)]}'
{"specs/backlog/federated-query-apis.rst":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"ac50b1046505d64e62e1becab4ad4ada91eec89a","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp fed-query \u003chttps://blueprints.launchpad.net/keystone/+spec/fed-query\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Add APIs for federation that allow the query of mapping results and,"},{"line_number":14,"context_line":"if necessary, prepopulation of the shadow user table for federated"},{"line_number":15,"context_line":"users that have not yet authenticated against Keystone."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7aa08908_6705a512","line":15,"range":{"start_line":13,"start_character":0,"end_line":15,"end_character":55},"updated":"2016-06-14 11:45:48.000000000","message":"\u0027Mapping shadow users into projects and roles\u0027 [1] allows this\n\n[1] https://review.openstack.org/#/c/324055/","commit_id":"e8646c2c834691de2c34e5f3048b80cf4dff6a4f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"75174ff87e2a4f928a1147306af4a3febef5d0f5","unresolved":false,"context_lines":[{"line_number":26,"context_line":"*  A federation deployment often requires assigning roles directly to"},{"line_number":27,"context_line":"   users, but if that user has never authenticated against the"},{"line_number":28,"context_line":"   Keystone server, the shadow user entry will never have been"},{"line_number":29,"context_line":"   created, and there is no user entry to use for the assignment."},{"line_number":30,"context_line":"*  Even if a federated user has visited, the assigning user has no way"},{"line_number":31,"context_line":"   to determine the userid or username to use for the remote user"},{"line_number":32,"context_line":"   without having out-of-band information."}],"source_content_type":"text/x-rst","patch_set":1,"id":"dab17558_45dd6f6f","line":29,"range":{"start_line":29,"start_character":64,"end_line":29,"end_character":65},"updated":"2016-05-13 17:28:17.000000000","message":"Is role assignment now required user/group to exist in Keystone? If that\u0027s the case, we definitely have a regression on the LDAP use cases. That\u0027s a very serious problem.","commit_id":"e8646c2c834691de2c34e5f3048b80cf4dff6a4f"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e1eabb4327b80dcc21e9d2d9489841041a99b47b","unresolved":false,"context_lines":[{"line_number":26,"context_line":"*  A federation deployment often requires assigning roles directly to"},{"line_number":27,"context_line":"   users, but if that user has never authenticated against the"},{"line_number":28,"context_line":"   Keystone server, the shadow user entry will never have been"},{"line_number":29,"context_line":"   created, and there is no user entry to use for the assignment."},{"line_number":30,"context_line":"*  Even if a federated user has visited, the assigning user has no way"},{"line_number":31,"context_line":"   to determine the userid or username to use for the remote user"},{"line_number":32,"context_line":"   without having out-of-band information."}],"source_content_type":"text/x-rst","patch_set":1,"id":"bab6814e_42119003","line":29,"range":{"start_line":29,"start_character":64,"end_line":29,"end_character":65},"in_reply_to":"dab17558_45dd6f6f","updated":"2016-12-01 21:19:47.000000000","message":"No. But there is a demand to be able to do so.  The problem is that there is no ID created in the Shadow table, so it cannot be generated.","commit_id":"e8646c2c834691de2c34e5f3048b80cf4dff6a4f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"75174ff87e2a4f928a1147306af4a3febef5d0f5","unresolved":false,"context_lines":[{"line_number":29,"context_line":"   created, and there is no user entry to use for the assignment."},{"line_number":30,"context_line":"*  Even if a federated user has visited, the assigning user has no way"},{"line_number":31,"context_line":"   to determine the userid or username to use for the remote user"},{"line_number":32,"context_line":"   without having out-of-band information."},{"line_number":33,"context_line":"*  In order for Applications running in the OpenStack deployment to be"},{"line_number":34,"context_line":"   able to consume the identity of users set up via the Federation"},{"line_number":35,"context_line":"   server, they need to consume the token API.  However,  These"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dab17558_e5110306","line":32,"range":{"start_line":32,"start_character":41,"end_line":32,"end_character":42},"updated":"2016-05-13 17:28:17.000000000","message":"Can you please elaborate further? If I am a federated user, why do I care about assigning user?","commit_id":"e8646c2c834691de2c34e5f3048b80cf4dff6a4f"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e1eabb4327b80dcc21e9d2d9489841041a99b47b","unresolved":false,"context_lines":[{"line_number":29,"context_line":"   created, and there is no user entry to use for the assignment."},{"line_number":30,"context_line":"*  Even if a federated user has visited, the assigning user has no way"},{"line_number":31,"context_line":"   to determine the userid or username to use for the remote user"},{"line_number":32,"context_line":"   without having out-of-band information."