)]}'
{"api/v3/identity-api-v3-os-federation-ext.rst":[{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"2c576aa780bf59719884893fd0ce9afb2a76c2a3","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Corresponding to Identity API v3.5 release."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- Add IDP specific websso routes."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"API Resources"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a50d1a3_ee5368e0","line":48,"updated":"2015-07-29 02:24:51.000000000","message":"Use \"IdP\" for consistency with the rest of the doc","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4444908694d262a88d37a544d96c1268c9d15e29","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Corresponding to Identity API v3.5 release."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- Add IDP specific websso routes."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"API Resources"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa1b9901_a51d2c75","line":48,"in_reply_to":"1a4dcd0f_9e7a0287","updated":"2015-08-18 05:50:26.000000000","message":"++","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"567c70354d48e26634ac6512780bc1341cbfbab0","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Corresponding to Identity API v3.5 release."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- Add IDP specific websso routes."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"API Resources"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_9e7a0287","line":48,"in_reply_to":"3a50d1a3_ee5368e0","updated":"2015-08-07 00:27:07.000000000","message":"really, we shouldn\u0027t be abbreviating anything using insider terminology... but that\u0027s perhaps outside the scope of this change","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4444908694d262a88d37a544d96c1268c9d15e29","unresolved":false,"context_lines":[{"line_number":1496,"context_line":""},{"line_number":1497,"context_line":"    GET /OS-FEDERATION/identity_providers/{idp_id}/protocol/{protocol_id}/websso?origin\u003dhttps%3A//horizon.example.com"},{"line_number":1498,"context_line":""},{"line_number":1499,"context_line":"In contrast to the above websso route that works for every registered identity"},{"line_number":1500,"context_line":"provider this route instigates a websso authentication that is specific to the"},{"line_number":1501,"context_line":"specified identity provider and protocol specified in the URL. Keystone will"},{"line_number":1502,"context_line":"issue JavaScript that handles redirections in the same way as the other route."}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa1b9901_85182886","line":1499,"updated":"2015-08-18 05:50:26.000000000","message":"suggest:\n\n\"In contrast to the above route, this route begins a Web Single Sign On request that is specific to the supplied Identity Provider and Protocol\"?","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"1abbdf002a9e487b960ee8fda0caf7bc2281189c","unresolved":false,"context_lines":[{"line_number":1496,"context_line":""},{"line_number":1497,"context_line":"    GET /OS-FEDERATION/identity_providers/{idp_id}/protocol/{protocol_id}/websso?origin\u003dhttps%3A//horizon.example.com"},{"line_number":1498,"context_line":""},{"line_number":1499,"context_line":"In contrast to the above websso route that works for every registered identity"},{"line_number":1500,"context_line":"provider this route instigates a websso authentication that is specific to the"},{"line_number":1501,"context_line":"specified identity provider and protocol specified in the URL. Keystone will"},{"line_number":1502,"context_line":"issue JavaScript that handles redirections in the same way as the other route."}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa1b9901_3fb3fa99","line":1499,"in_reply_to":"fa1b9901_85182886","updated":"2015-08-20 13:43:34.000000000","message":"Done","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"173608f75dbfaa6e1dbf436d5a5522b06a342987","unresolved":false,"context_lines":[{"line_number":1498,"context_line":""},{"line_number":1499,"context_line":"In contrast to the above websso route that works for every registered identity"},{"line_number":1500,"context_line":"provider this route instigates a websso authentication that is specific to the"},{"line_number":1501,"context_line":"specified identity provider and protocol specified in the URL. Keystone will"},{"line_number":1502,"context_line":"issue JavaScript that handles redirections in the same way as the other route."},{"line_number":1503,"context_line":"An unscoped federated token will be included in the form being sent."},{"line_number":1504,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_1ee6f214","line":1501,"updated":"2015-08-07 00:43:58.000000000","message":"i use specific three times in this sentence","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3022472267d5dcb96aff5abe2385648ea74849f7","unresolved":false,"context_lines":[{"line_number":1498,"context_line":""},{"line_number":1499,"context_line":"In contrast to the above websso route that works for every registered identity"},{"line_number":1500,"context_line":"provider this route instigates a websso authentication that is specific to the"},{"line_number":1501,"context_line":"specified identity provider and protocol specified in the URL. Keystone will"},{"line_number":1502,"context_line":"issue JavaScript that handles redirections in the same way as the other route."},{"line_number":1503,"context_line":"An unscoped federated token will be included in the form being sent."},{"line_number":1504,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_6af16b94","line":1501,"in_reply_to":"1a4dcd0f_1ee6f214","updated":"2015-08-07 07:21:05.000000000","message":"did you have anything specific in mind? :-)","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"544fee4d9594355e7bae1050724876a1601d5c9c","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Corresponding to Identity API v3.5 release."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- Add IDP specific websso routes."