)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"71c64747c9b2cbbb234f436b831c84f944015020","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-12-03 05:54:14 -0800"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Self Management of Domain Scoped (DS) Roles"},{"line_number":8,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"This specification enables domain administrator to create and manage DS"},{"line_number":11,"context_line":"roles within a federation, by inviting federated users to join the various DS"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"5a890539_e3b1e944","line":8,"updated":"2014-12-03 23:22:04.000000000","message":"As a point for future reference, you\u0027ll need to avoid putting a line like this after the initial line in the commit. an empty line between the \"subject\" and the commit message is sufficient [and looks better in gerrit/git].\n\nI haven\u0027t reviewed the rest of this yet so i\u0027m withholding a score. if everything else looks ok, i can fix the commit message.","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4bb2d3e42959ab4b2ea25e4a7cead5d5893a90be","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-12-03 05:54:14 -0800"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Self Management of Domain Scoped (DS) Roles"},{"line_number":8,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"This specification enables domain administrator to create and manage DS"},{"line_number":11,"context_line":"roles within a federation, by inviting federated users to join the various DS"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3a961159_d61d0a68","line":8,"in_reply_to":"5a890539_e3b1e944","updated":"2014-12-09 18:02:05.000000000","message":"++","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"}],"specs/kilo/ds-role-self-manage.md":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b072d9cb0c37d2850e32bcd17632890718b9d9f4","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"5a890539_83de656b","updated":"2014-12-03 23:22:42.000000000","message":"I believe the file needs to be .rst not .md for sphinx to catch it properly.","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"d139685c45ac05cbb5e2ee9af149fb3b155f93dc","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"3a961159_230b5526","in_reply_to":"3a961159_d6626ad7","updated":"2014-12-10 12:20:14.000000000","message":"++","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4bb2d3e42959ab4b2ea25e4a7cead5d5893a90be","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"3a961159_d6626ad7","in_reply_to":"5a890539_83de656b","updated":"2014-12-09 18:02:05.000000000","message":"Copying the template and modifying the template should work around this, and ensure consistency.","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"d139685c45ac05cbb5e2ee9af149fb3b155f93dc","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Self Management of Domain Scoped (DS) Roles"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"In a federation, both users and keystone domain administrators may not know the"},{"line_number":5,"context_line":"identifiers or identity attributes that IdPs assert for their users. It is"},{"line_number":6,"context_line":"therefore difficult, if not impossible, for a domain administrator to add the"}],"source_content_type":"text/x-markdown","patch_set":1,"id":"3a961159_a802c408","line":3,"updated":"2014-12-10 12:20:14.000000000","message":"You need a reference to the blueprint here, like:\n\n`bp example \u003chttps://blueprints.launchpad.net/keystone/+spec/example\u003e`_","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4bb2d3e42959ab4b2ea25e4a7cead5d5893a90be","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Self Management of Domain Scoped (DS) Roles"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"In a federation, both users and keystone domain administrators may not know the"},{"line_number":5,"context_line":"identifiers or identity attributes that IdPs assert for their users. It is"},{"line_number":6,"context_line":"therefore difficult, if not impossible, for a domain administrator to add the"},{"line_number":7,"context_line":"correct mapping rules to Keystone in order to assign particular DS roles to"}],"source_content_type":"text/x-markdown","patch_set":1,"id":"3a961159_d6e7ca3e","line":4,"updated":"2014-12-09 18:02:05.000000000","message":"nit: Keystone","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"cd161c646d0aa6ab9086023904fea0a8527bf68b","unresolved":false,"context_lines":[{"line_number":5,"context_line":"identifiers or identity attributes that IdPs assert for their users. It is"},{"line_number":6,"context_line":"therefore difficult, if not impossible, for a domain administrator to add the"},{"line_number":7,"context_line":"correct mapping rules to Keystone in order to assign particular DS roles to"},{"line_number":8,"context_line":"particular federated users."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"This specification enables domain administrator to create and manage DS"},{"line_number":11,"context_line":"roles within a federation, by inviting federated users to join the various DS"}],"source_content_type":"text/x-markdown","patch_set":1,"id":"5a890539_45039741","line":8,"updated":"2014-12-04 07:20:24.000000000","message":"Maybe I\u0027m not quite getting what you are proposing, but I think we may have a misunderstanding of what a DS role is (assuming DS role is meant to be a domain-role as defined in https://review.openstack.org/#/c/133855/).  