)]}'
{"api/v3/identity-api-v3-os-federation-ext.rst":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4b27acb7ef35761ce0d121251101fdf34fd89b09","unresolved":false,"context_lines":[{"line_number":1460,"context_line":"                \"OS-FEDERATION\": {"},{"line_number":1461,"context_line":"                    \"identity_provider\": \"ACME\","},{"line_number":1462,"context_line":"                    \"protocol\": \"SAML\","},{"line_number":1463,"context_line":"                    \"groups\": ["},{"line_number":1464,"context_line":"                        {\"id\": \"abc123\"},"},{"line_number":1465,"context_line":"                        {\"id\": \"bcd234\"}"},{"line_number":1466,"context_line":"                    ]"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_251b7875","line":1463,"updated":"2015-06-25 18:55:21.000000000","message":"are we going to get rid of this then? Why have it twice?","commit_id":"1262312a9e8aa6c83b177801ac226d5ca2c68d30"}],"api/v3/identity-api-v3.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ee0e166fd648544571c2c4decd74ee77e8df0e62","unresolved":false,"context_lines":[{"line_number":1205,"context_line":"            },"},{"line_number":1206,"context_line":"            \"groups\": ["},{"line_number":1207,"context_line":"                {"},{"line_number":1208,"context_line":"                    \"domain_id\": \"1789d1\","},{"line_number":1209,"context_line":"                    \"id\": \"70febc\","},{"line_number":1210,"context_line":"                    \"name\": \"Developers\""},{"line_number":1211,"context_line":"                }"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_0a2c3faa","line":1208,"updated":"2015-06-04 20:19:12.000000000","message":"groups are domain-specific! which means that we can\u0027t simply expose X-Group-Names to the underlying service unless there\u0027s an assumption about their domain scope being made somewhere (confine the group list to either X-User-Domain, or X-Project-Domain?)","commit_id":"dbf27cf6e5f4d77bbfd174b0f6aa1dcb79b92c6f"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"ff207ce877b72aea670a3dd07ea72004e589193f","unresolved":false,"context_lines":[{"line_number":1205,"context_line":"            },"},{"line_number":1206,"context_line":"            \"groups\": ["},{"line_number":1207,"context_line":"                {"},{"line_number":1208,"context_line":"                    \"domain_id\": \"1789d1\","},{"line_number":1209,"context_line":"                    \"id\": \"70febc\","},{"line_number":1210,"context_line":"                    \"name\": \"Developers\""},{"line_number":1211,"context_line":"                }"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_e475bd31","line":1208,"in_reply_to":"3afb71cf_0a2c3faa","updated":"2015-06-10 19:49:32.000000000","message":"Definitely need to confine.  Will you be stating what options for confinement will be supported and provide an example?","commit_id":"dbf27cf6e5f4d77bbfd174b0f6aa1dcb79b92c6f"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"9222b36c11084a7b3d0770fde1f362f997bc5f5d","unresolved":false,"context_lines":[{"line_number":1141,"context_line":""},{"line_number":1142,"context_line":"  Includes the full resource description of a user."},{"line_number":1143,"context_line":""},{"line_number":1144,"context_line":"- ``groups`` (list of objects)"},{"line_number":1145,"context_line":""},{"line_number":1146,"context_line":"  Enumerates all of the user\u0027s group memberships."},{"line_number":1147,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1af86dd1_95c5c35c","line":1144,"updated":"2015-06-12 21:30:57.000000000","message":"THis is too long a list.  It should only ennumerate the group used to create the token.","commit_id":"cc0391ceca03fd7d665ee9ef453a305606c5c263"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"b37486850d2df7acc45a93a13b7e0430cda0e6ce","unresolved":false,"context_lines":[{"line_number":1141,"context_line":""},{"line_number":1142,"context_line":"  Includes the full resource description of a user."},{"line_number":1143,"context_line":""},{"line_number":1144,"context_line":"- ``groups`` (list of objects)"},{"line_number":1145,"context_line":""},{"line_number":1146,"context_line":"  Enumerates all of the user\u0027s group memberships."