)]}'
{"specs/backlog/query-config.rst":[{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"f087953749a40746872bf43a32653777069e23b3","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp Query Config"},{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/query-config\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Provide an API to expose Keystone configuration values to remote services."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_b79192f3","line":12,"updated":"2015-06-10 09:44:05.000000000","message":"Need a real BP.","commit_id":"473784fa6fc3b975731bc7ae6882e1a1bd1df526"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"f087953749a40746872bf43a32653777069e23b3","unresolved":false,"context_lines":[{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"As we move from V2 to V3, and as we implement dynamic policy, we find that"},{"line_number":22,"context_line":"there as certain pieces odf information that the Keystone server has that"},{"line_number":23,"context_line":"other services need in order to make smart decisions.  When handling a V2"},{"line_number":24,"context_line":"verion token, we do not know the default domain.  When enforcing policy we"},{"line_number":25,"context_line":"do not know the admin domain.  Both these values are in the configuration file."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_17a2a64b","line":22,"updated":"2015-06-10 09:44:05.000000000","message":"s/oaf/of","commit_id":"473784fa6fc3b975731bc7ae6882e1a1bd1df526"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"f087953749a40746872bf43a32653777069e23b3","unresolved":false,"context_lines":[{"line_number":21,"context_line":"As we move from V2 to V3, and as we implement dynamic policy, we find that"},{"line_number":22,"context_line":"there as certain pieces odf information that the Keystone server has that"},{"line_number":23,"context_line":"other services need in order to make smart decisions.  When handling a V2"},{"line_number":24,"context_line":"verion token, we do not know the default domain.  When enforcing policy we"},{"line_number":25,"context_line":"do not know the admin domain.  Both these values are in the configuration file."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_3da34302","line":24,"updated":"2015-06-10 09:44:05.000000000","message":"s/verion/version","commit_id":"473784fa6fc3b975731bc7ae6882e1a1bd1df526"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"f087953749a40746872bf43a32653777069e23b3","unresolved":false,"context_lines":[{"line_number":61,"context_line":"  a new way to access sensitive information or a new way to login?"},{"line_number":62,"context_line":"  The information would be used when processing tokens.  A hacked value would"},{"line_number":63,"context_line":"  allow a service to treat a non-admin token as an admin token.  However, to"},{"line_number":64,"context_line":"  perform an attack like this requires DNS poi\\soning, and would lead to many"},{"line_number":65,"context_line":"  other more viable attacks first."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"* Does this change involve cryptography or hashing?"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_9c1e7d6e","line":64,"updated":"2015-06-10 09:44:05.000000000","message":"s/poi\\soning/poisoning","commit_id":"473784fa6fc3b975731bc7ae6882e1a1bd1df526"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"f087953749a40746872bf43a32653777069e23b3","unresolved":false,"context_lines":[{"line_number":95,"context_line":"Performance Impact"},{"line_number":96,"context_line":"------------------"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"No performance impact.  The change would potentially increas the number of"},{"line_number":99,"context_line":"calls upon Keystone, but the amolunt would be minimal compared with token"},{"line_number":100,"context_line":"validations."},{"line_number":101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_1f95df85","line":98,"updated":"2015-06-10 09:44:05.000000000","message":"s/increas/increase","commit_id":"473784fa6fc3b975731bc7ae6882e1a1bd1df526"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"f087953749a40746872bf43a32653777069e23b3","unresolved":false,"context_lines":[{"line_number":96,"context_line":"------------------"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"No performance impact.  The change would potentially increas the number of"},{"line_number":99,"context_line":"calls upon Keystone, but the amolunt would be minimal compared with token"},{"line_number":100,"context_line":"validations."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Other Deployer Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_df8aa763","line":99,"updated":"2015-06-10 09:44:05.000000000","message":"s/amolunt/amount","commit_id":"473784fa6fc3b975731bc7ae6882e1a1bd1df526"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"f087953749a40746872bf43a32653777069e23b3","unresolved":false,"context_lines":[{"line_number":111,"context_line":"  real deployments?"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"  One configuratuion option, which would be the list of whitelisted values"},{"line_number":114,"context_line":"  reported byt the config API."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"* Is this a change that takes immediate effect after its merged, or is it"},{"line_number":117,"context_line":"  something that has to be explicitly enabled?"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_9fd66f4d","line":114,"updated":"2015-06-10 09:44:05.000000000","message":"s/byt/by","commit_id":"473784fa6fc3b975731bc7ae6882e1a1bd1df526"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"f087953749a40746872bf43a32653777069e23b3","unresolved":false,"context_lines":[{"line_number":131,"context_line":"* If the blueprint proposes a change to the driver API, discussion of how"},{"line_number":132,"context_line":"  other backends would implement the feature is required."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Any developer attempting to performaoperations with V2 tokens should use the"},{"line_number":135,"context_line":"data returned by this aapi to set the default Domain."