)]}'
{"specs/keystone/pike/api-keys.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":20,"context_line":"          to the Keystone User Resource, Consumer will be used to refer"},{"line_number":21,"context_line":"          to a Human who is consuming resources from an OpenStack Cloud,"},{"line_number":22,"context_line":"          Deployer to a Human who manages an OpenStack Deployment and"},{"line_number":23,"context_line":"          Application as non-Human consumer of OpenStacak APIs. While the"},{"line_number":24,"context_line":"          word \"application\" may carry connotations, it should be understood"},{"line_number":25,"context_line":"          here to mean any amount of code or automation expected to interact"},{"line_number":26,"context_line":"          with OpenStack in the absence of direct human interaction."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_8b92a44a","line":23,"updated":"2017-05-19 20:09:44.000000000","message":"OpenStack","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":20,"context_line":"          to the Keystone User Resource, Consumer will be used to refer"},{"line_number":21,"context_line":"          to a Human who is consuming resources from an OpenStack Cloud,"},{"line_number":22,"context_line":"          Deployer to a Human who manages an OpenStack Deployment and"},{"line_number":23,"context_line":"          Application as non-Human consumer of OpenStacak APIs. While the"},{"line_number":24,"context_line":"          word \"application\" may carry connotations, it should be understood"},{"line_number":25,"context_line":"          here to mean any amount of code or automation expected to interact"},{"line_number":26,"context_line":"          with OpenStack in the absence of direct human interaction."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_9c52923a","line":23,"in_reply_to":"ff0f0b1f_8b92a44a","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":23,"context_line":"          Application as non-Human consumer of OpenStacak APIs. While the"},{"line_number":24,"context_line":"          word \"application\" may carry connotations, it should be understood"},{"line_number":25,"context_line":"          here to mean any amount of code or automation expected to interact"},{"line_number":26,"context_line":"          with OpenStack in the absence of direct human interaction."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* As an OpenStack Consumer, I want to create Applications that programmatically"},{"line_number":29,"context_line":"  request a token and make API calls for resources in my project."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_4bb5accc","line":26,"updated":"2017-05-19 20:09:44.000000000","message":"Is this interaction expected to be only through the APIs?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":23,"context_line":"          Application as non-Human consumer of OpenStacak APIs. While the"},{"line_number":24,"context_line":"          word \"application\" may carry connotations, it should be understood"},{"line_number":25,"context_line":"          here to mean any amount of code or automation expected to interact"},{"line_number":26,"context_line":"          with OpenStack in the absence of direct human interaction."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* As an OpenStack Consumer, I want to create Applications that programmatically"},{"line_number":29,"context_line":"  request a token and make API calls for resources in my project."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_f59fa800","line":26,"in_reply_to":"ff0f0b1f_4bb5accc","updated":"2017-05-21 22:04:47.000000000","message":"Yes. I\u0027ll add that next rev.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":23,"context_line":"          Application as non-Human consumer of OpenStacak APIs. While the"},{"line_number":24,"context_line":"          word \"application\" may carry connotations, it should be understood"},{"line_number":25,"context_line":"          here to mean any amount of code or automation expected to interact"},{"line_number":26,"context_line":"          with OpenStack in the absence of direct human interaction."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* As an OpenStack Consumer, I want to create Applications that programmatically"},{"line_number":29,"context_line":"  request a token and make API calls for resources in my project."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_7c433e6d","line":26,"in_reply_to":"ff0f0b1f_f59fa800","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"2b128c5af121e6ea06d6be3c17291149baeda60a","unresolved":false,"context_lines":[{"line_number":25,"context_line":"          here to mean any amount of code or automation expected to interact"},{"line_number":26,"context_line":"          with OpenStack in the absence of direct human interaction."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* As an OpenStack Consumer, I want to create Applications that programmatically"},{"line_number":29,"context_line":"  request a token and make API calls for resources in my project."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"To accomplish this, one will typically store User credentials in a"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_9a4a4daa","line":28,"updated":"2017-05-25 16:03:11.000000000","message":"These use cases need a little preamble that say \"in existing openstack this is what I do and these are the problems they raise\" otherwise a brain will see the use cases and forget we are in the problem description section. Or at least my brain did.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":25,"context_line":"          here to mean any amount of code or automation expected to interact"},{"line_number":26,"context_line":"          with OpenStack in the absence of direct human interaction."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* As an OpenStack Consumer, I want to create Applications that programmatically"},{"line_number":29,"context_line":"  request a token and make API calls for resources in my project."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"To accomplish this, one will typically store User credentials in a"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_3c614606","line":28,"in_reply_to":"df140735_4e43336d","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":25,"context_line":"          here to mean any amount of code or automation expected to interact"},{"line_number":26,"context_line":"          with OpenStack in the absence of direct human interaction."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"* As an OpenStack Consumer, I want to create Applications that programmatically"},{"line_number":29,"context_line":"  request a token and make API calls for resources in my project."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"To accomplish this, one will typically store User credentials in a"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_4e43336d","line":28,"in_reply_to":"ff0f0b1f_9a4a4daa","updated":"2017-06-02 16:50:45.000000000","message":"Agree. Maybe we should make a very short section summarizing the problem, then put the use-cases into a sub-section?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"a925673a5d1a1558ed21e85b0eca2af367767a07","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":"As the use of Automation increases in the world, more and more teams have"},{"line_number":48,"context_line":"problems with automation that was tied to a specific Consumer\u0027s User"},{"line_number":49,"context_line":"credentials. The API Key should live at the Project level so that all Consumers"},{"line_number":50,"context_line":"who have Users with roles on the Project can rotate or delete them as they"},{"line_number":51,"context_line":"see fit if membership in their Team changes."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"* As an OpenStack Consumer and an OpenStack Deployer, I need to be able to"},{"line_number":54,"context_line":"  gracefully rotate API credentials."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_f077a89f","line":51,"range":{"start_line":49,"start_character":13,"end_line":51,"end_character":44},"updated":"2017-05-22 12:32:21.000000000","message":"I agree that it should live at project level, but I don\u0027t with the statement that all consumers can rotate or delete them, that should be an administrative only operation","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":"As the use of Automation increases in the world, more and more teams have"},{"line_number":48,"context_line":"problems with automation that was tied to a specific Consumer\u0027s User"},{"line_number":49,"context_line":"credentials. The API Key should live at the Project level so that all Consumers"},{"line_number":50,"context_line":"who have Users with roles on the Project can rotate or delete them as they"},{"line_number":51,"context_line":"see fit if membership in their Team changes."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"* As an OpenStack Consumer and an OpenStack Deployer, I need to be able to"},{"line_number":54,"context_line":"  gracefully rotate API credentials."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_1c5e8243","line":51,"range":{"start_line":49,"start_character":13,"end_line":51,"end_character":44},"in_reply_to":"df140735_ce7d03b3","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0433e9130aa087f9facd3401160f86954b4008ba","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":"As the use of Automation increases in the world, more and more teams have"},{"line_number":48,"context_line":"problems with automation that was tied to a specific Consumer\u0027s User"},{"line_number":49,"context_line":"credentials. The API Key should live at the Project level so that all Consumers"},{"line_number":50,"context_line":"who have Users with roles on the Project can rotate or delete them as they"},{"line_number":51,"context_line":"see fit if membership in their Team changes."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"* As an OpenStack Consumer and an OpenStack Deployer, I need to be able to"},{"line_number":54,"context_line":"  gracefully rotate API credentials."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_92c4de92","line":51,"range":{"start_line":49,"start_character":13,"end_line":51,"end_character":44},"in_reply_to":"ff0f0b1f_59267f17","updated":"2017-05-22 23:22:02.000000000","message":"Thinking about the discussion here - \nhttp://eavesdrop.openstack.org/irclogs/%23openstack-dev/%23openstack-dev.2017-05-18.log.html#t2017-05-18T15:41:16\n\nThere\u0027s been a decent amount of discussion on the mailing list thread about what kind of access the key should have to everything else, but if keys are going to belong to a project rather than to a user then the inverse needs to be better defined as well, i.e. what access does the user need in order to create and delete keys. I agree that it shouldn\u0027t be an admin-only task but there should still be specific policy definitions around maintenance of a key - an \"observer\", for instance, shouldn\u0027t be able to delete an API key.