)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"efddc9a5322ac05e230b8284148f6ff8bbe74340","unresolved":false,"context_lines":[{"line_number":11,"context_line":"url-safe names."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Co-Authored-By: Adam Young \u003cayoung@redhat.com\u003e"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Change-Id: I00c43a542b915695be025a288e8387358e1277ea"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"ba8a016a_5602f2b5","line":14,"updated":"2015-11-20 16:24:59.000000000","message":"it\u0027s missing Implementes: bp \u003cname\u003e","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b07e89d189a4bc316f709861ed4693f29114707d","unresolved":false,"context_lines":[{"line_number":11,"context_line":"url-safe names."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Co-Authored-By: Adam Young \u003cayoung@redhat.com\u003e"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Change-Id: I00c43a542b915695be025a288e8387358e1277ea"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"ba8a016a_a7051515","line":14,"in_reply_to":"ba8a016a_5602f2b5","updated":"2015-11-21 10:26:47.000000000","message":"oops, yes, thx","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"}],"specs/mitaka/url-safe-names.rst":[{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"466fc88646d6a3974f4b8dff7edebbe76b8d4ce9","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Once upon a time, in a release far away, there were just tenants in a flat"},{"line_number":22,"context_line":"namespace. It was natural that tenant names had to be unique keystone-wide."},{"line_number":23,"context_line":"Subsequently we have added domains (to hold tenants, now called projects),"},{"line_number":24,"context_line":"which meant that project names had only to be unqiue within that domain. We"},{"line_number":25,"context_line":"now support hierarchies of projects (within a domain) and potentially may"},{"line_number":26,"context_line":"support hierarchies of domains above projects. However, our name uniqueness"},{"line_number":27,"context_line":"rules have not changed, so a project name must (effectively) be unique within"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_62864d67","line":24,"updated":"2015-11-20 18:36:01.000000000","message":"typo: unique","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fd838c162fce0169493b5c31b8ba77862c225bd3","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Once upon a time, in a release far away, there were just tenants in a flat"},{"line_number":22,"context_line":"namespace. It was natural that tenant names had to be unique keystone-wide."},{"line_number":23,"context_line":"Subsequently we have added domains (to hold tenants, now called projects),"},{"line_number":24,"context_line":"which meant that project names had only to be unqiue within that domain. We"},{"line_number":25,"context_line":"now support hierarchies of projects (within a domain) and potentially may"},{"line_number":26,"context_line":"support hierarchies of domains above projects. However, our name uniqueness"},{"line_number":27,"context_line":"rules have not changed, so a project name must (effectively) be unique within"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_6a762d40","line":24,"in_reply_to":"ba8a016a_62864d67","updated":"2015-11-24 17:13:33.000000000","message":"Done","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"718f241215b95e2823b5b0812aff09075d962753","unresolved":false,"context_lines":[{"line_number":47,"context_line":"                    \"domain\": {"},{"line_number":48,"context_line":"                        \"name\": \"acme.com\""},{"line_number":49,"context_line":"                    },"},{"line_number":50,"context_line":"                    \"name\": \"development/sas/myproject\""},{"line_number":51,"context_line":"                }"},{"line_number":52,"context_line":"            }"},{"line_number":53,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_90880524","line":50,"updated":"2015-11-23 21:34:44.000000000","message":"The paragraph above and this example seem a bit confusing to me. In my opinion, making all names URL-safe will allow us to pick a character to be the separator of project names, # for example.\n\nThis way, we could do parent#child#grandchild when requesting a token by project name.\n\nThis example with / is basically the same, but slash is url-safe, so  names may contain it. That said, we should pick another separator.\n\nIf this isn\u0027t why we are introducing these checks for url-safe, I don\u0027t know what that buy us.","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"8d4a0f0f010bcbb4534901828d6779f0fcc75d0a","unresolved":false,"context_lines":[{"line_number":47,"context_line":"                    \"domain\": {"},{"line_number":48,"context_line":"                        \"name\": \"acme.com\""},{"line_number":49,"context_line":"                    },"},{"line_number":50,"context_line":"                    \"name\": \"development/sas/myproject\""},{"line_number":51,"context_line":"                }"},{"line_number":52,"context_line":"            }"},{"line_number":53,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_fe82d6c7","line":50,"in_reply_to":"9a8ffd7b_47656443","updated":"2015-11-24 18:23:15.000000000","message":"Yep, I was thinking about any text that can go in a URL, but actually it doens\u0027t include the separators, special characters, etc \n\nIn my test, I used urllib.quote(str) to make it URL-safe, but it this case I think we\u0027d need to do urllib.quote_plus(str) to make a name url-safe.\n\nThanks for clarifying","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fd838c162fce0169493b5c31b8ba77862c225bd3","unresolved":false,"context_lines":[{"line_number":47,"context_line":"                    \"domain\": {"},{"line_number":48,"context_line":"                        \"name\": \"acme.com\""},{"line_number":49,"context_line":"                    },"},{"line_number":50,"context_line":"                    \"name\": \"development/sas/myproject\""},{"line_number":51,"context_line":"                }"},{"line_number":52,"context_line":"            }"},{"line_number":53,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_47656443","line":50,"in_reply_to":"ba8a016a_90880524","updated":"2015-11-24 17:13:33.000000000","message":"\u0027/\u0027 is a reserved character in urls isn\u0027t it? (just like \u0027?