)]}'
{"specs/kilo/barbican-for-credentials.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"317ad91c6287b34905c8ad9649287d96db34aa1f","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Replace the concept of extensions"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp barbican-for-credentials \u003chttps://blueprints.launchpad.net/keystone/+spec/barbican-for-credentials\u003e`_"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_399d180c","line":8,"updated":"2015-01-26 00:35:25.000000000","message":"update the title","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"294acec5833c5958d1d37e6e047c86f2b99c464e","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Replace the concept of extensions"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp barbican-for-credentials \u003chttps://blueprints.launchpad.net/keystone/+spec/barbican-for-credentials\u003e`_"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_fa47e774","line":8,"in_reply_to":"1a930d6b_399d180c","updated":"2015-01-26 16:34:19.000000000","message":"Will do in next patch","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"317ad91c6287b34905c8ad9649287d96db34aa1f","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"In Openstack ecosystem, Barbican service is designed for secure storage and"},{"line_number":29,"context_line":"mangement of secrets/keys/certificate. Sensitive data-at-rest in barbican is"},{"line_number":30,"context_line":"stored in encrypted format. Now in addition, Barbican service has recently"},{"line_number":31,"context_line":"added option to store secrets/keys in a HSM (Hardware security module)"},{"line_number":32,"context_line":"applicance via KMIP. With these enhancements in Barbican and its increasing"},{"line_number":33,"context_line":"maturity, Barbican is a good solution for storing sensitive credential data."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_d9fa5442","line":30,"updated":"2015-01-26 00:35:25.000000000","message":"how does HSM help the keystone project?","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"b4baff24e4347830685302b79d4de11771c6b0b3","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"In Openstack ecosystem, Barbican service is designed for secure storage and"},{"line_number":29,"context_line":"mangement of secrets/keys/certificate. Sensitive data-at-rest in barbican is"},{"line_number":30,"context_line":"stored in encrypted format. Now in addition, Barbican service has recently"},{"line_number":31,"context_line":"added option to store secrets/keys in a HSM (Hardware security module)"},{"line_number":32,"context_line":"applicance via KMIP. With these enhancements in Barbican and its increasing"},{"line_number":33,"context_line":"maturity, Barbican is a good solution for storing sensitive credential data."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_2efa0c43","line":30,"in_reply_to":"1a930d6b_4532e0f2","updated":"2015-01-26 19:56:44.000000000","message":"The basic idea is that a deployment can have choice to store credential (sensitive data) in a secure and compliant manner via barbican HSM usage. Barbican is specifically meant to manage keys for openstack services. Keystone credential API was developed before barbican so now this can be one way to leverage Barbican without requiring services to move their usage of the API to Barbican directly.","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"294acec5833c5958d1d37e6e047c86f2b99c464e","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"In Openstack ecosystem, Barbican service is designed for secure storage and"},{"line_number":29,"context_line":"mangement of secrets/keys/certificate. Sensitive data-at-rest in barbican is"},{"line_number":30,"context_line":"stored in encrypted format. Now in addition, Barbican service has recently"},{"line_number":31,"context_line":"added option to store secrets/keys in a HSM (Hardware security module)"},{"line_number":32,"context_line":"applicance via KMIP. With these enhancements in Barbican and its increasing"},{"line_number":33,"context_line":"maturity, Barbican is a good solution for storing sensitive credential data."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_4532e0f2","line":30,"in_reply_to":"1a930d6b_d9fa5442","updated":"2015-01-26 16:34:19.000000000","message":"With barbican and HSM, credentials data can be securely stored whereas right now they are stored in SQL as-is.","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"317ad91c6287b34905c8ad9649287d96db34aa1f","unresolved":false,"context_lines":[{"line_number":31,"context_line":"added option to store secrets/keys in a HSM (Hardware security module)"},{"line_number":32,"context_line":"applicance via KMIP. With these enhancements in Barbican and its increasing"},{"line_number":33,"context_line":"maturity, Barbican is a good solution for storing sensitive credential data."