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3afec73d97a2f7d2ab567e8a6ed72bdcf5320915","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":"As the use of Automation increases in the world, more and more teams have"},{"line_number":48,"context_line":"problems with automation that was tied to a specific Consumer\u0027s User"},{"line_number":49,"context_line":"credentials. The API Key should live at the Project level so that all Consumers"},{"line_number":50,"context_line":"who have Users with roles on the Project can rotate or delete them as they"},{"line_number":51,"context_line":"see fit if membership in their Team changes."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"* As an OpenStack Consumer and an OpenStack Deployer, I need to be able to"},{"line_number":54,"context_line":"  gracefully rotate API credentials."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_59267f17","line":51,"range":{"start_line":49,"start_character":13,"end_line":51,"end_character":44},"in_reply_to":"ff0f0b1f_7e6b69b6","updated":"2017-05-22 13:54:34.000000000","message":"Cool, I agree that it should be possible to determine what roles are able to perform API keys rotation/deletion (via policy). Maybe make a bit more explicit on authorization rather than just saying all will be able to do so: \"all Consumers who have Users with roles on the Project\"","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":"As the use of Automation increases in the world, more and more teams have"},{"line_number":48,"context_line":"problems with automation that was tied to a specific Consumer\u0027s User"},{"line_number":49,"context_line":"credentials. The API Key should live at the Project level so that all Consumers"},{"line_number":50,"context_line":"who have Users with roles on the Project can rotate or delete them as they"},{"line_number":51,"context_line":"see fit if membership in their Team changes."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"* As an OpenStack Consumer and an OpenStack Deployer, I need to be able to"},{"line_number":54,"context_line":"  gracefully rotate API credentials."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_ce7d03b3","line":51,"range":{"start_line":49,"start_character":13,"end_line":51,"end_character":44},"in_reply_to":"ff0f0b1f_92c4de92","updated":"2017-06-02 16:50:45.000000000","message":"Yes. Totally agree. My main thoughts/needs here are that creating/deleting should be an actions that every \"normal\" user (aka Member) can do ... and that it should be our intent to recommend to Interop WG that it become a required capability that a Member can always create and delete keys.\n\nbut yes - more fleshing out on some of the other role types is important.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"455eb176627356393bdde27172270c865a1cbd2c","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":"As the use of Automation increases in the world, more and more teams have"},{"line_number":48,"context_line":"problems with automation that was tied to a specific Consumer\u0027s User"},{"line_number":49,"context_line":"credentials. The API Key should live at the Project level so that all Consumers"},{"line_number":50,"context_line":"who have Users with roles on the Project can rotate or delete them as they"},{"line_number":51,"context_line":"see fit if membership in their Team changes."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"* As an OpenStack Consumer and an OpenStack Deployer, I need to be able to"},{"line_number":54,"context_line":"  gracefully rotate API credentials."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_7e6b69b6","line":51,"range":{"start_line":49,"start_character":13,"end_line":51,"end_character":44},"in_reply_to":"ff0f0b1f_f077a89f","updated":"2017-05-22 13:13:17.000000000","message":"Making it an admin task defeats the purpose of allowing API Keys for automation survive a team member going away. Now - it could be that the admin needs to grant a new user a role on that project to allow ongoing maint -but if an admin has to get involved when a human leaves a team of humans, it\u0027s not really a feature that can be used for facililation of automation very well.\n\nWhat\u0027s the concern?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":63,"context_line":"no downtime."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* As an OpenStack Deployer, I need to configure some OpenStack Services to be"},{"line_number":66,"context_line":"  albe to make API calls to other OpenStack Services."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Information about Service Users are currently stored in configuration files."},{"line_number":69,"context_line":"For example, the nova Service User is currently in the configuration of every"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_8bc184e7","line":66,"updated":"2017-05-19 20:09:44.000000000","message":"able*","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":63,"context_line":"no downtime."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"* As an OpenStack Deployer, I need to configure some OpenStack Services to be"},{"line_number":66,"context_line":"  albe to make API calls to other OpenStack Services."},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Information about Service Users are currently stored in configuration files."},{"line_number":69,"context_line":"For example, the nova Service User is currently in the configuration of every"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_fc562e2a","line":66,"in_reply_to":"ff0f0b1f_8bc184e7","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":70,"context_line":"nova-api, nova-compute and neutron configuration file. At run time, those"},{"line_number":71,"context_line":"services use those User Credentials to perform service-to-service actions."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"From a security perspective, it can be considered unfavorable to have User"},{"line_number":74,"context_line":"credentials written to a file on disk, especially if the User has elevated"},{"line_number":75,"context_line":"privileges on a Project. It should be possible to apply the principle of least"},{"line_number":76,"context_line":"privilege (POLP) and limit access to the minimum level required to complete the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_4b3eccda","line":73,"updated":"2017-05-19 20:09:44.000000000","message":"nit: s/User/Service User/\n\ngiven the things that various services need to do via the API, this could include elevated privileges.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":70,"context_line":"nova-api, nova-compute and neutron configuration file. At run time, those"},{"line_number":71,"context_line":"services use those User Credentials to perform service-to-service actions."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"From a security perspective, it can be considered unfavorable to have User"},{"line_number":74,"context_line":"credentials written to a file on disk, especially if the User has elevated"},{"line_number":75,"context_line":"privileges on a Project. It should be possible to apply the principle of least"},{"line_number":76,"context_line":"privilege (POLP) and limit access to the minimum level required to complete the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_bc32f60e","line":73,"in_reply_to":"df140735_d9194f7a","updated":"2017-06-03 19:28:24.000000000","message":"not done - I think User covers both cases. It\u0027s a Bad Thing if an account at any level is compromised.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":70,"context_line":"nova-api, nova-compute and neutron configuration file. At run time, those"},{"line_number":71,"context_line":"services use those User Credentials to perform service-to-service actions."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"From a security perspective, it can be considered unfavorable to have User"},{"line_number":74,"context_line":"credentials written to a file on disk, especially if the User has elevated"},{"line_number":75,"context_line":"privileges on a Project. It should be possible to apply the principle of least"},{"line_number":76,"context_line":"privilege (POLP) and limit access to the minimum level required to complete the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_d9194f7a","line":73,"in_reply_to":"ff0f0b1f_4b3eccda","updated":"2017-06-02 16:50:45.000000000","message":"I agree - but it\u0027s actually not just applicable to serice users. For instance, I spoke to a fellow at OpenStack Days Nordic last year whose cloud used federated identity with his corporate LDAP. His issue was that he did not want to put his corporate LDAP password into a config file, but he still wanted to be able to do automated tasks.\n\nMaybe we should break out both of those?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":87,"context_line":"Applications. API Keys will be assigned the same roles the Creating User"},{"line_number":88,"context_line":"has at creation time."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":".. note:: The name \u0027API Key` was chosen after discussion on the mailing list"},{"line_number":91,"context_line":"          to be consistent with other industry usage around generating a key"},{"line_number":92,"context_line":"          to be used in an API. Rackspace Public Cloud also has an auth-type"},{"line_number":93,"context_line":"          called \u0027API Key\u0027 available. This is not designed to be identical to"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_c6453145","line":90,"updated":"2017-05-19 20:09:44.000000000","message":"We could include a link here for reference (for those ambitious folk who want to see how things unfold).\n\nhttp://lists.openstack.org/pipermail/openstack-dev/2017-May/116596.html","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":87,"context_line":"Applications. API Keys will be assigned the same roles the Creating User"},{"line_number":88,"context_line":"has at creation time."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":".. note:: The name \u0027API Key` was chosen after discussion on the mailing list"},{"line_number":91,"context_line":"          to be consistent with other industry usage around generating a key"},{"line_number":92,"context_line":"          to be used in an API. Rackspace Public Cloud also has an auth-type"},{"line_number":93,"context_line":"          called \u0027API Key\u0027 available. This is not designed to be identical to"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_9c373200","line":90,"in_reply_to":"df140735_f939b3d6","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":87,"context_line":"Applications. API Keys will be assigned the same roles the Creating User"},{"line_number":88,"context_line":"has at creation time."