)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"258ec4910b86f88f1f24db79cd29832b6f14b363","unresolved":false,"context_lines":[{"line_number":9,"context_line":"A new attribute, remote_id, to be associated with the IDP and"},{"line_number":10,"context_line":"used to verify the origin of the authentication assertion of the user"},{"line_number":11,"context_line":"using saml or other protocol supported in OS-Federation."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: Idb49727bf830b3e7701ba12e81f98c70d43b2006"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"fa81d914_03b484cf","line":12,"updated":"2015-01-30 00:57:19.000000000","message":"shouldn\u0027t point the bp here?","commit_id":"86538740dd1eac1de9f4f23a253f9baba09ae05f"}],"api/v3/identity-api-v3-os-federation-ext.rst":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f46cce741d6427573f698f4bcf7c66474ca25a0b","unresolved":false,"context_lines":[{"line_number":68,"context_line":"  authentication requests."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"  If a value is not specified by the client, the service will default this to"},{"line_number":71,"context_line":"  ``false``."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"Protocols"},{"line_number":74,"context_line":"~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_42ea7b78","line":71,"updated":"2015-01-19 16:30:26.000000000","message":"Add ``remote_ids`` with a description here.","commit_id":"15bf7c274c472664332c5be68cd28ce7237014d2"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b1b4f5b2de99c14290e040c232e64102d1c22f1b","unresolved":false,"context_lines":[{"line_number":295,"context_line":"            },"},{"line_number":296,"context_line":"            {"},{"line_number":297,"context_line":"                \"description\": \"Stores contractor identities\","},{"line_number":298,"context_line":"                \"remote_ids\": [\"sore_id_1\", \"store_id_2\"],"},{"line_number":299,"context_line":"                \"enabled\": false,"},{"line_number":300,"context_line":"                \"id\": \"ACME-contractors\","},{"line_number":301,"context_line":"                \"links\": {"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa81d914_30cb9e54","line":298,"updated":"2015-01-29 18:39:41.000000000","message":"(nit/typo) This should be \"store_id_1\".","commit_id":"86538740dd1eac1de9f4f23a253f9baba09ae05f"}],"specs/kilo/idp-id-registration.rst":[{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"4da3f490a2f26237a5c544ddaca21565f8e8d0d3","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The python-keystoneclient needs to be updated in order to reflect the new API"},{"line_number":100,"context_line":"to register the IDP. In the current implementation there is not the attribute"},{"line_number":101,"context_line":"``remote_id`` during the registration of a new Identity Provider. The attribute"},{"line_number":102,"context_line":"has to be included during the creation/editing of the IDPs."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_40d43e1f","line":101,"updated":"2015-01-19 12:00:52.000000000","message":"remote_ids","commit_id":"a0ae86f38d632f7767d1095221418bdb05980016"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"e5fa558cd0733f55c791b7f9664c03d1db4b32aa","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"The python-keystoneclient needs to be updated in order to reflect the new API"},{"line_number":100,"context_line":"to register the IDP. In the current implementation there is not the attribute"},{"line_number":101,"context_line":"``remote_id`` during the registration of a new Identity Provider. The attribute"},{"line_number":102,"context_line":"has to be included during the creation/editing of the IDPs."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_3b004300","line":101,"in_reply_to":"3a961159_40d43e1f","updated":"2015-01-19 12:26:55.000000000","message":"Done","commit_id":"a0ae86f38d632f7767d1095221418bdb05980016"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"4da3f490a2f26237a5c544ddaca21565f8e8d0d3","unresolved":false,"context_lines":[{"line_number":144,"context_line":"Work Items"},{"line_number":145,"context_line":"----------"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* Modify the IDP APIs to contain the new attribute ``remote_id``"},{"line_number":148,"context_line":"* Modify the ``python-keystoneclient`` to interact with modified API"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"A partial implementation of this specs under review: `review 142743"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_004eb638","line":147,"updated":"2015-01-19 12:00:52.000000000","message":"remote_ids","commit_id":"a0ae86f38d632f7767d1095221418bdb05980016"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"e5fa558cd0733f55c791b7f9664c03d1db4b32aa","unresolved":false,"context_lines":[{"line_number":144,"context_line":"Work Items"},{"line_number":145,"context_line":"----------"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"* Modify the IDP APIs to contain the new attribute ``remote_id``"},{"line_number":148,"context_line":"* Modify the ``python-keystoneclient`` to interact with modified API"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"A partial implementation of this specs under review: `review 142743"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_fb15db3d","line":147,"in_reply_to":"3a961159_004eb638","updated":"2015-01-19 12:26:55.000000000","message":"Done","commit_id":"a0ae86f38d632f7767d1095221418bdb05980016"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"4da3f490a2f26237a5c544ddaca21565f8e8d0d3","unresolved":false,"context_lines":[{"line_number":147,"context_line":"* Modify