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"API Resources"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_4eddda6d","line":48,"updated":"2015-08-20 02:22:33.000000000","message":"IDP -\u003e use Identity provider (comment  from previous patchset)","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Corresponding to Identity API v3.5 release."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"- Add IDP specific websso routes."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"API Resources"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_9b3c7ac9","line":48,"in_reply_to":"fa1b9901_4eddda6d","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"4f6f9674fc53d4f7fc146b67713e931261d3098b","unresolved":false,"context_lines":[{"line_number":1494,"context_line":""},{"line_number":1495,"context_line":"::"},{"line_number":1496,"context_line":""},{"line_number":1497,"context_line":"    GET /OS-FEDERATION/identity_providers/{idp_id}/protocol/{protocol_id}/websso?origin\u003dhttps%3A//horizon.example.com"},{"line_number":1498,"context_line":""},{"line_number":1499,"context_line":""},{"line_number":1500,"context_line":"In contrast to the above route, this route begins a Web Single Sign On request"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_4e54fa51","line":1497,"updated":"2015-08-20 02:34:43.000000000","message":"/auth at the beginning?","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":1494,"context_line":""},{"line_number":1495,"context_line":"::"},{"line_number":1496,"context_line":""},{"line_number":1497,"context_line":"    GET /OS-FEDERATION/identity_providers/{idp_id}/protocol/{protocol_id}/websso?origin\u003dhttps%3A//horizon.example.com"},{"line_number":1498,"context_line":""},{"line_number":1499,"context_line":""},{"line_number":1500,"context_line":"In contrast to the above route, this route begins a Web Single Sign On request"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_e4c64d67","line":1497,"in_reply_to":"fa1b9901_4e54fa51","updated":"2015-08-20 03:38:16.000000000","message":"++","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":1494,"context_line":""},{"line_number":1495,"context_line":"::"},{"line_number":1496,"context_line":""},{"line_number":1497,"context_line":"    GET /OS-FEDERATION/identity_providers/{idp_id}/protocol/{protocol_id}/websso?origin\u003dhttps%3A//horizon.example.com"},{"line_number":1498,"context_line":""},{"line_number":1499,"context_line":""},{"line_number":1500,"context_line":"In contrast to the above route, this route begins a Web Single Sign On request"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_db06721b","line":1497,"in_reply_to":"fa1b9901_4e54fa51","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"}],"specs/liberty/federation-idp-websso.rst":[{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"ebfb3f439b6618607c5b260eade5b533fd26cb69","unresolved":false,"context_lines":[{"line_number":8,"context_line":"IDP Specific WebSSO"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp example \u003chttps://blueprints.launchpad.net/keystone/+spec/federation-idp-websso\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Currently the way keystone handles websso is global for each protocol in the"},{"line_number":14,"context_line":"keystone instance. This requires some form of web page discovery service"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a41bdd9_6cca7d51","line":11,"updated":"2015-07-17 22:11:26.000000000","message":"bp federation-idp-websso","commit_id":"f1de8bcf01d9b21d8b4c43bc60d9ef6d7ed148c8"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"7044807fe5bf79a18d3f9a8aecb61beda27f9899","unresolved":false,"context_lines":[{"line_number":8,"context_line":"IDP Specific WebSSO"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp example \u003chttps://blueprints.launchpad.net/keystone/+spec/federation-idp-websso\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Currently the way keystone handles websso is global for each protocol in the"},{"line_number":14,"context_line":"keystone instance. This requires some form of web page discovery service"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_88312def","line":11,"in_reply_to":"9a41bdd9_6cca7d51","updated":"2015-07-20 07:54:44.000000000","message":"Done","commit_id":"f1de8bcf01d9b21d8b4c43bc60d9ef6d7ed148c8"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"2c576aa780bf59719884893fd0ce9afb2a76c2a3","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"IDP Specific WebSSO"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp federation-idp-websso \u003chttps://blueprints.launchpad.net/keystone/+spec/federation-idp-websso\u003e`_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a50d1a3_ae8a4019","line":8,"updated":"2015-07-29 02:24:51.000000000","message":"Isn\u0027t IDP supposed to be IdP? most of the previous docs are using IdP","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"be860d97107638638bfb6d72bf867a6194dc622d","unresolved":false,"context_lines":[{"line_number":17,"context_line":"In more simplistic deployments I want to be able to configure multiple saml"},{"line_number":18,"context_line":"providers that can be selected from the horizon drop down menu rather than an"},{"line_number":19,"context_line":"additional service."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem Description"},{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_96665eb9","line":20,"updated":"2015-08-07 08:52:31.000000000","message":"For the saml scenario should be possible to use horizon as Discovery and providing the id of the IdP to use for the authentication. You do not need to redirect to a different urls which make difficult to configure and manage in a dynamic environment.