},{"line_number":33,"context_line":"*  In order for Applications running in the OpenStack deployment to be"},{"line_number":34,"context_line":"   able to consume the identity of users set up via the Federation"},{"line_number":35,"context_line":"   server, they need to consume the token API.  However,  These"}],"source_content_type":"text/x-rst","patch_set":1,"id":"bab6814e_6223f458","line":32,"range":{"start_line":32,"start_character":41,"end_line":32,"end_character":42},"in_reply_to":"dab17558_e5110306","updated":"2016-12-01 21:19:47.000000000","message":"From Federation, I only know the pre-mapped attributed, not the user_id assigned by Keystone.","commit_id":"e8646c2c834691de2c34e5f3048b80cf4dff6a4f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"75174ff87e2a4f928a1147306af4a3febef5d0f5","unresolved":false,"context_lines":[{"line_number":36,"context_line":"   applications often authenticate the users directly.  An application"},{"line_number":37,"context_line":"   should be able to make use of the federation mapping API to"},{"line_number":38,"context_line":"   determine what roles an authenticate user can have without actually"},{"line_number":39,"context_line":"   having a token to pass to other applications."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":""},{"line_number":42,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"dab17558_c5a03fa8","line":39,"range":{"start_line":39,"start_character":47,"end_line":39,"end_character":48},"updated":"2016-05-13 17:28:17.000000000","message":"Not sure if I understand this use case. Which application authenticate the user directly? I thought everything goes through Keystone, no?","commit_id":"e8646c2c834691de2c34e5f3048b80cf4dff6a4f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"04d4b771745e1ae752530d98e9f74936e1153236","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Proposed Change"},{"line_number":44,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Add three APIs for federation:"},{"line_number":47,"context_line":"*  Query what a Federated mapping would produce for a given set of environment"},{"line_number":48,"context_line":"   variables passed from the authentication modules of the web server."},{"line_number":49,"context_line":"*  Query if a Federated user has authenticated against a Keystone server"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dab17558_6917ce54","line":46,"range":{"start_line":46,"start_character":0,"end_line":46,"end_character":29},"updated":"2016-05-13 07:50:17.000000000","message":"can you spec out the APIs a bit further? give more details about what they would look like?","commit_id":"e8646c2c834691de2c34e5f3048b80cf4dff6a4f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"75174ff87e2a4f928a1147306af4a3febef5d0f5","unresolved":false,"context_lines":[{"line_number":44,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Add three APIs for federation:"},{"line_number":47,"context_line":"*  Query what a Federated mapping would produce for a given set of environment"},{"line_number":48,"context_line":"   variables passed from the authentication modules of the web server."},{"line_number":49,"context_line":"*  Query if a Federated user has authenticated against a Keystone server"},{"line_number":50,"context_line":"*  Preallocate a shadow user for a federated user that has not yet"},{"line_number":51,"context_line":"   authenticated."}],"source_content_type":"text/x-rst","patch_set":1,"id":"dab17558_a59d3bbd","line":48,"range":{"start_line":47,"start_character":3,"end_line":48,"end_character":70},"updated":"2016-05-13 17:28:17.000000000","message":"Who are the \"consumers\" of these APIs? If I understand the problem correctly, we are 1) unsure of what the incoming SAML2 attributes looks like, and 2) unsure of what the mapping will yield. I think they are separate issues in which we need to deal with separately. For 1), we need a better filtering mechanism so that we know *exactly* which attributes we want. For 2) we just need a CLI for administrators to validate the mapping output.","commit_id":"e8646c2c834691de2c34e5f3048b80cf4dff6a4f"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"75174ff87e2a4f928a1147306af4a3febef5d0f5","unresolved":false,"context_lines":[{"line_number":48,"context_line":"   variables passed from the authentication modules of the web server."},{"line_number":49,"context_line":"*  Query if a Federated user has authenticated against a Keystone server"},{"line_number":50,"context_line":"*  Preallocate a shadow user for a federated user that has not yet"},{"line_number":51,"context_line":"   authenticated."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dab17558_25902b4e","line":51,"range":{"start_line":51,"start_character":16,"end_line":51,"end_character":17},"updated":"2016-05-13 17:28:17.000000000","message":"POST /v3/users?","commit_id":"e8646c2c834691de2c34e5f3048b80cf4dff6a4f"},{"author":{"_account_id":7191,"name":"Jamie Lennox","email":"jamielennox@gmail.com","username":"jamielennox"},"change_message_id":"a53332a0d840f360521bafb30af197192e33313e","unresolved":false,"context_lines":[{"line_number":48,"context_line":"   variables passed from the authentication modules of the web server."