},{"line_number":89,"context_line":""},{"line_number":90,"context_line":".. note:: The name \u0027API Key` was chosen after discussion on the mailing list"},{"line_number":91,"context_line":"          to be consistent with other industry usage around generating a key"},{"line_number":92,"context_line":"          to be used in an API. Rackspace Public Cloud also has an auth-type"},{"line_number":93,"context_line":"          called \u0027API Key\u0027 available. This is not designed to be identical to"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_f939b3d6","line":90,"in_reply_to":"ff0f0b1f_c6453145","updated":"2017-06-02 16:50:45.000000000","message":"Agree.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"2b128c5af121e6ea06d6be3c17291149baeda60a","unresolved":false,"context_lines":[{"line_number":98,"context_line":"API Keys will have the following characteristics:"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_ba7e31ad","line":101,"updated":"2017-05-25 16:03:11.000000000","message":"Why have limits (or at least low limits)? In other environments an api-key is explicitly something that is very cheap and very burnable. You create as many as you like, so that you can use a different one in each script you have, and kill them as necessary, often frequently because you are busily experimenting.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"a925673a5d1a1558ed21e85b0eca2af367767a07","unresolved":false,"context_lines":[{"line_number":98,"context_line":"API Keys will have the following characteristics:"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_90862c13","line":101,"range":{"start_line":101,"start_character":40,"end_line":101,"end_character":55},"updated":"2017-05-22 12:32:21.000000000","message":"per use and per project? user has at maximum 5 and the same is valid to projects?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":98,"context_line":"API Keys will have the following characteristics:"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_5c3d1adb","line":101,"in_reply_to":"df140735_9985175d","updated":"2017-06-03 19:28:24.000000000","message":"I think allowing limits is reasonable, clarified to make it clear it\u0027s optional","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"455eb176627356393bdde27172270c865a1cbd2c","unresolved":false,"context_lines":[{"line_number":98,"context_line":"API Keys will have the following characteristics:"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_fe85395b","line":101,"range":{"start_line":101,"start_character":40,"end_line":101,"end_character":55},"in_reply_to":"ff0f0b1f_90862c13","updated":"2017-05-22 13:13:17.000000000","message":"Good question. Honestly I\u0027m not sure a per-user quota here makes as much sense as a per-project quota, given that the key storage is on a project level.\n\nHowever, I think the key here is \"can have a quota defined\" - 5 is just an arbitrary example. Will fix.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":98,"context_line":"API Keys will have the following characteristics:"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_9985175d","line":101,"in_reply_to":"ff0f0b1f_ba7e31ad","updated":"2017-06-02 16:50:45.000000000","message":"I\u0027d be fine killing the limits, it was just in the original spec. That said - I could see some organizations wanting to be able to impose some sort of limit for real or perceived compliance reasons. Perhaps we make it a project-level limit but that defaults to unlimited, so we can let an operator set one, but by default there is no limit? (also, it has a name and a description field, so a REALLY weird user could decide to use it as a key-value store that they don\u0027t pay for if there was no limit)","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"6a85ec7009d977d584134346ffe95ae51a4e81a0","unresolved":false,"context_lines":[{"line_number":98,"context_line":"API Keys will have the following characteristics:"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_ca8188fd","line":101,"range":{"start_line":101,"start_character":40,"end_line":101,"end_character":55},"in_reply_to":"ff0f0b1f_fe85395b","updated":"2017-05-22 16:53:40.000000000","message":"Yes, given that these will be stored on a per-project level I don\u0027t think we should have a per-user quota. Only a per-project quota. Also, AFAIK, we\u0027re trying to move away from user limits in the Unified Limits spec.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":105,"context_line":"* Cannot create or delete API Keys."},{"line_number":106,"context_line":"* Support expiration."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_26dd0d70","line":103,"updated":"2017-05-19 20:09:44.000000000","message":"Do we want to expose the ability for a User to scope down if they have that ability? For example, I have roles \u0027x\u0027, \u0027y\u0027, and \u0027z\u0027 on a project, but I only want my API Key to have role \u0027x\u0027.\n\nIs that something we want to address in this step? Or do we want to open up the ability to scope down later?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"3fad99d941878f937f64dcfca876e1e45fcd5cb0","unresolved":false,"context_lines":[{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":105,"context_line":"* Cannot create or delete API Keys."},{"line_number":106,"context_line":"* Support expiration."}],"source_content_type":"text/x-rst","patch_set":9,"id":"7f231b9d_1ca99dde","line":103,"in_reply_to":"df140735_3c26e6cf","updated":"2017-06-09 16:19:34.000000000","message":"And adding parameter to the POST call","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":105,"context_line":"* Cannot create or delete API Keys."},{"line_number":106,"context_line":"* Support expiration."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_3c26e6cf","line":103,"in_reply_to":"df140735_b9e0db27","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":105,"context_line":"* Cannot create or delete API Keys."},{"line_number":106,"context_line":"* Support expiration."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_b5b25093","line":103,"in_reply_to":"ff0f0b1f_26dd0d70","updated":"2017-05-21 22:04:47.000000000","message":"_maybe_? I mean, to me if you are a human who has the ability to understand anything about roles, you are a human who likely has the ability to create user accounts with roles. The follow on to limit what a key can do seems lke it would apply more cleanly to all the humans ... but I don\u0027t have strong feelings on this.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":105,"context_line":"* Cannot create or delete API Keys."},{"line_number":106,"context_line":"* Support expiration."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_b9e0db27","line":103,"in_reply_to":"ff0f0b1f_4afb3846","updated":"2017-06-02 16:50:45.000000000","message":"Yah - ok. Given that a user does get a list of roles in their token, it\u0027s not unreasonable to say \"by default it\u0027s the current roles the user has been granted on the project, but can take an optional list of roles which can be a subset of the roles the user has been granted on the project\"","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"6a85ec7009d977d584134346ffe95ae51a4e81a0","unresolved":false,"context_lines":[{"line_number":100,"context_line":"* Immutable."},{"line_number":101,"context_line":"* Allow for limits, e.g. 5 API Keys per User or Project."},{"line_number":102,"context_line":"* Exist within a Project."},{"line_number":103,"context_line":"* Assigned the roles that the creating User has on a Project."},{"line_number":104,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":105,"context_line":"* Cannot create or delete API Keys."},{"line_number":106,"context_line":"* Support expiration."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_4afb3846","line":103,"in_reply_to":"ff0f0b1f_b5b25093","updated":"2017-05-22 16:53:40.000000000","message":"I think this makes a lot of sense in the automation case and something that we should aim at supporting from the start rather than a follow-on which may not land during the same cycle as this.\n\nMost of the time Applications will only need a subset of the permissions that a User has and Consumers don\u0027t have the permissions to create users. This makes sense in the context of the principle of least privilege. Having this piece in place will also provide a much stronger case for our current discussion and work with regards to policy and RBAC. I see them going hand in hand.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":114,"context_line":"selectively, or a User can request an API Key that has no permissions and"},{"line_number":115,"context_line":"add to them selectively. In both cases the API Key will never be able to be"},{"line_number":116,"context_line":"granted the ability to perform actions that a User\u0027s roles do not already"},{"line_number":117,"context_line":"grant them."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"API Key Management"},{"line_number":120,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_a6059dc4","line":117,"updated":"2017-05-19 20:09:44.000000000","message":"For some reason I get the feeling this paragraph should be accompanied with a statement about working that bit carefully with other projects. There is so much policy stuff in flight that may or may not influence this.\n\nI\u0027m stumbling over how to wordsmith that though.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":114,"context_line":"selectively, or a User can request an API Key that has no permissions and"},{"line_number":115,"context_line":"add to them selectively. In both cases the API Key will never be able to be"},{"line_number":116,"context_line":"granted the ability to perform actions that a User\u0027s roles do not already"},{"line_number":117,"context_line":"grant them."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"API Key Management"},{"line_number":120,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_fc2bce91","line":117,"in_reply_to":"df140735_b94e9b35","updated":"2017-06-03 19:28:24.000000000","message":"killed","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"2b128c5af121e6ea06d6be3c17291149baeda60a","unresolved":false,"context_lines":[{"line_number":114,"context_line":"selectively, or a User can request an API Key that has no permissions and"},{"line_number":115,"context_line":"add to them selectively. In both cases the API Key will never be able to be"},{"line_number":116,"context_line":"granted the ability to perform actions that a User\u0027s roles do not already"},{"line_number":117,"context_line":"grant them."