\n\n(See https://blogs.oracle.com/dcarru/entry/implementing_an_idp_discovery_service for details on the discovery protocol in SAML. The DS just send the ID of the IdP so should not be a problem to implement it in horizon)\n\n\nIf other supported protocols (e.g. OpenID*) support the same possibility I would avoid the need for different urls per IdP.","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"8bda2c6d77857802440646888afb6055765dfd42","unresolved":false,"context_lines":[{"line_number":17,"context_line":"In more simplistic deployments I want to be able to configure multiple saml"},{"line_number":18,"context_line":"providers that can be selected from the horizon drop down menu rather than an"},{"line_number":19,"context_line":"additional service."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem Description"},{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_56bc56ba","line":20,"updated":"2015-08-07 08:55:34.000000000","message":"See also last section of https://wiki.surfnet.nl/display/surfconextdev/IDP+Discovery+-+WAYF","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"6f7a162ed7b45c5cc1660fa70c26f827320b932d","unresolved":false,"context_lines":[{"line_number":17,"context_line":"In more simplistic deployments I want to be able to configure multiple saml"},{"line_number":18,"context_line":"providers that can be selected from the horizon drop down menu rather than an"},{"line_number":19,"context_line":"additional service."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Problem Description"},{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_7e87fb60","line":20,"in_reply_to":"1a4dcd0f_96665eb9","updated":"2015-08-12 21:48:03.000000000","message":"I agree. This is the direction we have been going in","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"567c70354d48e26634ac6512780bc1341cbfbab0","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Problem Description"},{"line_number":22,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Currently WebSSO is configured in a global sense for keystone. You have to pick"},{"line_number":25,"context_line":"a handler for /v3/auth/OS-FEDERATION/websso with a single apache module, this"},{"line_number":26,"context_line":"route should offer some form of handler that will typically involve IDP"},{"line_number":27,"context_line":"discovery and selection that redirects to the actual IDP handler."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_3e564e06","line":24,"updated":"2015-08-07 00:27:07.000000000","message":":(","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"2c576aa780bf59719884893fd0ce9afb2a76c2a3","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"If your list of IDPs is fairly static it would be much better to simply have"},{"line_number":34,"context_line":"horizon handle this. It already has a drop down selection to enable you to"},{"line_number":35,"context_line":"select identity provider and it would be useful to be able to configure"},{"line_number":36,"context_line":"individual identity providers to show up there. I should be able to select"},{"line_number":37,"context_line":"google or facebook as my IDP and not care that they both use SAML from a"},{"line_number":38,"context_line":"keystone perspective."}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a50d1a3_8e5bc485","line":35,"updated":"2015-07-29 02:24:51.000000000","message":"right now, horizon only displays a drop down of list of protocols, not the IdP.  But yeah, I get what you mean, it should be by IdP and protocol.","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"6f7a162ed7b45c5cc1660fa70c26f827320b932d","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"If your list of IDPs is fairly static it would be much better to simply have"},{"line_number":34,"context_line":"horizon handle this. It already has a drop down selection to enable you to"},{"line_number":35,"context_line":"select identity provider and it would be useful to be able to configure"},{"line_number":36,"context_line":"individual identity providers to show up there. I should be able to select"},{"line_number":37,"context_line":"google or facebook as my IDP and not care that they both use SAML from a"},{"line_number":38,"context_line":"keystone perspective."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_dedf2f67","line":35,"in_reply_to":"3a50d1a3_8e5bc485","updated":"2015-08-12 21:48:03.000000000","message":"Actually from a user perspective, listing a protocol is meaningless. Users only need to see a list of organisations, and they can then pick their own. Anything else is too complicated for them. Determining the actual protocol should be done intelligently in the background by Horizon and or Apache/Keystoe","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"567c70354d48e26634ac6512780bc1341cbfbab0","unresolved":false,"context_lines":[{"line_number":35,"context_line":"select identity provider and it would be useful to be able to configure"},{"line_number":36,"context_line":"individual identity providers to show up there. I should be able to select"},{"line_number":37,"context_line":"google or facebook as my IDP and not care that they both use SAML from a"},{"line_number":38,"context_line":"keystone perspective."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Proposed Change"},{"line_number":41,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_9e53e216","line":38,"updated":"2015-08-07 00:27:07.000000000","message":"The only reason horizon should be exposing protocols to the end user is if a single IdP supports multiple protocols -- then the user has a reason to choose one.","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"6f7a162ed7b45c5cc1660fa70c26f827320b932d","unresolved":false,"context_lines":[{"line_number":35,"context_line":"select identity provider and it would be useful to be able to configure"},{"line_number":36,"context_line":"individual identity providers to show up there. I should be able to select"},{"line_number":37,"context_line":"google or facebook as my IDP and not care that they both use SAML from a"},{"line_number":38,"context_line":"keystone perspective."