\u0027 ) See: http://www.ietf.org/rfc/rfc3986.txt","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"718f241215b95e2823b5b0812aff09075d962753","unresolved":false,"context_lines":[{"line_number":67,"context_line":"projects and domains. In particular, we would:"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"- Deprecate non url-safe naming, so deprecation warnings would be logged for"},{"line_number":70,"context_line":"  unsafe names"},{"line_number":71,"context_line":"- Provide a keystone-manage option to list any unsafe projects or domains."},{"line_number":72,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":73,"context_line":"  enable enforcement. These would be off by default, and if enabled would"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_7aa2224d","line":70,"updated":"2015-11-23 21:34:44.000000000","message":"Same note as below from Lance:\n\nnit: url-unsafe?","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fd838c162fce0169493b5c31b8ba77862c225bd3","unresolved":false,"context_lines":[{"line_number":67,"context_line":"projects and domains. In particular, we would:"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"- Deprecate non url-safe naming, so deprecation warnings would be logged for"},{"line_number":70,"context_line":"  unsafe names"},{"line_number":71,"context_line":"- Provide a keystone-manage option to list any unsafe projects or domains."},{"line_number":72,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":73,"context_line":"  enable enforcement. These would be off by default, and if enabled would"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_2a2b45ed","line":70,"in_reply_to":"ba8a016a_7aa2224d","updated":"2015-11-24 17:13:33.000000000","message":"Done","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7033b07e9d731dac1acb063b960037e91caa3f41","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"- Deprecate non url-safe naming, so deprecation warnings would be logged for"},{"line_number":70,"context_line":"  unsafe names"},{"line_number":71,"context_line":"- Provide a keystone-manage option to list any unsafe projects or domains."},{"line_number":72,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":73,"context_line":"  enable enforcement. These would be off by default, and if enabled would"},{"line_number":74,"context_line":"  prevent the creation of an unsafely-named projects/domains. Further any"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_8e1230b3","line":71,"updated":"2015-11-23 19:19:37.000000000","message":"nit: url-unsafe?","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fd838c162fce0169493b5c31b8ba77862c225bd3","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"- Deprecate non url-safe naming, so deprecation warnings would be logged for"},{"line_number":70,"context_line":"  unsafe names"},{"line_number":71,"context_line":"- Provide a keystone-manage option to list any unsafe projects or domains."},{"line_number":72,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":73,"context_line":"  enable enforcement. These would be off by default, and if enabled would"},{"line_number":74,"context_line":"  prevent the creation of an unsafely-named projects/domains. Further any"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_ea345d4b","line":71,"in_reply_to":"ba8a016a_8e1230b3","updated":"2015-11-24 17:13:33.000000000","message":"Done","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"718f241215b95e2823b5b0812aff09075d962753","unresolved":false,"context_lines":[{"line_number":72,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":73,"context_line":"  enable enforcement. These would be off by default, and if enabled would"},{"line_number":74,"context_line":"  prevent the creation of an unsafely-named projects/domains. Further any"},{"line_number":75,"context_line":"  existing unsafely-named projects/domains would be treated as being disabled,"},{"line_number":76,"context_line":"  and would not be available for scoped tokens."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Future keystone releases would harden the above, moving towards a situation"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_3a081a2d","line":75,"updated":"2015-11-23 21:34:44.000000000","message":"Disabled for token issuance purposes right ? Or do you mean the entity itself would be disabled ?\n\nIf it\u0027s the former, maybe clarifying it is for token issuance purposes.\n\nIf it\u0027s the latter, how would we detect the option\u003d\u003dtrue and disable all the projects that don\u0027t meet the criteria?","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fd838c162fce0169493b5c31b8ba77862c225bd3","unresolved":false,"context_lines":[{"line_number":72,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":73,"context_line":"  enable enforcement. These would be off by default, and if enabled would"},{"line_number":74,"context_line":"  prevent the creation of an unsafely-named projects/domains. Further any"},{"line_number":75,"context_line":"  existing unsafely-named projects/domains would be treated as being disabled,"},{"line_number":76,"context_line":"  and would not be available for scoped tokens."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Future keystone releases would harden the above, moving towards a situation"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_aa6df533","line":75,"in_reply_to":"ba8a016a_3a081a2d","updated":"2015-11-24 17:13:33.000000000","message":"Done","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"466fc88646d6a3974f4b8dff7edebbe76b8d4ce9","unresolved":false,"context_lines":[{"line_number":73,"context_line":"  enable enforcement. These would be off by default, and if enabled would"},{"line_number":74,"context_line":"  prevent the creation of an unsafely-named projects/domains. Further any"},{"line_number":75,"context_line":"  existing unsafely-named projects/domains would be treated as being disabled,"},{"line_number":76,"context_line":"  and would not be available for scoped tokens."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Future keystone releases would harden the above, moving towards a situation"},{"line_number":79,"context_line":"when the configuration options are eventually deprecated and url-safe naming"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_62308d9f","line":76,"updated":"2015-11-20 18:36:01.000000000","message":"scoped tokens by name, right? And wouldn\u0027t it be better if it was set on by default? So in new deploys we probably wouldn\u0027t need to care about those unsafe names","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"50b4b0ccde4c01bb8ff4b99c877766f340c2511f","unresolved":false,"context_lines":[{"line_number":73,"context_line":"  enable enforcement. These would be off by default, and if enabled would"},{"line_number":74,"context_line":"  prevent the creation of an unsafely-named projects/domains. Further any"},{"line_number":75,"context_line":"  existing unsafely-named projects/domains would be treated as being disabled,"},{"line_number":76,"context_line":"  and would not be available for scoped tokens."