43.000000000","message":"(for example, ``[ldap] url`` ...)","commit_id":"06278a71d88337c00111d06599035378865d7419"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2b841afbec02e84c6d05f983b1cb446a1f6dfb01","unresolved":false,"context_lines":[{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Domain specific configuration files are used to specify the unique options"},{"line_number":22,"context_line":"for a given domain with regard to its identity backend (e.g. ldap url to be"},{"line_number":23,"context_line":"used for that domain). This use of a separate configuration file for each"},{"line_number":24,"context_line":"domain leads to some complexity in the choreography of on-boarding a new"},{"line_number":25,"context_line":"domain, e.g.:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_99076ac9","line":22,"in_reply_to":"3a961159_0b8f8b24","updated":"2015-01-12 15:39:39.000000000","message":"Done","commit_id":"06278a71d88337c00111d06599035378865d7419"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"28cda901ba1a406ca06c77a4311b312288d5ab07","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The two different mediums of where information about a domain is stored also"},{"line_number":35,"context_line":"makes it rather difficult to easily see what options are defined for a"},{"line_number":36,"context_line":"specific domain."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Proposed Change"},{"line_number":39,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_cbe4a3ae","line":36,"updated":"2014-12-16 22:48:43.000000000","message":"what are the two mediums? configuration file, and ...?","commit_id":"06278a71d88337c00111d06599035378865d7419"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2b841afbec02e84c6d05f983b1cb446a1f6dfb01","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The two different mediums of where information about a domain is stored also"},{"line_number":35,"context_line":"makes it rather difficult to easily see what options are defined for a"},{"line_number":36,"context_line":"specific domain."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Proposed Change"},{"line_number":39,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_b90c26ee","line":36,"in_reply_to":"3a961159_cbe4a3ae","updated":"2015-01-12 15:39:39.000000000","message":"clarified this (it configuration file and the existing domain entity)","commit_id":"06278a71d88337c00111d06599035378865d7419"},{"author":{"_account_id":2472,"name":"Doug Hellmann","email":"dhellmann@redhat.com","username":"doug-hellmann"},"change_message_id":"43fcb3e7a2bd297ec90c340493dbfb84ecef8155","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"This functionality exposes a new API to the backend configuration data for a"},{"line_number":92,"context_line":"domain. Like any other v3 API, it will be subject to the standard RBAC"},{"line_number":93,"context_line":"permissions model."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Notifications Impact"},{"line_number":96,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_ddaa8219","line":93,"updated":"2014-12-17 22:23:11.000000000","message":"If this configuration mechanism is going to interact with oslo.config at all, you also have to deal with the issue of exposing values through the interpolation mechanism.\n\nFor example, if the database contains an option foo with the value \"${bar}\" and you\u0027re mixing configuration data from oslo.confg and the database using a ConfigOpts instance, then if bar is defined in the config files it can be exposed to someone who has access to a place where the value of foo is going to be sent. I could set up a service that pretends to be a domain, configure it so the password sent to it is ${bar} and then learn the value for bar. We have changes in the queue to allow ${bar} to be ${blah.bar} to pull values out of sections other than the default section, so someone who knows about OpenStack configuration files could probe for any value they wanted.\n\nThat assumes, of course, that you\u0027re mixing the values together using oslo.config as the access mechanism, instead of wrapping an ConfigOpts object with something that knows how to get values from oslo.config and from this new part of the database.","commit_id":"06278a71d88337c00111d06599035378865d7419"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"2b841afbec02e84c6d05f983b1cb446a1f6dfb01","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"This functionality exposes a new API to the backend configuration data for a"},{"line_number":92,"context_line":"domain. Like any other v3 API, it will be subject to the standard RBAC"},{"line_number":93,"context_line":"permissions model."},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"Notifications Impact"},{"line_number":96,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"3a961159_82da8077","line":93,"in_reply_to":"3a961159_ddaa8219","updated":"2015-01-12 15:39:39.000000000","message":"Doug - thanks for the detailed comment.  So none of the data items that are domain specific are in oslo....they relate to the keystone identity driver configuration (e.g. ldap url).