},{"line_number":34,"context_line":"On similar lines, other openstack services e.g. Cinder, are now integrating"},{"line_number":35,"context_line":"with Barbican for managing its keys."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_19985c1b","line":34,"updated":"2015-01-26 00:35:25.000000000","message":"can you source the cinder project adoption?","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"294acec5833c5958d1d37e6e047c86f2b99c464e","unresolved":false,"context_lines":[{"line_number":31,"context_line":"added option to store secrets/keys in a HSM (Hardware security module)"},{"line_number":32,"context_line":"applicance via KMIP. With these enhancements in Barbican and its increasing"},{"line_number":33,"context_line":"maturity, Barbican is a good solution for storing sensitive credential data."},{"line_number":34,"context_line":"On similar lines, other openstack services e.g. Cinder, are now integrating"},{"line_number":35,"context_line":"with Barbican for managing its keys."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_a5a2a4fa","line":34,"in_reply_to":"1a930d6b_19985c1b","updated":"2015-01-26 16:34:19.000000000","message":"Here it is.\nhttps://github.com/openstack/cinder/blob/master/cinder/keymgr/barbican.py","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"5c069198ed9c78756c12cc1fc9f38c9d8a96bc66","unresolved":false,"context_lines":[{"line_number":55,"context_line":"------------"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"To address security concern raised above, ask services using Keystone"},{"line_number":58,"context_line":"credential API to invoke barbican API instead. This will require a change in"},{"line_number":59,"context_line":"openstack service side. It may or may not be a big issue if service is already"},{"line_number":60,"context_line":"planning to integrate with Barbican. The other issue can be when"},{"line_number":61,"context_line":"service/deployment want to keep using its existing credentials data. In that"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_21ba830a","line":58,"updated":"2015-01-22 21:47:47.000000000","message":"Can you please address how are you going to call barbican from keystone?  Are you going to pass user\u0027s token to barbican?  If so how are you going to get user\u0027s token in backend?","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"ac84acf5262ae2d8e5f32bf9e3de05a42ff8f336","unresolved":false,"context_lines":[{"line_number":55,"context_line":"------------"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"To address security concern raised above, ask services using Keystone"},{"line_number":58,"context_line":"credential API to invoke barbican API instead. This will require a change in"},{"line_number":59,"context_line":"openstack service side. It may or may not be a big issue if service is already"},{"line_number":60,"context_line":"planning to integrate with Barbican. The other issue can be when"},{"line_number":61,"context_line":"service/deployment want to keep using its existing credentials data. In that"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_9b28db87","line":58,"in_reply_to":"1a930d6b_21ba830a","updated":"2015-01-23 18:58:14.000000000","message":"So far, thinking was to use Keystone user\u0027s project scoped token to communicate with Barbican service. \n\nIf that\u0027s not feasible from Keystone side, then may be need to go back to drawing board with Barbican team to discuss it. Earlier thinking was to use \"service token\" (token with admin privileges on barbican side) and somehow barbican allow secrets storage via some additional project identifier in request (as service token\u0027s project and target project are different) .","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"5c069198ed9c78756c12cc1fc9f38c9d8a96bc66","unresolved":false,"context_lines":[{"line_number":59,"context_line":"openstack service side. It may or may not be a big issue if service is already"},{"line_number":60,"context_line":"planning to integrate with Barbican. The other issue can be when"},{"line_number":61,"context_line":"service/deployment want to keep using its existing credentials data. In that"},{"line_number":62,"context_line":"case, each service may have to deal with migration of that data from Keystone"},{"line_number":63,"context_line":"to Barbican."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Data Model Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_c1e7ff10","line":62,"updated":"2015-01-22 21:47:47.000000000","message":"Barbican works on tenant level and credential apis are user level api. How are they both going to fit?\n\n(ie) You can create credential without tenant id in keystone api -- implies that is user\u0027s credential.  