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_1f4a7f26","line":134,"updated":"2015-06-10 09:44:05.000000000","message":"s/performaoperations/perform a operations","commit_id":"473784fa6fc3b975731bc7ae6882e1a1bd1df526"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"f087953749a40746872bf43a32653777069e23b3","unresolved":false,"context_lines":[{"line_number":132,"context_line":"  other backends would implement the feature is required."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Any developer attempting to performaoperations with V2 tokens should use the"},{"line_number":135,"context_line":"data returned by this aapi to set the default Domain."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_9f642fb9","line":135,"updated":"2015-06-10 09:44:05.000000000","message":"s/aapi/a api","commit_id":"473784fa6fc3b975731bc7ae6882e1a1bd1df526"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"f087953749a40746872bf43a32653777069e23b3","unresolved":false,"context_lines":[{"line_number":166,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"The new API will have to exist in the guide."},{"line_number":169,"context_line":"Policy engine will be able to use this new API to enforce POlicy for the Admin"},{"line_number":170,"context_line":"domain."},{"line_number":171,"context_line":""},{"line_number":172,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_bfd6cb25","line":169,"updated":"2015-06-10 09:44:05.000000000","message":"s/POlicy/Policy","commit_id":"473784fa6fc3b975731bc7ae6882e1a1bd1df526"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d36569c777c4b38c405217a625069f4779e849f0","unresolved":false,"context_lines":[{"line_number":22,"context_line":"there as certain pieces of information that the Keystone server has that"},{"line_number":23,"context_line":"other services need in order to make smart decisions.  When handling a V2"},{"line_number":24,"context_line":"version token, we do not know the default domain.  When enforcing policy we"},{"line_number":25,"context_line":"do not know the admin domain.  Both these values are in the configuration file."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_762c5899","line":25,"updated":"2015-07-08 01:11:36.000000000","message":"another use case is when assigning the default role, the member_role_name have to be copied to the horizon config too.","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"079aa9f1bdd37d14db7265acdbe83580887f3493","unresolved":false,"context_lines":[{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Create an API that exposes a limited subset of the configuration values from"},{"line_number":32,"context_line":"the keystone server.  Limit the values returned by a whitelist."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_77318859","line":32,"updated":"2015-06-10 16:10:02.000000000","message":"A suppose whitelist will be a configuration value too. How shall we protect it from being exposed?","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"bc0c817ea0a328a788c59bcfa4564572065f6f8a","unresolved":false,"context_lines":[{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Create an API that exposes a limited subset of the configuration values from"},{"line_number":32,"context_line":"the keystone server.  Limit the values returned by a whitelist."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_e5dbe519","line":32,"in_reply_to":"3afb71cf_77318859","updated":"2015-07-07 16:32:05.000000000","message":"There is no risk in exposing whitelist, so if the whitelist is in the whitelist, expose it.  If the whitelist is not in the whitelist, it won\u0027t show up.","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"7174bf146305c856f4fdf49319c21a9f97f0fb93","unresolved":false,"context_lines":[{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Create an API that exposes a limited subset of the configuration values from"},{"line_number":32,"context_line":"the keystone server.  Limit the values returned by a whitelist."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_7e29aa36","line":32,"in_reply_to":"3afb71cf_77318859","updated":"2015-07-07 19:45:56.000000000","message":"Why do you need to protect the whitelist?","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d36569c777c4b38c405217a625069f4779e849f0","unresolved":false,"context_lines":[{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Create an API that exposes a limited subset of the configuration values from"},{"line_number":32,"context_line":"the keystone server.  Limit the values returned by a whitelist."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_760a188c","line":32,"in_reply_to":"ba3cc151_7e29aa36","updated":"2015-07-08 01:11:36.000000000","message":"Good question, if we already whitelisted the config what type of limiting on the returned values need to be done?","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"d7b888c5d7cd9a5260875767fee3b84306721860","unresolved":false,"context_lines":[{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Create an API that exposes a limited subset of the configuration values from"},{"line_number":32,"context_line":"the keystone server.  Limit the values returned by a whitelist."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_00b5972f","line":32,"in_reply_to":"ba3cc151_e5dbe519","updated":"2015-07-07 16:41:40.000000000","message":"Since this spec is about query API (i.e. read-only interface) my concern is invalid here.","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d36569c777c4b38c405217a625069f4779e849f0","unresolved":false,"context_lines":[{"line_number":44,"context_line":"We could ignore the V2 to V3 case and only solve the issue for policy."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"`Policy Substitue Values \u003chttps://review.openstack.org/#/c/186929/\u003e`_"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_b6a740a6","line":47,"updated":"2015-07-08 01:11:36.000000000","message":"nit: Substitute","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d36569c777c4b38c405217a625069f4779e849f0","unresolved":false,"context_lines":[{"line_number":54,"context_line":"consider include:"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":57,"context_line":"  Nonoe of the sensitive values from the config file would be whitelisted.  