A user cannot be a \"member\" of a domain-role....they can be part of an assignment of a domain-role onto a target (i.e. project or domain) - just like a user can\u0027t be a member of one of the existing (global) roles. domain-roles will not appear in the mapping rules, that\u0027s still just groups (and one of those groups might have a domain-roles assignment to a given project/domain)","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"e0905c26dc1bd0f47b840c3252264fb352a912ea","unresolved":false,"context_lines":[{"line_number":5,"context_line":"identifiers or identity attributes that IdPs assert for their users. It is"},{"line_number":6,"context_line":"therefore difficult, if not impossible, for a domain administrator to add the"},{"line_number":7,"context_line":"correct mapping rules to Keystone in order to assign particular DS roles to"},{"line_number":8,"context_line":"particular federated users."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"This specification enables domain administrator to create and manage DS"},{"line_number":11,"context_line":"roles within a federation, by inviting federated users to join the various DS"}],"source_content_type":"text/x-markdown","patch_set":1,"id":"5a890539_3d8d847d","line":8,"in_reply_to":"5a890539_45039741","updated":"2014-12-05 17:16:40.000000000","message":"Yes it is meant to be a domain-role. \nIn my previous version of this spec, I called it a VO role and mapped it into a group. And the group was then assigned to a role. But you said you did not like groups and wanted to get rid of them (or have I misunderstood your position?). So, instead of mapping from external attributes to groups to domain-roles, why not allow mapping straight from external attributes to domain-roles. The code that self manages the mapping can just as easily self manage the assignment of a federated user to a domain-role (or normal role for that matter). This was actually in our original design for attribute mapping.","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":9142,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@lsd.ufcg.edu.br","username":"samuel-z","inactive":true},"change_message_id":"d139685c45ac05cbb5e2ee9af149fb3b155f93dc","unresolved":false,"context_lines":[{"line_number":22,"context_line":"### DS roles: `/OS-FEDERATION/DS_roles`"},{"line_number":23,"context_line":"### DS role membership: `/OS-FEDERATION/DS_roles/member`"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Admin API on DS roles"},{"line_number":26,"context_line":"---------------------"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"### Create a DS role: `PUT /OS-FEDERATION/DS_roles`"}],"source_content_type":"text/x-markdown","patch_set":1,"id":"3a961159_03a019f3","line":25,"updated":"2014-12-10 12:20:14.000000000","message":"I think you should follow the spec template, as pointed out earlier.\nIn addition, I think all these API operations have to be placed in a patch to [1].\n\n[1] https://github.com/openstack/keystone-specs/blob/master/api/v3/identity-api-v3.rst","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4bb2d3e42959ab4b2ea25e4a7cead5d5893a90be","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"- `secret` (string)"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"  The secret to be presented by users to register for this DS role."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Optional attributes:"},{"line_number":45,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":1,"id":"3a961159_964b822a","line":42,"updated":"2014-12-09 18:02:05.000000000","message":"This will all be represented with a schema.py for jsonschema validation, correct?\n\nhttps://github.com/openstack/keystone/blob/6aaba42f0d3038aa3f26b5f308dd45fcfef2a65a/keystone/assignment/schema.py","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4bb2d3e42959ab4b2ea25e4a7cead5d5893a90be","unresolved":false,"context_lines":[{"line_number":196,"context_line":"        }"},{"line_number":197,"context_line":"    }"},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"\t"},{"line_number":200,"context_line":"Admin API on DS role membership"},{"line_number":201,"context_line":"-------------------------------"},{"line_number":202,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":1,"id":"3a961159_164eb26f","line":199,"updated":"2014-12-09 18:02:05.000000000","message":"remove whitespace","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4bb2d3e42959ab4b2ea25e4a7cead5d5893a90be","unresolved":false,"context_lines":[{"line_number":313,"context_line":""},{"line_number":314,"context_line":"Status: 204 No Content"},{"line_number":315,"context_line":""},{"line_number":316,"context_line":"Users will become blacklisted if they make too many wrong attempts at joining a"},{"line_number":317,"context_line":"DS role (e.g. by quoting the wrong password/PIN). This will mean that all"},{"line_number":318,"context_line":"further attempts to join any DS role in this domain will fail and the domain"},{"line_number":319,"context_line":"administrator must remove the user from the blacklist for that user to be able"}],"source_content_type":"text/x-markdown","patch_set":1,"id":"3a961159_b6c95e7b","line":316,"updated":"2014-12-09 18:02:05.000000000","message":"Is this going to be configurable?","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4bb2d3e42959ab4b2ea25e4a7cead5d5893a90be","unresolved":false,"context_lines":[{"line_number":317,"context_line":"DS role (e.g. by quoting the wrong password/PIN). This will mean that all"},{"line_number":318,"context_line":"further attempts to join any DS role in this domain will fail and the domain"},{"line_number":319,"context_line":"administrator must remove the user from the blacklist for that user to be able"},{"line_number":320,"context_line":"to join any DS role again."