Barbican doesn\u0027t have such concept, as everything is associated with tenant.\n\nAssume  a user has  a  credential and he wants to use across multiple tenant.  In keystone he just need to issue one api to create a credential. \nHow does that work in barbican?  Can you give an example?","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"ac84acf5262ae2d8e5f32bf9e3de05a42ff8f336","unresolved":false,"context_lines":[{"line_number":59,"context_line":"openstack service side. It may or may not be a big issue if service is already"},{"line_number":60,"context_line":"planning to integrate with Barbican. The other issue can be when"},{"line_number":61,"context_line":"service/deployment want to keep using its existing credentials data. In that"},{"line_number":62,"context_line":"case, each service may have to deal with migration of that data from Keystone"},{"line_number":63,"context_line":"to Barbican."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Data Model Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_fb863fda","line":62,"in_reply_to":"1a930d6b_c1e7ff10","updated":"2015-01-23 18:58:14.000000000","message":"Credentials are expected to be associated with a project as generally openstack services operate at project level and not at user level.\n\nIf it needs to be user level, then one way to support partially can be to use user\u0027s default project value. If user has that, then we can store credentials under that project in barbican. If no default project available, then that case can be documented as a limitation for this specific backend usage.","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"317ad91c6287b34905c8ad9649287d96db34aa1f","unresolved":false,"context_lines":[{"line_number":125,"context_line":"* Enhance keystone-manage to do migration of credential from Keystone"},{"line_number":126,"context_line":"  to Barbican service."},{"line_number":127,"context_line":"* Update documentation as mentioned in Documentation Impact section."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Dependencies"},{"line_number":131,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_b97668d5","line":128,"updated":"2015-01-26 00:35:25.000000000","message":"I\u0027m wondering if there is a middleware piece that we could plug into https://github.com/openstack/keystone/blob/master/etc/keystone-paste.ini and have requests be filtered as necessary? or am I thinking about it incorrectly?","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"294acec5833c5958d1d37e6e047c86f2b99c464e","unresolved":false,"context_lines":[{"line_number":125,"context_line":"* Enhance keystone-manage to do migration of credential from Keystone"},{"line_number":126,"context_line":"  to Barbican service."},{"line_number":127,"context_line":"* Update documentation as mentioned in Documentation Impact section."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Dependencies"},{"line_number":131,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a930d6b_e512ec07","line":128,"in_reply_to":"1a930d6b_b97668d5","updated":"2015-01-26 16:34:19.000000000","message":"Currently the plan was just to provide another backend for credential API to limit its impact on keystone side. But we may need something like this if need to pass user project scoped token to backend somehow, this is still being investigated.","commit_id":"9efc1ee09bba573334748cc572f090c2a785dbfb"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c50f9a4ba375f300075bad8811ce7614c7016e44","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Barbican as Credential API backend"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_cf62bfd7","line":7,"updated":"2015-01-29 06:32:07.000000000","message":"nit:\n\n    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n    Barbican as Credential API backend\n    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nTitles should be equal length as the wrapping \u003d","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"7a593a09b10bf35f3a7a4abc41048c8da531abca","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Barbican as Credential API backend"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_fc42c70e","line":7,"in_reply_to":"fa81d914_cf62bfd7","updated":"2015-01-29 17:36:19.000000000","message":"Will address in next patch.","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c50f9a4ba375f300075bad8811ce7614c7016e44","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp barbican-for-credentials \u003chttps://blueprints.launchpad.net/keystone/+spec/barbican-for-credentials\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Add optional support for storing Keystone credential data in openstack barbican"},{"line_number":14,"context_line":"service."