the IDP APIs to contain the new attribute ``remote_id``"},{"line_number":148,"context_line":"* Modify the ``python-keystoneclient`` to interact with modified API"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"A partial implementation of this specs under review: `review 142743"},{"line_number":151,"context_line":"\u003chttps://review.openstack.org/#/c/142743\u003e`_"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_0065d6ae","line":150,"updated":"2015-01-19 12:00:52.000000000","message":"This could be probably moved to \u0027References\u0027 section.","commit_id":"a0ae86f38d632f7767d1095221418bdb05980016"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"e5fa558cd0733f55c791b7f9664c03d1db4b32aa","unresolved":false,"context_lines":[{"line_number":147,"context_line":"* Modify the IDP APIs to contain the new attribute ``remote_id``"},{"line_number":148,"context_line":"* Modify the ``python-keystoneclient`` to interact with modified API"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"A partial implementation of this specs under review: `review 142743"},{"line_number":151,"context_line":"\u003chttps://review.openstack.org/#/c/142743\u003e`_"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a961159_9b35b7de","line":150,"in_reply_to":"3a961159_0065d6ae","updated":"2015-01-19 12:26:55.000000000","message":"Done","commit_id":"a0ae86f38d632f7767d1095221418bdb05980016"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b1c992ccdc3b52c4535ff883919bead8f583c5be","unresolved":false,"context_lines":[{"line_number":15,"context_line":"This specification describes a more secure user mapping after authentication"},{"line_number":16,"context_line":"using the ``OS-FEDERATION`` APIs. The Identity Provider releasing the"},{"line_number":17,"context_line":"authentication assertion is identified to avoid wrong user mapping so its ID"},{"line_number":18,"context_line":"has to be registered in Keystone and validate upon authentication request."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Problem Description"},{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_5dd17c55","line":18,"updated":"2015-01-19 17:04:32.000000000","message":"change \"validate\" to \"validated\"","commit_id":"15bf7c274c472664332c5be68cd28ce7237014d2"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bae1377b77e18c67c455ae8397176ded9fb22964","unresolved":false,"context_lines":[{"line_number":15,"context_line":"This specification describes a more secure user mapping after authentication"},{"line_number":16,"context_line":"using the ``OS-FEDERATION`` APIs. The Identity Provider releasing the"},{"line_number":17,"context_line":"authentication assertion is identified to avoid wrong user mapping so its ID"},{"line_number":18,"context_line":"has to be registered in Keystone and validate upon authentication request."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Problem Description"},{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_78d9e655","line":18,"in_reply_to":"3a961159_5dd17c55","updated":"2015-01-19 17:18:48.000000000","message":"Done","commit_id":"15bf7c274c472664332c5be68cd28ce7237014d2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b1c992ccdc3b52c4535ff883919bead8f583c5be","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Problem Description"},{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"With OS-Federation is possible to use external Identity Providers (IDPs) for"},{"line_number":24,"context_line":"user authentication. A user, to be authenticated, needs to access a specific"},{"line_number":25,"context_line":"path containing IDP name and protocol::"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_7d3d588e","line":23,"updated":"2015-01-19 17:04:32.000000000","message":"change \"is\" to \"it is\"\n\nchange \"IDPs\" to \"IdPs\" (and change IDP -\u003e IdP throughout this document.","commit_id":"15bf7c274c472664332c5be68cd28ce7237014d2"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bae1377b77e18c67c455ae8397176ded9fb22964","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Problem Description"},{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"With OS-Federation is possible to use external Identity Providers (IDPs) for"},{"line_number":24,"context_line":"user authentication. A user, to be authenticated, needs to access a specific"},{"line_number":25,"context_line":"path containing IDP name and protocol::"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_d8df3a37","line":23,"in_reply_to":"3a961159_7d3d588e","updated":"2015-01-19 17:18:48.000000000","message":"Done","commit_id":"15bf7c274c472664332c5be68cd28ce7237014d2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b1c992ccdc3b52c4535ff883919bead8f583c5be","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"When an IDP is registered in Keystone, its ID (i.e. in saml protocol this will"},{"line_number":52,"context_line":"be the entity_id of the IDP) has to be stored alongside the other information"},{"line_number":53,"context_line":"and used during the authentication to verify the if the IDP releasing the"},{"line_number":54,"context_line":"assertion matches the IDP specified in the URL. The ID is provided with a new"},{"line_number":55,"context_line":"attribute, named ``remote_ids``, and this can contains a list of IDs."