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Proposed Change"},{"line_number":41,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_1e3fd787","line":38,"in_reply_to":"1a4dcd0f_9e53e216","updated":"2015-08-12 21:48:03.000000000","message":"Disagree. If an organisation wants to support multiple protocols then its IdPs should have different names so that users know which name to pick. Users dont want or need to be burdened with protocols.","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"facc5c2523ace15cdbf8ccd07262f0cf237cbd70","unresolved":false,"context_lines":[{"line_number":44,"context_line":"similar handler at"},{"line_number":45,"context_line":"/v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id}/websso."},{"line_number":46,"context_line":"Rather than being dynamic, using remote-id to lookup the IDP that this relates"},{"line_number":47,"context_line":"to this route will be handled only by the IDP specified in the URL."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"This would allow the configuration of"},{"line_number":50,"context_line":"/v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id} that is"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_b9a75d0a","line":47,"updated":"2015-08-10 21:21:43.000000000","message":"This would result in essentially the same call as - \n\nhttps://github.com/openstack/keystone/blob/304c21fe4e5734ac5b26fd2837e4af727761b506/keystone/contrib/federation/routers.py#L80-L81\n\nbut you\u0027d be able to do it with the IdP id instead of just the protocol, right?","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"6c0317a7365f41cdc79c1ee04ccfa623c5b75a84","unresolved":false,"context_lines":[{"line_number":44,"context_line":"similar handler at"},{"line_number":45,"context_line":"/v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id}/websso."},{"line_number":46,"context_line":"Rather than being dynamic, using remote-id to lookup the IDP that this relates"},{"line_number":47,"context_line":"to this route will be handled only by the IDP specified in the URL."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"This would allow the configuration of"},{"line_number":50,"context_line":"/v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id} that is"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_bddc2047","line":47,"in_reply_to":"1a4dcd0f_b9a75d0a","updated":"2015-08-11 00:50:41.000000000","message":"right, i expect it would be almost exactly the same except you wouldn\u0027t need to lookup the idp_id via remote_ids:\n\nhttps://github.com/openstack/keystone/blob/304c21fe4e5734ac5b26fd2837e4af727761b506/keystone/contrib/federation/controllers.py#L313\n\nbecause that information would be in the URL.","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"facc5c2523ace15cdbf8ccd07262f0cf237cbd70","unresolved":false,"context_lines":[{"line_number":53,"context_line":"Alternatives"},{"line_number":54,"context_line":"------------"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"We could continue with the global approach."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Security Impact"},{"line_number":59,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_b9f51dee","line":56,"updated":"2015-08-10 21:21:43.000000000","message":"Which wouldn\u0027t allow for the case where you have multiple IdPs that use the same protocol that needs to be kept secret (i.e. the public cloud case from here http://lists.openstack.org/pipermail/openstack-dev/2015-August/071504.html )","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"6f7a162ed7b45c5cc1660fa70c26f827320b932d","unresolved":false,"context_lines":[{"line_number":53,"context_line":"Alternatives"},{"line_number":54,"context_line":"------------"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"We could continue with the global approach."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Security Impact"},{"line_number":59,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_7e093b94","line":56,"in_reply_to":"1a4dcd0f_b9f51dee","updated":"2015-08-12 21:48:03.000000000","message":"I have just commented on this email, as I think that the example is spurious.","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"2c576aa780bf59719884893fd0ce9afb2a76c2a3","unresolved":false,"context_lines":[{"line_number":121,"context_line":"  /v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id}/websso"},{"line_number":122,"context_line":"  path to keystone."},{"line_number":123,"context_line":"* Allow configuring django_openstack_auth to use an individual IDP websso"},{"line_number":124,"context_line":"  mechanism rather than the global endpoint."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Dependencies"},{"line_number":127,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a50d1a3_8e9ae460","line":124,"updated":"2015-07-29 02:24:51.000000000","message":"I can work on this if you need help.\n\nAside from django_openstack_auth, horizon changes are needed to expose the new setting that will allow operator to define the set of  IdP/protocols that will be exposed in the login screen to the user.","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"facc5c2523ace15cdbf8ccd07262f0cf237cbd70","unresolved":false,"context_lines":[{"line_number":136,"context_line":"References"},{"line_number":137,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"* https://bugs.launchpad.net/bugs/1472060"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a4dcd0f_d936e9b3","line":139,"updated":"2015-08-10 21:21:43.000000000","message":"convert this to a rst link","commit_id":"bcd0de1f9ccfd9438bd47d22bd926ea0ada31ae0"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Currently WebSSO is configured in a global sense for keystone. You have to pick"},{"line_number":25,"context_line":"a handler for /v3/auth/OS-FEDERATION/websso with a single apache module, this"},{"line_number":26,"context_line":"route should offer some form of handler that will typically involve IDP"},{"line_number":27,"context_line":"discovery and selection that redirects to the actual IDP handler."