},{"line_number":15,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_6f80f346","line":12,"updated":"2015-01-29 06:32:07.000000000","message":"OpenStack Barbican*\n\napplies throughout the file","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"7a593a09b10bf35f3a7a4abc41048c8da531abca","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp barbican-for-credentials \u003chttps://blueprints.launchpad.net/keystone/+spec/barbican-for-credentials\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Add optional support for storing Keystone credential data in openstack barbican"},{"line_number":14,"context_line":"service."},{"line_number":15,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_bc5f6fe4","line":12,"in_reply_to":"fa81d914_6f80f346","updated":"2015-01-29 17:36:19.000000000","message":"Okay. Will change in next patch.","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c50f9a4ba375f300075bad8811ce7614c7016e44","unresolved":false,"context_lines":[{"line_number":67,"context_line":"  requirement."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"* Credentials are managed at project level and management only at user level is"},{"line_number":70,"context_line":"  not supported."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_4f596ffd","line":70,"updated":"2015-01-29 06:32:07.000000000","message":"Will this only be a limitation until a token is scoped per resource?","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"7a593a09b10bf35f3a7a4abc41048c8da531abca","unresolved":false,"context_lines":[{"line_number":67,"context_line":"  requirement."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"* Credentials are managed at project level and management only at user level is"},{"line_number":70,"context_line":"  not supported."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"},{"line_number":73,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_c2b7d8d6","line":70,"in_reply_to":"fa81d914_4f596ffd","updated":"2015-01-29 17:36:19.000000000","message":"Keystone credential API with sql backend allows credential with only userid and without projectid. Which means that credential can be created and managed at user (via domain scope token) level. As mentioned earlier, this cannot be supported with Barbican backend. Client will always need project scoped token which should be okay for most of practical usage purpose as credentials are defined per project.","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c50f9a4ba375f300075bad8811ce7614c7016e44","unresolved":false,"context_lines":[{"line_number":94,"context_line":"---------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"This change is expected to address security concern raised above. With this"},{"line_number":97,"context_line":"change, deployments will have option to secure credential data via pyhsical"},{"line_number":98,"context_line":"or virtual HSM appliances."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_cf6c7f9f","line":97,"updated":"2015-01-29 06:32:07.000000000","message":"physical*","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"7a593a09b10bf35f3a7a4abc41048c8da531abca","unresolved":false,"context_lines":[{"line_number":94,"context_line":"---------------"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"This change is expected to address security concern raised above. With this"},{"line_number":97,"context_line":"change, deployments will have option to secure credential data via pyhsical"},{"line_number":98,"context_line":"or virtual HSM appliances."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_9c68eb88","line":97,"in_reply_to":"fa81d914_cf6c7f9f","updated":"2015-01-29 17:36:19.000000000","message":"Good catch. Will address in next patch.","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c50f9a4ba375f300075bad8811ce7614c7016e44","unresolved":false,"context_lines":[{"line_number":141,"context_line":"----------"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"* Modify credential driver to include request context in API parameter."},{"line_number":144,"context_line":"* Add new barbican backend module."},{"line_number":145,"context_line":"* Map credential backend API with Barbican REST API."},{"line_number":146,"context_line":"* Transform credential data to barbican request/response format."},{"line_number":147,"context_line":"* Update existing credential tests to account for context argument in its API."}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_cf039fb6","line":144,"updated":"2015-01-29 06:32:07.000000000","message":"and introduce optional Barbican dependency.","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"7a593a09b10bf35f3a7a4abc41048c8da531abca","unresolved":false,"context_lines":[{"line_number":141,"context_line":"----------"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"* Modify credential driver to include request context in API parameter."