},{"line_number":49,"context_line":"*  Query if a Federated user has authenticated against a Keystone server"},{"line_number":50,"context_line":"*  Preallocate a shadow user for a federated user that has not yet"},{"line_number":51,"context_line":"   authenticated."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dab17558_44b9e7ca","line":51,"range":{"start_line":51,"start_character":16,"end_line":51,"end_character":17},"in_reply_to":"dab17558_25902b4e","updated":"2016-05-13 22:25:19.000000000","message":"ergh - that\u0027s going to be a lot of pain, and i\u0027m not sure the advantages are really there.","commit_id":"e8646c2c834691de2c34e5f3048b80cf4dff6a4f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"04d4b771745e1ae752530d98e9f74936e1153236","unresolved":false,"context_lines":[{"line_number":144,"context_line":""},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Primary assignee:"},{"line_number":147,"context_line":"  Ron de Rose rderose "},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"Other contributors:"},{"line_number":150,"context_line":"  Adam Young ayoung ayoung@redhat.com"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dab17558_c95a3a50","line":147,"range":{"start_line":147,"start_character":2,"end_line":147,"end_character":13},"updated":"2016-05-13 07:50:17.000000000","message":"i think ron has his hands full with:\n\n  - shadow users\n  - helping with pci dss\n  - moving/creating abstract drivers for each resource\n\nnothing against ron, i just want to make sure he gets some sleep","commit_id":"e8646c2c834691de2c34e5f3048b80cf4dff6a4f"}],"specs/keystone/ongoing/federated-query-apis.rst":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0fb996437b082b4e1f854935022cdc243563a4a7","unresolved":false,"context_lines":[{"line_number":21,"context_line":"backends and expects it to be passed in from remote servers.  Setting"},{"line_number":22,"context_line":"up workflows for Federation has some frustrating aspects."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"*  When setting up a mapping, the administrator has no way of testing"},{"line_number":25,"context_line":"   what the result of that mapping would be without having an actual"},{"line_number":26,"context_line":"   assertion, but getting the full range of actual assertions is"},{"line_number":27,"context_line":"   impractical."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"*  A federation deployment often requires assigning roles directly to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_0ef05fda","line":26,"range":{"start_line":24,"start_character":30,"end_line":26,"end_character":12},"updated":"2018-10-04 19:42:55.000000000","message":"This is not true, the keystone-manage mapping_engine command can do this without an actual assertion. Can you be specific and explain why that isn\u0027t sufficient?","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e1e519bc198aa4192dc87e56978dd8e8118459df","unresolved":false,"context_lines":[{"line_number":21,"context_line":"backends and expects it to be passed in from remote servers.  Setting"},{"line_number":22,"context_line":"up workflows for Federation has some frustrating aspects."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"*  When setting up a mapping, the administrator has no way of testing"},{"line_number":25,"context_line":"   what the result of that mapping would be without having an actual"},{"line_number":26,"context_line":"   assertion, but getting the full range of actual assertions is"},{"line_number":27,"context_line":"   impractical."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"*  A federation deployment often requires assigning roles directly to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_49d091c9","line":26,"range":{"start_line":24,"start_character":30,"end_line":26,"end_character":12},"in_reply_to":"3f79a3b5_0ef05fda","updated":"2018-10-04 20:32:05.000000000","message":"This is a problem with our use of \u0027admin\u0027 as this really is a \"Project Manager\" use case, not a cloud admin.\n\n but also, the mapping API does not give the end user\u0027s ID, just what would be the local user value mapped in.\n\nAlso, counting on command line access for online apps day-to-day operations is so 1990s.","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"35b2849a146db1237eb57af2a533433642117770","unresolved":false,"context_lines":[{"line_number":21,"context_line":"backends and expects it to be passed in from remote servers.  Setting"},{"line_number":22,"context_line":"up workflows for Federation has some frustrating aspects."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"*  When setting up a mapping, the administrator has no way of testing"},{"line_number":25,"context_line":"   what the result of that mapping would be without having an actual"},{"line_number":26,"context_line":"   assertion, but getting the full range of actual assertions is"},{"line_number":27,"context_line":"   impractical."