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Future keystone releases would harden the above, moving towards a situation"},{"line_number":79,"context_line":"when the configuration options are eventually deprecated and url-safe naming"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_e70b1d2a","line":76,"in_reply_to":"ba8a016a_62308d9f","updated":"2015-11-21 10:25:58.000000000","message":"I did consider two sets of switches, e.g.:\n\nenforce_new_project_names_url_safe\nenforce_all_project_names_url_safe\nenforce_new_domain_names_url_safe\nenforce_all_domain_names_url_safe\n\nAnd you could argue that the \"new\" options would be on by default, the \"all\" options off by default. However, my concern is that people may have naming schemes they are currently working with which would stop working at an upgrade","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"718f241215b95e2823b5b0812aff09075d962753","unresolved":false,"context_lines":[{"line_number":73,"context_line":"  enable enforcement. These would be off by default, and if enabled would"},{"line_number":74,"context_line":"  prevent the creation of an unsafely-named projects/domains. Further any"},{"line_number":75,"context_line":"  existing unsafely-named projects/domains would be treated as being disabled,"},{"line_number":76,"context_line":"  and would not be available for scoped tokens."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"Future keystone releases would harden the above, moving towards a situation"},{"line_number":79,"context_line":"when the configuration options are eventually deprecated and url-safe naming"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_ba664a27","line":76,"in_reply_to":"ba8a016a_e70b1d2a","updated":"2015-11-23 21:34:44.000000000","message":"Henry: ++","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"718f241215b95e2823b5b0812aff09075d962753","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":"New features we release, for example domain hierarchies for resellers, could"},{"line_number":83,"context_line":"insist that the appropriate url-safe configuration option was enabled before"},{"line_number":84,"context_line":"that feature was supported."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"To be clear, this proposal does not enable the actual use of hierarchical"},{"line_number":87,"context_line":"naming, rather it lays the groundwork for us to do so in the future."}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_55092f2b","line":84,"updated":"2015-11-23 21:34:44.000000000","message":"++","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"efddc9a5322ac05e230b8284148f6ff8bbe74340","unresolved":false,"context_lines":[{"line_number":89,"context_line":"Alternatives"},{"line_number":90,"context_line":"------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"None"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Data Model Impact"},{"line_number":95,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_56ac328c","line":92,"updated":"2015-11-20 16:24:59.000000000","message":"how about adding another attribute project_name_encoded where urlsafe project name would be stored? Would it help anyhow?","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"50b4b0ccde4c01bb8ff4b99c877766f340c2511f","unresolved":false,"context_lines":[{"line_number":89,"context_line":"Alternatives"},{"line_number":90,"context_line":"------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"None"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Data Model Impact"},{"line_number":95,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_871c9178","line":92,"in_reply_to":"ba8a016a_56ac328c","updated":"2015-11-21 10:25:58.000000000","message":"I\u0027m not suggesting we store both....just that we only allow safe names","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"1f240a1455983a8e60b7d59307b47ba4cea73bbc","unresolved":false,"context_lines":[{"line_number":89,"context_line":"Alternatives"},{"line_number":90,"context_line":"------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"None"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Data Model Impact"},{"line_number":95,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_d4cc6163","line":92,"in_reply_to":"ba8a016a_871c9178","updated":"2015-11-23 12:30:59.000000000","message":"that\u0027s why it\u0027s in the alternatives.","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"718f241215b95e2823b5b0812aff09075d962753","unresolved":false,"context_lines":[{"line_number":89,"context_line":"Alternatives"},{"line_number":90,"context_line":"------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"None"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Data Model Impact"},{"line_number":95,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_9588f723","line":92,"in_reply_to":"ba8a016a_d4cc6163","updated":"2015-11-23 21:34:44.000000000","message":"I don\u0027t think it could help. For example, two projects with names \"#project-1\" and \"%23project-1\" would be allowed, as they have unique names within their domain.\n\nHowever, they would have the same project_name_encoded that couldn\u0027t be used for, let\u0027s say get a token, as they are not unique.","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"466fc88646d6a3974f4b8dff7edebbe76b8d4ce9","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"REST API Impact"},{"line_number":100,"context_line":"---------------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"None"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_a28f55cb","line":101,"updated":"2015-11-20 18:36:01.000000000","message":"Isn\u0027t the schema going to be modified? Seems like an impact to me","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7033b07e9d731dac1acb063b960037e91caa3f41","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"REST API Impact"},{"line_number":100,"context_line":"---------------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"None"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_8e60f036","line":101,"in_reply_to":"ba8a016a_67172d55","updated":"2015-11-23 19:19:37.000000000","message":"Are we talking the schema on the data layer or the jsonschema api validation?\n\nThe jsonschema api validation stuff would have to change if you wanted to build a regular expression into it [0]. Which could possibly be exposed through configs.