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"To handle multiple IDPs this relies on the apache module having discovery"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_e4abad73","line":26,"updated":"2015-08-20 03:38:16.000000000","message":"IdP","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Currently WebSSO is configured in a global sense for keystone. You have to pick"},{"line_number":25,"context_line":"a handler for /v3/auth/OS-FEDERATION/websso with a single apache module, this"},{"line_number":26,"context_line":"route should offer some form of handler that will typically involve IDP"},{"line_number":27,"context_line":"discovery and selection that redirects to the actual IDP handler."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"To handle multiple IDPs this relies on the apache module having discovery"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_3bf0cefd","line":26,"in_reply_to":"fa1b9901_e4abad73","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Currently WebSSO is configured in a global sense for keystone. You have to pick"},{"line_number":25,"context_line":"a handler for /v3/auth/OS-FEDERATION/websso with a single apache module, this"},{"line_number":26,"context_line":"route should offer some form of handler that will typically involve IDP"},{"line_number":27,"context_line":"discovery and selection that redirects to the actual IDP handler."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"To handle multiple IDPs this relies on the apache module having discovery"},{"line_number":30,"context_line":"capability and the deployer constructing a webpage that shows the available"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_04a9017b","line":27,"updated":"2015-08-20 03:38:16.000000000","message":"IdP","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":24,"context_line":"Currently WebSSO is configured in a global sense for keystone. You have to pick"},{"line_number":25,"context_line":"a handler for /v3/auth/OS-FEDERATION/websso with a single apache module, this"},{"line_number":26,"context_line":"route should offer some form of handler that will typically involve IDP"},{"line_number":27,"context_line":"discovery and selection that redirects to the actual IDP handler."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"To handle multiple IDPs this relies on the apache module having discovery"},{"line_number":30,"context_line":"capability and the deployer constructing a webpage that shows the available"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_dbf0b2ff","line":27,"in_reply_to":"fa1b9901_04a9017b","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":26,"context_line":"route should offer some form of handler that will typically involve IDP"},{"line_number":27,"context_line":"discovery and selection that redirects to the actual IDP handler."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"To handle multiple IDPs this relies on the apache module having discovery"},{"line_number":30,"context_line":"capability and the deployer constructing a webpage that shows the available"},{"line_number":31,"context_line":"alternatives."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_24a685ae","line":29,"updated":"2015-08-20 03:38:16.000000000","message":"IdP","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":26,"context_line":"route should offer some form of handler that will typically involve IDP"},{"line_number":27,"context_line":"discovery and selection that redirects to the actual IDP handler."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"To handle multiple IDPs this relies on the apache module having discovery"},{"line_number":30,"context_line":"capability and the deployer constructing a webpage that shows the available"},{"line_number":31,"context_line":"alternatives."},{"line_number":32,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_fbf576ec","line":29,"in_reply_to":"fa1b9901_24a685ae","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":30,"context_line":"capability and the deployer constructing a webpage that shows the available"},{"line_number":31,"context_line":"alternatives."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"If your list of IDPs is fairly static it would be much better to simply have"},{"line_number":34,"context_line":"horizon handle this. It already has a drop down selection to enable you to"},{"line_number":35,"context_line":"select identity provider and it would be useful to be able to configure"},{"line_number":36,"context_line":"individual identity providers to show up there. I should be able to select"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_64979d3a","line":33,"updated":"2015-08-20 03:38:16.000000000","message":"IdP","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":30,"context_line":"capability and the deployer constructing a webpage that shows the available"},{"line_number":31,"context_line":"alternatives."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"If your list of IDPs is fairly static it would be much better to simply have"},{"line_number":34,"context_line":"horizon handle this. It already has a drop down selection to enable you to"},{"line_number":35,"context_line":"select identity provider and it would be useful to be able to configure"},{"line_number":36,"context_line":"individual identity providers to show up there. I should be able to select"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_bbdcde73","line":33,"in_reply_to":"fa1b9901_64979d3a","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"544fee4d9594355e7bae1050724876a1601d5c9c","unresolved":false,"context_lines":[{"line_number":35,"context_line":"select identity provider and it would be useful to be able to configure"},{"line_number":36,"context_line":"individual identity providers to show up there. I should be able to select"},{"line_number":37,"context_line":"google or facebook as my IDP and not care that they both use SAML from a"},{"line_number":38,"context_line":"keystone perspective."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Proposed Change"},{"line_number":41,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_aea356b1","line":38,"updated":"2015-08-20 02:22:33.000000000","message":"There were some discussion on how horizon should represent the list of IdP and protocol.