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"*  A federation deployment often requires assigning roles directly to"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_104387b2","line":26,"range":{"start_line":24,"start_character":30,"end_line":26,"end_character":12},"in_reply_to":"3f79a3b5_49d091c9","updated":"2018-10-05 16:32:57.000000000","message":"\u003e This is a problem with our use of \u0027admin\u0027 as this really is a\n \u003e \"Project Manager\" use case, not a cloud admin.\n\nOkay, let\u0027s change \"administrator\" to \"project admin\" to be more clear.\n\n \u003e \n \u003e but also, the mapping API does not give the end user\u0027s ID, just\n \u003e what would be the local user value mapped in.\n\nAnd what do you need the user ID for exactly?\n\nCurrently, the mapping rules should make it so role assignments happen dynamically without the need for known IDs. If we implement the step \"Preallocate a shadow user for a federated user that has not yet authenticated.\" then we still don\u0027t necessarily need the user ID for role assignments as long as we know the user name and domain.\n\n \u003e \n \u003e Also, counting on command line access for online apps day-to-day\n \u003e operations is so 1990s.\n\nTouché, but when you said \"administrator\" I was assuming system admin/cloud admin, not project admin.","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0fb996437b082b4e1f854935022cdc243563a4a7","unresolved":false,"context_lines":[{"line_number":26,"context_line":"   assertion, but getting the full range of actual assertions is"},{"line_number":27,"context_line":"   impractical."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"*  A federation deployment often requires assigning roles directly to"},{"line_number":30,"context_line":"   users, but if that user has never authenticated against the"},{"line_number":31,"context_line":"   Keystone server, the shadow user entry will never have been"},{"line_number":32,"context_line":"   created, and there is no user entry to use for the assignment."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"*  Even if a federated user has visited, the assigning user has no way"},{"line_number":35,"context_line":"   to determine the userid or username to use for the remote user"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_4eaad784","line":32,"range":{"start_line":29,"start_character":3,"end_line":32,"end_character":65},"updated":"2018-10-04 19:42:55.000000000","message":"True that you can\u0027t directly create a role assignment on the user yet, but autoprovisioning with the mapping API accomplishes the same end result. Can you provide specific examples to support why that is not sufficient? The fact that it\u0027s a somewhat clumsy API isn\u0027t sufficient reason to add a new way to do the same thing, imo.","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"35b2849a146db1237eb57af2a533433642117770","unresolved":false,"context_lines":[{"line_number":26,"context_line":"   assertion, but getting the full range of actual assertions is"},{"line_number":27,"context_line":"   impractical."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"*  A federation deployment often requires assigning roles directly to"},{"line_number":30,"context_line":"   users, but if that user has never authenticated against the"},{"line_number":31,"context_line":"   Keystone server, the shadow user entry will never have been"},{"line_number":32,"context_line":"   created, and there is no user entry to use for the assignment."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"*  Even if a federated user has visited, the assigning user has no way"},{"line_number":35,"context_line":"   to determine the userid or username to use for the remote user"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_4164d3e6","line":32,"range":{"start_line":29,"start_character":3,"end_line":32,"end_character":65},"in_reply_to":"3f79a3b5_29e435a8","updated":"2018-10-05 16:32:57.000000000","message":"\u003e I proposed this first :).\n \u003e Auto-provisioning is a different use case:  we want to assign a\n \u003e role for a specific user to a pre-existing project, \n\nIt doesn\u0027t have to be a pre-existing project, the mapped auth plugin dynamically creates the project if need be.\n\n \u003e prior to that\n \u003e user logging in.  Editing the mapping rules for this use case is\n \u003e not a viable solution.  Its not just that the API is bulky, but the\n \u003e access level is way higher than someone who should only be able to\n \u003e create a role assignment.\n\nI think I found my disconnect - editing a mapping rule is a system-admin action, and you think editing role assignments is a domain-admin or project-admin action. Currently that\u0027s not the case by default, but I guess you\u0027re thinking about the future: http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/policies/grant.py?h\u003d14.0.0#n62","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"247008cd34b4024221922540d4dd0f79a5db9525","unresolved":false,"context_lines":[{"line_number":26,"context_line":"   assertion, but getting the full range of actual assertions is"},{"line_number":27,"context_line":"   impractical."