},{"line_number":1147,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1af86dd1_35996f6f","line":1144,"in_reply_to":"1af86dd1_95c5c35c","updated":"2015-06-12 21:31:51.000000000","message":"Note that it can still be \"groups\" and an array, just that for a scoped token it should be an array of length 1.","commit_id":"cc0391ceca03fd7d665ee9ef453a305606c5c263"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4b27acb7ef35761ce0d121251101fdf34fd89b09","unresolved":false,"context_lines":[{"line_number":1193,"context_line":"                \"domain\": {"},{"line_number":1194,"context_line":"                    \"id\": \"1789d1\","},{"line_number":1195,"context_line":"                    \"name\": \"example.com\""},{"line_number":1196,"context_line":"                },"},{"line_number":1197,"context_line":"                \"id\": \"0ca8f6\","},{"line_number":1198,"context_line":"                \"name\": \"Joe\""},{"line_number":1199,"context_line":"            }"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_a55468fe","line":1196,"updated":"2015-06-25 18:55:21.000000000","message":"(nit) unrelated","commit_id":"1262312a9e8aa6c83b177801ac226d5ca2c68d30"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4b27acb7ef35761ce0d121251101fdf34fd89b09","unresolved":false,"context_lines":[{"line_number":1323,"context_line":"  on the token\u0027s project scope, then that group will appear in the token."},{"line_number":1324,"context_line":""},{"line_number":1325,"context_line":"  Includes only group ``id`` attributes, instead of a full resource"},{"line_number":1326,"context_line":"  description."},{"line_number":1327,"context_line":""},{"line_number":1328,"context_line":"Example entity:"},{"line_number":1329,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_256058cf","line":1326,"updated":"2015-06-25 18:55:21.000000000","message":"what if there\u0027s no groups, is it an empty list or is groups not even present?","commit_id":"1262312a9e8aa6c83b177801ac226d5ca2c68d30"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"ea0d80b5049c4533303b47df3a38ba83c65299ed","unresolved":false,"context_lines":[{"line_number":1323,"context_line":"  on the token\u0027s project scope, then that group will appear in the token."},{"line_number":1324,"context_line":""},{"line_number":1325,"context_line":"  Includes only group ``id`` attributes, instead of a full resource"},{"line_number":1326,"context_line":"  description."},{"line_number":1327,"context_line":""},{"line_number":1328,"context_line":"Example entity:"},{"line_number":1329,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_b3bfc7fb","line":1326,"in_reply_to":"fa32b979_256058cf","updated":"2015-07-15 19:18:08.000000000","message":"empty list should be OK","commit_id":"1262312a9e8aa6c83b177801ac226d5ca2c68d30"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4b27acb7ef35761ce0d121251101fdf34fd89b09","unresolved":false,"context_lines":[{"line_number":1859,"context_line":"Authentication responses"},{"line_number":1860,"context_line":"\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027"},{"line_number":1861,"context_line":""},{"line_number":1862,"context_line":"A response without an explicit authorization scope does not contain a"},{"line_number":1863,"context_line":"``catalog``, ``project``, ``domain`` or ``roles`` but can be used to uniquely"},{"line_number":1864,"context_line":"identify the user. Example response:"},{"line_number":1865,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_85aa84d1","line":1862,"updated":"2015-06-25 18:55:21.000000000","message":"add ``groups`` to the list.","commit_id":"1262312a9e8aa6c83b177801ac226d5ca2c68d30"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4b27acb7ef35761ce0d121251101fdf34fd89b09","unresolved":false,"context_lines":[{"line_number":1888,"context_line":""},{"line_number":1889,"context_line":"Notice that token ID is not part of the token data. Rather, it is conveyed in"},{"line_number":1890,"context_line":"the ``X-Subject-Token`` header."},{"line_number":1891,"context_line":""},{"line_number":1892,"context_line":"A token scoped to a ``project`` will also have a service ``catalog``, along"},{"line_number":1893,"context_line":"with the user\u0027s roles applicable to the ``project``."},{"line_number":1894,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_c57e4c6a","line":1891,"updated":"2015-06-25 18:55:21.000000000","message":"(unrelated) this isn\u0027t totally accurate since the catalog may not be present.","commit_id":"1262312a9e8aa6c83b177801ac226d5ca2c68d30"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4b27acb7ef35761ce0d121251101fdf34fd89b09","unresolved":false,"context_lines":[{"line_number":1889,"context_line":"Notice that token ID is not part of the token data. Rather, it is conveyed in"},{"line_number":1890,"context_line":"the ``X-Subject-Token`` header."