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"API Key Management"},{"line_number":120,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_5d794f91","line":117,"in_reply_to":"ff0f0b1f_55a77450","updated":"2017-05-25 16:03:11.000000000","message":"I think limiting access should be mentioned as little as possible in this spec because there seems to be a lot of different ideas on how it should be done and how it can be done, with the usual not yet quite reached shared understanding-ness.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":114,"context_line":"selectively, or a User can request an API Key that has no permissions and"},{"line_number":115,"context_line":"add to them selectively. In both cases the API Key will never be able to be"},{"line_number":116,"context_line":"granted the ability to perform actions that a User\u0027s roles do not already"},{"line_number":117,"context_line":"grant them."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"API Key Management"},{"line_number":120,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_b94e9b35","line":117,"in_reply_to":"ff0f0b1f_5d794f91","updated":"2017-06-02 16:50:45.000000000","message":"I agree. The main reason I added it was because the payload defined below has an access list in it, but the access_list doesn\u0027t really do anything yet (so we wouldn\u0027t have to rev the api again in queens). Let\u0027s kill the paragraph.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":114,"context_line":"selectively, or a User can request an API Key that has no permissions and"},{"line_number":115,"context_line":"add to them selectively. In both cases the API Key will never be able to be"},{"line_number":116,"context_line":"granted the ability to perform actions that a User\u0027s roles do not already"},{"line_number":117,"context_line":"grant them."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"API Key Management"},{"line_number":120,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_55a77450","line":117,"in_reply_to":"ff0f0b1f_a6059dc4","updated":"2017-05-21 22:04:47.000000000","message":"Maybe I just said too many words here ... like, honestly most of that needs to be in the next spec","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0433e9130aa087f9facd3401160f86954b4008ba","unresolved":false,"context_lines":[{"line_number":120,"context_line":"------------------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"By default, any User with at least a member role on a Project should be able to"},{"line_number":123,"context_line":"list, add, and delete API Keys. For example, adding an app key:"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"::"},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_d2e936b7","line":123,"range":{"start_line":123,"start_character":55,"end_line":123,"end_character":58},"updated":"2017-05-22 23:22:02.000000000","message":"This might be a typo or leftover from the earlier revisions but I think this is supposed to be API key now. I know that name isn\u0027t written in stone yet but at least keeping it consistent will make the eventual sed easier.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":120,"context_line":"------------------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"By default, any User with at least a member role on a Project should be able to"},{"line_number":123,"context_line":"list, add, and delete API Keys. For example, adding an app key:"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"::"},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_dc280a98","line":123,"range":{"start_line":123,"start_character":55,"end_line":123,"end_character":58},"in_reply_to":"df140735_59577fcb","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":120,"context_line":"------------------"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"By default, any User with at least a member role on a Project should be able to"},{"line_number":123,"context_line":"list, add, and delete API Keys. For example, adding an app key:"},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"::"},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_59577fcb","line":123,"range":{"start_line":123,"start_character":55,"end_line":123,"end_character":58},"in_reply_to":"ff0f0b1f_d2e936b7","updated":"2017-06-02 16:50:45.000000000","message":"yup. api key","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0433e9130aa087f9facd3401160f86954b4008ba","unresolved":false,"context_lines":[{"line_number":139,"context_line":"        }"},{"line_number":140,"context_line":"    }"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"`name` must be unique within a given Project, but `name` is only guaranteed to"},{"line_number":143,"context_line":"be unique within its Project. `name` may be useful for Consumers who want"},{"line_number":144,"context_line":"human readable config files."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_b2fb6277","line":142,"updated":"2017-05-22 23:22:02.000000000","message":"Why does it need to be unique? It will have a unique ID. One could potentially want to rotate in a second key named \"backup\" while making config updates across a cluster before finally revoking the first \"backup\" key.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":139,"context_line":"        }"},{"line_number":140,"context_line":"    }"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"`name` must be unique within a given Project, but `name` is only guaranteed to"},{"line_number":143,"context_line":"be unique within its Project. `name` may be useful for Consumers who want"},{"line_number":144,"context_line":"human readable config files."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_bc1b167f","line":142,"in_reply_to":"df140735_11a79b0d","updated":"2017-06-03 19:28:24.000000000","message":"Leaving this in with added explanation","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"83b940eb9598b95be22ccd313eae2f05a5dff463","unresolved":false,"context_lines":[{"line_number":139,"context_line":"        }"},{"line_number":140,"context_line":"    }"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"`name` must be unique within a given Project, but `name` is only guaranteed to"},{"line_number":143,"context_line":"be unique within its Project. `name` may be useful for Consumers who want"},{"line_number":144,"context_line":"human readable config files."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_11a79b0d","line":142,"in_reply_to":"df140735_39116b05","updated":"2017-06-02 21:44:37.000000000","message":"Okay the point you made on line 360 made me change my mind about this, every other resource in keystone requires names to be unique within a project so it makes sense for it to be the same here.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":139,"context_line":"        }"},{"line_number":140,"context_line":"    }"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"`name` must be unique within a given Project, but `name` is only guaranteed to"},{"line_number":143,"context_line":"be unique within its Project. `name` may be useful for Consumers who want"},{"line_number":144,"context_line":"human readable config files."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_39116b05","line":142,"in_reply_to":"ff0f0b1f_9d5ec710","updated":"2017-06-02 16:50:45.000000000","message":"If the name isn\u0027t unique, I guess on validation side the server just tries to validate against each key it has that matches the name? Ok, wfm.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"2b128c5af121e6ea06d6be3c17291149baeda60a","unresolved":false,"context_lines":[{"line_number":139,"context_line":"        }"},{"line_number":140,"context_line":"    }"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"`name` must be unique within a given Project, but `name` is only guaranteed to"},{"line_number":143,"context_line":"be unique within its Project. `name` may be useful for Consumers who want"},{"line_number":144,"context_line":"human readable config files."},{"line_number":145,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_9d5ec710","line":142,"in_reply_to":"ff0f0b1f_b2fb6277","updated":"2017-05-25 16:03:11.000000000","message":"agree","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":160,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":161,"context_line":"API Key starts with. Its contents are currently undefined but is included for"},{"line_number":162,"context_line":"forward compatibility. Values other than the empty list or omitting the field"},{"line_number":163,"context_line":"are currently an error."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since API Keys"},{"line_number":166,"context_line":"are immutable, the contents of this list will be copied to `api_access_list` at"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_c6c0912d","line":163,"updated":"2017-05-19 20:09:44.000000000","message":"Interesting. I see a relationship between these two:\n\n  if allow \u003d true then api_access_list \u003d\u003d [*]\n  if api_access_list \u003d [(\u0027POST\u0027, \u0027/v3/{project_id}/backups/)\u0027, ... ] then allow \u003d\u003d false\n\nIf I look at this from a u-x perspective, I can\u0027t seem to think of a case where I would use both knobs simultaneously (but I could be short-sighted here). I feel like I either want to allow my API key to access all the thing I can via my roles (which is going to be the initial step AFAICT), or you want to scope it to only a couple APIs.\n\nIs there ever going to be a case where you have the following?\n\n  allow \u003d true\n  api_access_list \u003d [(\u0027POST\u0027, \u0027/v3/{project_id}/backups/)\u0027, ... ]","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":160,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":161,"context_line":"API Key starts with. Its contents are currently undefined but is included for"},{"line_number":162,"context_line":"forward compatibility. Values other than the empty list or omitting the field"},{"line_number":163,"context_line":"are currently an error."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since API Keys"},{"line_number":166,"context_line":"are immutable, the contents of this list will be copied to `api_access_list` at"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_f96ad317","line":163,"in_reply_to":"ff0f0b1f_856821b9","updated":"2017-06-02 16:50:45.000000000","message":"The reason to not restrict the auth level only by roles is that roles are not possible to understand or reason about by a normal end user. Even if/when we do wind up exposing policy.json information in the API, that\u0027s still not information that is super understandable. BUT- what\u0027s worse is that roles are only creatable by the admin, so as user you\u0027d be restricted to only pre-defined groupings of activities.