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"*  A federation deployment often requires assigning roles directly to"},{"line_number":30,"context_line":"   users, but if that user has never authenticated against the"},{"line_number":31,"context_line":"   Keystone server, the shadow user entry will never have been"},{"line_number":32,"context_line":"   created, and there is no user entry to use for the assignment."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"*  Even if a federated user has visited, the assigning user has no way"},{"line_number":35,"context_line":"   to determine the userid or username to use for the remote user"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_827c0672","line":32,"range":{"start_line":29,"start_character":3,"end_line":32,"end_character":65},"in_reply_to":"3f79a3b5_4164d3e6","updated":"2018-10-08 18:00:19.000000000","message":"\u003e \u003e I proposed this first :).\n \u003e \u003e Auto-provisioning is a different use case:  we want to assign a\n \u003e \u003e role for a specific user to a pre-existing project,\n \u003e \n \u003e It doesn\u0027t have to be a pre-existing project, the mapped auth\n \u003e plugin dynamically creates the project if need be.\n \u003e \n \u003e \u003e prior to that\n \u003e \u003e user logging in.  Editing the mapping rules for this use case is\n \u003e \u003e not a viable solution.  Its not just that the API is bulky, but\n \u003e the\n \u003e \u003e access level is way higher than someone who should only be able\n \u003e to\n \u003e \u003e create a role assignment.\n \u003e \n \u003e I think I found my disconnect - editing a mapping rule is a\n \u003e system-admin action, and you think editing role assignments is a\n \u003e domain-admin or project-admin action. Currently that\u0027s not the case\n \u003e by default, but I guess you\u0027re thinking about the future:\n \u003e http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/policies/grant.py?h\u003d14.0.0#n62\n\nThis is yet another great example of where incorporating scopes into keystone\u0027s own API will make things so much more usable \u003d/","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e1e519bc198aa4192dc87e56978dd8e8118459df","unresolved":false,"context_lines":[{"line_number":26,"context_line":"   assertion, but getting the full range of actual assertions is"},{"line_number":27,"context_line":"   impractical."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"*  A federation deployment often requires assigning roles directly to"},{"line_number":30,"context_line":"   users, but if that user has never authenticated against the"},{"line_number":31,"context_line":"   Keystone server, the shadow user entry will never have been"},{"line_number":32,"context_line":"   created, and there is no user entry to use for the assignment."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"*  Even if a federated user has visited, the assigning user has no way"},{"line_number":35,"context_line":"   to determine the userid or username to use for the remote user"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_29e435a8","line":32,"range":{"start_line":29,"start_character":3,"end_line":32,"end_character":65},"in_reply_to":"3f79a3b5_4eaad784","updated":"2018-10-04 20:32:05.000000000","message":"I proposed this first :).\nAuto-provisioning is a different use case:  we want to assign a role for a specific user to a pre-existing project, prior to that user logging in.  Editing the mapping rules for this use case is not a viable solution.  Its not just that the API is bulky, but the access level is way higher than someone who should only be able to create a role assignment.","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0fb996437b082b4e1f854935022cdc243563a4a7","unresolved":false,"context_lines":[{"line_number":31,"context_line":"   Keystone server, the shadow user entry will never have been"},{"line_number":32,"context_line":"   created, and there is no user entry to use for the assignment."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"*  Even if a federated user has visited, the assigning user has no way"},{"line_number":35,"context_line":"   to determine the userid or username to use for the remote user"},{"line_number":36,"context_line":"   without having out-of-band information."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"*  In order for Applications running in the OpenStack deployment to be"},{"line_number":39,"context_line":"   able to consume the identity of users set up via the Federation"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_ee77233c","line":36,"range":{"start_line":34,"start_character":41,"end_line":36,"end_character":42},"updated":"2018-10-04 19:42:55.000000000","message":"The way this is worded is ambiguous to me, can you provide an example?","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"35b2849a146db1237eb57af2a533433642117770","unresolved":false,"context_lines":[{"line_number":31,"context_line":"   Keystone server, the shadow user entry will never have been"},{"line_number":32,"context_line":"   created, and there is no user entry to use for the assignment."