},{"line_number":1891,"context_line":""},{"line_number":1892,"context_line":"A token scoped to a ``project`` will also have a service ``catalog``, along"},{"line_number":1893,"context_line":"with the user\u0027s roles applicable to the ``project``."},{"line_number":1894,"context_line":""},{"line_number":1895,"context_line":"Provided there are enabled service providers, a token will be populated with"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_45b47c34","line":1892,"updated":"2015-06-25 18:55:21.000000000","message":"also add ``groups``","commit_id":"1262312a9e8aa6c83b177801ac226d5ca2c68d30"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4b27acb7ef35761ce0d121251101fdf34fd89b09","unresolved":false,"context_lines":[{"line_number":1986,"context_line":"        }"},{"line_number":1987,"context_line":"    }"},{"line_number":1988,"context_line":""},{"line_number":1989,"context_line":"A token scoped to a ``domain`` will also have a service ``catalog`` along with"},{"line_number":1990,"context_line":"the user\u0027s roles applicable to the ``domain``. Example response:"},{"line_number":1991,"context_line":""},{"line_number":1992,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_65dbc07e","line":1989,"updated":"2015-06-25 18:55:21.000000000","message":"(unrelated) this is totally accurate since you can request a token without a catalog.","commit_id":"1262312a9e8aa6c83b177801ac226d5ca2c68d30"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4b27acb7ef35761ce0d121251101fdf34fd89b09","unresolved":false,"context_lines":[{"line_number":1987,"context_line":"    }"},{"line_number":1988,"context_line":""},{"line_number":1989,"context_line":"A token scoped to a ``domain`` will also have a service ``catalog`` along with"},{"line_number":1990,"context_line":"the user\u0027s roles applicable to the ``domain``. Example response:"},{"line_number":1991,"context_line":""},{"line_number":1992,"context_line":"::"},{"line_number":1993,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_85d84481","line":1990,"updated":"2015-06-25 18:55:21.000000000","message":"also add groups (should be \"roles and groups\")","commit_id":"1262312a9e8aa6c83b177801ac226d5ca2c68d30"}],"specs/liberty/groups-in-token.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f50691fd51a0e1e14a07663b4231aa268266f0b7","unresolved":false,"context_lines":[{"line_number":41,"context_line":"  (referencing the impacted group ID) would have to be issued. This is"},{"line_number":42,"context_line":"  primarily a performance and user experience improvement."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"* It would promote a portion of OS-FEDERATION\u0027s design into the core API."},{"line_number":45,"context_line":"  Federated tokens are already implementing this behavior, such that groups"},{"line_number":46,"context_line":"  produced by mapping for ephemeral users do not need to be persisted outside"},{"line_number":47,"context_line":"  of tokens, and this specification would then promote this behavior into the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_68d64950","line":44,"updated":"2015-06-10 16:59:55.000000000","message":"This will differ slightly from how the OS-FEDERATION design works with Fernet tokens because we pass the group IDs in the ephemeral token. We won\u0027t be doing that for this specification will we? The token\u0027s packing scheme for Fernet shouldn\u0027t change as a result of this work, right? We should be able to reconstruct a user\u0027s groups, like we do with other resources in the token reference, because Keystone should have access to that data. That is the opposite of the OS-FEDERATION case because we have no way to look up the group IDs somewhere else.\n\nThis comment doesn\u0027t have to be included in the specification, since it\u0027s more of an implementation detail, but I just wanted to clarify in review.","commit_id":"dbf27cf6e5f4d77bbfd174b0f6aa1dcb79b92c6f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b0d6a6538e82746fdde3d84cc1e9a0b467a7f7ce","unresolved":false,"context_lines":[{"line_number":41,"context_line":"  (referencing the impacted group ID) would have to be issued. This is"},{"line_number":42,"context_line":"  primarily a performance and user experience improvement."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"* It would promote a portion of OS-FEDERATION\u0027s design into the core API."