},{"line_number":56,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_3d5cb080","line":53,"updated":"2015-01-19 17:04:32.000000000","message":"change \"the if\" to \"that\"","commit_id":"15bf7c274c472664332c5be68cd28ce7237014d2"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bae1377b77e18c67c455ae8397176ded9fb22964","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"When an IDP is registered in Keystone, its ID (i.e. in saml protocol this will"},{"line_number":52,"context_line":"be the entity_id of the IDP) has to be stored alongside the other information"},{"line_number":53,"context_line":"and used during the authentication to verify the if the IDP releasing the"},{"line_number":54,"context_line":"assertion matches the IDP specified in the URL. The ID is provided with a new"},{"line_number":55,"context_line":"attribute, named ``remote_ids``, and this can contains a list of IDs."},{"line_number":56,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_78b006fe","line":53,"in_reply_to":"3a961159_3d5cb080","updated":"2015-01-19 17:18:48.000000000","message":"Done","commit_id":"15bf7c274c472664332c5be68cd28ce7237014d2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b1c992ccdc3b52c4535ff883919bead8f583c5be","unresolved":false,"context_lines":[{"line_number":52,"context_line":"be the entity_id of the IDP) has to be stored alongside the other information"},{"line_number":53,"context_line":"and used during the authentication to verify the if the IDP releasing the"},{"line_number":54,"context_line":"assertion matches the IDP specified in the URL. The ID is provided with a new"},{"line_number":55,"context_line":"attribute, named ``remote_ids``, and this can contains a list of IDs."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"The remote_ids is defined as a list to allow the mapping of multiple external"},{"line_number":58,"context_line":"IDPs in a single IDP in keystone. This can simplify the sharing of a mapping"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_1da37444","line":55,"updated":"2015-01-19 17:04:32.000000000","message":"is the new attribute optional or required? I think it needs to be optional for backwards compatibility.","commit_id":"15bf7c274c472664332c5be68cd28ce7237014d2"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bae1377b77e18c67c455ae8397176ded9fb22964","unresolved":false,"context_lines":[{"line_number":52,"context_line":"be the entity_id of the IDP) has to be stored alongside the other information"},{"line_number":53,"context_line":"and used during the authentication to verify the if the IDP releasing the"},{"line_number":54,"context_line":"assertion matches the IDP specified in the URL. The ID is provided with a new"},{"line_number":55,"context_line":"attribute, named ``remote_ids``, and this can contains a list of IDs."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"The remote_ids is defined as a list to allow the mapping of multiple external"},{"line_number":58,"context_line":"IDPs in a single IDP in keystone. This can simplify the sharing of a mapping"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_d8c65a69","line":55,"in_reply_to":"3a961159_1da37444","updated":"2015-01-19 17:18:48.000000000","message":"Done","commit_id":"15bf7c274c472664332c5be68cd28ce7237014d2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b1c992ccdc3b52c4535ff883919bead8f583c5be","unresolved":false,"context_lines":[{"line_number":113,"context_line":"Other Deployer Impact"},{"line_number":114,"context_line":"---------------------"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"A new configuration variable is introduced:"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  ``remote_id_attribute``"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_9d45a471","line":116,"updated":"2015-01-19 17:04:32.000000000","message":"Use :: for valid rst.","commit_id":"15bf7c274c472664332c5be68cd28ce7237014d2"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"bae1377b77e18c67c455ae8397176ded9fb22964","unresolved":false,"context_lines":[{"line_number":113,"context_line":"Other Deployer Impact"},{"line_number":114,"context_line":"---------------------"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"A new configuration variable is introduced:"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"  ``remote_id_attribute``"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a961159_d8749a39","line":116,"in_reply_to":"3a961159_9d45a471","updated":"2015-01-19 17:18:48.000000000","message":"Done","commit_id":"15bf7c274c472664332c5be68cd28ce7237014d2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9448d4c7159a19871fb9d42797f875b4eb32b76c","unresolved":false,"context_lines":[{"line_number":116,"context_line":""},{"line_number":117,"context_line":"A new configuration variable is introduced::"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"  ``remote_ids``"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"The variable is a list and its value is the name of the attribute to look-up"},{"line_number":122,"context_line":"to get the ID of the current IdP. Default value is an empty list and in this"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a961159_f8723611","line":119,"updated":"2015-01-19 17:24:41.000000000","message":"This is the config option, not the attribute, so change this back to remote_id_attribute","commit_id":"fe38d871e7b1fa64de63120b163840b0d1cd4873"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"3262df624413c275df40e9e369338db1b78e8bba","unresolved":false,"context_lines":[{"line_number":61,"context_line":"and all share the same set of attributes and policies. In this case a single"},{"line_number":62,"context_line":"map could be possible to manage all the IdPs, avoiding to register all of them"},{"line_number":63,"context_line":"in Keystone."