)]}'
{"specs/liberty/lightweight-k2k-federation.rst":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":11,"context_line":"`bp lightweight-k2k-federation"},{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/lightweight-k2k-federation\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"This is completely based on the current Keystone to Keystone Federation mechanicism. "},{"line_number":15,"context_line":"And this is not a replacement but an alternative way to support a light-weight"},{"line_number":16,"context_line":"federation that does not require Shibbolethan, instead using a simply system tool for"},{"line_number":17,"context_line":"signature validation."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_fdf3ab08","line":14,"updated":"2015-05-15 14:28:42.000000000","message":"mechanism - this is misspelled many times below","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/lightweight-k2k-federation\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"This is completely based on the current Keystone to Keystone Federation mechanicism. "},{"line_number":15,"context_line":"And this is not a replacement but an alternative way to support a light-weight"},{"line_number":16,"context_line":"federation that does not require Shibbolethan, instead using a simply system tool for"},{"line_number":17,"context_line":"signature validation."},{"line_number":18,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_fdca8ba0","line":15,"updated":"2015-05-15 14:28:42.000000000","message":"s/And t/T/\n\nand add a \",\" after replacement","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":16,"context_line":"federation that does not require Shibbolethan, instead using a simply system tool for"},{"line_number":17,"context_line":"signature validation."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"The ligh-weight mechanicism will simplify the SAML validation on the Service"},{"line_number":20,"context_line":"Provider(SP) side; it is treating the SAML assertion as just a generic signed XML"},{"line_number":21,"context_line":"document. A python utility ``xmlsec1`` will be used for signature validation instead"},{"line_number":22,"context_line":"of relying on the separated Shibboleth process. And there will be no changes on"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_3d3823a0","line":19,"updated":"2015-05-15 14:28:42.000000000","message":"light","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"The ligh-weight mechanicism will simplify the SAML validation on the Service"},{"line_number":20,"context_line":"Provider(SP) side; it is treating the SAML assertion as just a generic signed XML"},{"line_number":21,"context_line":"document. A python utility ``xmlsec1`` will be used for signature validation instead"},{"line_number":22,"context_line":"of relying on the separated Shibboleth process. And there will be no changes on"},{"line_number":23,"context_line":"Identity Provider(IdP) side."},{"line_number":24,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_1d6207ae","line":21,"updated":"2015-05-15 14:28:42.000000000","message":"Is this a Python utility or a system binary?","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":19,"context_line":"The ligh-weight mechanicism will simplify the SAML validation on the Service"},{"line_number":20,"context_line":"Provider(SP) side; it is treating the SAML assertion as just a generic signed XML"},{"line_number":21,"context_line":"document. A python utility ``xmlsec1`` will be used for signature validation instead"},{"line_number":22,"context_line":"of relying on the separated Shibboleth process. And there will be no changes on"},{"line_number":23,"context_line":"Identity Provider(IdP) side."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"See `Keystone to Keystone Federation \u003chttp://specs.openstack.org/openstack/"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_9d6ef794","line":22,"updated":"2015-05-15 14:28:42.000000000","message":"s/. A/a","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":33,"context_line":"In a typical enterprise deployment, a proxy is always installed and sitting in"},{"line_number":34,"context_line":"front of a Keystone node. When a SAML assertion is created on the IdP side,"},{"line_number":35,"context_line":"the destination URI is part of the signed data in the SAML assertion and points"},{"line_number":36,"context_line":"to the endpoint where the proxy is located. One of the validation Shibboleth"},{"line_number":37,"context_line":"does is to validate if the destination endpoint in the SAML assertion matches"},{"line_number":38,"context_line":"with the destinated URL in the HTTP header. "},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_7d1b3b1c","line":36,"updated":"2015-05-15 14:28:42.000000000","message":"s/One of/Part of/","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ba647b5d8fb78f121636306d11b6fcc6f124c5c3","unresolved":false,"context_lines":[{"line_number":35,"context_line":"the destination URI is part of the signed data in the SAML assertion and points"},{"line_number":36,"context_line":"to the endpoint where the proxy is located. One of the validation Shibboleth"},{"line_number":37,"context_line":"does is to validate if the destination endpoint in the SAML assertion matches"},{"line_number":38,"context_line":"with the destinated URL in the HTTP header. "},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"In many cases, the request from the client terminated at the proxy and it"},{"line_number":41,"context_line":"resends it to the Keystone node by resetting the destined URL with the endpoint"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_a7cbbca4","line":38,"updated":"2015-05-17 20:08:04.000000000","message":"I think this problem might be solvable with Shibboleth