)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"61de66475172c40c38e9ad65d9208e539a90402a","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Adam Young \u003cayoung@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2016-02-10 11:03:12 -0500"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Tokens with subset of catalog"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Request at token with a subset of the endpoints that would"},{"line_number":10,"context_line":"otherwise be assigned."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"3a57f1b5_b7653946","line":7,"updated":"2016-02-10 16:12:27.000000000","message":"Need to Rename this. Suggestions?","commit_id":"c2d3d87995d67c2f9a36f055a1e2eae1800bd651"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"61de66475172c40c38e9ad65d9208e539a90402a","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Tokens with subset of catalog"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Request at token with a subset of the endpoints that would"},{"line_number":10,"context_line":"otherwise be assigned."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I8725e9418f1e31bc0e05115df177d87f709fc06c"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":2,"id":"3a57f1b5_97c7dd11","line":9,"updated":"2016-02-10 16:12:27.000000000","message":"Does not match what is now happening.  Should read \"Only validate tokens if optional passed endpoint host matches\"","commit_id":"c2d3d87995d67c2f9a36f055a1e2eae1800bd651"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ab59bf50b6a93ef2deedc6356b41ffced14f9ce1","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Tokens with subset of catalog"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Request at token with a subset of the endpoints that would"},{"line_number":10,"context_line":"otherwise be assigned."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I8725e9418f1e31bc0e05115df177d87f709fc06c"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"5a9d85d2_92167953","line":9,"range":{"start_line":9,"start_character":0,"end_line":9,"end_character":17},"updated":"2016-06-21 16:01:34.000000000","message":"This seems to be talking about token issuance, while when reading the spec I understand it\u0027s about validation. I am confused, please expand this a bit more.\n\nIf this is for requesting the token, so how is the user supposed to know what endpoints he needs/should reach ?","commit_id":"53e203cc9ae0fe66621bd7a320933f54efa1b6e3"}],"api/v3/identity-api-v3.rst":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"4a6cad7fcee96deb2cbafd053e108b46f4253e5c","unresolved":false,"context_lines":[{"line_number":2201,"context_line":"    }"},{"line_number":2202,"context_line":""},{"line_number":2203,"context_line":""},{"line_number":2204,"context_line":"*New in version 3.7* A user may explicitly request a token with only a subset"},{"line_number":2205,"context_line":"of the endpoints associated with the project.  If the user does not specify,"},{"line_number":2206,"context_line":"all explicitly assigned endpoints are contained with in the token.  A subset"},{"line_number":2207,"context_line":"of the endpoints may be requested by specifying by an array of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a57f1b5_7b5ec313","line":2204,"updated":"2016-02-10 19:13:13.000000000","message":"We don\u0027t need all this. Endpoint controll should be done at the backend, not at the discretion of the end user. We are pushing too much complexity to the end users. The existing endpoint filtering API should be adequate.","commit_id":"c2d3d87995d67c2f9a36f055a1e2eae1800bd651"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"4a6cad7fcee96deb2cbafd053e108b46f4253e5c","unresolved":false,"context_lines":[{"line_number":2441,"context_line":""},{"line_number":2442,"context_line":"::"},{"line_number":2443,"context_line":""},{"line_number":2444,"context_line":"    GET /auth/tokens?endpoint\u003d{hostname:port}"},{"line_number":2445,"context_line":""},{"line_number":2446,"context_line":"Relationship:"},{"line_number":2447,"context_line":"``http://docs.openstack.org/api/openstack-identity/3/rel/auth_tokens``"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a57f1b5_9b97ff8f","line":2444,"range":{"start_line":2444,"start_character":21,"end_line":2444,"end_character":45},"updated":"2016-02-10 19:13:13.000000000","message":"endpoint\u003d{endpoint_filter}","commit_id":"c2d3d87995d67c2f9a36f055a1e2eae1800bd651"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8dce5deb1e2be65d2b90793585f4072b22dae8bb","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":4,"id":"1aa78d24_3a5c0625","updated":"2016-07-04 04:04:51.000000000","message":"i think you forgot to add in the API change","commit_id":"53e203cc9ae0fe66621bd7a320933f54efa1b6e3"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ab59bf50b6a93ef2deedc6356b41ffced14f9ce1","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"What\u0027s New in Version 3.7"},{"line_number":13,"context_line":"-------------------------"},{"line_number":14,"context_line":"- Validate a a token based on an endpoint association."