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"To enable the mapping between the registered and the provided ID a new"},{"line_number":66,"context_line":"configuration variable is introduced, this is named ``remote_id_attribute``."},{"line_number":67,"context_line":"Shibboleth plug-in for Apache includes the ID of the IdP performing the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_06adc79b","line":64,"updated":"2015-01-20 16:31:32.000000000","message":"There is some duplication here, leading to possibly confusion for future administrators. Firstly we already have the list of trusted IdPs, which can be retrieved to present to the user (e.g. by Horizon) to inform the user which IdPs can be used to authenticate to Keystone. Secondly we have this list of remote_ids which essentially duplicates the previous information, though now it is on an endpoint by endpoint basis. Plus there is no linking between these two lists, and there is no guarantee that the strings will be the same (indeed they might be different). I would propose that we try to unify these two lists as follows:\n\nEnhance the list of trusted IdPs table to contain: \n\ni) the IdP user friendly name to present to the user when choosing which IdP to use (as now), and\n\nii) the string that Apache will return to Keystone in the protocol message, Optional, only needed if different from i), and\n\niii) a monotonically increasing integer to uniquely identify this table entry, starting at 1.\n\nRemote_ids would then simply contain a list of integers pointing to the trusted IdP table entries that apply to this endpoint.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5b42975204374d2d090b6c87ea97383721c88346","unresolved":false,"context_lines":[{"line_number":61,"context_line":"and all share the same set of attributes and policies. In this case a single"},{"line_number":62,"context_line":"map could be possible to manage all the IdPs, avoiding to register all of them"},{"line_number":63,"context_line":"in Keystone."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"To enable the mapping between the registered and the provided ID a new"},{"line_number":66,"context_line":"configuration variable is introduced, this is named ``remote_id_attribute``."},{"line_number":67,"context_line":"Shibboleth plug-in for Apache includes the ID of the IdP performing the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_2941ac63","line":64,"in_reply_to":"3a961159_06adc79b","updated":"2015-01-20 17:45:49.000000000","message":"David, are you proposing implementation where we keep remote_ids (which would be equal to entityID) to put in a separate SQL table, and simply reference it by id (counter) in various identity_provider?","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"3412aaa060644e3396606e24c27112b2f61cb3f0","unresolved":false,"context_lines":[{"line_number":61,"context_line":"and all share the same set of attributes and policies. In this case a single"},{"line_number":62,"context_line":"map could be possible to manage all the IdPs, avoiding to register all of them"},{"line_number":63,"context_line":"in Keystone."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"To enable the mapping between the registered and the provided ID a new"},{"line_number":66,"context_line":"configuration variable is introduced, this is named ``remote_id_attribute``."},{"line_number":67,"context_line":"Shibboleth plug-in for Apache includes the ID of the IdP performing the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_091a307c","line":64,"in_reply_to":"3a961159_06adc79b","updated":"2015-01-20 17:44:20.000000000","message":"What is referred by \"the string that Apache will return to Keystone in the protocol message\"?\n\nThe remote_ids contains a list of entity_id authorised with the IDP. This is a list because in my opinion it could be possible to configure one IDP in keystone and perform the mapping for multiple IDP. It is an option that could be useful in some situation. There is not duplication but for each IDP in Keystone you have the entity_-id saml. For other protocol will be something similar.\nEach IDP has a remote_ids associated so there is a strong link among them.\n\nDo you suggest to have a list of IDP and a list of entity_id (or whatever) and then remote_ids is a reference? Could you explain the benefit of this approach?","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"13b23acc15041e59cc1a56d1f25d9f9cbee27325","unresolved":false,"context_lines":[{"line_number":61,"context_line":"and all share the same set of attributes and policies. In this case a single"},{"line_number":62,"context_line":"map could be possible to manage all the IdPs, avoiding to register all of them"},{"line_number":63,"context_line":"in Keystone."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"To enable the mapping between the registered and the provided ID a new"},{"line_number":66,"context_line":"configuration variable is introduced, this is named ``remote_id_attribute``."},{"line_number":67,"context_line":"Shibboleth plug-in for Apache includes the ID of the IdP performing the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_0c06be85","line":64,"in_reply_to":"3a961159_091a307c","updated":"2015-01-20 17:59:54.000000000","message":"What is referred by \"the string that Apache will return to Keystone in the protocol message\"?\nIt means the attribute value returned in the remote_id_attribute i.e. the string that should match remote_id.