},{"line_number":144,"context_line":"* Add new barbican backend module."},{"line_number":145,"context_line":"* Map credential backend API with Barbican REST API."},{"line_number":146,"context_line":"* Transform credential data to barbican request/response format."},{"line_number":147,"context_line":"* Update existing credential tests to account for context argument in its API."}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_7c0417c0","line":144,"in_reply_to":"fa81d914_cf039fb6","updated":"2015-01-29 17:36:19.000000000","message":"Okay. Will add this.","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c50f9a4ba375f300075bad8811ce7614c7016e44","unresolved":false,"context_lines":[{"line_number":159,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"None"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"Documentation Impact"},{"line_number":164,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":165,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_4f27af64","line":162,"updated":"2015-01-29 06:32:07.000000000","message":"For testing, will this require a devstack specific configuration where Barbican is deployed along side Keystone? That might make this dependent on the functional testing work that dstanek is doing.","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"7a593a09b10bf35f3a7a4abc41048c8da531abca","unresolved":false,"context_lines":[{"line_number":159,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"None"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"Documentation Impact"},{"line_number":164,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":165,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa81d914_3c6e1f30","line":162,"in_reply_to":"fa81d914_4f27af64","updated":"2015-01-29 17:36:19.000000000","message":"Are you referring to integrated tests at the gate-build? Earlier thinking was just to have unit tests to get good code coverage, especially considering this optional backend.\n\nCan you please clarify and accordingly I can look into this.","commit_id":"c27b669dc1d42d5c9bd5baf1336e7bf2015e5ba3"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"bd18b7fa8c1f52d17253a441bf143628c1515043","unresolved":false,"context_lines":[{"line_number":16,"context_line":"Problem Description"},{"line_number":17,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Keystone provides credential (EC2, PKI, SSH etc) storage via its credential"},{"line_number":20,"context_line":"APIs. Currently sql is the only supported backend for storing this data."},{"line_number":21,"context_line":"In sql backend, these credentials are stored as-is without any encrpytion."},{"line_number":22,"context_line":"These credentials are generally used for authentication by OpenStack services"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da86d52c_bd40a957","line":19,"updated":"2015-01-31 20:35:52.000000000","message":"Great problem description!","commit_id":"6581c3d59b4a6a2d4284e1ce4ecd0bb3b1ceccf2"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"bd18b7fa8c1f52d17253a441bf143628c1515043","unresolved":false,"context_lines":[{"line_number":31,"context_line":"added option to store secrets/keys in a HSM (Hardware Security Module)"},{"line_number":32,"context_line":"applicance via KMIP. With these enhancements in Barbican and its increasing"},{"line_number":33,"context_line":"maturity, Barbican is a good solution for storing sensitive credential data."},{"line_number":34,"context_line":"On similar lines, other OpenStack services e.g. Cinder, are now integrating"},{"line_number":35,"context_line":"with Barbican for managing its keys."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da86d52c_9d6da507","line":34,"updated":"2015-01-31 20:35:52.000000000","message":"I think you should add the reference to https://github.com/openstack/cinder/blob/master/cinder/keymgr/barbican.py in the spec. It is more helpful to have this reference listed in the spec than as a comment on a previous patch.  The barbican.py is very helpful","commit_id":"6581c3d59b4a6a2d4284e1ce4ecd0bb3b1ceccf2"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"ffa8892d7b2daee964a77d5e1cd8b6e55f93572f","unresolved":false,"context_lines":[{"line_number":31,"context_line":"added option to store secrets/keys in a HSM (Hardware Security Module)"},{"line_number":32,"context_line":"applicance via KMIP. With these enhancements in Barbican and its increasing"},{"line_number":33,"context_line":"maturity, Barbican is a good solution for storing sensitive credential data."},{"line_number":34,"context_line":"On similar lines, other OpenStack services e.g. Cinder, are now integrating"},{"line_number":35,"context_line":"with Barbican for managing its keys."