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"What\u0027s New in Version 3.6"},{"line_number":17,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a9d85d2_1203a910","line":14,"range":{"start_line":14,"start_character":11,"end_line":14,"end_character":14},"updated":"2016-06-21 16:01:34.000000000","message":"double a","commit_id":"53e203cc9ae0fe66621bd7a320933f54efa1b6e3"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ab59bf50b6a93ef2deedc6356b41ffced14f9ce1","unresolved":false,"context_lines":[{"line_number":1984,"context_line":"behave the same as a token request with no scope, where the user has no"},{"line_number":1985,"context_line":"default project defined."},{"line_number":1986,"context_line":""},{"line_number":1987,"context_line":""},{"line_number":1988,"context_line":"Catalog Opt-Out"},{"line_number":1989,"context_line":"^^^^^^^^^^^^^^^"},{"line_number":1990,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a9d85d2_12d8c91c","line":1987,"updated":"2016-06-21 16:01:34.000000000","message":"unrelated","commit_id":"53e203cc9ae0fe66621bd7a320933f54efa1b6e3"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ab59bf50b6a93ef2deedc6356b41ffced14f9ce1","unresolved":false,"context_lines":[{"line_number":2200,"context_line":"        }"},{"line_number":2201,"context_line":"    }"},{"line_number":2202,"context_line":""},{"line_number":2203,"context_line":""},{"line_number":2204,"context_line":""},{"line_number":2205,"context_line":""},{"line_number":2206,"context_line":"Authentication failures"},{"line_number":2207,"context_line":"\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027\u0027"},{"line_number":2208,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a9d85d2_f2f9bd81","line":2205,"range":{"start_line":2203,"start_character":0,"end_line":2205,"end_character":0},"updated":"2016-06-21 16:01:34.000000000","message":"unrelated","commit_id":"53e203cc9ae0fe66621bd7a320933f54efa1b6e3"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ab59bf50b6a93ef2deedc6356b41ffced14f9ce1","unresolved":false,"context_lines":[{"line_number":2330,"context_line":"format as ``GET /auth/tokens``."},{"line_number":2331,"context_line":""},{"line_number":2332,"context_line":"The Identity service will return the exact same response as when the subject"},{"line_number":2333,"context_line":"token was issued by ``POST /auth/tokens?endpoint\u003d{hostname:port}``."},{"line_number":2334,"context_line":""},{"line_number":2335,"context_line":""},{"line_number":2336,"context_line":"Check token"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a9d85d2_35368fe6","line":2333,"range":{"start_line":2333,"start_character":20,"end_line":2333,"end_character":66},"updated":"2016-06-21 16:01:34.000000000","message":"this isn\u0027t detailed anywhere","commit_id":"53e203cc9ae0fe66621bd7a320933f54efa1b6e3"}],"specs/backlog/subset-catalog-tokens.rst":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"4a6cad7fcee96deb2cbafd053e108b46f4253e5c","unresolved":false,"context_lines":[{"line_number":46,"context_line":"load balancing.  They may provide different terms of service, such as access"},{"line_number":47,"context_line":"to more powerful hardware or security constraints.  A user should only be able"},{"line_number":48,"context_line":"to perform operations on that subset of endpoints that the deployer designates."},{"line_number":49,"context_line":"allowed."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":""},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a57f1b5_00715ee0","line":49,"range":{"start_line":49,"start_character":7,"end_line":49,"end_character":8},"updated":"2016-02-10 19:13:13.000000000","message":"Use Cases:\n\n1. I have a set of beta services such that only my beta customers should be able to see or access. Other customer need not know about them nor should they be aware of them as they have absolutely no access.\n\n2. I have a virtual region, which is represented as a set of services. This virtual region have a specific set of SLAs and therefore have different pricing structure. These services should only be accessible to customers who are currently subcribe to them. Other customers does not need to know about them nor do they have access to them. Keep in mind that all the users/customers are being managed by one Keystone.","commit_id":"c2d3d87995d67c2f9a36f055a1e2eae1800bd651"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b7d91b1d4527f7b7d8998c1d6a2565577eca44d9","unresolved":false,"context_lines":[{"line_number":57,"context_line":"endpoint that will use the token.  