\n\nthe benefit of having the user friendly IdP name and entity_id in the same table is ease of association and ease of configuration and ease of understanding by the administrator. What is the benefit of having them in disparate tables as you suggest?","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"a5ce84ef8279501a8210bd38597540f1b11d0c21","unresolved":false,"context_lines":[{"line_number":61,"context_line":"and all share the same set of attributes and policies. In this case a single"},{"line_number":62,"context_line":"map could be possible to manage all the IdPs, avoiding to register all of them"},{"line_number":63,"context_line":"in Keystone."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"To enable the mapping between the registered and the provided ID a new"},{"line_number":66,"context_line":"configuration variable is introduced, this is named ``remote_id_attribute``."},{"line_number":67,"context_line":"Shibboleth plug-in for Apache includes the ID of the IdP performing the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_e275f900","line":64,"in_reply_to":"3a961159_2941ac63","updated":"2015-01-20 18:46:26.000000000","message":"We already have a table containing the IDP names, which is returned at the start of federated authentication to tell the user which IdPs are trusted by Keystone. So I am suggesting adding the the remote_ids to this existing table, assuming that these strings are somewhat different to each other (one is user friendly and meant to be consumed by the user, the other is not). If however, the strings are the same, then we can use the existing table as is, and remote_ids only needs to contain the indexes to this table.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"3262df624413c275df40e9e369338db1b78e8bba","unresolved":false,"context_lines":[{"line_number":79,"context_line":"performed by Apache and skip any control in Keystone. This approach has the"},{"line_number":80,"context_line":"same level of security but requires a change in the configuration every time an"},{"line_number":81,"context_line":"IdP is added/removed."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Security Impact"},{"line_number":85,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_4666ef56","line":82,"updated":"2015-01-20 16:31:32.000000000","message":"This only has the same level of security for the default case of no checking. However, if checking is enabled, then security is increased because Keystone is now checking that the IdP actually used by the user is the one that Keystone expected.\n\nIn a federation, there might well be IdPs that are trusted by the federation (at the lowest level), and hence Apache will allow users to authenticate with them, but that Keystone does not wish to trust e.g. their LoA is too low for the OpenStack cloud services. Security is increased if Keystone checks which IdP was used by the user.\n\nIn addition, it protects against misconfiguration by the Apache administrator.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"3412aaa060644e3396606e24c27112b2f61cb3f0","unresolved":false,"context_lines":[{"line_number":79,"context_line":"performed by Apache and skip any control in Keystone. This approach has the"},{"line_number":80,"context_line":"same level of security but requires a change in the configuration every time an"},{"line_number":81,"context_line":"IdP is added/removed."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Security Impact"},{"line_number":85,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_49b6f8fa","line":82,"in_reply_to":"3a961159_4666ef56","updated":"2015-01-20 17:44:20.000000000","message":"In the default case you can force apache (at least shibboleth) to enable only one IDP per URL so the level of security should be the same allowing access only with one IDP. It is true that configuration become more problematic and I do not know if it is possible with mod_mellon","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5b42975204374d2d090b6c87ea97383721c88346","unresolved":false,"context_lines":[{"line_number":79,"context_line":"performed by Apache and skip any control in Keystone. This approach has the"},{"line_number":80,"context_line":"same level of security but requires a change in the configuration every time an"},{"line_number":81,"context_line":"IdP is added/removed."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Security Impact"},{"line_number":85,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_4914384d","line":82,"in_reply_to":"3a961159_4666ef56","updated":"2015-01-20 17:45:49.000000000","message":"What is LoA ?","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"a5ce84ef8279501a8210bd38597540f1b11d0c21","unresolved":false,"context_lines":[{"line_number":79,"context_line":"performed by Apache and skip any control in Keystone. This approach has the"},{"line_number":80,"context_line":"same level of security but requires a change in the configuration every time an"},{"line_number":81,"context_line":"IdP is added/removed."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Security Impact"},{"line_number":85,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_a24a11ab","line":82,"in_reply_to":"3a961159_4914384d","updated":"2015-01-20 18:46:26.000000000","message":"Level of Assurance. It is the strength you attach to the authentication mechanism. (e.g. LOA1 means no guarantee who the end user is, could be online registration and PW used for authn, whereas LOA3 means turned up in person to register with a passport or similar, and uses PKI for authn). LOA has five values (0 to 4).","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"3262df624413c275df40e9e369338db1b78e8bba","unresolved":false,"context_lines":[{"line_number":87,"context_line":"The proposed specification increment the security of the OS-Federation"},{"line_number":88,"context_line":"authentication APIs by introducing a new check aimed at verifying that the IdP"},{"line_number":89,"context_line":"performing the authentication is the same specified in the authentication URL."