\n\nDavid Chadwick argued that we should only show IdP and hide the protocol since this is a technical detail that the user does not need to know. David:  \"If an organisation wants to support multiple protocols then its IdPs should have different names so that users know which name to pick. Users dont want or need to be burdened with protocols.\"\n\nJust wanted to close the loop for the horizon design? should we display IdP and Protocol in the dropdown for the initial implementation? Or just hide the protocol in the dropdown?","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":35,"context_line":"select identity provider and it would be useful to be able to configure"},{"line_number":36,"context_line":"individual identity providers to show up there. I should be able to select"},{"line_number":37,"context_line":"google or facebook as my IDP and not care that they both use SAML from a"},{"line_number":38,"context_line":"keystone perspective."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Proposed Change"},{"line_number":41,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_dbad1285","line":38,"in_reply_to":"fa1b9901_aea356b1","updated":"2015-08-20 13:54:58.000000000","message":"Horizon could also have a dedicated landing page for each customer that is looking to use federation, similar to this flow. http://goo.gl/q3RrFw\n\nwhere \"coke dashboard\" is technically Horizon, and since Horizon knows that the user used Coke Dashboard, they know which IdP to use in the federated authentication call.","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e5f2e7a39d2765efa172135ac34cf4fe30a4cbb5","unresolved":false,"context_lines":[{"line_number":35,"context_line":"select identity provider and it would be useful to be able to configure"},{"line_number":36,"context_line":"individual identity providers to show up there. I should be able to select"},{"line_number":37,"context_line":"google or facebook as my IDP and not care that they both use SAML from a"},{"line_number":38,"context_line":"keystone perspective."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Proposed Change"},{"line_number":41,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_0e736216","line":38,"in_reply_to":"fa1b9901_aea356b1","updated":"2015-08-20 02:33:29.000000000","message":"We need to be able to show both.  There are cases where a user needs to select which mechanism she wants to use.","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"In addition to the /v3/auth/OS-FEDERATION/websso/{protocol} path we add a"},{"line_number":44,"context_line":"similar handler at"},{"line_number":45,"context_line":"/v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id}/websso."},{"line_number":46,"context_line":"Rather than being dynamic, using remote-id to lookup the IDP that this relates"},{"line_number":47,"context_line":"to this route will be handled only by the IDP specified in the URL."},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_04c4a15c","line":45,"updated":"2015-08-20 03:38:16.000000000","message":"/v3/auth","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"In addition to the /v3/auth/OS-FEDERATION/websso/{protocol} path we add a"},{"line_number":44,"context_line":"similar handler at"},{"line_number":45,"context_line":"/v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id}/websso."},{"line_number":46,"context_line":"Rather than being dynamic, using remote-id to lookup the IDP that this relates"},{"line_number":47,"context_line":"to this route will be handled only by the IDP specified in the URL."},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_5bbca205","line":45,"in_reply_to":"fa1b9901_04c4a15c","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":47,"context_line":"to this route will be handled only by the IDP specified in the URL."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"This would allow the configuration of"},{"line_number":50,"context_line":"/v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id} that is"},{"line_number":51,"context_line":"done for the CLI to also handle the websso case."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_a4a375b1","line":50,"updated":"2015-08-20 03:38:16.000000000","message":"/v3/auth","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":47,"context_line":"to this route will be handled only by the IDP specified in the URL."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"This would allow the configuration of"},{"line_number":50,"context_line":"/v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id} that is"},{"line_number":51,"context_line":"done for the CLI to also handle the websso case."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_7bb96614","line":50,"in_reply_to":"fa1b9901_a4a375b1","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":59,"context_line":"---------------"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"This is more secure than the current approach. When websso requests return to"},{"line_number":62,"context_line":"keystone the global handler asserts that some configured apache module has"},{"line_number":63,"context_line":"verified the request. If I have both google and facebook saml providers I must"},{"line_number":64,"context_line":"validate against either of them and then we use the remote-ids parameter of a"},{"line_number":65,"context_line":"keystone IDP to ensure that the URL that issued the assertion is one of those"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_6480fdf7","line":62,"updated":"2015-08-20 03:38:16.000000000","message":"Apache*","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":59,"context_line":"---------------"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"This is more secure than the current approach. When websso requests return to"},{"line_number":62,"context_line":"keystone the global handler asserts that some configured apache module has"},{"line_number":63,"context_line":"verified the request. If I have both google and facebook saml providers I must"},{"line_number":64,"context_line":"validate against either of them and then we use the remote-ids parameter of a"},{"line_number":65,"context_line":"keystone IDP to ensure that the URL that issued the assertion is one of those"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_db5512c2","line":62,"in_reply_to":"fa1b9901_6480fdf7","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"This is more secure than the current approach. When websso requests return to"},{"line_number":62,"context_line":"keystone the global handler asserts that some configured apache module has"},{"line_number":63,"context_line":"verified the request. If I have both google and facebook saml providers I must"},{"line_number":64,"context_line":"validate against either of them and then we use the remote-ids parameter of a"},{"line_number":65,"context_line":"keystone IDP to ensure that the URL that issued the assertion is one of those"},{"line_number":66,"context_line":"already known and we discover mappings that way."