When endpoint filtering of the catalog"},{"line_number":58,"context_line":"is in effect, tokens will on be reported as valid if the validation requests"},{"line_number":59,"context_line":"come from endpoint that are within the subset allowed for the project scoped"},{"line_number":60,"context_line":"to the project."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a57f1b5_95bcb56d","line":60,"updated":"2016-02-10 16:39:25.000000000","message":"This will not work with validated token caching, as the tokens are cached directly which conveys they are valid. The only real answer is to place the allowed endpoints in the token body (same mechanism) which allows the endpoints to validate the token.","commit_id":"c2d3d87995d67c2f9a36f055a1e2eae1800bd651"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"4a6cad7fcee96deb2cbafd053e108b46f4253e5c","unresolved":false,"context_lines":[{"line_number":57,"context_line":"endpoint that will use the token.  When endpoint filtering of the catalog"},{"line_number":58,"context_line":"is in effect, tokens will on be reported as valid if the validation requests"},{"line_number":59,"context_line":"come from endpoint that are within the subset allowed for the project scoped"},{"line_number":60,"context_line":"to the project."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3a57f1b5_e0120262","line":60,"in_reply_to":"3a57f1b5_95bcb56d","updated":"2016-02-10 19:13:13.000000000","message":"This will work as the project-endpoint relationship is stored in the DB and managed by API.","commit_id":"c2d3d87995d67c2f9a36f055a1e2eae1800bd651"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ab59bf50b6a93ef2deedc6356b41ffced14f9ce1","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Problem Description"},{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"When a user requests a token today, that token has full access to all"},{"line_number":23,"context_line":"endpoints in a deployment."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"The principal of least privilege is well established.  In academia,"},{"line_number":26,"context_line":"the most cited paper on this,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a9d85d2_d222c100","line":23,"range":{"start_line":22,"start_character":0,"end_line":23,"end_character":26},"updated":"2016-06-21 16:01:34.000000000","message":"that\u0027s not true in all the cases, we support endpoint filtering","commit_id":"53e203cc9ae0fe66621bd7a320933f54efa1b6e3"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ab59bf50b6a93ef2deedc6356b41ffced14f9ce1","unresolved":false,"context_lines":[{"line_number":53,"context_line":"   to see or access. Other customer need not know about them nor should they be"},{"line_number":54,"context_line":"   aware of them as they have absolutely no access."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"2. I have a virtual region, which is represented as a set of services. This virtual"},{"line_number":57,"context_line":"   region have a specific set of SLAs and therefore have different pricing structure."},{"line_number":58,"context_line":"   These services should only be accessible to customers who are currently subcribe"},{"line_number":59,"context_line":"   to them. Other customers does not need to know about them nor do they have access"},{"line_number":60,"context_line":"   to them. Keep in mind that all the users/customers are being managed by one Keystone."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Proposed Change"},{"line_number":63,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a9d85d2_b2b73585","line":60,"range":{"start_line":56,"start_character":0,"end_line":60,"end_character":88},"updated":"2016-06-21 16:01:34.000000000","message":"Can\u0027t this be done with endpoint filtering ?","commit_id":"53e203cc9ae0fe66621bd7a320933f54efa1b6e3"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ab59bf50b6a93ef2deedc6356b41ffced14f9ce1","unresolved":false,"context_lines":[{"line_number":62,"context_line":"Proposed Change"},{"line_number":63,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Add an additional field to the token validation request that indicates the"},{"line_number":66,"context_line":"endpoint that will use the token.  When endpoint filtering of the catalog"},{"line_number":67,"context_line":"is in effect, tokens will on be reported as valid if the validation requests"},{"line_number":68,"context_line":"come from endpoint that are within the subset allowed for the project scoped"},{"line_number":69,"context_line":"to the project."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5a9d85d2_12e2899f","line":69,"range":{"start_line":65,"start_character":0,"end_line":69,"end_character":15},"updated":"2016-06-21 16:01:34.000000000","message":"Do endpoints know how they\u0027re represented in keystone ? (remember proxies, etc)\n\nIs this proposing to make endpoint binding checks ?","commit_id":"53e203cc9ae0fe66621bd7a320933f54efa1b6e3"}]}