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Notifications Impact"},{"line_number":92,"context_line":"--------------------"},{"line_number":93,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_268563ae","line":90,"updated":"2015-01-20 16:31:32.000000000","message":"Agreed. And this statement directly contradicts the earlier statement that the same of level of security is there in both cases.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"b090d81f1cee9020dde39d6483b2c556f691960a","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_81a29eab","line":117,"updated":"2015-01-19 18:24:38.000000000","message":"It just hit me, that we need to make such attributes per registered protocol -\u003e for the IdP that handles (unlikely, but in theory possible with the current OS-FEDERATION design in OpenStack) multiple protocols we might need to be able to specify different parameters per protocol.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"2fb961c9c6a07859c2f58cb1f40df06584ba7cd4","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a930d6b_f7507e60","line":117,"in_reply_to":"1a930d6b_4cee298d","updated":"2015-01-21 11:40:29.000000000","message":"1. it is reasonable although I would prefer not to include \"idp\" in the name since we are defining a list of ids.\n\n2. This configuration parameter specify the name of the attribute where the plug-in provides the ID of the IDP and the plug-in works at the same way for the URLs so it is not requested to be specified for URL.\n\nThe parameter enabling/disabling the control was the remote_ids. Is not set then all the IDPs are accepted otherwise only the one specified will be accepted.\n\n3. I like the way you can specify the id using reference and providing smart selection like 6-* but I am puzzled about the overall steps for the administrator. Using this approach, if I want to register a federation I need first to register all the entityIDs of the IDPs, then I have to select id of these entityID and associate them to the IDP. Is this right? If so there is a problem to manage multiple federation. If I register multiple federation then I could have the entityID mixed (1,2,3 of fed1, 4,5 of fed2, 6 of fed 3 and so on) and I cannot use the reference or at least I have to be very careful with \"*\", unless I have to put also the fedearion id in the remote_ids.\nI do not know but I still prefer the string approach, maybe with the introduction of the concept of white and black list (e.g. using !\u003centity_ids\u003e will allow all but the entity_ids specified)","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"2a9498b7555c542a32cfc109ef0fe2ebfe2d2b1a","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a930d6b_4cee298d","line":117,"in_reply_to":"1a930d6b_a6416e0d","updated":"2015-01-21 11:14:47.000000000","message":"If the config attribute remote_attribute_id is missing, then any IdP can use the URL. \n\n1. I would prefer more meaningful names such as remote_idp_att_name instead of remote_attribute_id. Also remote_idps rather than remote_ids.\n\n2. Surely we will need this config parameter for every endpoint URL, since some URLs might allow any IDP to connect to them, whilst others may want to restrict the IDP to just one (as now) or a few.\n\n3. Consider the current academic federations in which there are hundreds of IDPs. We need a compact of way of saying which IdPs are trusted to access which endpoint URL, so using indexes is better than strings. We can then use a value for remote-idps such as: 1,2-4, 6-*. meaning IdPs 1, 2,3,4,6 and all the rest from 7 to the end of the list of trusted IdPs.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"9f7eddf0ff4d6f22234dac9cfc1b7df9ae506cb8","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a930d6b_06687db9","line":117,"in_reply_to":"1a930d6b_f7507e60","updated":"2015-01-21 12:25:52.000000000","message":"1. We are defining two things\na) the name of the attribute which will hold the name of the IDP\nb) the names of the IdPs that can use an endpoint.\nYou prefer to call  both of these IDs, I prefer to call them names. Regardless of what we call them, they are strings in your proposal, not numbers. My proposal is that b) should be a series of integers, that point to the IdP names/IDs in the trusted IdP table.\n\nConcerning multiple federations, we have not addressed this topic yet as far as I am aware. I agree that it will need to be addressed eventually, but currently we don\u0027t have support for single federations completely specified. As a first step. perhaps the name of the federation should be stored somewhere.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"9f9df3abb0137e0381a50bf88c414daf04322493","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_cb4ae3ac","line":117,"in_reply_to":"3a961159_22b8ecc6","updated":"2015-01-20 15:52:51.000000000","message":"I am against building parameters and again baking protocol names in the atributes names.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5b42975204374d2d090b6c87ea97383721c88346","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_7cd9b383","line":117,"in_reply_to":"3a961159_413339f7","updated":"2015-01-20 17:45:49.000000000","message":"Agreed, but we would still need a way configure whether you want to use this feature for SAML2 (not matter what module you are using) and for OpenID Connect. And I still think this should be somewhere in the keystone.conf file, not the code.