configuration [0]. Sounds like a common problem? See the notes about \"backend configuration\" for HAProxy [1]. You can tell HAProxy to use x-forwarded-for which will retain the original client IP address. We can also tell Shibboleth to look for x-forwarded-for instead of using REMOTE_ADDR [2]. \n\n[0] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings\n[1] https://serversforhackers.com/load-balancing-with-haproxy\n[2] http://t100191.web-shibboleth-user.webdiscuss.info/checkaddress-and-x-forwarded-for-t100191.html","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":41,"context_line":"resends it to the Keystone node by resetting the destined URL with the endpoint"},{"line_number":42,"context_line":"that points to the actual Keystone node in HTTP header. "},{"line_number":43,"context_line":"This will fail the validation as this new URL in the HTTP header does not match"},{"line_number":44,"context_line":"with the one in the SAML assertion."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Problem 2:"},{"line_number":47,"context_line":"After the SAML assertion is successfully validated by Keystone, it sends back"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_bdcf737e","line":44,"updated":"2015-05-15 14:28:42.000000000","message":"What header are you talking about? The HTTP host? Why is the proxy changing this?","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":44,"context_line":"with the one in the SAML assertion."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Problem 2:"},{"line_number":47,"context_line":"After the SAML assertion is successfully validated by Keystone, it sends back"},{"line_number":48,"context_line":"the client a ``Redirect 302`` and the client will need to send back a HTTP "},{"line_number":49,"context_line":"Redirect to obtain an unscoped token. This will force the proxy to have"},{"line_number":50,"context_line":"sticky session configured."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_ddaeaf97","line":47,"updated":"2015-05-15 14:28:42.000000000","message":"remove \"back\"","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":46,"context_line":"Problem 2:"},{"line_number":47,"context_line":"After the SAML assertion is successfully validated by Keystone, it sends back"},{"line_number":48,"context_line":"the client a ``Redirect 302`` and the client will need to send back a HTTP "},{"line_number":49,"context_line":"Redirect to obtain an unscoped token. This will force the proxy to have"},{"line_number":50,"context_line":"sticky session configured."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"On the production level, there are reasons that load balancers should not"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_3db703da","line":49,"updated":"2015-05-15 14:28:42.000000000","message":"The client probably isn\u0027t sending a redirect anywhere. Do you mean following?","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":47,"context_line":"After the SAML assertion is successfully validated by Keystone, it sends back"},{"line_number":48,"context_line":"the client a ``Redirect 302`` and the client will need to send back a HTTP "},{"line_number":49,"context_line":"Redirect to obtain an unscoped token. This will force the proxy to have"},{"line_number":50,"context_line":"sticky session configured."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"On the production level, there are reasons that load balancers should not"},{"line_number":53,"context_line":"be configured with sticky session due to cluster recovery issues. Hence, "}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_ddb34fe8","line":50,"updated":"2015-05-15 14:28:42.000000000","message":"Why? This request can\u0027t go to another node in the Keystone cluster?","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ba647b5d8fb78f121636306d11b6fcc6f124c5c3","unresolved":false,"context_lines":[{"line_number":47,"context_line":"After the SAML assertion is successfully validated by Keystone, it sends back"},{"line_number":48,"context_line":"the client a ``Redirect 302`` and the client will need to send back a HTTP "},{"line_number":49,"context_line":"Redirect to obtain an unscoped token. This will force the proxy to have"},{"line_number":50,"context_line":"sticky session configured."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"On the production level, there are reasons that load balancers should not"},{"line_number":53,"context_line":"be configured with sticky session due to cluster recovery issues. Hence, "}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_27c0ec7a","line":50,"in_reply_to":"7a016987_ddb34fe8","updated":"2015-05-17 20:08:04.000000000","message":"Agreed.","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d39a16d4873e452283c5bebf091de1450fef9508","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"On the production level, there are reasons that load balancers should not"},{"line_number":53,"context_line":"be configured with sticky session due to cluster recovery issues. Hence, "},{"line_number":54,"context_line":"this is another problem."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Problem 3:"},{"line_number":57,"context_line":"Since a HTTP Redirect will need to be made by the client, this will introduce"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_eb04f37e","line":54,"updated":"2015-05-15 21:50:57.000000000","message":"This is making an assertion of problems without quantifying them. Please be specific. Why is sticky sessioning bad? What are the cluster recovery issues? What are ways other users solve this?","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ba647b5d8fb78f121636306d11b6fcc6f124c5c3","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"On the production level, there are reasons that load balancers should not"},{"line_number":53,"context_line":"be configured with sticky session due to cluster recovery issues. Hence, "},{"line_number":54,"context_line":"this is another problem."