\n\n\n[0] http://spacetelescope.github.io/understanding-json-schema/reference/regular_expressions.html#example","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fd838c162fce0169493b5c31b8ba77862c225bd3","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"REST API Impact"},{"line_number":100,"context_line":"---------------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"None"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_2ad02553","line":101,"in_reply_to":"ba8a016a_8e60f036","updated":"2015-11-24 17:13:33.000000000","message":"Lance, agreed - although this would only be relevant at the time we actually chose to support specifying (or searching) via the \"url name\"","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"50b4b0ccde4c01bb8ff4b99c877766f340c2511f","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"REST API Impact"},{"line_number":100,"context_line":"---------------"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"None"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_67172d55","line":101,"in_reply_to":"ba8a016a_a28f55cb","updated":"2015-11-21 10:25:58.000000000","message":"I don\u0027t think the scheme is modified...unless you mean that we will now allow certain characters? But that\u0027s not a schema mod.","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7033b07e9d731dac1acb063b960037e91caa3f41","unresolved":false,"context_lines":[{"line_number":125,"context_line":"---------------------"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"None, by default, although would require them to potentially rename projects"},{"line_number":128,"context_line":"or domains if they want to start enforcing url-safe naming."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Developer Impact"},{"line_number":131,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_4e444873","line":128,"updated":"2015-11-23 19:19:37.000000000","message":"Would deployers have to do this step if they have the \n\n    enforce_new_project_names_url_safe \u003d True\n    enforce_new_domain_names_url_safe \u003d True\n\nTo me, those options sound like you can have project and domain names that don\u0027t fit the convention in your deployment, but all new domains and projects you create must adhere to the new url-safe naming scheme.\n\nMaybe this should be something that is all or nothing? If you want to enfore url-safe naming of project and domains, you must rename all projects and domains that aren\u0027t url-safe before you can turn it on. Seems to make the deployment a little more clear and keeps less configuration options in keystone?","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"718f241215b95e2823b5b0812aff09075d962753","unresolved":false,"context_lines":[{"line_number":125,"context_line":"---------------------"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"None, by default, although would require them to potentially rename projects"},{"line_number":128,"context_line":"or domains if they want to start enforcing url-safe naming."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Developer Impact"},{"line_number":131,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_9531d70d","line":128,"in_reply_to":"ba8a016a_4e444873","updated":"2015-11-23 21:34:44.000000000","message":"Hmm, I think this makes sense to me.It could be a good idea too.\n\nIn this case, one would run keystone-manage to check if all the projects/domains are url safe.\n\nIn the case they are, it\u0027s safe to enable the _all_ options. Otherwise, the unsafe ocurrences must be fixed before enabling the options, otherwise that would cause auth to fail.","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fd838c162fce0169493b5c31b8ba77862c225bd3","unresolved":false,"context_lines":[{"line_number":125,"context_line":"---------------------"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"None, by default, although would require them to potentially rename projects"},{"line_number":128,"context_line":"or domains if they want to start enforcing url-safe naming."},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"Developer Impact"},{"line_number":131,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a8ffd7b_2abca56b","line":128,"in_reply_to":"ba8a016a_4e444873","updated":"2015-11-24 17:13:33.000000000","message":"Yeah, I tend to agree with you - that keep it to an all or nothing approach is less confusing.","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":10046,"name":"Henrique Truta","email":"henrique@lsd.ufcg.edu.br","username":"henriquetruta"},"change_message_id":"466fc88646d6a3974f4b8dff7edebbe76b8d4ce9","unresolved":false,"context_lines":[{"line_number":147,"context_line":"- Add deprecation logging"},{"line_number":148,"context_line":"- Add checking in create/update domain/project"},{"line_number":149,"context_line":"- Add checking in auth to prevent scoping to unsafe entities"},{"line_number":150,"context_line":"- Add support to keystone-manage for listing unsafely-named domains/projects"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"Dependencies"},{"line_number":153,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_22a36551","line":150,"updated":"2015-11-20 18:36:01.000000000","message":"What about add support to make them safe with a command? Replacing it with a \u0027-\u0027, for example","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7033b07e9d731dac1acb063b960037e91caa3f41","unresolved":false,"context_lines":[{"line_number":147,"context_line":"- Add deprecation logging"},{"line_number":148,"context_line":"- Add checking in create/update domain/project"},{"line_number":149,"context_line":"- Add checking in auth to prevent scoping to unsafe entities"},{"line_number":150,"context_line":"- Add support to keystone-manage for listing unsafely-named domains/projects"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"Dependencies"},{"line_number":153,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_e12f4d86","line":150,"in_reply_to":"ba8a016a_22a36551","updated":"2015-11-23 19:19:37.000000000","message":"I like the idea of building something that translates the url-unsafe name to a url-safe name, but I\u0027m on the fence if it should be done automatically?