}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_247f6516","line":63,"updated":"2015-08-20 03:38:16.000000000","message":"Google, Facebook, SAML","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"This is more secure than the current approach. When websso requests return to"},{"line_number":62,"context_line":"keystone the global handler asserts that some configured apache module has"},{"line_number":63,"context_line":"verified the request. If I have both google and facebook saml providers I must"},{"line_number":64,"context_line":"validate against either of them and then we use the remote-ids parameter of a"},{"line_number":65,"context_line":"keystone IDP to ensure that the URL that issued the assertion is one of those"},{"line_number":66,"context_line":"already known and we discover mappings that way."}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_fb5a56f1","line":63,"in_reply_to":"fa1b9901_247f6516","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":62,"context_line":"keystone the global handler asserts that some configured apache module has"},{"line_number":63,"context_line":"verified the request. If I have both google and facebook saml providers I must"},{"line_number":64,"context_line":"validate against either of them and then we use the remote-ids parameter of a"},{"line_number":65,"context_line":"keystone IDP to ensure that the URL that issued the assertion is one of those"},{"line_number":66,"context_line":"already known and we discover mappings that way."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"With this change we would have seperate URLs for instigating websso against"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_04726149","line":65,"updated":"2015-08-20 03:38:16.000000000","message":"IdP*","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":62,"context_line":"keystone the global handler asserts that some configured apache module has"},{"line_number":63,"context_line":"verified the request. If I have both google and facebook saml providers I must"},{"line_number":64,"context_line":"validate against either of them and then we use the remote-ids parameter of a"},{"line_number":65,"context_line":"keystone IDP to ensure that the URL that issued the assertion is one of those"},{"line_number":66,"context_line":"already known and we discover mappings that way."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"With this change we would have seperate URLs for instigating websso against"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_bb713e78","line":65,"in_reply_to":"fa1b9901_04726149","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":66,"context_line":"already known and we discover mappings that way."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"With this change we would have seperate URLs for instigating websso against"},{"line_number":69,"context_line":"google or facebook and the apache module is configured to only allow assertions"},{"line_number":70,"context_line":"from the configure remote IDP."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_a48a9519","line":69,"updated":"2015-08-20 03:38:16.000000000","message":"Google, Facebook, Apache, these are proper nouns","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":66,"context_line":"already known and we discover mappings that way."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"With this change we would have seperate URLs for instigating websso against"},{"line_number":69,"context_line":"google or facebook and the apache module is configured to only allow assertions"},{"line_number":70,"context_line":"from the configure remote IDP."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_5b6a6282","line":69,"in_reply_to":"fa1b9901_a48a9519","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"With this change we would have seperate URLs for instigating websso against"},{"line_number":69,"context_line":"google or facebook and the apache module is configured to only allow assertions"},{"line_number":70,"context_line":"from the configure remote IDP."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Notifications Impact"},{"line_number":73,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_049b4173","line":70,"updated":"2015-08-20 03:38:16.000000000","message":"IdP*","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"With this change we would have seperate URLs for instigating websso against"},{"line_number":69,"context_line":"google or facebook and the apache module is configured to only allow assertions"},{"line_number":70,"context_line":"from the configure remote IDP."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Notifications Impact"},{"line_number":73,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_1b070acb","line":70,"in_reply_to":"fa1b9901_049b4173","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Other End User Impact"},{"line_number":78,"context_line":"---------------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"This would be configured in django_openstack_auth. It would not be directly"},{"line_number":81,"context_line":"used by a user."