},{"line_number":45,"context_line":"  Federated tokens are already implementing this behavior, such that groups"},{"line_number":46,"context_line":"  produced by mapping for ephemeral users do not need to be persisted outside"},{"line_number":47,"context_line":"  of tokens, and this specification would then promote this behavior into the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af86dd1_fa7ce421","line":44,"in_reply_to":"1af86dd1_3a26fc68","updated":"2015-06-12 20:57:14.000000000","message":"++ awesome, thank you for the clarification","commit_id":"dbf27cf6e5f4d77bbfd174b0f6aa1dcb79b92c6f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ed4a9c9187dae0f5a32c6ae58edf35c9b11662d6","unresolved":false,"context_lines":[{"line_number":41,"context_line":"  (referencing the impacted group ID) would have to be issued. This is"},{"line_number":42,"context_line":"  primarily a performance and user experience improvement."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"* It would promote a portion of OS-FEDERATION\u0027s design into the core API."},{"line_number":45,"context_line":"  Federated tokens are already implementing this behavior, such that groups"},{"line_number":46,"context_line":"  produced by mapping for ephemeral users do not need to be persisted outside"},{"line_number":47,"context_line":"  of tokens, and this specification would then promote this behavior into the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1af86dd1_3a26fc68","line":44,"in_reply_to":"3afb71cf_68d64950","updated":"2015-06-12 20:54:32.000000000","message":"per the mailing list conversation cited at the bottom of the doc, i\u0027m updating this spec to only provide group IDs, as OS-FEDERATION does.\n\nbut with regard to Fernet, your analysis is correct: Fernet token payloads will not be impacted by this spec at all.","commit_id":"dbf27cf6e5f4d77bbfd174b0f6aa1dcb79b92c6f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e081ac02428659b06db2f8c373ccff53323d7446","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  of revocation events than is theoretically necessary. With the inclusion of"},{"line_number":40,"context_line":"  user groups in token validation responses, only one revocation event"},{"line_number":41,"context_line":"  (referencing the impacted group ID) would have to be issued. This is"},{"line_number":42,"context_line":"  primarily a performance and user experience improvement."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"* It would promote a portion of OS-FEDERATION\u0027s design into the core API."},{"line_number":45,"context_line":"  Federated tokens are already implementing this behavior, such that groups"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_8d44064a","line":42,"updated":"2015-06-18 18:19:30.000000000","message":"While this is true, in most production systems, user group membership and group role assignments are highly static. They don\u0027t tend to change often.","commit_id":"cc0391ceca03fd7d665ee9ef453a305606c5c263"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e081ac02428659b06db2f8c373ccff53323d7446","unresolved":false,"context_lines":[{"line_number":45,"context_line":"  Federated tokens are already implementing this behavior, such that groups"},{"line_number":46,"context_line":"  produced by mapping for ephemeral users do not need to be persisted outside"},{"line_number":47,"context_line":"  of tokens, and this specification would then promote this behavior into the"},{"line_number":48,"context_line":"  core API."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* It would allow ``keystonemiddleware.auth_token`` to expose a client\u0027s group"},{"line_number":51,"context_line":"  IDs to services via a ``X-Group-Ids`` header (per the middleware\u0027s prevailing"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_ad1eaa09","line":48,"updated":"2015-06-18 18:19:30.000000000","message":"That\u0027s an interesting argument though the proposed API change spec didn\u0027t reflect that. Are we saying this is an added bonus because Federated token already carry the group information or are we proposing to move the \u0027group\u0027 attribute from token[\u0027user\u0027][\u0027OS-FEDERATION\u0027] into token[\u0027groups\u0027]?","commit_id":"cc0391ceca03fd7d665ee9ef453a305606c5c263"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e081ac02428659b06db2f8c373ccff53323d7446","unresolved":false,"context_lines":[{"line_number":51,"context_line":"  IDs to services via a ``X-Group-Ids`` header (per the middleware\u0027s prevailing"},{"line_number":52,"context_line":"  conventions). The primary consumer of that new data would be Barbican, which"},{"line_number":53,"context_line":"  has expressed an interest_ in adding user group support to its per-secret"},{"line_number":54,"context_line":"  access control lists (ACLs_) since the Kilo time frame."