)]}'
{"specs/kilo/websso.rst":[{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"dcff0595f91937e1c92ebbef0ce4d8cd0ac79307","unresolved":false,"context_lines":[{"line_number":35,"context_line":"   this will start the federation handshake between Keystone and the IdP."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"3. `keystone` will retrieve a federated token, however, rather than returning"},{"line_number":38,"context_line":"   said token, `keystone` will perform a GET request to::"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"      localhost/auth/websso?token\u003d\u003csome_token_id\u003e"},{"line_number":41,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_9994488c","line":38,"updated":"2014-11-24 07:29:32.000000000","message":"If it was Keystone who initiates GET request your browser wouldn\u0027t get back to Horizon. Given the fact that you built something and it seems to work I think you mentioned HTTP 30x response.","commit_id":"6cc7e4d206d975e261b8786627340cba942c4c1f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"485bdf07385e65c99aa94486fed1a7a6683b0569","unresolved":false,"context_lines":[{"line_number":35,"context_line":"   this will start the federation handshake between Keystone and the IdP."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"3. `keystone` will retrieve a federated token, however, rather than returning"},{"line_number":38,"context_line":"   said token, `keystone` will perform a GET request to::"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"      localhost/auth/websso?token\u003d\u003csome_token_id\u003e"},{"line_number":41,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_b17866f9","line":38,"in_reply_to":"5a890539_9994488c","updated":"2014-12-02 08:17:04.000000000","message":"yes, you are right, it would be a redirect back to horizon. i\u0027ll change that in the next patch","commit_id":"6cc7e4d206d975e261b8786627340cba942c4c1f"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"dcff0595f91937e1c92ebbef0ce4d8cd0ac79307","unresolved":false,"context_lines":[{"line_number":37,"context_line":"3. `keystone` will retrieve a federated token, however, rather than returning"},{"line_number":38,"context_line":"   said token, `keystone` will perform a GET request to::"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"      localhost/auth/websso?token\u003d\u003csome_token_id\u003e"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"   Note, that this is an endpoint on `django_openstack_auth`."},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_d98a5063","line":40,"updated":"2014-11-24 07:29:32.000000000","message":"I don\u0027t think it\u0027s secure to have all the tokens in /var/log/apache/access.log files.\nAlso, Keystone needs to know *where* it should redirect back the user.","commit_id":"6cc7e4d206d975e261b8786627340cba942c4c1f"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"0442bf53bc91d597a779342f5fa9744b2080bce7","unresolved":false,"context_lines":[{"line_number":37,"context_line":"3. `keystone` will retrieve a federated token, however, rather than returning"},{"line_number":38,"context_line":"   said token, `keystone` will perform a GET request to::"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"      localhost/auth/websso?token\u003d\u003csome_token_id\u003e"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"   Note, that this is an endpoint on `django_openstack_auth`."},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_ac2ba931","line":40,"in_reply_to":"5a890539_11869adb","updated":"2014-12-02 15:56:13.000000000","message":"So, if you have one Horizon pointing to a Keystone you can even add a parameter in Keyston config, something like \u0027websso_redirect_url\u0027, and once the authN is done Keystone will always redirect you to said Horizon (or URL in general). Now, if accept many Horizons  pointing to our Keystone (like we do today), you would need to keep some source-url (or referer?) somewhere for that session so later you can redirect to the originating Horizon. I don\u0027t exactly know where to store that url.... somewhere in the headers?","commit_id":"6cc7e4d206d975e261b8786627340cba942c4c1f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"485bdf07385e65c99aa94486fed1a7a6683b0569","unresolved":false,"context_lines":[{"line_number":37,"context_line":"3. `keystone` will retrieve a federated token, however, rather than returning"},{"line_number":38,"context_line":"   said token, `keystone` will perform a GET request to::"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"      localhost/auth/websso?token\u003d\u003csome_token_id\u003e"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"   Note, that this is an endpoint on `django_openstack_auth`."},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_11869adb","line":40,"in_reply_to":"5a890539_d98a5063","updated":"2014-12-02 08:17:04.000000000","message":"can you elaborate on your second point, i don\u0027t follow.\n\nas you know, the alternative to the query parameter is to include it in the POST body.","commit_id":"6cc7e4d206d975e261b8786627340cba942c4c1f"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"f80b675dccd1f056e3098c7b4b13ddd3449cedd1","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"      localhost/auth/websso?token\u003d\u003csome_token_id\u003e"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"   Note, that this is an endpoint on `django_openstack_auth`."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"4. `django_openstack_auth` will attempt to create a `python-keystoneclient`"},{"line_number":45,"context_line":"   session based on the token that was sent over. If the client is instantiated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_28bdc0b7","line":42,"updated":"2014-11-24 02:34:06.000000000","message":"Is this assuming ECP?  What about for cass where the IdP does not support ECP?","commit_id":"6cc7e4d206d975e261b8786627340cba942c4c1f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"485bdf07385e65c99aa94486fed1a7a6683b0569","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"      localhost/auth/websso?token\u003d\u003csome_token_id\u003e"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"   Note, that this is an endpoint on `django_openstack_auth`."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"4. `django_openstack_auth` will attempt to create a `python-keystoneclient`"},{"line_number":45,"context_line":"   session based on the token that was sent over. If the client is instantiated"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_316c7636","line":42,"in_reply_to":"5a890539_28bdc0b7","updated":"2014-12-02 08:17:04.000000000","message":"it works for openid connect, so it\u0027s not ecp specific.","commit_id":"6cc7e4d206d975e261b8786627340cba942c4c1f"}]}