\n\nMaybe it\u0027s just something as simple as finding all names that aren\u0027t url-safe and \"suggests\" names to change them to.","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"718f241215b95e2823b5b0812aff09075d962753","unresolved":false,"context_lines":[{"line_number":147,"context_line":"- Add deprecation logging"},{"line_number":148,"context_line":"- Add checking in create/update domain/project"},{"line_number":149,"context_line":"- Add checking in auth to prevent scoping to unsafe entities"},{"line_number":150,"context_line":"- Add support to keystone-manage for listing unsafely-named domains/projects"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"Dependencies"},{"line_number":153,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba8a016a_95eeb789","line":150,"in_reply_to":"ba8a016a_e12f4d86","updated":"2015-11-23 21:34:44.000000000","message":"Yeah, or perhaps saying what characters make them unsafe; kind of \"get ride of these characters\".","commit_id":"23087e336f5e0ffd568187b56d08573b5faa19b8"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"e23b3ed2667e5d1bdb933f0387ff8c906d238932","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"However, our current project and domain names are not url-safe, so we could not"},{"line_number":60,"context_line":"guarantee to support any particular hierarchical naming scheme without risk of"},{"line_number":61,"context_line":"breaking access to strangely named projects/domains."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Proposed Change"},{"line_number":64,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a8ffd7b_c39b68c8","line":61,"updated":"2015-11-25 04:59:04.000000000","message":"How url unsafely project/domain names could break access to strangely named projects/domains? what\u0027s the consequence if got access to those unwanted projects or domains?","commit_id":"0b6625fbc03b6733cc67696d55231c30bad2c13a"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d253dfabc4efedd5d7098aaf87c4721297253cf","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":"However, our current project and domain names are not url-safe, so we could not"},{"line_number":60,"context_line":"guarantee to support any particular hierarchical naming scheme without risk of"},{"line_number":61,"context_line":"breaking access to strangely named projects/domains."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Proposed Change"},{"line_number":64,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a8ffd7b_bf2bcc81","line":61,"in_reply_to":"9a8ffd7b_c39b68c8","updated":"2015-11-25 09:15:30.000000000","message":"So today we don\u0027t try and use the domain or project names for hierarchical purposes - we might in the future. The only place where we really use the names in the url is in the query parameters.  I guess it\u0027s possible that today you could cause the inability to were by name by choosing a weird name. In which case, this proposal would avoid that.","commit_id":"0b6625fbc03b6733cc67696d55231c30bad2c13a"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"e23b3ed2667e5d1bdb933f0387ff8c906d238932","unresolved":false,"context_lines":[{"line_number":66,"context_line":"It is proposed that we lay the groundwork to move to url-safe naming for all"},{"line_number":67,"context_line":"projects and domains. In particular, we would:"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"- Deprecate url-unsafe naming, so deprecation warnings would be logged for"},{"line_number":70,"context_line":"  unsafe names"},{"line_number":71,"context_line":"- Provide a keystone-manage option to list any url-unsafe projects or domains."},{"line_number":72,"context_line":"- Provide two configuration options (one for projects and one for domains) to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a8ffd7b_a3cf44af","line":69,"updated":"2015-11-25 04:59:04.000000000","message":"which kind of name is url-unsafe should be well documented, or just follow rfc1738?","commit_id":"0b6625fbc03b6733cc67696d55231c30bad2c13a"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d253dfabc4efedd5d7098aaf87c4721297253cf","unresolved":false,"context_lines":[{"line_number":66,"context_line":"It is proposed that we lay the groundwork to move to url-safe naming for all"},{"line_number":67,"context_line":"projects and domains. In particular, we would:"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"- Deprecate url-unsafe naming, so deprecation warnings would be logged for"},{"line_number":70,"context_line":"  unsafe names"},{"line_number":71,"context_line":"- Provide a keystone-manage option to list any url-unsafe projects or domains."},{"line_number":72,"context_line":"- Provide two configuration options (one for projects and one for domains) to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a8ffd7b_bc943a37","line":69,"in_reply_to":"9a8ffd7b_a3cf44af","updated":"2015-11-25 09:15:30.000000000","message":"Done","commit_id":"0b6625fbc03b6733cc67696d55231c30bad2c13a"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"e23b3ed2667e5d1bdb933f0387ff8c906d238932","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"- Deprecate url-unsafe naming, so deprecation warnings would be logged for"},{"line_number":70,"context_line":"  unsafe names"},{"line_number":71,"context_line":"- Provide a keystone-manage option to list any url-unsafe projects or domains."},{"line_number":72,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":73,"context_line":"  enable enforcement. These would be off by default, and if enabled would"},{"line_number":74,"context_line":"  prevent the creation of an unsafely-named projects/domains."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a8ffd7b_a32bc42f","line":71,"updated":"2015-11-25 04:59:04.000000000","message":"Do we want keystone-mange do anything about url-unsafe project/domains? or just use it to show some info? state more clear how we can leverage these info might be nice.","commit_id":"0b6625fbc03b6733cc67696d55231c30bad2c13a"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d253dfabc4efedd5d7098aaf87c4721297253cf","unresolved":false,"context_lines":[{"line_number":68,"context_line":""},{"line_number":69,"context_line":"- Deprecate url-unsafe naming, so deprecation warnings would be logged for"},{"line_number":70,"context_line":"  unsafe names"},{"line_number":71,"context_line":"- Provide a keystone-manage option to list any url-unsafe projects or domains."},{"line_number":72,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":73,"context_line":"  enable enforcement. These would be off by default, and if enabled would"},{"line_number":74,"context_line":"  prevent the creation of an unsafely-named projects/domains."}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a8ffd7b_5c998e6d","line":71,"in_reply_to":"9a8ffd7b_a32bc42f","updated":"2015-11-25 09:15:30.000000000","message":"Done","commit_id":"0b6625fbc03b6733cc67696d55231c30bad2c13a"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"e23b3ed2667e5d1bdb933f0387ff8c906d238932","unresolved":false,"context_lines":[{"line_number":75,"context_line":"- Once the corresponding config option is enabled, any existing"},{"line_number":76,"context_line":"  unsafely-named projects or domains will be treated as disabled for"},{"line_number":77,"context_line":"  the purposes of issuing a token scoped by project/domain name."