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":".. _interest: https://github.com/openstack/barbican-specs/blob/eb5fc837e5ac6e569eac654a268f04668dc6dc8c/specs/kilo/add-per-secret-policy.rst#rest-api-impact"},{"line_number":57,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_2d95ba31","line":54,"updated":"2015-06-18 18:19:30.000000000","message":"Can\u0027t Barbican authorize on the roles? Groups are just a mechanism to facilitate role assignments.","commit_id":"cc0391ceca03fd7d665ee9ef453a305606c5c263"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"6c00ff7e0cb71337d39f1dff2378820055075234","unresolved":false,"context_lines":[{"line_number":51,"context_line":"  IDs to services via a ``X-Group-Ids`` header (per the middleware\u0027s prevailing"},{"line_number":52,"context_line":"  conventions). The primary consumer of that new data would be Barbican, which"},{"line_number":53,"context_line":"  has expressed an interest_ in adding user group support to its per-secret"},{"line_number":54,"context_line":"  access control lists (ACLs_) since the Kilo time frame."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":".. _interest: https://github.com/openstack/barbican-specs/blob/eb5fc837e5ac6e569eac654a268f04668dc6dc8c/specs/kilo/add-per-secret-policy.rst#rest-api-impact"},{"line_number":57,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_434fa233","line":54,"in_reply_to":"fa32b979_2d95ba31","updated":"2015-06-18 23:14:06.000000000","message":"Barbican does uses project roles for authorization. Need for ACL came up for following reasons.\n1) There was functionality requested where some users want to make their keys private from users who may have necessary project roles to access otherwise. So ACL are created which have list of userids to allow access to keys/certs. \n2) Also there was need for system level users to access keys across projects or some service users who can access specific keys across multiple projects. This is more like service account which can have access if user part of ACL userids (and does not necessarily need to have roles in all those projects).\n\nMore details are available in barbican spec: http://specs.openstack.org/openstack/barbican-specs/specs/kilo/add-per-secret-policy.html#problem-description\n\nIMHO, these kind of access can be better managed via groups instead of having specific userids.","commit_id":"cc0391ceca03fd7d665ee9ef453a305606c5c263"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e081ac02428659b06db2f8c373ccff53323d7446","unresolved":false,"context_lines":[{"line_number":63,"context_line":"The proposed change would impact two API responses, ``POST /v3/auth/tokens``"},{"line_number":64,"context_line":"and ``GET /v3/auth/tokens``. Specifically, a ``groups`` attribute would be"},{"line_number":65,"context_line":"added to each response body in identical fashion, enumerating all groups that"},{"line_number":66,"context_line":"user belongs to."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Alternatives"},{"line_number":69,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_cdcf6e27","line":66,"updated":"2015-06-18 18:19:30.000000000","message":"I think we should avoid token bloat as much as possible. If this is a corner case, we should think about a separate API, the same approach as making service catalog optional. i.e.\n\n  GET /v3/auth/tokens/groups\n\nThis would return all the groups associated with the calling token\u0027s scope.","commit_id":"cc0391ceca03fd7d665ee9ef453a305606c5c263"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"6c00ff7e0cb71337d39f1dff2378820055075234","unresolved":false,"context_lines":[{"line_number":63,"context_line":"The proposed change would impact two API responses, ``POST /v3/auth/tokens``"},{"line_number":64,"context_line":"and ``GET /v3/auth/tokens``. Specifically, a ``groups`` attribute would be"},{"line_number":65,"context_line":"added to each response body in identical fashion, enumerating all groups that"},{"line_number":66,"context_line":"user belongs to."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Alternatives"},{"line_number":69,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_23485ecb","line":66,"in_reply_to":"fa32b979_cdcf6e27","updated":"2015-06-18 23:14:06.000000000","message":"It primarily ids so not sure how many group ids are considered large. May be have some configurable upper limit.","commit_id":"cc0391ceca03fd7d665ee9ef453a305606c5c263"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e081ac02428659b06db2f8c373ccff53323d7446","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Remote services such as Barbican could make additional calls to keystone to"},{"line_number":72,"context_line":"discover group memberships to implement their desired behaviors, but this would"},{"line_number":73,"context_line":"incur additional network chattiness, additional resources to cache, etc."