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"3412aaa060644e3396606e24c27112b2f61cb3f0","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_c9166849","line":117,"in_reply_to":"3a961159_413339f7","updated":"2015-01-20 17:44:20.000000000","message":"I have some difficulties to think to an installation using two different plug-in for the same protocol. I mean, protect with saml two urls but one with a plug-in and the other with a different plug-in.\n\nUnless there is some evidence of this scenario I think we can have a plug-in per protocol.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"d971ff543865316748a129b9293d7bba067968e7","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_22b8ecc6","line":117,"in_reply_to":"3a961159_41ca5947","updated":"2015-01-20 14:34:51.000000000","message":"Actually, I do not like the first option, it is better plug-in names and attributes are not coded in classes.\n\nIs there any possibility to have configuration like remote_attribute_id_\u003cprotocol_name\u003e inside the federation configuration? This would be nice, otherwise I would prefer to encode the protocol inside the value: remote_id_attribute\u003d\u003cprotocol_name_1\u003e:\u003cvalue_1\u003e,\u003cprotocol_name_2\u003e:\u003cvalue_2\u003e. Not very elegant indeed but it works","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"f81894e92d272d6bbb8733869bfb1b48917afe8a","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a930d6b_a6416e0d","line":117,"in_reply_to":"3a961159_62d749c1","updated":"2015-01-21 10:18:17.000000000","message":"According to the documentation of mod_mellon you can specify the name of the attribute to use in order to provide the IDP ID to the application. Therefore, if remote_id_attribute is just a csv list of attribute and the code will check if at least an attribute is defined do you think there are problem?\n\nIn more detail, if I have remote_attribute_id\u003dShib-Identity-Provider,Mellon-IDP and in the code we verify if one of the two is present. If no one is present then it is like this this is not defined (I would at least log a warning). If one attribute match we use that.\n\nThis work if there is not overlap between the name of the attribute providing the IDP ID and the other attributes and among the names selected by different plug-in. For mod_shibboleth and mod_mellon this is true, are there plug-in where this is not true?","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"f81894e92d272d6bbb8733869bfb1b48917afe8a","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a930d6b_a3b6c088","line":117,"in_reply_to":"3a961159_7cd9b383","updated":"2015-01-21 10:18:17.000000000","message":"@marek\n\nAccording to David you should not think in terms of protocol but plug-ins. Yo u may have two IDP with saml2 but one protected by mod_mellon and the other by mod_shibboleth so you cannot just say use this attribute for saml2.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"a5ce84ef8279501a8210bd38597540f1b11d0c21","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_62d749c1","line":117,"in_reply_to":"3a961159_7cd9b383","updated":"2015-01-20 18:46:26.000000000","message":"I agree that it should be a configuration parameter and not in the code","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"785ebb83f6ed5c63dd71091471157fdbd22fe51e","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_bf007f6a","line":117,"in_reply_to":"3a961159_81a29eab","updated":"2015-01-20 09:55:45.000000000","message":"Is it acceptable to have a comma separated value where each value is: protocol:variable_name? (Es remote_id_attribute: saml:Shib-Identity-Provider,openID:otherVariable).\n\nOther alternative is to define a configuration variable per protocol, remote_id_attribute_\u003cprotocol\u003e, so we will have: remote_id_attribute_saml, remote_id_attribute_oauth, ....\n\nI would prefer the first solution, it makes easier to integrate new protocols.\nAny preference or alternative?","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"3262df624413c275df40e9e369338db1b78e8bba","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_413339f7","line":117,"in_reply_to":"3a961159_bf007f6a","updated":"2015-01-20 16:31:32.000000000","message":"It is not actually per protocol but per Apache plugin ie. mod_shib and mod_mellon could use different attribute names. Thus it would be better to have this attribute registered per Apache plugin","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"03d9e7b192249c273c126a9e91f2b2031d3651ae","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_41ca5947","line":117,"in_reply_to":"3a961159_bf007f6a","updated":"2015-01-20 13:51:36.000000000","message":"So we have two options:\n\nWe define attributes names directly in plugin class (that corresponds with the plugin we are using - different for mellon, different for shibboleth, different for oidc) - this would align with David Chadwick\u0027s preffered arcitecture. But then, we still have no way to control whether we want to use remote_id validation for a certain protocol. We are still lacking per protocol switch somewhere in the keystone.conf.\n\nAnother option is becoming less liberal on protocols naming (registered via OS-FEDERATION API). For instance, call the protocol \u0027saml2\u0027 if you want to use saml2, not \u0027saml\u0027, nor \u0027myfancyprotocoljustbecauseican\u0027 etc. Later, specify remote_attribute_id parameters in [saml2] and [oidc] (and any other protocol) section in keystone.conf. When it comes to the remote_id validation,  Keystone would simply lookup value in CONF.