},{"line_number":78,"context_line":"  Renaming the  project or domain will re-enable it."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Future keystone releases would harden the above, moving towards a situation"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a8ffd7b_83dd6044","line":78,"updated":"2015-11-25 04:59:04.000000000","message":"remove the extra space before \u0027project\u0027.","commit_id":"0b6625fbc03b6733cc67696d55231c30bad2c13a"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d253dfabc4efedd5d7098aaf87c4721297253cf","unresolved":false,"context_lines":[{"line_number":75,"context_line":"- Once the corresponding config option is enabled, any existing"},{"line_number":76,"context_line":"  unsafely-named projects or domains will be treated as disabled for"},{"line_number":77,"context_line":"  the purposes of issuing a token scoped by project/domain name."},{"line_number":78,"context_line":"  Renaming the  project or domain will re-enable it."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Future keystone releases would harden the above, moving towards a situation"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a8ffd7b_3ccfea57","line":78,"in_reply_to":"9a8ffd7b_83dd6044","updated":"2015-11-25 09:15:30.000000000","message":"Done","commit_id":"0b6625fbc03b6733cc67696d55231c30bad2c13a"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"e23b3ed2667e5d1bdb933f0387ff8c906d238932","unresolved":false,"context_lines":[{"line_number":107,"context_line":"Security Impact"},{"line_number":108,"context_line":"---------------"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"None"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Notifications Impact"},{"line_number":113,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a8ffd7b_c3ba88e1","line":110,"updated":"2015-11-25 04:59:04.000000000","message":"Is this a security enhancement as what is said in \"Problem Description\"?","commit_id":"0b6625fbc03b6733cc67696d55231c30bad2c13a"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7d253dfabc4efedd5d7098aaf87c4721297253cf","unresolved":false,"context_lines":[{"line_number":107,"context_line":"Security Impact"},{"line_number":108,"context_line":"---------------"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"None"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Notifications Impact"},{"line_number":113,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a8ffd7b_3c24ca0b","line":110,"in_reply_to":"9a8ffd7b_c3ba88e1","updated":"2015-11-25 09:15:30.000000000","message":"I don\u0027t think it fixes any current security issue, rather it enables us to better. more manageable naming rules.","commit_id":"0b6625fbc03b6733cc67696d55231c30bad2c13a"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"f3bbfd9c1f37a404d7232b265ebf8d7227282f41","unresolved":false,"context_lines":[{"line_number":66,"context_line":"It is proposed that we lay the groundwork to move to url-safe naming for all"},{"line_number":67,"context_line":"projects and domains. url-safe names are those that adhere to"},{"line_number":68,"context_line":"`rfc3986 \u003chttp://tools.ietf.org/html/rfc3986\u003e_`, i.e. do not contain any of the"},{"line_number":69,"context_line":"reserved charcaters described in section 2.2 of that specification."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"In particular, we would:"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_eab98f7a","line":69,"updated":"2015-11-25 11:18:40.000000000","message":"(typo) characters","commit_id":"b8dcc78119ee3a8f594ae14cd7f2493bf43485df"},{"author":{"_account_id":17026,"name":"Sean Perry","email":"sean.perry@hpe.com","username":"sean_perry"},"change_message_id":"91a13a9e9d4653eeaa82ed1aec9c3f9e82550738","unresolved":false,"context_lines":[{"line_number":66,"context_line":"It is proposed that we lay the groundwork to move to url-safe naming for all"},{"line_number":67,"context_line":"projects and domains. url-safe names are those that adhere to"},{"line_number":68,"context_line":"`rfc3986 \u003chttp://tools.ietf.org/html/rfc3986\u003e_`, i.e. do not contain any of the"},{"line_number":69,"context_line":"reserved charcaters described in section 2.2 of that specification."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"In particular, we would:"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_2c56b35c","line":69,"updated":"2015-11-25 19:38:34.000000000","message":"There is a minor disconnect between \"not any reserved\" and the RFCs list of \"unreserved\". Specifically, the RFC does not allow a letter outside of A-Za-z. IOW English letters only. Is this our intent as well?","commit_id":"b8dcc78119ee3a8f594ae14cd7f2493bf43485df"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"f3bbfd9c1f37a404d7232b265ebf8d7227282f41","unresolved":false,"context_lines":[{"line_number":71,"context_line":"In particular, we would:"},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"- Deprecate url-unsafe naming, so deprecation warnings would be logged for"},{"line_number":74,"context_line":"  unsafe names. _"},{"line_number":75,"context_line":"- Provide a keystone-manage option to list the ID and name of any url-unsafe"},{"line_number":76,"context_line":"  projects or domains, so that such names can subsequently be updated using the"},{"line_number":77,"context_line":"  regular Identity API."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_ea3e6fd9","line":74,"updated":"2015-11-25 11:18:40.000000000","message":"(nit) Remove the leading \u0027 _\u0027","commit_id":"b8dcc78119ee3a8f594ae14cd7f2493bf43485df"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"f3bbfd9c1f37a404d7232b265ebf8d7227282f41","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  regular Identity API."},{"line_number":78,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":79,"context_line":"  enable enforcement. These would be off by default, and if enabled would"},{"line_number":80,"context_line":"  prevent the creation of an unsafely-named projects/domains."},{"line_number":81,"context_line":"- Once the corresponding config option is enabled, any existing"},{"line_number":82,"context_line":"  unsafely-named projects or domains will be treated as disabled for"},{"line_number":83,"context_line":"  the purposes of issuing a token scoped by project/domain name."