)]}'
{"specs/kilo/rescoping.rst":[{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"be9f16065202dd7a39511114f6661aeaa02aea20","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Limit the rescoping of tokens to prevent unauthorized reuse."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_6231a659","line":15,"updated":"2014-10-15 18:37:11.000000000","message":"or escalation of privileges","commit_id":"6047792ee01a487e3969aa4dd954d30baca29707"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"be9f16065202dd7a39511114f6661aeaa02aea20","unresolved":false,"context_lines":[{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Any token a user requests themselves can be used to request another token.  Effectivly, any such token is unconstrained."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Proposed Change"},{"line_number":24,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_221a3ec6","line":21,"updated":"2014-10-15 18:37:11.000000000","message":"Does not describe the problem clearly. How about\n\n\nAn unscoped token can be used to obtain a token scoped to any project. However, once a user is in possession of a scoped token, he is able to exchange it back to an unscoped token, and from there to another project scoped token. This should not be allowed, since it means that any token is effectively unconstrained. In order to exchange a scoped token to an unscoped token the user should have to re-authenticate to prove he is entitled to the unscoped token","commit_id":"6047792ee01a487e3969aa4dd954d30baca29707"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"be9f16065202dd7a39511114f6661aeaa02aea20","unresolved":false,"context_lines":[{"line_number":24,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Constrain tokens such that any token that is not \"unscoped\" cannot be exchanged for a token that is scoped to a domain or project."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Alternatives"},{"line_number":30,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"baa201ad_a200ee66","line":27,"updated":"2014-10-15 18:37:11.000000000","message":"without the user re-authenticating","commit_id":"6047792ee01a487e3969aa4dd954d30baca29707"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0d1d9641fd1ef1d0f48dde38f5b355871940048e","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Limit the rescoping of tokens to prevent unauthorized reuse or escalation of"},{"line_number":16,"context_line":"privileges."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_57f7c5d2","line":16,"updated":"2014-10-28 00:44:00.000000000","message":"Yes please!","commit_id":"98e025f7e811ad8364ef842ffcb0e81d57d38d56"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"f75418bdffec1592878438cbd1fd760b2c942eea","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"An unscoped token can be used to obtain a token scoped to any project. However,"},{"line_number":23,"context_line":"once a user is in possession of a scoped token, that user, or any user, which"},{"line_number":24,"context_line":"obtains the token is able to exchange it for another project scoped token. This"},{"line_number":25,"context_line":"should not be allowed, since it means that any token is effectively"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_3413da5d","line":22,"updated":"2014-10-20 16:45:48.000000000","message":"Can\u0027t we exchange unscoped token for domain scoped token?","commit_id":"98e025f7e811ad8364ef842ffcb0e81d57d38d56"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0d1d9641fd1ef1d0f48dde38f5b355871940048e","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"An unscoped token can be used to obtain a token scoped to any project. However,"},{"line_number":23,"context_line":"once a user is in possession of a scoped token, that user, or any user, which"},{"line_number":24,"context_line":"obtains the token is able to exchange it for another project scoped token. This"},{"line_number":25,"context_line":"should not be allowed, since it means that any token is effectively"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_37fc01b8","line":22,"in_reply_to":"9aa7fdbe_3413da5d","updated":"2014-10-28 00:44:00.000000000","message":"Hannah: are you asking for the ability to do:\n\nunscoped -\u003e domain scope\ndomain scope -\u003e projects within the domain?\n\nOr just unscoped to domains cope as well as to project scope?\n\nI think the implication is an unscoped token can be exchanged for a scoped token of any form (domain, project, etc). But a scoped token cannot be rescoped.","commit_id":"98e025f7e811ad8364ef842ffcb0e81d57d38d56"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"22ba2967d45ab78eec1454de59f0f46c561d3efd","unresolved":false,"context_lines":[{"line_number":107,"context_line":"  implement as well)? Are the default values ones which will work well in"},{"line_number":108,"context_line":"  real deployments?"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"A Config flag to enable,disable this feature"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"* Is this a change that takes immediate effect after its merged, or is it"},{"line_number":113,"context_line":"  something that has to be explicitly enabled?"