\n\nDefining at the API action level, otoh, is a thing that a user understands because they\u0027re already expected to understand API calls. So a user can say \"please give me an API Key that is only allowed to upload objects to swift\" by saying [(\u0027POST\u0027, \u0027object-store\u0027, \u0027/v1\u0027)] and that same user can create a different API key for a different application that has [(\u0027GET\u0027, \u0027object-store\u0027, \u0027/v1\u0027)] ... or even [(\u0027GET\u0027, \u0027object-store\u0027, \u0027/v1/logfiles\u0027)] - it empowers the user to be flexible but is still easy enough to understand ... and is a thing we can enforce at the entry point to the routing.\n\nFinally, the intent with the access_lists is that they are only enforced at user route entry - so if a user says [(\u0027POST\u0027, \u0027compute\u0027, \u0027/v2/servers\u0027)] but server creation involves nova needing to do \u0027POST network /v2/ports\u0027, that call should still work (as long as the user\u0027s roles allow it) The user should not need to be aware of intra-service interactions that are otherwise implementatoins details.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":160,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":161,"context_line":"API Key starts with. Its contents are currently undefined but is included for"},{"line_number":162,"context_line":"forward compatibility. Values other than the empty list or omitting the field"},{"line_number":163,"context_line":"are currently an error."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since API Keys"},{"line_number":166,"context_line":"are immutable, the contents of this list will be copied to `api_access_list` at"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_9c2052ae","line":163,"in_reply_to":"ff0f0b1f_b577f0d4","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"6a85ec7009d977d584134346ffe95ae51a4e81a0","unresolved":false,"context_lines":[{"line_number":160,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":161,"context_line":"API Key starts with. Its contents are currently undefined but is included for"},{"line_number":162,"context_line":"forward compatibility. Values other than the empty list or omitting the field"},{"line_number":163,"context_line":"are currently an error."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since API Keys"},{"line_number":166,"context_line":"are immutable, the contents of this list will be copied to `api_access_list` at"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_856821b9","line":163,"in_reply_to":"ff0f0b1f_b577f0d4","updated":"2017-05-22 16:53:40.000000000","message":"Why not restrict the authorization level of the API key via roles only?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":160,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":161,"context_line":"API Key starts with. Its contents are currently undefined but is included for"},{"line_number":162,"context_line":"forward compatibility. Values other than the empty list or omitting the field"},{"line_number":163,"context_line":"are currently an error."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since API Keys"},{"line_number":166,"context_line":"are immutable, the contents of this list will be copied to `api_access_list` at"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_b577f0d4","line":163,"in_reply_to":"ff0f0b1f_c6c0912d","updated":"2017-05-21 22:04:47.000000000","message":"Well, in my stupid brain I was thinking that\n\n  allow \u003d true\n  api_access_list \u003d [(\u0027POST\u0027, \u0027/v3/{project_id}/backups/)\u0027, ... ]\n\nwould mean \"everything except for (\u0027POST\u0027, \u0027/v3/{project_id}/backups/)\" - but that\u0027s clearly bad UX. I like your thing much better!","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0433e9130aa087f9facd3401160f86954b4008ba","unresolved":false,"context_lines":[{"line_number":169,"context_line":"is an error. There are no pre-defined API Access Lists yet but it is included"},{"line_number":170,"context_line":"for forward compatibility. As values that cannot be found are creation errors"},{"line_number":171,"context_line":"and there are no actual objects, any value other than null or omitting the"},{"line_number":172,"context_line":"field is an error."},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Response example:"},{"line_number":175,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_12f7ae61","line":172,"updated":"2017-05-22 23:22:02.000000000","message":"I\u0027m not sure I understand the benefit of thinking in terms of forward-compatibility here. New parameters should be easy to add in the future without breaking backwards-compatibility. But while the specifics of access control are still being worked out, the desired interface for those controls might change, and that is harder to do after the fact.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":169,"context_line":"is an error. There are no pre-defined API Access Lists yet but it is included"},{"line_number":170,"context_line":"for forward compatibility. As values that cannot be found are creation errors"},{"line_number":171,"context_line":"and there are no actual objects, any value other than null or omitting the"},{"line_number":172,"context_line":"field is an error."},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Response example:"},{"line_number":175,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_7c11fe5c","line":172,"in_reply_to":"df140735_b9de9bd7","updated":"2017-06-03 19:28:24.000000000","message":":P","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":169,"context_line":"is an error. There are no pre-defined API Access Lists yet but it is included"},{"line_number":170,"context_line":"for forward compatibility. As values that cannot be found are creation errors"},{"line_number":171,"context_line":"and there are no actual objects, any value other than null or omitting the"},{"line_number":172,"context_line":"field is an error."},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"Response example:"},{"line_number":175,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_b9de9bd7","line":172,"in_reply_to":"ff0f0b1f_12f7ae61","updated":"2017-06-02 16:50:45.000000000","message":"That is a good point - the main reason is that keystone doesn\u0027t have any microversion system, and most clients aren\u0027t actually set up to understand the difference between keystone 3.7 and 3.8 since clients tend to request \u00273\u0027 and it all just works. So I would be concerned that we\u0027d be setting ourselves up for an awkward future where a user wouldn\u0027t be able to know if their cloud support access lists or not.\n\nThat said - I just convinced myself of your point in writing that - because the user won\u0027t actually be able to know if they can create a key with access lists or not.\n\nMaybe we should add a quick capabilities discovery too ... :)","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":196,"context_line":"`secret` is a random string and only returned via the create API call."},{"line_number":197,"context_line":"Keystone will only store a hash of the `secret` and not the `secret` itself,"},{"line_number":198,"context_line":"so a lost `secret` is unrecoverable. Subsequent queries of an API Key will"},{"line_number":199,"context_line":"always return `null` in the secret field."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":".. note:: Identifying the correct way to generate an acceptable secret needs"},{"line_number":202,"context_line":"          to be done. Nova generates admin passwords on server creation, which"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_86c179e7","line":199,"updated":"2017-05-19 20:09:44.000000000","message":"Does it make sense to even expose this attribute in GET /api-keys/?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"2b128c5af121e6ea06d6be3c17291149baeda60a","unresolved":false,"context_lines":[{"line_number":196,"context_line":"`secret` is a random string and only returned via the create API call."},{"line_number":197,"context_line":"Keystone will only store a hash of the `secret` and not the `secret` itself,"},{"line_number":198,"context_line":"so a lost `secret` is unrecoverable. Subsequent queries of an API Key will"},{"line_number":199,"context_line":"always return `null` in the secret field."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":".. note:: Identifying the correct way to generate an acceptable secret needs"},{"line_number":202,"context_line":"          to be done. Nova generates admin passwords on server creation, which"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_3d0d7be8","line":199,"updated":"2017-05-25 16:03:11.000000000","message":"What\u0027s it for/mean?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":196,"context_line":"`secret` is a random string and only returned via the create API call."},{"line_number":197,"context_line":"Keystone will only store a hash of the `secret` and not the `secret` itself,"},{"line_number":198,"context_line":"so a lost `secret` is unrecoverable. Subsequent queries of an API Key will"},{"line_number":199,"context_line":"always return `null` in the secret field."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":".. note:: Identifying the correct way to generate an acceptable secret needs"},{"line_number":202,"context_line":"          to be done. Nova generates admin passwords on server creation, which"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_f546887c","line":199,"in_reply_to":"ff0f0b1f_86c179e7","updated":"2017-05-21 22:04:47.000000000","message":"I was doing it so that one could have a single Object Schema which is \"An API Key\" that would always have all the same attributes. It\u0027s not super important though and we could also just not have it.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0433e9130aa087f9facd3401160f86954b4008ba","unresolved":false,"context_lines":[{"line_number":208,"context_line":"API Key has the roles expected."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"`creator_id` contains the `id` of the User who created the API Key. It can be"},{"line_number":211,"context_line":"used by other Consumers who have a User with access to the Project in question"},{"line_number":212,"context_line":"to manage API Keys that were created by other Team members."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"If the Consumer prefers to generate their own `secret`, they can do so and"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_f2431a6b","line":211,"range":{"start_line":211,"start_character":0,"end_line":211,"end_character":23},"updated":"2017-05-22 23:22:02.000000000","message":"Used how?