\u003cprotocol\u003e.remote_attribute_id.\n\nThis would require us some red warning in the doc, but I like such constraints.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"13b23acc15041e59cc1a56d1f25d9f9cbee27325","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_cc70360b","line":117,"in_reply_to":"3a961159_c9166849","updated":"2015-01-20 17:59:54.000000000","message":"It is perfectly possible to configure Apache in this way, with each endpoint protected by a different plugin. So one should not code up restrictively to forbid it just because you have difficulty thinking of an installation that does it.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"3412aaa060644e3396606e24c27112b2f61cb3f0","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"A new configuration variable is introduced::"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"  ``remote_id_attribute``"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The variable is a string and its value is the name of the attribute to look-up"},{"line_number":120,"context_line":"to get the ID of the current IdP. Default value is an empty string and in this"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3a961159_89f2a0e1","line":117,"in_reply_to":"3a961159_cb4ae3ac","updated":"2015-01-20 17:44:20.000000000","message":"In my case protocol name is not the ream protocol but the one you register. If we would maintain the flexibility to specify any name to identify a protocol, and I agree, then you have to write this in same place and can be in the configuration paramter name or value. I do not see other options without reducing the possibility to define a protocol name.","commit_id":"79ca073beb34d85ee9fee66a66fccec600649546"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"81804a1c027785a31a1b77f9d2bd0f4c6f3dbe5f","unresolved":false,"context_lines":[{"line_number":62,"context_line":"map could be possible to manage all the IdPs, avoiding to register all of them"},{"line_number":63,"context_line":"in Keystone."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"As Keystone deployment should handle different protocols and different modules"},{"line_number":66,"context_line":"handling protocols parameter where ``remote_id`` values is stored needs to be"},{"line_number":67,"context_line":"dynamically configured in ``keystone.conf``. Each protocol handled by Keystone"},{"line_number":68,"context_line":"must exist as a authentication method defined in ``[auth]`` section as well as"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa81d914_5bbdc767","line":65,"updated":"2015-01-28 22:13:56.000000000","message":"(nit) A* Keystone..","commit_id":"86538740dd1eac1de9f4f23a253f9baba09ae05f"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"a5fd4a731a7bc28bc6fd5afbc3e7f119ca148cb1","unresolved":false,"context_lines":[{"line_number":62,"context_line":"map could be possible to manage all the IdPs, avoiding to register all of them"},{"line_number":63,"context_line":"in Keystone."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"As Keystone deployment should handle different protocols and different modules"},{"line_number":66,"context_line":"handling protocols parameter where ``remote_id`` values is stored needs to be"},{"line_number":67,"context_line":"dynamically configured in ``keystone.conf``. Each protocol handled by Keystone"},{"line_number":68,"context_line":"must exist as a authentication method defined in ``[auth]`` section as well as"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa81d914_6703b70d","line":65,"in_reply_to":"fa81d914_5bbdc767","updated":"2015-01-29 08:40:10.000000000","message":"I don\u0027t want to loose +2 so can fix it in a followup patch.","commit_id":"86538740dd1eac1de9f4f23a253f9baba09ae05f"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b1b4f5b2de99c14290e040c232e64102d1c22f1b","unresolved":false,"context_lines":[{"line_number":116,"context_line":"The python-keystoneclient needs to be updated in order to reflect the new API"},{"line_number":117,"context_line":"to register the IdP. In the current implementation there, the config attribute"},{"line_number":118,"context_line":"``remote_ids`` does not exist. The attribute has to be included during the"},{"line_number":119,"context_line":"creation/editing of the IdPs."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Performance Impact"},{"line_number":122,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa81d914_d064024b","line":119,"updated":"2015-01-29 18:39:41.000000000","message":"Is a change needed in python-openstackclient as well?","commit_id":"86538740dd1eac1de9f4f23a253f9baba09ae05f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"09abcb95e8c188c5b0fd00bee386c65191f539ad","unresolved":false,"context_lines":[{"line_number":116,"context_line":"The python-keystoneclient needs to be updated in order to reflect the new API"},{"line_number":117,"context_line":"to register the IdP. In the current implementation there, the config attribute"},{"line_number":118,"context_line":"``remote_ids`` does not exist. The attribute has to be included during the"},{"line_number":119,"context_line":"creation/editing of the IdPs."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Performance Impact"},{"line_number":122,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa81d914_8b45fbb4","line":119,"in_reply_to":"fa81d914_d064024b","updated":"2015-01-29 18:56:48.000000000","message":"yep, but i\u0027m okay with not calling it out.","commit_id":"86538740dd1eac1de9f4f23a253f9baba09ae05f"}]}