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_14f6dbd7","line":110,"updated":"2014-10-20 15:04:47.000000000","message":"use / in stead of ,","commit_id":"98e025f7e811ad8364ef842ffcb0e81d57d38d56"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"22ba2967d45ab78eec1454de59f0f46c561d3efd","unresolved":false,"context_lines":[{"line_number":124,"context_line":"----------------"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"All services that need multiple tokens will have to hold on to one unscoped"},{"line_number":127,"context_line":"token to get the other tokens.  This should be managed by the keystone client."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_94bf2bd0","line":127,"updated":"2014-10-20 15:04:47.000000000","message":"so this blueprint is going to require work to both the keystoneclient and the server? Can these steps be laid out in the \u0027Work Items\u0027 section?","commit_id":"98e025f7e811ad8364ef842ffcb0e81d57d38d56"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0d1d9641fd1ef1d0f48dde38f5b355871940048e","unresolved":false,"context_lines":[{"line_number":124,"context_line":"----------------"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"All services that need multiple tokens will have to hold on to one unscoped"},{"line_number":127,"context_line":"token to get the other tokens.  This should be managed by the keystone client."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_f725195c","line":127,"in_reply_to":"9aa7fdbe_94bf2bd0","updated":"2014-10-28 00:44:00.000000000","message":"++ This needs additions to the work items. (Likely Openstackclient will need to be aware as well)","commit_id":"98e025f7e811ad8364ef842ffcb0e81d57d38d56"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0d1d9641fd1ef1d0f48dde38f5b355871940048e","unresolved":false,"context_lines":[{"line_number":144,"context_line":"Work Items"},{"line_number":145,"context_line":"----------"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":""},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"Dependencies"},{"line_number":150,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_57e50507","line":147,"updated":"2014-10-28 00:44:00.000000000","message":"Please add the work to the work items. In general I\u0027m a huge supporter of this concept and would like to see this be implemented.","commit_id":"98e025f7e811ad8364ef842ffcb0e81d57d38d56"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0d1d9641fd1ef1d0f48dde38f5b355871940048e","unresolved":false,"context_lines":[{"line_number":149,"context_line":"Dependencies"},{"line_number":150,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"*"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"References"},{"line_number":155,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9aa7fdbe_d7d9f557","line":152,"updated":"2014-10-28 00:44:00.000000000","message":"You\u0027ve got a little something here. Might want to remove the *.","commit_id":"98e025f7e811ad8364ef842ffcb0e81d57d38d56"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"34447fe2718b8c4faaf9c5e82fc103f337e42241","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"An unscoped token can be used to obtain a token scoped to any project or"},{"line_number":23,"context_line":"domain. However, once a user is in possession of a scoped token, that user, or"},{"line_number":24,"context_line":"any user, which obtains the token is able to exchange it for another project"},{"line_number":25,"context_line":"scoped token. This should not be allowed, since it means that any token is"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_d66b4a83","line":22,"updated":"2014-12-17 17:04:24.000000000","message":"Great writeup!","commit_id":"a7e3c288c4d899f854645baaf3680347b678f5f7"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"362fc4f67e5931edd4e3d18f7c992cf505e65f95","unresolved":false,"context_lines":[{"line_number":122,"context_line":"----------------"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"All services that need multiple tokens will have to hold on to one unscoped"},{"line_number":125,"context_line":"token to get the other tokens.  This should be managed by the keystone client."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a890539_6ee7dd12","line":125,"updated":"2014-12-02 20:30:47.000000000","message":"We should add if this functionality exists in python-keystoneclient already.","commit_id":"a7e3c288c4d899f854645baaf3680347b678f5f7"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"a8079b285e890b3965b488958326263ca48c4945","unresolved":false,"context_lines":[{"line_number":122,"context_line":"----------------"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"All services that need multiple tokens will have to hold on to one unscoped"},{"line_number":125,"context_line":"token to get the other tokens.  This should be managed by the keystone client."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_590f8de1","line":125,"in_reply_to":"5a890539_6ee7dd12","updated":"2014-12-17 17:36:58.000000000","message":"Below in the work-items it says this needs to be created","commit_id":"a7e3c288c4d899f854645baaf3680347b678f5f7"}]}