},{"line_number":321,"context_line":""},{"line_number":322,"context_line":"### List blacklisted users for DS role: `GET /OS-FEDERATION/DS_roles/{DS_role_id}/blacklist`"},{"line_number":323,"context_line":""}],"source_content_type":"text/x-markdown","patch_set":1,"id":"3a961159_96954242","line":320,"updated":"2014-12-09 18:02:05.000000000","message":"How long will someone be blacklisted for?","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4bb2d3e42959ab4b2ea25e4a7cead5d5893a90be","unresolved":false,"context_lines":[{"line_number":437,"context_line":""},{"line_number":438,"context_line":"Response:"},{"line_number":439,"context_line":""},{"line_number":440,"context_line":"Status: 204 No Content"}],"source_content_type":"text/x-markdown","patch_set":1,"id":"3a961159_96caa24d","line":440,"updated":"2014-12-09 18:02:05.000000000","message":"What about the rest of the template sections? \n\nhttps://github.com/openstack/keystone-specs/blob/master/specs/template.rst","commit_id":"f9f4004c9e69b8e69ce91073b1904eebbea63983"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c563fba7128c0df445ea153d84ab1e0676916423","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Self Management of Domain Scoped (DS) Roles"},{"line_number":2,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"In a federation, both users and keystone domain administrators may not know the"}],"source_content_type":"text/x-markdown","patch_set":2,"id":"3a961159_fa8720d5","line":1,"updated":"2014-12-10 18:32:36.000000000","message":"This still needs to be be based on the template to get the license, required sections, etc. Like noted earlier this needs to be a .rst and not a .md.","commit_id":"a47f425795897bac16b8d4661596c00bb46557a4"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c563fba7128c0df445ea153d84ab1e0676916423","unresolved":false,"context_lines":[{"line_number":9,"context_line":""},{"line_number":10,"context_line":"This specification enables domain administrator to create and manage DS"},{"line_number":11,"context_line":"roles within a federation, by inviting federated users to join the various DS"},{"line_number":12,"context_line":"roles, and then it automatically creates the correct mapping rule for each user."},{"line_number":13,"context_line":"In this way, each time a user authenticates to Keystone via his IdP, there"},{"line_number":14,"context_line":"will be the correct mapping rule in Keystone to assign the user to the correct"},{"line_number":15,"context_line":"DS role. The DS roles created by this specification are protected by a secret"}],"source_content_type":"text/x-markdown","patch_set":2,"id":"3a961159_15975d91","line":12,"updated":"2014-12-10 18:32:36.000000000","message":"There is not Work Items section yet, but I\u0027m assuming part of this work is to add the ability to use multiple mappings per IdP/protocol?","commit_id":"a47f425795897bac16b8d4661596c00bb46557a4"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c563fba7128c0df445ea153d84ab1e0676916423","unresolved":false,"context_lines":[{"line_number":14,"context_line":"will be the correct mapping rule in Keystone to assign the user to the correct"},{"line_number":15,"context_line":"DS role. The DS roles created by this specification are protected by a secret"},{"line_number":16,"context_line":"or PIN, which has to be quoted by the federated users when they wish to join"},{"line_number":17,"context_line":"this DS role."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"DS Roles are assigned OpenStack roles in the normal way, so that all the"},{"line_number":20,"context_line":"members of a DS Role have the same capabilities/privileges."}],"source_content_type":"text/x-markdown","patch_set":2,"id":"3a961159_ba3598f8","line":17,"updated":"2014-12-10 18:32:36.000000000","message":"So this pin is a shared secret between the person creating the DS record and *anyone* that they wish to join? So that means that if I\u0027m invited to a DS role I am implicitly granted the ability to invite more people?\n\nSince this is a secret do we care about hashing it? This definitely needs to be explored in the Security Impact section.","commit_id":"a47f425795897bac16b8d4661596c00bb46557a4"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c563fba7128c0df445ea153d84ab1e0676916423","unresolved":false,"context_lines":[{"line_number":19,"context_line":"DS Roles are assigned OpenStack roles in the normal way, so that all the"},{"line_number":20,"context_line":"members of a DS Role have the same capabilities/privileges."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"### DS roles: `/OS-FEDERATION/DS_roles`"},{"line_number":23,"context_line":"### DS role membership: `/OS-FEDERATION/DS_roles/member`"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Admin API on DS roles"}],"source_content_type":"text/x-markdown","patch_set":2,"id":"3a961159_fad560b9","line":22,"updated":"2014-12-10 18:32:36.000000000","message":"Is this trying to use markdown?","commit_id":"a47f425795897bac16b8d4661596c00bb46557a4"}]}