\n\nWhat happens when this user is deleted from keystone and the foreign key no longer refers to anything?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":208,"context_line":"API Key has the roles expected."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"`creator_id` contains the `id` of the User who created the API Key. It can be"},{"line_number":211,"context_line":"used by other Consumers who have a User with access to the Project in question"},{"line_number":212,"context_line":"to manage API Keys that were created by other Team members."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"If the Consumer prefers to generate their own `secret`, they can do so and"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_5c163a57","line":211,"range":{"start_line":211,"start_character":0,"end_line":211,"end_character":23},"in_reply_to":"df140735_5406261e","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":208,"context_line":"API Key has the roles expected."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"`creator_id` contains the `id` of the User who created the API Key. It can be"},{"line_number":211,"context_line":"used by other Consumers who have a User with access to the Project in question"},{"line_number":212,"context_line":"to manage API Keys that were created by other Team members."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"If the Consumer prefers to generate their own `secret`, they can do so and"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_5406261e","line":211,"range":{"start_line":211,"start_character":0,"end_line":211,"end_character":23},"in_reply_to":"ff0f0b1f_f2431a6b","updated":"2017-06-02 16:50:45.000000000","message":"Thoughts were that, since it\u0027s a project-level resource, it\u0027s possible another team member, or perhaps an admin, would like to get a list of all of the keys created by a user who is no longer there so that they can manage them or rotate them or delete them or whatnot.\n\nI think it\u0027s fine if the user is deleted and the user_id ceases to mean anything. In that case, the person looking at keys would say \"wow, that one has a user_id and that user_id is not valid\" (so I don\u0027t think it\u0027s important that it be implemented in the backend as an actual foreign key - but rather just as a copy of the particular piece of information.)","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":215,"context_line":"provide it in the create call. Keystone will store a hash of the given"},{"line_number":216,"context_line":"`secret` and not return it or store it in any way. Keystone will return `null`"},{"line_number":217,"context_line":"in the `secret` field as an acknowledgement that it recieved and did not"},{"line_number":218,"context_line":"generate a `secret`. For example:"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"::"},{"line_number":221,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_019313a5","line":218,"updated":"2017-05-19 20:09:44.000000000","message":"Is there a reason to not provide the secret in this case either? We can relay the same information in a positive sense by returning the actual secret they passed in, too.\n\n  def create_api_key(self, api_key_id, api_key_ref):\n      ...\n      secret \u003d api_key_ref.get(\u0027secret\u0027)\n      if not secret:\n          # The user didn\u0027t define a secret, so we should do that here\n          secret \u003d utils.generate_api_key_secret()\n\n      # pass control to the drivers to persist the bits\n      ref \u003d self.driver.create_api_key(...)\n      ref.update({\u0027secret\u0027: secret})\n      return ref\n\nI\u0027m not sure if it makes sense to script the creation of API keys, but if so then the thing doing the creating can always assume the secret in the response is the one they need to use when consuming the API key. This might totally be a usability nit, too.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":215,"context_line":"provide it in the create call. Keystone will store a hash of the given"},{"line_number":216,"context_line":"`secret` and not return it or store it in any way. Keystone will return `null`"},{"line_number":217,"context_line":"in the `secret` field as an acknowledgement that it recieved and did not"},{"line_number":218,"context_line":"generate a `secret`. For example:"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"::"},{"line_number":221,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_755a784f","line":218,"in_reply_to":"ff0f0b1f_019313a5","updated":"2017-05-21 22:04:47.000000000","message":"Yah - I can\u0027t come up with a real reason to not do that...","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":215,"context_line":"provide it in the create call. Keystone will store a hash of the given"},{"line_number":216,"context_line":"`secret` and not return it or store it in any way. Keystone will return `null`"},{"line_number":217,"context_line":"in the `secret` field as an acknowledgement that it recieved and did not"},{"line_number":218,"context_line":"generate a `secret`. For example:"},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"::"},{"line_number":221,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_3c0f0638","line":218,"in_reply_to":"ff0f0b1f_755a784f","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0433e9130aa087f9facd3401160f86954b4008ba","unresolved":false,"context_lines":[{"line_number":305,"context_line":""},{"line_number":306,"context_line":"::"},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"    DELETE /v3/projects/{project_id}/api_keys"},{"line_number":309,"context_line":""},{"line_number":310,"context_line":".. note:: API Keys that expire could accumulate for forever without an"},{"line_number":311,"context_line":"          automated cleanup. However, deleting a key as soon as it expires"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_920cde41","line":308,"updated":"2017-05-22 23:22:02.000000000","message":".../{key_id} right?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":305,"context_line":""},{"line_number":306,"context_line":"::"},{"line_number":307,"context_line":""},{"line_number":308,"context_line":"    DELETE /v3/projects/{project_id}/api_keys"},{"line_number":309,"context_line":""},{"line_number":310,"context_line":".. note:: API Keys that expire could accumulate for forever without an"},{"line_number":311,"context_line":"          automated cleanup. However, deleting a key as soon as it expires"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_742eca92","line":308,"in_reply_to":"ff0f0b1f_920cde41","updated":"2017-06-02 16:50:45.000000000","message":"yes!\n\n DELETE /v3/projects/{project_id}/api_keys/{key_id)","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          may make investigation as to why an Application is not working"},{"line_number":313,"context_line":"          harder. More thought and feedback on this are needed, but are not"},{"line_number":314,"context_line":"          essential for the first round of work. The amount of data stored"},{"line_number":315,"context_line":"          is very small and unlike tokens API Keys are not created constantly."},{"line_number":316,"context_line":""},{"line_number":317,"context_line":"Aside from deletion, API Keys are immutable and may not be modified."},{"line_number":318,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_e19edf61","line":315,"updated":"2017-05-19 20:09:44.000000000","message":"Oh - this is a good point. Let\u0027s say we work on a project that has a limit of 5 API keys. We go ahead and create:\n\n  - API key for backups\n  - API key for cleanup things based on notifications\n  - API key for billing things\n  - API key for monitoring\n  - API key for signup automation\n\nLet\u0027s say one of them expires and our backups stop working. Should we be able to create another API key if we have 5 API keys already even though one of them is expired?\n\nNot automatically deleting them after they expire makes total sense (and can probably be confirmed by an operator), but I tend to lean towards viewing the quota of all API keys, including expired ones. It means they are still traceable but we limit the damage of API key explosion (shrug)?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          may make investigation as to why an Application is not working"},{"line_number":313,"context_line":"          harder. More thought and feedback on this are needed, but are not"},{"line_number":314,"context_line":"          essential for the first round of work. The amount of data stored"},{"line_number":315,"context_line":"          is very small and unlike tokens API Keys are not created constantly."},{"line_number":316,"context_line":""},{"line_number":317,"context_line":"Aside from deletion, API Keys are immutable and may not be modified."},{"line_number":318,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_1c0c423f","line":315,"in_reply_to":"df140735_540ce6ea","updated":"2017-06-03 19:28:24.000000000","message":"Done\n\nOn the other hand - with all the discussion about how token expiry is why tokens are bad for applications, is adding expiry to API keys really an important feature? Operators and Users could delete keys manually or with scripts/keystone-manage that they really want revoked","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          may make investigation as to why an Application is not working"},{"line_number":313,"context_line":"          harder. More thought and feedback on this are needed, but are not"},{"line_number":314,"context_line":"          essential for the first round of work. The amount of data stored"},{"line_number":315,"context_line":"          is very small and unlike tokens API Keys are not created constantly."},{"line_number":316,"context_line":""},{"line_number":317,"context_line":"Aside from deletion, API Keys are immutable and may not be modified."},{"line_number":318,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_540ce6ea","line":315,"in_reply_to":"ff0f0b1f_d53ee4d8","updated":"2017-06-02 16:50:45.000000000","message":"the more I think about this, the more I think we should just delete them. The only real benefit is providing a different error message ... but I don\u0027t think that\u0027s actually that helpful.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":312,"context_line":"          may make investigation as to why an Application is not working"},{"line_number":313,"context_line":"          harder. More thought and feedback on this are needed, but are not"},{"line_number":314,"context_line":"          essential for the first round of work. The amount of data stored"},{"line_number":315,"context_line":"          is very small and unlike tokens API Keys are not created constantly."