\n\nAnd my intention was to do what you suggest - create a class that wraps ConfigOpts that you initialise with the dict of \"options from SQL\"...and it will know where to pull the option from.","commit_id":"06278a71d88337c00111d06599035378865d7419"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"928a986d4f402203614998c28bc1b8ad4e58e538","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"None"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Data Model Impact"},{"line_number":78,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_2e25075c","line":75,"updated":"2015-01-13 18:48:56.000000000","message":"federation?","commit_id":"da032a2b6477e81610fb76197981eff88d69ad7f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"424120e07ea207148108d759b73be3710cf79fe0","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"None"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Data Model Impact"},{"line_number":78,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_8cb57cef","line":75,"in_reply_to":"3a961159_2e25075c","updated":"2015-01-19 15:30:37.000000000","message":"Agreed.","commit_id":"da032a2b6477e81610fb76197981eff88d69ad7f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"3aa26546ab56818256c0916e16e7661faa843dc7","unresolved":false,"context_lines":[{"line_number":91,"context_line":""},{"line_number":92,"context_line":"This functionality exposes a new API to the backend configuration data for a"},{"line_number":93,"context_line":"domain. Like any other v3 API, it will be subject to the standard RBAC"},{"line_number":94,"context_line":"permissions model."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Notifications Impact"},{"line_number":97,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_2e98a769","line":94,"updated":"2015-01-13 18:54:14.000000000","message":"i\u0027d appreciate if \"[ldap] password\" was specifically addressed, along with the re-iterating the allowed scope of keystone.conf that is mutable via the API","commit_id":"da032a2b6477e81610fb76197981eff88d69ad7f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"424120e07ea207148108d759b73be3710cf79fe0","unresolved":false,"context_lines":[{"line_number":91,"context_line":""},{"line_number":92,"context_line":"This functionality exposes a new API to the backend configuration data for a"},{"line_number":93,"context_line":"domain. Like any other v3 API, it will be subject to the standard RBAC"},{"line_number":94,"context_line":"permissions model."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Notifications Impact"},{"line_number":97,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":10,"id":"3a961159_0cea6cd8","line":94,"in_reply_to":"3a961159_2e98a769","updated":"2015-01-19 15:30:37.000000000","message":"will do.","commit_id":"da032a2b6477e81610fb76197981eff88d69ad7f"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"bf593dcadad0f47ac192885e15c936f535c3dd7f","unresolved":false,"context_lines":[{"line_number":92,"context_line":"REST API Impact"},{"line_number":93,"context_line":"---------------"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"The exact API specification will be defined as part of a review of an"},{"line_number":96,"context_line":"changes to the Identity API."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a961159_a5b79fd6","line":95,"updated":"2015-01-19 22:40:42.000000000","message":"Remove \u0027an\u0027?","commit_id":"ff495bfa2da8c00f43e2db33c55eb62415693cc8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c399c2937eb97f706cb70bacb8eb1fb1e17a2e47","unresolved":false,"context_lines":[{"line_number":92,"context_line":"REST API Impact"},{"line_number":93,"context_line":"---------------"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"The exact API specification will be defined as part of a review of an"},{"line_number":96,"context_line":"changes to the Identity API."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a961159_852d43b1","line":95,"in_reply_to":"3a961159_a5b79fd6","updated":"2015-01-19 22:52:48.000000000","message":"Done","commit_id":"ff495bfa2da8c00f43e2db33c55eb62415693cc8"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"bf593dcadad0f47ac192885e15c936f535c3dd7f","unresolved":false,"context_lines":[{"line_number":146,"context_line":"- Add support to keystoneclient library"},{"line_number":147,"context_line":"- Add support to openstack client"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"The work for supporting this API in Horizon will be propose separately."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Dependencies"},{"line_number":152,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a961159_c5310b5b","line":149,"updated":"2015-01-19 22:40:42.000000000","message":"s/propose/proposed ?","commit_id":"ff495bfa2da8c00f43e2db33c55eb62415693cc8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c399c2937eb97f706cb70bacb8eb1fb1e17a2e47","unresolved":false,"context_lines":[{"line_number":146,"context_line":"- Add support to keystoneclient library"},{"line_number":147,"context_line":"- Add support to openstack client"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"The work for supporting this API in Horizon will be propose separately."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Dependencies"},{"line_number":152,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":14,"id":"3a961159_c5690bfa","line":149,"in_reply_to":"3a961159_c5310b5b","updated":"2015-01-19 22:52:48.000000000","message":"Done","commit_id":"ff495bfa2da8c00f43e2db33c55eb62415693cc8"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0f7300d3aeeebdab521bcbb8e633b50b8d5bbad0","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"For example:"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"\"url\": \"http://myldap/root/henry/${password}\""},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The configuration option specified for substitution, which must exist in the"},{"line_number":90,"context_line":"same group as the option being defined (in this case \"url\"), will be"}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_51441474","line":87,"updated":"2015-01-20 21:11:42.000000000","message":"Same comment as other substitution comment.","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"193f3a3c5991ad33fcf67d8ce1cf5fadebb185a8","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"For example:"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"\"url\": \"http://myldap/root/henry/${password}\""},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The