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"*  Even if a federated user has visited, the assigning user has no way"},{"line_number":35,"context_line":"   to determine the userid or username to use for the remote user"},{"line_number":36,"context_line":"   without having out-of-band information."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"*  In order for Applications running in the OpenStack deployment to be"},{"line_number":39,"context_line":"   able to consume the identity of users set up via the Federation"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_a1a4c708","line":36,"range":{"start_line":34,"start_character":41,"end_line":36,"end_character":42},"in_reply_to":"3f79a3b5_a9f7e55a","updated":"2018-10-05 16:32:57.000000000","message":"Got it","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e1e519bc198aa4192dc87e56978dd8e8118459df","unresolved":false,"context_lines":[{"line_number":31,"context_line":"   Keystone server, the shadow user entry will never have been"},{"line_number":32,"context_line":"   created, and there is no user entry to use for the assignment."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"*  Even if a federated user has visited, the assigning user has no way"},{"line_number":35,"context_line":"   to determine the userid or username to use for the remote user"},{"line_number":36,"context_line":"   without having out-of-band information."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"*  In order for Applications running in the OpenStack deployment to be"},{"line_number":39,"context_line":"   able to consume the identity of users set up via the Federation"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_a9f7e55a","line":36,"range":{"start_line":34,"start_character":41,"end_line":36,"end_character":42},"in_reply_to":"3f79a3b5_ee77233c","updated":"2018-10-04 20:32:05.000000000","message":"If I log in to a system, I get a UUID (soon to be HASH) based ID.  I need to do that, query my information, and then send it to the person that wants to assign me a role. There is no way to do \"list federated users\" and get the assigned IDs.","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0fb996437b082b4e1f854935022cdc243563a4a7","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"*  In order for Applications running in the OpenStack deployment to be"},{"line_number":39,"context_line":"   able to consume the identity of users set up via the Federation"},{"line_number":40,"context_line":"   server, they need to consume the token API.  However,  These"},{"line_number":41,"context_line":"   applications often authenticate the users directly.  An application"},{"line_number":42,"context_line":"   should be able to make use of the federation mapping API to"},{"line_number":43,"context_line":"   determine what roles an authenticate user can have without actually"},{"line_number":44,"context_line":"   having a token to pass to other applications."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_2efafb76","line":44,"range":{"start_line":40,"start_character":48,"end_line":44,"end_character":48},"updated":"2018-10-04 19:42:55.000000000","message":"This sounds backwards to me. A user (or the application owned by the user) regardless of whether the user is federated or not should only be able to inspect their own roles by getting a token.","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e1e519bc198aa4192dc87e56978dd8e8118459df","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"*  In order for Applications running in the OpenStack deployment to be"},{"line_number":39,"context_line":"   able to consume the identity of users set up via the Federation"},{"line_number":40,"context_line":"   server, they need to consume the token API.  However,  These"},{"line_number":41,"context_line":"   applications often authenticate the users directly.  An application"},{"line_number":42,"context_line":"   should be able to make use of the federation mapping API to"},{"line_number":43,"context_line":"   determine what roles an authenticate user can have without actually"},{"line_number":44,"context_line":"   having a token to pass to other applications."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_c98901c8","line":44,"range":{"start_line":40,"start_character":48,"end_line":44,"end_character":48},"in_reply_to":"3f79a3b5_2efafb76","updated":"2018-10-04 20:32:05.000000000","message":"The token is just a pointer to the auth data, but it is also used as a proxy for other operations.  What the application needs is the auth data to enforce its own RBAC, but that does not mean it should be able to perform operations on behalf of the user.  If the app requests a token for me (or if I give it a token) it can then reuse that token, and we don\u0027t want that.