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_2d2a517f","line":80,"updated":"2015-11-25 11:18:40.000000000","message":"(nit) Remove \u0027an \u0027","commit_id":"b8dcc78119ee3a8f594ae14cd7f2493bf43485df"},{"author":{"_account_id":17026,"name":"Sean Perry","email":"sean.perry@hpe.com","username":"sean_perry"},"change_message_id":"91a13a9e9d4653eeaa82ed1aec9c3f9e82550738","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  regular Identity API."},{"line_number":78,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":79,"context_line":"  enable enforcement. These would be off by default, and if enabled would"},{"line_number":80,"context_line":"  prevent the creation of an unsafely-named projects/domains."},{"line_number":81,"context_line":"- Once the corresponding config option is enabled, any existing"},{"line_number":82,"context_line":"  unsafely-named projects or domains will be treated as disabled for"},{"line_number":83,"context_line":"  the purposes of issuing a token scoped by project/domain name."}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_4cff7734","line":80,"updated":"2015-11-25 19:38:34.000000000","message":"As discussed on IRC, replace this with a ternary. Off -\u003e Enforce on new only -\u003e Strict, Enforce on all.","commit_id":"b8dcc78119ee3a8f594ae14cd7f2493bf43485df"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"f3bbfd9c1f37a404d7232b265ebf8d7227282f41","unresolved":false,"context_lines":[{"line_number":81,"context_line":"- Once the corresponding config option is enabled, any existing"},{"line_number":82,"context_line":"  unsafely-named projects or domains will be treated as disabled for"},{"line_number":83,"context_line":"  the purposes of issuing a token scoped by project/domain name."},{"line_number":84,"context_line":"  Renaming the project or domain will re-enable it."},{"line_number":85,"context_line":""},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Future keystone releases would harden the above, moving towards a situation"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a8ffd7b_0d750d97","line":84,"updated":"2015-11-25 11:18:40.000000000","message":"Cool, so that means we don\u0027t effectively disable entities, we rather consider them as disabled at auth time when they don\u0027t pass the url-safe check","commit_id":"b8dcc78119ee3a8f594ae14cd7f2493bf43485df"},{"author":{"_account_id":17026,"name":"Sean Perry","email":"sean.perry@hpe.com","username":"sean_perry"},"change_message_id":"511867887507b9bf79e291a4bc112c0db00d65f1","unresolved":false,"context_lines":[{"line_number":66,"context_line":"It is proposed that we lay the groundwork to move to url-safe naming for all"},{"line_number":67,"context_line":"projects and domains. url-safe names are those that adhere to"},{"line_number":68,"context_line":"`rfc3986 \u003chttp://tools.ietf.org/html/rfc3986\u003e_`, i.e. do not contain any of the"},{"line_number":69,"context_line":"reserved charcaters described in section 2.2 of that specification."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"In particular, we would:"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a8ffd7b_377efc19","line":69,"updated":"2015-11-25 19:54:43.000000000","message":"Still needs clarification over allowed characters WRT non-English letters. The \"unreserved\" list is not the same as the \"not in the reserved list\".","commit_id":"6b95f77c444cf10ac6dbac986cd6a691e24e5caf"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b55b308d9313b711da7e1b7a179b46d4d262cdc1","unresolved":false,"context_lines":[{"line_number":66,"context_line":"It is proposed that we lay the groundwork to move to url-safe naming for all"},{"line_number":67,"context_line":"projects and domains. url-safe names are those that adhere to"},{"line_number":68,"context_line":"`rfc3986 \u003chttp://tools.ietf.org/html/rfc3986\u003e_`, i.e. do not contain any of the"},{"line_number":69,"context_line":"reserved charcaters described in section 2.2 of that specification."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"In particular, we would:"},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a8ffd7b_9d0d54ea","line":69,"in_reply_to":"9a8ffd7b_377efc19","updated":"2015-11-26 16:04:17.000000000","message":"Done","commit_id":"6b95f77c444cf10ac6dbac986cd6a691e24e5caf"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"7a0bd53f7375587967e09287346f961527be9f40","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  projects or domains, so that such names can subsequently be updated using the"},{"line_number":77,"context_line":"  regular Identity API."},{"line_number":78,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":79,"context_line":"  enable enforcement.  These would accept three values: `off`, `new`, `strict`."},{"line_number":80,"context_line":"  These would be `off` by default, which means no change in behavior."},{"line_number":81,"context_line":"- If set to `new` then a request to create a new domain or project"},{"line_number":82,"context_line":"  with a name that does not match the url safe criteria will be"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a8ffd7b_24320c60","line":79,"updated":"2015-11-26 20:19:36.000000000","message":"So we decided to get back again with this vs the all or nothing, as proposed by Lance.","commit_id":"8fa87f0523a0d6b8e7d09dc0d0d110782c528b39"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"93e06fcf6b3c37acc483af350202615daa9adbac","unresolved":false,"context_lines":[{"line_number":76,"context_line":"  projects or domains, so that such names can subsequently be updated using the"},{"line_number":77,"context_line":"  regular Identity API."},{"line_number":78,"context_line":"- Provide two configuration options (one for projects and one for domains) to"},{"line_number":79,"context_line":"  enable enforcement.  These would accept three values: `off`, `new`, `strict`."},{"line_number":80,"context_line":"  These would be `off` by default, which means no change in behavior."},{"line_number":81,"context_line":"- If set to `new` then a request to create a new domain or project"},{"line_number":82,"context_line":"  with a name that does not match the url safe criteria will be"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a8ffd7b_96567c28","line":79,"in_reply_to":"9a8ffd7b_24320c60","updated":"2015-11-27 09:58:57.000000000","message":"Yes, that appeared to the result of an IRC discussion...tri-state is better than two separate sets of config options I think.","commit_id":"8fa87f0523a0d6b8e7d09dc0d0d110782c528b39"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"7a0bd53f7375587967e09287346f961527be9f40","unresolved":false,"context_lines":[{"line_number":84,"context_line":"- If the configuration option is set to `strict`, any existing"},{"line_number":85,"context_line":"  unsafely-named domains or projects will be treated as disabled for"},{"line_number":86,"context_line":"  the purposes of issuing a token scoped by project/domain name."