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da86d52c_9458f233","line":34,"in_reply_to":"da86d52c_9d6da507","updated":"2015-02-02 19:30:19.000000000","message":"Current patch has reference to above mentioned link in \u0027References\u0027 section at the bottom.","commit_id":"6581c3d59b4a6a2d4284e1ce4ecd0bb3b1ceccf2"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"bd18b7fa8c1f52d17253a441bf143628c1515043","unresolved":false,"context_lines":[{"line_number":42,"context_line":"existing sql backend. This backend is an optional backend and sql backend is"},{"line_number":43,"context_line":"still going to be default backend for Credential API."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"In new Barbican backend, credential CRUD APIs calls going to be proxied to"},{"line_number":46,"context_line":"Barbican service. Barbican client is going to be used to interact with Barbican"},{"line_number":47,"context_line":"service. Barbican client dependency is going to be a run-time dependency as its"},{"line_number":48,"context_line":"expected to be an optional backend."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da86d52c_3d55991d","line":45,"updated":"2015-01-31 20:35:52.000000000","message":"Can you provide a little more detail on on how the credential APIs will be mapped to the Barbican APIs? I saw how Cinder uses Barbican so I\u0027m curious how similar or different the Credential usage of Barbican will be","commit_id":"6581c3d59b4a6a2d4284e1ce4ecd0bb3b1ceccf2"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"ffa8892d7b2daee964a77d5e1cd8b6e55f93572f","unresolved":false,"context_lines":[{"line_number":42,"context_line":"existing sql backend. This backend is an optional backend and sql backend is"},{"line_number":43,"context_line":"still going to be default backend for Credential API."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"In new Barbican backend, credential CRUD APIs calls going to be proxied to"},{"line_number":46,"context_line":"Barbican service. Barbican client is going to be used to interact with Barbican"},{"line_number":47,"context_line":"service. Barbican client dependency is going to be a run-time dependency as its"},{"line_number":48,"context_line":"expected to be an optional backend."}],"source_content_type":"text/x-rst","patch_set":3,"id":"da86d52c_0050385d","line":45,"in_reply_to":"da86d52c_3d55991d","updated":"2015-02-02 19:30:19.000000000","message":"Its going to be similar to cinder in terms of barbicanclient usage. Most of additional changes would be around \"how credential backend requests are mapped to barbican requests/ response.\"\n\nI will try to add more details around this.","commit_id":"6581c3d59b4a6a2d4284e1ce4ecd0bb3b1ceccf2"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"bd18b7fa8c1f52d17253a441bf143628c1515043","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"In new Barbican backend, credential CRUD APIs calls going to be proxied to"},{"line_number":46,"context_line":"Barbican service. Barbican client is going to be used to interact with Barbican"},{"line_number":47,"context_line":"service. Barbican client dependency is going to be a run-time dependency as its"},{"line_number":48,"context_line":"expected to be an optional backend."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"In Barbican, like any other OpenStack service, its resources (keys, certs etc.)"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da86d52c_fd5a214f","line":47,"updated":"2015-01-31 20:35:52.000000000","message":"Will you be adding CADF based auditing support?  Would be good to have records of when folks are accessing secrets.","commit_id":"6581c3d59b4a6a2d4284e1ce4ecd0bb3b1ceccf2"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"ffa8892d7b2daee964a77d5e1cd8b6e55f93572f","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"In new Barbican backend, credential CRUD APIs calls going to be proxied to"},{"line_number":46,"context_line":"Barbican service. Barbican client is going to be used to interact with Barbican"},{"line_number":47,"context_line":"service. Barbican client dependency is going to be a run-time dependency as its"},{"line_number":48,"context_line":"expected to be an optional backend."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"In Barbican, like any other OpenStack service, its resources (keys, certs etc.)"}],"source_content_type":"text/x-rst","patch_set":3,"id":"da86d52c_c03f00d5","line":47,"in_reply_to":"da86d52c_fd5a214f","updated":"2015-02-02 19:30:19.000000000","message":"That\u0027s a good point. Will update spec to include event notification for create/update/delete credentials. Looks like its not generated currently in credentials flow.\n\nShould list or read operation require event notification?","commit_id":"6581c3d59b4a6a2d4284e1ce4ecd0bb3b1ceccf2"}]}