\n\nTHis is the building block for \"Identity as a Service\"","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"35b2849a146db1237eb57af2a533433642117770","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"*  In order for Applications running in the OpenStack deployment to be"},{"line_number":39,"context_line":"   able to consume the identity of users set up via the Federation"},{"line_number":40,"context_line":"   server, they need to consume the token API.  However,  These"},{"line_number":41,"context_line":"   applications often authenticate the users directly.  An application"},{"line_number":42,"context_line":"   should be able to make use of the federation mapping API to"},{"line_number":43,"context_line":"   determine what roles an authenticate user can have without actually"},{"line_number":44,"context_line":"   having a token to pass to other applications."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":""},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_41e133fd","line":44,"range":{"start_line":40,"start_character":48,"end_line":44,"end_character":48},"in_reply_to":"3f79a3b5_c98901c8","updated":"2018-10-05 16:32:57.000000000","message":"\u003e The token is just a pointer to the auth data, but it is also used\n \u003e as a proxy for other operations.  What the application needs is the\n \u003e auth data to enforce its own RBAC, \n\nWhy is the application enforcing its own RBAC? What application do you have in mind here?\n\n \u003e but that does not mean it should\n \u003e be able to perform operations on behalf of the user.  If the app\n \u003e requests a token for me (or if I give it a token) it can then reuse\n \u003e that token, and we don\u0027t want that.\n\nLet me rephrase to see if I understand - so the application, which has project-admin access (it must, otherwise how could it be using this API), needs to be able to query about the user, but letting it *be* the user is too much access?\n\n \u003e \n \u003e THis is the building block for \"Identity as a Service\"","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0fb996437b082b4e1f854935022cdc243563a4a7","unresolved":false,"context_lines":[{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Continue to suffer with the existing limitations."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Build an offline library to test mapping.  This should actually be"},{"line_number":69,"context_line":"done, but can be a complementary effort."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Get rid of shadow users, require all Federated users to have Keystone"},{"line_number":72,"context_line":"accounts created via the existing APIs, map to them.  This still won\u0027t"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_8e2a2fe4","line":69,"range":{"start_line":68,"start_character":0,"end_line":69,"end_character":39},"updated":"2018-10-04 19:42:55.000000000","message":"This is already done","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0fb996437b082b4e1f854935022cdc243563a4a7","unresolved":false,"context_lines":[{"line_number":123,"context_line":"Other Deployer Impact"},{"line_number":124,"context_line":"---------------------"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"These changes should be deployable with no configuration changes.  If"},{"line_number":127,"context_line":"they are deemed to be risky, it might be necessary to add"},{"line_number":128,"context_line":"configuration changes to disable the new APIs, or to add configuration"},{"line_number":129,"context_line":"type options to the individual Identity Providers to allow or not"},{"line_number":130,"context_line":"allow these APIs."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Otherwise, these changes will take effect immediately after deployment."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_ae428bab","line":130,"range":{"start_line":126,"start_character":66,"end_line":130,"end_character":17},"updated":"2018-10-04 19:42:55.000000000","message":"Not a fan of this, configurable APIs breaks interop","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"247008cd34b4024221922540d4dd0f79a5db9525","unresolved":false,"context_lines":[{"line_number":123,"context_line":"Other Deployer Impact"},{"line_number":124,"context_line":"---------------------"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"These changes should be deployable with no configuration changes.  If"},{"line_number":127,"context_line":"they are deemed to be risky, it might be necessary to add"},{"line_number":128,"context_line":"configuration changes to disable the new APIs, or to add configuration"},{"line_number":129,"context_line":"type options to the individual Identity Providers to allow or not"},{"line_number":130,"context_line":"allow these APIs."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"Otherwise, these changes will take effect immediately after deployment."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"3f79a3b5_a2cd82bb","line":130,"range":{"start_line":126,"start_character":66,"end_line":130,"end_character":17},"in_reply_to":"3f79a3b5_ae428bab","updated":"2018-10-08 18:00:19.000000000","message":"++","commit_id":"4f3b9b8a804ebd8e834246a3361a4ef0539f7aec"}]}