},{"line_number":316,"context_line":""},{"line_number":317,"context_line":"Aside from deletion, API Keys are immutable and may not be modified."},{"line_number":318,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_d53ee4d8","line":315,"in_reply_to":"ff0f0b1f_e19edf61","updated":"2017-05-21 22:04:47.000000000","message":"This is an excellent question - I can argue this one both ways I think.\n\nWe should try to figure out an actual use-case for the \u0027debug API keys not working\u0027 investigation ... although you\u0027ve given me an idea ...","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"a925673a5d1a1558ed21e85b0eca2af367767a07","unresolved":false,"context_lines":[{"line_number":318,"context_line":""},{"line_number":319,"context_line":".. _ISO Date Time Format: https://tools.ietf.org/html/rfc3339#section-5.6"},{"line_number":320,"context_line":""},{"line_number":321,"context_line":"Using an API Key to Obtain a Token"},{"line_number":322,"context_line":"----------------------------------"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"An API Key can be used for authentication to request a scoped token following"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_1029fc99","line":321,"updated":"2017-05-22 12:32:21.000000000","message":"Is there a use case for allowing this? The api key might not have all the roles a user has on a project, while it will still allow getting a token that will contain all user\u0027s roles.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"455eb176627356393bdde27172270c865a1cbd2c","unresolved":false,"context_lines":[{"line_number":318,"context_line":""},{"line_number":319,"context_line":".. _ISO Date Time Format: https://tools.ietf.org/html/rfc3339#section-5.6"},{"line_number":320,"context_line":""},{"line_number":321,"context_line":"Using an API Key to Obtain a Token"},{"line_number":322,"context_line":"----------------------------------"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"An API Key can be used for authentication to request a scoped token following"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_feead90c","line":321,"in_reply_to":"ff0f0b1f_1029fc99","updated":"2017-05-22 13:13:17.000000000","message":"This is the entire purpose of the API Key. It\u0027s a way to get a token that does not involve the original password.\n\nThe token the API Key gets will get the roles the API Key got on creation.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":318,"context_line":""},{"line_number":319,"context_line":".. _ISO Date Time Format: https://tools.ietf.org/html/rfc3339#section-5.6"},{"line_number":320,"context_line":""},{"line_number":321,"context_line":"Using an API Key to Obtain a Token"},{"line_number":322,"context_line":"----------------------------------"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"An API Key can be used for authentication to request a scoped token following"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_74f6ca65","line":321,"in_reply_to":"ff0f0b1f_9deec7b2","updated":"2017-06-02 16:50:45.000000000","message":"Yes - I totally understand your confusion and sadness. The main thing here is that all the libs and whatnot already understand the password-auth workflow.\n\nI mean, we *could* consider implementing a new form of bearer token, but I have a hunch that would grind itself for a couple of years trying to get agreement.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3afec73d97a2f7d2ab567e8a6ed72bdcf5320915","unresolved":false,"context_lines":[{"line_number":318,"context_line":""},{"line_number":319,"context_line":".. _ISO Date Time Format: https://tools.ietf.org/html/rfc3339#section-5.6"},{"line_number":320,"context_line":""},{"line_number":321,"context_line":"Using an API Key to Obtain a Token"},{"line_number":322,"context_line":"----------------------------------"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"An API Key can be used for authentication to request a scoped token following"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_b980fbc0","line":321,"in_reply_to":"ff0f0b1f_feead90c","updated":"2017-05-22 13:54:34.000000000","message":"Ah nice, I thought the keys would be passed along to services and those would use it to validate, just as an alternative to tokens. Thanks for clarifying.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"2b128c5af121e6ea06d6be3c17291149baeda60a","unresolved":false,"context_lines":[{"line_number":318,"context_line":""},{"line_number":319,"context_line":".. _ISO Date Time Format: https://tools.ietf.org/html/rfc3339#section-5.6"},{"line_number":320,"context_line":""},{"line_number":321,"context_line":"Using an API Key to Obtain a Token"},{"line_number":322,"context_line":"----------------------------------"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"An API Key can be used for authentication to request a scoped token following"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_9deec7b2","line":321,"in_reply_to":"ff0f0b1f_feead90c","updated":"2017-05-25 16:03:11.000000000","message":"This summary is a bit different from what I understood from one of the forums. I had heard:\n\nAs an OpenStack Consumer, I want to create tokens that I can give to my Applications so they may make API calls for resource in my project.\n\nThe implication being that API key generation (and the eventually tuning of permissions) is mostly initiated by a human (at least indirectly) who then consciously and knowingly takes that API key and puts it somewhere useful, like in a script and the API key isn\u0027t used to get a token, it stands in for the token.\n\nThat you\u0027ve designed something to get a token is perhaps why I\u0027ve been feeling this is over-engineered and doesn\u0027t map to create and burn a lot notion mention above.\n\nThe process I was imagining is much more like what you get on github:\n\n* got to web page, request api-key\n    * optionally de-tune api-key to be less than me\n* copy api-key to clipboard\n* paste api-key into script, code, config file, etc of Application\n* send api-key in my headers to various APIs\n* profit\n\nThat, to me, is _normal_, it\u0027s like a bearer token.\n\nI suppose, however, that it doesn\u0027t play well with existing auth middleware solutions and thus the two step dance is required.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"2b128c5af121e6ea06d6be3c17291149baeda60a","unresolved":false,"context_lines":[{"line_number":338,"context_line":"                ],"},{"line_number":339,"context_line":"                \"api_key\": {"},{"line_number":340,"context_line":"                    \"id\": \"aa4541d9-0bc0-44f5-b02d-a9d922df7cbd\","},{"line_number":341,"context_line":"                    \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\""},{"line_number":342,"context_line":"                }"},{"line_number":343,"context_line":"            }"},{"line_number":344,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_3d5a1b83","line":341,"updated":"2017-05-25 16:03:11.000000000","message":"So, here the secret is being used as the equivalent as a password. I guess that\u0027s more secure than having burnable api-keys that you just don\u0027t share but it kind of feels like this will lead to people creating:\n\n* name keys\n* with the same secret\n\nwhich means that safe rotation becomes a bit more complex.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":338,"context_line":"                ],"},{"line_number":339,"context_line":"                \"api_key\": {"},{"line_number":340,"context_line":"                    \"id\": \"aa4541d9-0bc0-44f5-b02d-a9d922df7cbd\","},{"line_number":341,"context_line":"                    \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\""},{"line_number":342,"context_line":"                }"},{"line_number":343,"context_line":"            }"},{"line_number":344,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_74c48af5","line":341,"in_reply_to":"ff0f0b1f_3d5a1b83","updated":"2017-06-02 16:50:45.000000000","message":"I\u0027m not sure I understand the concern or distinction you\u0027re making?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"2b128c5af121e6ea06d6be3c17291149baeda60a","unresolved":false,"context_lines":[{"line_number":357,"context_line":"If the API Key is referred to by `name`, it will be necessary to provide"},{"line_number":358,"context_line":"either `project_id` or the combination of `project_name` and"},{"line_number":359,"context_line":"`project_domain_name` so that Keystone can look up the API Key in the"},{"line_number":360,"context_line":"appropriate Project."},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"::"},{"line_number":363,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_5d7cafea","line":360,"updated":"2017-05-25 16:03:11.000000000","message":"Is the intent here to make it possible to rotate the key named \"foobar\" and not have to upgrade Application?\n\nI guess that\u0027s reasonable but it does make me wish for a simpler world.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":357,"context_line":"If the API Key is referred to by `name`, it will be necessary to provide"},{"line_number":358,"context_line":"either `project_id` or the combination of `project_name` and"},{"line_number":359,"context_line":"`project_domain_name` so that Keystone can look up the API Key in the"},{"line_number":360,"context_line":"appropriate Project."},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"::"},{"line_number":363,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_b4534239","line":360,"in_reply_to":"ff0f0b1f_5d7cafea","updated":"2017-06-02 16:50:45.000000000","message":"No, you\u0027ll have to update the application/config no matter what because the secret will change. This is to allow people to use a human readable name in a config file. putting id: {uuid} secret: {hash} into a config file makes it very hard for an user to know which key they\u0027re using. Same reason people refer to images and flavors by name rather than id in config files, and use project_name+project_domain_name in config files instead of just using project_id.\n\nBasically, anything that only allows reference by opaque id is very hard to manage as a user. Of course, everything should allow reference by unique opaque id for the folks who prefer that too.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"a925673a5d1a1558ed21e85b0eca2af367767a07","unresolved":false,"context_lines":[{"line_number":389,"context_line":"with the addition of restricting an API Key\u0027s API Access."