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Additionally, the current status quo for revocation events is to issue"},{"line_number":76,"context_line":"revocation events for every user in a group whenever a group-specific event"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_0d4d5699","line":73,"updated":"2015-06-18 18:19:30.000000000","message":"Can Barbican authorize on roles?","commit_id":"cc0391ceca03fd7d665ee9ef453a305606c5c263"},{"author":{"_account_id":7789,"name":"John Wood","email":"john.wood@rackspace.com","username":"woodster"},"change_message_id":"77967c542dee30ea9df307b234700149aba29833","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Remote services such as Barbican could make additional calls to keystone to"},{"line_number":72,"context_line":"discover group memberships to implement their desired behaviors, but this would"},{"line_number":73,"context_line":"incur additional network chattiness, additional resources to cache, etc."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Additionally, the current status quo for revocation events is to issue"},{"line_number":76,"context_line":"revocation events for every user in a group whenever a group-specific event"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_489c080e","line":73,"in_reply_to":"fa32b979_0d4d5699","updated":"2015-06-23 16:26:03.000000000","message":"Hello guang-yee, are you asking if Barbican has the ability to add a role to the ACL? If so, that could be tricky if using the standard barbican:xxxx sort of roles. For example if a user has a barbican:observer role they can\u0027t decrypt a give secret. However, if the \u0027barbican:observer\u0027 role is added to the ACL for a given secret would that imply they could decrypt that secret?","commit_id":"cc0391ceca03fd7d665ee9ef453a305606c5c263"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e081ac02428659b06db2f8c373ccff53323d7446","unresolved":false,"context_lines":[{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Additionally, the current status quo for revocation events is to issue"},{"line_number":76,"context_line":"revocation events for every user in a group whenever a group-specific event"},{"line_number":77,"context_line":"occurs."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Security Impact"},{"line_number":80,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_0dbf9661","line":77,"updated":"2015-06-18 18:19:30.000000000","message":"In most productions, group membership is highly static.","commit_id":"cc0391ceca03fd7d665ee9ef453a305606c5c263"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4b27acb7ef35761ce0d121251101fdf34fd89b09","unresolved":false,"context_lines":[{"line_number":40,"context_line":"revocation events than is theoretically necessary. With the inclusion of user"},{"line_number":41,"context_line":"groups in token validation responses, only one revocation event (referencing"},{"line_number":42,"context_line":"the impacted group ID) would have to be issued. This is primarily a performance"},{"line_number":43,"context_line":"and user experience improvement."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"Second, it would allow ``keystonemiddleware.auth_token`` to expose a client\u0027s"},{"line_number":46,"context_line":"group IDs to services via a ``X-Group-Ids`` header (per the middleware\u0027s"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_a5230858","line":43,"updated":"2015-06-25 18:55:21.000000000","message":"Are we also changing v2 tokens? If not, then v2 tokens aren\u0027t going to be revoked properly.","commit_id":"1262312a9e8aa6c83b177801ac226d5ca2c68d30"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4b27acb7ef35761ce0d121251101fdf34fd89b09","unresolved":false,"context_lines":[{"line_number":126,"context_line":"Developer Impact"},{"line_number":127,"context_line":"----------------"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"* Clients will be have access to their group memberships."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa32b979_c5cc0cbe","line":129,"updated":"2015-06-25 18:55:21.000000000","message":"what is \"their\" referring to?","commit_id":"1262312a9e8aa6c83b177801ac226d5ca2c68d30"}]}