},{"line_number":87,"context_line":"  Renaming the project or domain will re-enable it."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Future keystone releases would harden the above, moving towards a situation"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a8ffd7b_444710bc","line":87,"updated":"2015-11-26 20:19:36.000000000","message":"(nit) Does \u0027strict\u0027 implies in \u0027new\u0027? i.e strict also causes requests to create new resources with invalid names to fail?\n\nI think so, perhaps it would be good to make it clear.","commit_id":"8fa87f0523a0d6b8e7d09dc0d0d110782c528b39"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"93e06fcf6b3c37acc483af350202615daa9adbac","unresolved":false,"context_lines":[{"line_number":84,"context_line":"- If the configuration option is set to `strict`, any existing"},{"line_number":85,"context_line":"  unsafely-named domains or projects will be treated as disabled for"},{"line_number":86,"context_line":"  the purposes of issuing a token scoped by project/domain name."},{"line_number":87,"context_line":"  Renaming the project or domain will re-enable it."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Future keystone releases would harden the above, moving towards a situation"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a8ffd7b_36479078","line":87,"in_reply_to":"9a8ffd7b_444710bc","updated":"2015-11-27 09:58:57.000000000","message":"Done","commit_id":"8fa87f0523a0d6b8e7d09dc0d0d110782c528b39"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"a939bd4f57e46f71b578d4ab35e8df61031cbda1","unresolved":false,"context_lines":[{"line_number":33,"context_line":"onerous on customers. Not only for customer with deep project hierarchies,"},{"line_number":34,"context_line":"but also will complicate any support for domain hierarchies for resellers."},{"line_number":35,"context_line":"In the future it would be ideal if you could address a node in a hierarchy with"},{"line_number":36,"context_line":"a url-style addressing scheme, for example:"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"::"},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a8ffd7b_8e16254a","line":36,"updated":"2015-11-30 09:10:06.000000000","message":"+1 for url-style addressing scheme","commit_id":"7435bc9f58bb9f4f875da6ddfe63bac456b4dd47"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d67a61bf2283a4b1835f2c64f01508d213a7a591","unresolved":false,"context_lines":[{"line_number":110,"context_line":"None"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"REST API Impact"},{"line_number":113,"context_line":"---------------"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"None"},{"line_number":116,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a8ffd7b_6373a1b5","line":113,"updated":"2015-12-01 07:06:52.000000000","message":"Changes to the Identity API to clarify naming.? Returning 400 if name is not URL safe?","commit_id":"7435bc9f58bb9f4f875da6ddfe63bac456b4dd47"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"11669527ba6682bd77152aeb308bca37cf7686a2","unresolved":false,"context_lines":[{"line_number":110,"context_line":"None"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"REST API Impact"},{"line_number":113,"context_line":"---------------"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"None"},{"line_number":116,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a8ffd7b_0000f964","line":113,"in_reply_to":"9a8ffd7b_6373a1b5","updated":"2015-12-03 09:02:38.000000000","message":"I agree that\u0027s what would happen - if I have to update this spec, I\u0027ll add that.","commit_id":"7435bc9f58bb9f4f875da6ddfe63bac456b4dd47"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"63879f16b73e878563d5b0df961dfbaa808f5391","unresolved":false,"context_lines":[{"line_number":158,"context_line":""},{"line_number":159,"context_line":"- Add support for new configuration options"},{"line_number":160,"context_line":"- Add deprecation logging"},{"line_number":161,"context_line":"- Add checking in create/update domain/project"},{"line_number":162,"context_line":"- Add checking in auth to prevent scoping to unsafe entities"},{"line_number":163,"context_line":"- Add support to keystone-manage for listing unsafely-named domains/projects"},{"line_number":164,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a8ffd7b_f956d45c","line":161,"updated":"2015-12-03 06:40:09.000000000","message":"i suppose creating several nested projects is out of scope for this work?\n\nlike if i attempted to create project with name:\n\n  steve/is/awesome\n\nit would just create one project right now? but in the future we want to be able to use this exact string to pick out the \"awesome\" project?\n\nare we working ourselves into a corner?","commit_id":"7435bc9f58bb9f4f875da6ddfe63bac456b4dd47"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"11669527ba6682bd77152aeb308bca37cf7686a2","unresolved":false,"context_lines":[{"line_number":158,"context_line":""},{"line_number":159,"context_line":"- Add support for new configuration options"},{"line_number":160,"context_line":"- Add deprecation logging"},{"line_number":161,"context_line":"- Add checking in create/update domain/project"},{"line_number":162,"context_line":"- Add checking in auth to prevent scoping to unsafe entities"},{"line_number":163,"context_line":"- Add support to keystone-manage for listing unsafely-named domains/projects"},{"line_number":164,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"9a8ffd7b_e095b531","line":161,"in_reply_to":"9a8ffd7b_f956d45c","updated":"2015-12-03 09:02:38.000000000","message":"so yes, one goal is to enable creating nested project that way (and authing to them as well).  I am proposing a separate bp, to backlog, that shows how we would use this for that (i.e. it will require you to have enabled strict mode for project naming)\n\nToday, without any url safe checking, I think you can create a project called \"steve/is/awesome\" - and that\u0027s what we would store in the DB as the name (rather than assuming the name was \"awesome\" under the project called \"is\").  This would would be flagged up as unsafe if you ran the keystone manage command proposed in this bp - and would have to be changed to enable strict mode. If you enabled \"new\" or \"strict\" mode, any new request to create such a project would fail with just this bp implemented. \n\nSo I don\u0027t think we are painting ourselves into a corner - rather we are painting ourselves out of the corner!","commit_id":"7435bc9f58bb9f4f875da6ddfe63bac456b4dd47"}]}