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_4495b93c","line":80,"updated":"2015-08-20 03:38:16.000000000","message":"django_openstack_auth in backticks ``","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Other End User Impact"},{"line_number":78,"context_line":"---------------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"This would be configured in django_openstack_auth. It would not be directly"},{"line_number":81,"context_line":"used by a user."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"Performance Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_fb11f604","line":80,"in_reply_to":"fa1b9901_4495b93c","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":118,"context_line":"----------"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"* Add a"},{"line_number":121,"context_line":"  /v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id}/websso"},{"line_number":122,"context_line":"  path to keystone."},{"line_number":123,"context_line":"* Allow configuring django_openstack_auth to use an individual IDP websso"},{"line_number":124,"context_line":"  mechanism rather than the global endpoint."}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_c4a8e98f","line":121,"updated":"2015-08-20 03:38:16.000000000","message":"/v3/auth","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":118,"context_line":"----------"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"* Add a"},{"line_number":121,"context_line":"  /v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id}/websso"},{"line_number":122,"context_line":"  path to keystone."},{"line_number":123,"context_line":"* Allow configuring django_openstack_auth to use an individual IDP websso"},{"line_number":124,"context_line":"  mechanism rather than the global endpoint."}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_dbdaf24a","line":121,"in_reply_to":"fa1b9901_c4a8e98f","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8fe74960af72fe2965aff74bfef8479a28f9b968","unresolved":false,"context_lines":[{"line_number":120,"context_line":"* Add a"},{"line_number":121,"context_line":"  /v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id}/websso"},{"line_number":122,"context_line":"  path to keystone."},{"line_number":123,"context_line":"* Allow configuring django_openstack_auth to use an individual IDP websso"},{"line_number":124,"context_line":"  mechanism rather than the global endpoint."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_64a9dd8f","line":123,"updated":"2015-08-20 03:38:16.000000000","message":"django_openstack_auth in backticks ``","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"805271d357962696b268da26d28c12627c63e199","unresolved":false,"context_lines":[{"line_number":120,"context_line":"* Add a"},{"line_number":121,"context_line":"  /v3/OS-FEDERATION/identity_providers/{idp_ip}/protocol/{protocol_id}/websso"},{"line_number":122,"context_line":"  path to keystone."},{"line_number":123,"context_line":"* Allow configuring django_openstack_auth to use an individual IDP websso"},{"line_number":124,"context_line":"  mechanism rather than the global endpoint."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa1b9901_9be9dae8","line":123,"in_reply_to":"fa1b9901_64a9dd8f","updated":"2015-08-20 13:54:58.000000000","message":"Done","commit_id":"c33dfaf4bd9824e140846470392328b4885a5246"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"343a487a7b0e4df596e764f5191b6f48ed0977cf","unresolved":false,"context_lines":[{"line_number":34,"context_line":"horizon handle this. It already has a drop down selection to enable you to"},{"line_number":35,"context_line":"select identity provider and it would be useful to be able to configure"},{"line_number":36,"context_line":"individual identity providers to show up there. I should be able to select"},{"line_number":37,"context_line":"google or facebook as my IdP and not care that they both use SAML from a"},{"line_number":38,"context_line":"keystone perspective."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa1b9901_b1d07df7","line":37,"updated":"2015-08-20 14:28:44.000000000","message":"that they both do NOT use SAML","commit_id":"c0183fbc5667302e8777f9371bde3159897f819e"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"10c863332d19ee080bcfb3a6eb46fc490ac30554","unresolved":false,"context_lines":[{"line_number":34,"context_line":"horizon handle this. It already has a drop down selection to enable you to"},{"line_number":35,"context_line":"select identity provider and it would be useful to be able to configure"},{"line_number":36,"context_line":"individual identity providers to show up there. I should be able to select"},{"line_number":37,"context_line":"google or facebook as my IdP and not care that they both use SAML from a"},{"line_number":38,"context_line":"keystone perspective."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa1b9901_99f554ee","line":37,"in_reply_to":"fa1b9901_b1d07df7","updated":"2015-08-20 18:05:14.000000000","message":"Use proper noun for google, facebook","commit_id":"c0183fbc5667302e8777f9371bde3159897f819e"},{"author":{"_account_id":6534,"name":"David Chadwick","email":"d.w.chadwick@truetrust.co.uk","username":"d-w-chadwick"},"change_message_id":"343a487a7b0e4df596e764f5191b6f48ed0977cf","unresolved":false,"context_lines":[{"line_number":60,"context_line":""},{"line_number":61,"context_line":"This is more secure than the current approach. When websso requests return to"},{"line_number":62,"context_line":"keystone the global handler asserts that some configured Apache module has"},{"line_number":63,"context_line":"verified the request. If I have both Google and Facebook SAML providers I must"},{"line_number":64,"context_line":"validate against either of them and then we use the remote-ids parameter of a"},{"line_number":65,"context_line":"keystone IdP to ensure that the URL that issued the assertion is one of those"},{"line_number":66,"context_line":"already known and we discover mappings that way."}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa1b9901_517561f7","line":63,"updated":"2015-08-20 14:28:44.000000000","message":"delete SAML as they do not support SAML","commit_id":"c0183fbc5667302e8777f9371bde3159897f819e"}]}