configuration option specified for substitution, which must exist in the"},{"line_number":90,"context_line":"same group as the option being defined (in this case \"url\"), will be"}],"source_content_type":"text/x-rst","patch_set":19,"id":"1a930d6b_547c0273","line":87,"in_reply_to":"1a930d6b_51441474","updated":"2015-01-20 21:25:51.000000000","message":"Done","commit_id":"f715288c9d40a7efe4013c7cb5ed82ab079ac886"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"0f5a969af936adea559f237a112fb224143ce6b4","unresolved":false,"context_lines":[{"line_number":28,"context_line":"  assignments are required"},{"line_number":29,"context_line":"* Use an out-of-band mechanism to create and place the domain specific"},{"line_number":30,"context_line":"  configuration file on the Keystone server"},{"line_number":31,"context_line":"* Restart Keystone to ensure cause the domain specific configuration file to"},{"line_number":32,"context_line":"  be read"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The two different mediums of where information about a domain is stored (i.e."}],"source_content_type":"text/x-rst","patch_set":20,"id":"9a80dd14_1efb3948","line":31,"updated":"2015-03-17 20:26:19.000000000","message":"delete ensure","commit_id":"178ac03691b5df6efcbe82e1a11f4c6da0845b72"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"0f5a969af936adea559f237a112fb224143ce6b4","unresolved":false,"context_lines":[{"line_number":45,"context_line":"configuration data or the existing domain specific configuration files"},{"line_number":46,"context_line":"approach. It will be an all or nothing option - there will be no mixing of some"},{"line_number":47,"context_line":"options in the extension and some in configuration files. If the extension is"},{"line_number":48,"context_line":"specified as the store of configuration data, then any domain-specific"},{"line_number":49,"context_line":"configuration files will be ignored. Keystone will go through the logic of"},{"line_number":50,"context_line":"building the domain configurations in the same way as it does today, either"},{"line_number":51,"context_line":"reading the configurations options from the extension or from the set files."}],"source_content_type":"text/x-rst","patch_set":20,"id":"9a80dd14_fea90526","line":48,"updated":"2015-03-17 20:26:19.000000000","message":"any -\u003e all","commit_id":"178ac03691b5df6efcbe82e1a11f4c6da0845b72"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"0f5a969af936adea559f237a112fb224143ce6b4","unresolved":false,"context_lines":[{"line_number":66,"context_line":"could be all LDAP if required)."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"One concern over this ability would be that some configuration options may"},{"line_number":69,"context_line":"be considered highly sensitive and would want to be stored separately and"},{"line_number":70,"context_line":"while can be written via the API, they cannot be read (for example password"},{"line_number":71,"context_line":"of the user required for doing LDAP searches, in the case when anonymous query"},{"line_number":72,"context_line":"is not supported). To address this concern, it is proposed that internally we"}],"source_content_type":"text/x-rst","patch_set":20,"id":"9a80dd14_5e177154","line":69,"updated":"2015-03-17 20:26:19.000000000","message":"separately. delete and","commit_id":"178ac03691b5df6efcbe82e1a11f4c6da0845b72"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"0f5a969af936adea559f237a112fb224143ce6b4","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"One concern over this ability would be that some configuration options may"},{"line_number":69,"context_line":"be considered highly sensitive and would want to be stored separately and"},{"line_number":70,"context_line":"while can be written via the API, they cannot be read (for example password"},{"line_number":71,"context_line":"of the user required for doing LDAP searches, in the case when anonymous query"},{"line_number":72,"context_line":"is not supported). To address this concern, it is proposed that internally we"},{"line_number":73,"context_line":"enforce an explicit whitelist of config options that can be read. All others"}],"source_content_type":"text/x-rst","patch_set":20,"id":"9a80dd14_de0a8126","line":70,"updated":"2015-03-17 20:26:19.000000000","message":"While these options can be","commit_id":"178ac03691b5df6efcbe82e1a11f4c6da0845b72"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"0f5a969af936adea559f237a112fb224143ce6b4","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Use of federation to access IdPs would (effectively) move this problem to"},{"line_number":101,"context_line":"creating mapping rules."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Data Model Impact"},{"line_number":104,"context_line":"-----------------"},{"line_number":105,"context_line":""}],"source_content_type":"text/x-rst","patch_set":20,"id":"9a80dd14_c9a72d0a","line":102,"updated":"2015-03-17 20:26:19.000000000","message":"the above is not well stated or clear","commit_id":"178ac03691b5df6efcbe82e1a11f4c6da0845b72"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"0f5a969af936adea559f237a112fb224143ce6b4","unresolved":false,"context_lines":[{"line_number":103,"context_line":"Data Model Impact"},{"line_number":104,"context_line":"-----------------"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Changes to the data model will be restricted to a new tables for storing the"},{"line_number":107,"context_line":"configuration information."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"REST API Impact"}],"source_content_type":"text/x-rst","patch_set":20,"id":"9a80dd14_09a945dd","line":106,"updated":"2015-03-17 20:26:19.000000000","message":"table","commit_id":"178ac03691b5df6efcbe82e1a11f4c6da0845b72"}]}