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Problem 3:"},{"line_number":57,"context_line":"Since a HTTP Redirect will need to be made by the client, this will introduce"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_07bbb00f","line":54,"in_reply_to":"7a016987_eb04f37e","updated":"2015-05-17 20:08:04.000000000","message":"Still not sure I understand why we need to have a stick session here? Keystone is stateless.","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d39a16d4873e452283c5bebf091de1450fef9508","unresolved":false,"context_lines":[{"line_number":56,"context_line":"Problem 3:"},{"line_number":57,"context_line":"Since a HTTP Redirect will need to be made by the client, this will introduce"},{"line_number":58,"context_line":"another round of request and response. Potentially, this has downside impact on"},{"line_number":59,"context_line":"the performance side."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"The problems mentioned above can be addressed by not replying on the Shibboleth"},{"line_number":62,"context_line":"module for validation. We could simply replace it with some other simple tools,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_0bee2fb4","line":59,"updated":"2015-05-15 21:50:57.000000000","message":"This is an acceptable side effect of SSO-type authentication.\n\nPlease quantify \"performance issues\" with actual metrics/profiling. Yes it is another round trip, but how significant is that round trip [consider people do this all the time on the internet today]. Keep in mind this is just to get the unscoped token for the SP\u0027s cloud, you don\u0027t keep doing the SAML2 dance for every operation.","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":62,"context_line":"module for validation. We could simply replace it with some other simple tools,"},{"line_number":63,"context_line":"for example \u0027xmlsec1\u0027 which is currently used for signing a SAML assertion. "},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Many of the applications may not need extra validations like checking destinated"},{"line_number":66,"context_line":"URL(disabling it in Shibboleth is not easy), but mainly cares about signature"},{"line_number":67,"context_line":"verification and timestamp validation. And \u0027xmlsec1\u0027 can handle of those in a easy"},{"line_number":68,"context_line":"way by treating the SAML assertion as a generic signed XML document."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_5dd75fed","line":65,"updated":"2015-05-15 14:28:42.000000000","message":"s/destinated/the destination/","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Many of the applications may not need extra validations like checking destinated"},{"line_number":66,"context_line":"URL(disabling it in Shibboleth is not easy), but mainly cares about signature"},{"line_number":67,"context_line":"verification and timestamp validation. And \u0027xmlsec1\u0027 can handle of those in a easy"},{"line_number":68,"context_line":"way by treating the SAML assertion as a generic signed XML document."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"The benefits of replacing Shibboleth with \u0027xmlsec1\u0027 are:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_e85ac729","line":67,"updated":"2015-05-15 14:28:42.000000000","message":"Remove \u0027And\u0027","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d39a16d4873e452283c5bebf091de1450fef9508","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"* Simplicity - \u0027xmlsec1\u0027 is just a command tool that requires no additional"},{"line_number":73,"context_line":"  configuration nor any demon process. Setting up different configurable"},{"line_number":74,"context_line":"  options in Keystone will be simple, like the length of validity of the signature."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"* Flexibility - the SAML assertion is treated as just a signed XML document "},{"line_number":77,"context_line":"  that does not require to be wrapped with ECP or any other forms."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_ab35db46","line":74,"updated":"2015-05-15 21:50:57.000000000","message":"I disagree with this assertion. You are replacing the complexity of shibboleth with the complexity of all the code in keystone to mimic shibboleth\u0027s functionality.","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"32b53f1929768e8df309a81121f3f17f451ee4c1","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"* Simplicity - \u0027xmlsec1\u0027 is just a command tool that requires no additional"},{"line_number":73,"context_line":"  configuration nor any demon process. Setting up different configurable"},{"line_number":74,"context_line":"  options in Keystone will be simple, like the length of validity of the signature."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"* Flexibility - the SAML assertion is treated as just a signed XML document "},{"line_number":77,"context_line":"  that does not require to be wrapped with ECP or any other forms."}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_473e48b9","line":74,"in_reply_to":"7a016987_ab35db46","updated":"2015-05-17 19:50:48.000000000","message":"I feel this approach will add more security work in Keystone, instead of just letting Shibboleth do what it\u0027s meant to do. It also adds additional setup to Federated deployments, not making it any simpler for users to deploy Keystone-to-Keystone Federation.","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":89,"context_line":"The proposed workflows are as the following -"},{"line_number":90,"context_line":"1. It is still using the current way for a client to authenticate to the IdP"},{"line_number":91,"context_line":"   to obtain the SAML assertion."