No"},{"line_number":58,"context_line":"  tokens would be exposed."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"* Does this change alter the API in a way that may impact security, such as"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_561354b8","line":57,"updated":"2015-07-08 01:11:36.000000000","message":"Nonoe -\u003e None","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d36569c777c4b38c405217a625069f4779e849f0","unresolved":false,"context_lines":[{"line_number":69,"context_line":""},{"line_number":70,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":71,"context_line":"  No.  Instead, the value would be used in expanding out Token data, and thus"},{"line_number":72,"context_line":"  used by other serivces attempting to determin access control."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":75,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_d6552450","line":72,"updated":"2015-07-08 01:11:36.000000000","message":"services","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d36569c777c4b38c405217a625069f4779e849f0","unresolved":false,"context_lines":[{"line_number":110,"context_line":"  implement as well)? Are the default values ones which will work well in"},{"line_number":111,"context_line":"  real deployments?"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"  One configuratuion option, which would be the list of whitelisted values"},{"line_number":114,"context_line":"  reported by the config API."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"* Is this a change that takes immediate effect after its merged, or is it"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_76669852","line":113,"updated":"2015-07-08 01:11:36.000000000","message":"configuration","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d36569c777c4b38c405217a625069f4779e849f0","unresolved":false,"context_lines":[{"line_number":132,"context_line":"  other backends would implement the feature is required."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Any developer attempting to perform a operations with V2 tokens should use the"},{"line_number":135,"context_line":"data returned by this a api to set the default Domain."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_16ce2c2d","line":135,"updated":"2015-07-08 01:11:36.000000000","message":"remove \"a\"","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"d36569c777c4b38c405217a625069f4779e849f0","unresolved":false,"context_lines":[{"line_number":152,"context_line":"Work Items"},{"line_number":153,"context_line":"----------"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"The should be implmented in a single patch with unit tests.  Follow on work in"},{"line_number":156,"context_line":"the auth plugins would allow other services to query this API."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba3cc151_36a1f046","line":155,"updated":"2015-07-08 01:11:36.000000000","message":"implemented","commit_id":"fab170613d0dd56f065cdfce4a84b9cc169c5ac2"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"257b9a8fa7a254fac99fec808b4e8cb80ac40a02","unresolved":false,"context_lines":[{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Create an API that exposes a limited subset of the configuration values from"},{"line_number":32,"context_line":"the keystone server.  Limit the values returned by a whitelist."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_b7f37a72","line":32,"updated":"2015-07-09 02:17:21.000000000","message":"Will this API require a keystone token to query the config values?\n\nJust thinking if horizon uses the API, will it need to present a token (or a cert  when we have the tokenless/cert middleware)?","commit_id":"a4c37a70bce7cbace85ba6f576325a4dda321a90"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"9c4d82f6b6ee4ff59fc16194fd2184f717c9bf73","unresolved":false,"context_lines":[{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Create an API that exposes a limited subset of the configuration values from"},{"line_number":32,"context_line":"the keystone server.  Limit the values returned by a whitelist."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_b21aa57b","line":32,"in_reply_to":"ba3cc151_0f432eb0","updated":"2015-07-09 05:30:48.000000000","message":"Cool, looking forward to this feature!","commit_id":"a4c37a70bce7cbace85ba6f576325a4dda321a90"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"dd845cda25bd9966abba463dbab82564a956c74b","unresolved":false,"context_lines":[{"line_number":29,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Create an API that exposes a limited subset of the configuration values from"},{"line_number":32,"context_line":"the keystone server.  Limit the values returned by a whitelist."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":""},{"line_number":35,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"ba3cc151_0f432eb0","line":32,"in_reply_to":"ba3cc151_b7f37a72","updated":"2015-07-09 04:36:15.000000000","message":"No, this should be an unauthenticated call, but that is actually a configuration option, and should not effect the spec.  It can be set either way in the paste pipeline.","commit_id":"a4c37a70bce7cbace85ba6f576325a4dda321a90"},{"author":{"_account_id":13997,"name":"SHIGEMATSU Mitsuhiro","email":"shigematsu.mitsuhiro@lab.ntt.co.jp","username":"pshige"},"change_message_id":"a69055c352dce527f6d581b2b485211d705180ea","unresolved":false,"context_lines":[{"line_number":69,"context_line":""},{"line_number":70,"context_line":"* Does this change require the use of sudo or any elevated privileges?"},{"line_number":71,"context_line":"  No.  Instead, the value would be used in expanding out Token data, and thus"},{"line_number":72,"context_line":"  used by other services attempting to determin access control."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":75,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."}],"source_content_type":"text/x-rst","patch_set":4,"id":"da20952f_3a5fb442","line":72,"updated":"2015-09-03 12:09:28.000000000","message":"s/determin/determine/","commit_id":"a4c37a70bce7cbace85ba6f576325a4dda321a90"}]}