},{"line_number":92,"context_line":"2. After the client obtains the SAM assertion, it does not need to wrap the  "},{"line_number":93,"context_line":"   SAML assertion with ECP."},{"line_number":94,"context_line":"3. The client sends a HTTP POST /OS-FEDERATION/auth/tokens to the SP and have"},{"line_number":95,"context_line":"   the SAML assertion in the payload. "}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_886353dc","line":92,"updated":"2015-05-15 14:28:42.000000000","message":"SAML","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":91,"context_line":"   to obtain the SAML assertion."},{"line_number":92,"context_line":"2. After the client obtains the SAM assertion, it does not need to wrap the  "},{"line_number":93,"context_line":"   SAML assertion with ECP."},{"line_number":94,"context_line":"3. The client sends a HTTP POST /OS-FEDERATION/auth/tokens to the SP and have"},{"line_number":95,"context_line":"   the SAML assertion in the payload. "},{"line_number":96,"context_line":"4. The client receives the unscoped token."},{"line_number":97,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_68b5b72f","line":94,"updated":"2015-05-15 14:28:42.000000000","message":"s/and have/with/","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"d37b979df7cc60ecddea6e375eef09eb187815fd","unresolved":false,"context_lines":[{"line_number":103,"context_line":"        \"identity_provider\": \"\u003cIdentity Provider Id\u003e\","},{"line_number":104,"context_line":"        \"protocol\": \"\u003cProtocol Id\u003e\","},{"line_number":105,"context_line":"        \"saml_assertion\": \"\u003cSAML assertion\u003e\""},{"line_number":106,"context_line":"    }"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Resource URL"},{"line_number":109,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_bacef22a","line":106,"updated":"2015-05-20 17:18:30.000000000","message":"You are basically changing the WORKFLOW defined and enforced by a SAML protocol, which essentially makes it no longer compatible with SAML.\nThis spec is not Lightweight K2K, rather a completely new token format/workflow, which happens to somewhat overlap with what SAML provides.","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":112,"context_line":"``federation router`` and the same action ``federated_authentication`` will be used"},{"line_number":113,"context_line":"as the current K2K."},{"line_number":114,"context_line":"Instead of passing the ``identity provider`` and ``protocol`` from the URL, they"},{"line_number":115,"context_line":"will be passed from the payload along with the assertion."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"SAML Assertion Validation"},{"line_number":118,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_08cbe3a6","line":115,"updated":"2015-05-15 14:28:42.000000000","message":"Why?","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"584bfd429fc6b252f93341b06cb572b8888afb53","unresolved":false,"context_lines":[{"line_number":117,"context_line":"SAML Assertion Validation"},{"line_number":118,"context_line":"-------------------------"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"The validation on the SAML assertion will including the following -"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"* Signature Validation - ``xmlsec1`` by default will be used to handle signature"},{"line_number":123,"context_line":"  verification. A different tool can be specified by setting the option ``xmlsec1_binary``"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_68ba570c","line":120,"updated":"2015-05-15 14:28:42.000000000","message":"s/ on / of /","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"d39a16d4873e452283c5bebf091de1450fef9508","unresolved":false,"context_lines":[{"line_number":181,"context_line":""},{"line_number":182,"context_line":"This is expected to have better performance compare with the current K2K as it does "},{"line_number":183,"context_line":"not need the client to do the two steps process to send an additional HTTP Redirect"},{"line_number":184,"context_line":"for the unscoped token."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"Other Deployer Impact"},{"line_number":187,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_8b0fbf87","line":184,"updated":"2015-05-15 21:50:57.000000000","message":"Please provide real metrics on the cost of K2K and at least a mockup POC to show the improvements gained if you\u0027re asserting this as a tangible benefit. You can hedge here if you want and say \"there may be improvements for \u003creasons\u003e\" if there are questions on how to measure and/or mock up a POC for measuring this.","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"32b53f1929768e8df309a81121f3f17f451ee4c1","unresolved":false,"context_lines":[{"line_number":225,"context_line":"Testing"},{"line_number":226,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"There will be unit tests to cover all the related implementation."},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"Documentation Impact"},{"line_number":231,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a016987_c778f891","line":228,"updated":"2015-05-17 19:50:48.000000000","message":"What about gate testing? We would be increasing the setup complexity of Federated deployments and we\u0027ve (@dstanek) put in a lot of work last cycle setting up federation testing.\n\nIf we were to do something like what\u0027s being proposed in this spec, it would be nice to understand how we can ensure it\u0027s tested in the gate and how we can leverage the existing work that\u0027s been done.","commit_id":"abb24b6a7baa1d2be62b7fc8d6b05e764d31e642"}]}