},{"line_number":390,"context_line":""},{"line_number":391,"context_line":".. _passlib: https://pypi.python.org/pypi/passlib"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"Limitations Imposed"},{"line_number":394,"context_line":"-------------------"},{"line_number":395,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_d3a70ebd","line":392,"updated":"2017-05-22 12:32:21.000000000","message":"What if a user gets a role revoked on a project? How does this affect that user\u0027s API keys on the project? What if a role used by an API-key is deleted? I guess it would be great to add a subsection talking about revocation of roles/invalidation of API-keys.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"378d7799f8f15100ff7061ec5bc0ab2235bc34cf","unresolved":false,"context_lines":[{"line_number":389,"context_line":"with the addition of restricting an API Key\u0027s API Access."},{"line_number":390,"context_line":""},{"line_number":391,"context_line":".. _passlib: https://pypi.python.org/pypi/passlib"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"Limitations Imposed"},{"line_number":394,"context_line":"-------------------"},{"line_number":395,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_cf1f0f6a","line":392,"in_reply_to":"ff0f0b1f_4d68e785","updated":"2017-05-24 13:27:19.000000000","message":"But a role assignment belongs to the user+project, then I would invalidate the API key if the role assignment has been revoked/removed or any of its components (role, project or domain, user or group) has been removed/disabled.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0433e9130aa087f9facd3401160f86954b4008ba","unresolved":false,"context_lines":[{"line_number":389,"context_line":"with the addition of restricting an API Key\u0027s API Access."},{"line_number":390,"context_line":""},{"line_number":391,"context_line":".. _passlib: https://pypi.python.org/pypi/passlib"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"Limitations Imposed"},{"line_number":394,"context_line":"-------------------"},{"line_number":395,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_4d68e785","line":392,"in_reply_to":"ff0f0b1f_59543f53","updated":"2017-05-22 23:22:02.000000000","message":"\u003e I would go for the latter\n\nIt\u0027s not either-or, it\u0027s two different scenarios - if the creator\u0027s roles change, the API key should keep the roles it has when it was created, regardless of the status of the user who created it. That is the point of having it owned by the project and not by the user. If the role itself is deleted, then the API key using it is invalid.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3afec73d97a2f7d2ab567e8a6ed72bdcf5320915","unresolved":false,"context_lines":[{"line_number":389,"context_line":"with the addition of restricting an API Key\u0027s API Access."},{"line_number":390,"context_line":""},{"line_number":391,"context_line":".. _passlib: https://pypi.python.org/pypi/passlib"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"Limitations Imposed"},{"line_number":394,"context_line":"-------------------"},{"line_number":395,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_59543f53","line":392,"in_reply_to":"ff0f0b1f_be3ea188","updated":"2017-05-22 13:54:34.000000000","message":"I would go for the latter, as this is what we do for tokens when a role is deleted from the system or grant removed from the user.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":389,"context_line":"with the addition of restricting an API Key\u0027s API Access."},{"line_number":390,"context_line":""},{"line_number":391,"context_line":".. _passlib: https://pypi.python.org/pypi/passlib"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"Limitations Imposed"},{"line_number":394,"context_line":"-------------------"},{"line_number":395,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_9f29778b","line":392,"in_reply_to":"ff0f0b1f_cf1f0f6a","updated":"2017-06-02 16:50:45.000000000","message":"Right - but then the api key is no longer immutable.\n\nConsider the API Key to be a type of a \"user\" on the backend, and that API Key creation time does the equiv of assigning roles to the Key. Once the key is created, it has no further relationship to the user.\n\nThat said, an admin deleting a role may very well want to delete all api keys that have that role, so we should probably at the very least make that easy to do.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"455eb176627356393bdde27172270c865a1cbd2c","unresolved":false,"context_lines":[{"line_number":389,"context_line":"with the addition of restricting an API Key\u0027s API Access."},{"line_number":390,"context_line":""},{"line_number":391,"context_line":".. _passlib: https://pypi.python.org/pypi/passlib"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"Limitations Imposed"},{"line_number":394,"context_line":"-------------------"},{"line_number":395,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_be3ea188","line":392,"in_reply_to":"ff0f0b1f_d3a70ebd","updated":"2017-05-22 13:13:17.000000000","message":"Great question! And I agree - I think we definitely need a section on that topic.\n\nI believe the answers would be:\n- User has role revoked - nothing happens - an API Key has the roles it has when it was created. If the admin who revokes the roles cares - they can delete all of the user\u0027s API Keys at role revocation time. (maybe we want to add a flag to role_remove to invalidate keys)\n- Role is removed should definitely invalidate all keys that use that role.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"2b128c5af121e6ea06d6be3c17291149baeda60a","unresolved":false,"context_lines":[{"line_number":406,"context_line":"* PATCH /projects/{}"},{"line_number":407,"context_line":"* DELETE /projects/{}"},{"line_number":408,"context_line":""},{"line_number":409,"context_line":".. note:: It might be simpler and safer for now to just block an token"},{"line_number":410,"context_line":"          generated from an API Key from doing any action in Keystone"},{"line_number":411,"context_line":"          altogether."},{"line_number":412,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_9ddfe7d5","line":409,"updated":"2017-05-25 16:03:11.000000000","message":"a token.\n\nAlso, just for my reference because I\u0027m not too savvy on keystone, if an api-key is being used to generate a token and then that token is used throughout the session, how does that token identify itself as \"I was created via an api-key?\"","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":406,"context_line":"* PATCH /projects/{}"},{"line_number":407,"context_line":"* DELETE /projects/{}"},{"line_number":408,"context_line":""},{"line_number":409,"context_line":".. note:: It might be simpler and safer for now to just block an token"},{"line_number":410,"context_line":"          generated from an API Key from doing any action in Keystone"},{"line_number":411,"context_line":"          altogether."},{"line_number":412,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_dc012a08","line":409,"in_reply_to":"df140735_dfb5af33","updated":"2017-06-03 19:28:24.000000000","message":"Added this note","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":406,"context_line":"* PATCH /projects/{}"},{"line_number":407,"context_line":"* DELETE /projects/{}"},{"line_number":408,"context_line":""},{"line_number":409,"context_line":".. note:: It might be simpler and safer for now to just block an token"},{"line_number":410,"context_line":"          generated from an API Key from doing any action in Keystone"},{"line_number":411,"context_line":"          altogether."},{"line_number":412,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_dfb5af33","line":409,"in_reply_to":"ff0f0b1f_9ddfe7d5","updated":"2017-06-02 16:50:45.000000000","message":"That\u0027s a great question. The token returned from keystone includes a \"methods\" key which has a list. This contains the list of auth methods used, so for password auth it\u0027s [\u0027password\u0027]  ... for api-key auth I would expect it to contain [\u0027api-key\u0027]","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0433e9130aa087f9facd3401160f86954b4008ba","unresolved":false,"context_lines":[{"line_number":408,"context_line":""},{"line_number":409,"context_line":".. note:: It might be simpler and safer for now to just block an token"},{"line_number":410,"context_line":"          generated from an API Key from doing any action in Keystone"},{"line_number":411,"context_line":"          altogether."},{"line_number":412,"context_line":""},{"line_number":413,"context_line":"In the follow up to this spec where API Access Lists are defined, this"},{"line_number":414,"context_line":"built-in blacklist should be migrated to being content in that system."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_ad230356","line":411,"updated":"2017-05-22 23:22:02.000000000","message":"I can imagine legitimate cases for an API key to want to do GETs from keystone","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":408,"context_line":""},{"line_number":409,"context_line":".. note:: It might be simpler and safer for now to just block an token"},{"line_number":410,"context_line":"          generated from an API Key from doing any action in Keystone"},{"line_number":411,"context_line":"          altogether."},{"line_number":412,"context_line":""},{"line_number":413,"context_line":"In the follow up to this spec where API Access Lists are defined, this"},{"line_number":414,"context_line":"built-in blacklist should be migrated to being content in that system."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_bf00a802","line":411,"in_reply_to":"df140735_df8ecf77","updated":"2017-06-03 19:28:24.000000000","message":"okay","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":408,"context_line":""},{"line_number":409,"context_line":".. note:: It might be simpler and safer for now to just block an token"},{"line_number":410,"context_line":"          generated from an API Key from doing any action in Keystone"},{"line_number":411,"context_line":"          altogether."},{"line_number":412,"context_line":""},{"line_number":413,"context_line":"In the follow up to this spec where API Access Lists are defined, this"},{"line_number":414,"context_line":"built-in blacklist should be migrated to being content in that system."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_df8ecf77","line":411,"in_reply_to":"ff0f0b1f_ad230356","updated":"2017-06-02 16:50:45.000000000","message":"Yes - I can too. I think the main concern from me was that until we have _proper_ access exclusions, it might be safer to just block keystone so that we don\u0027t have to have a hard-coded exclusion list.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"2b128c5af121e6ea06d6be3c17291149baeda60a","unresolved":false,"context_lines":[{"line_number":420,"context_line":"keystone model and is consistent with others APIs providing application"},{"line_number":421,"context_line":"authentication. It also avoids the security and performance implications of"},{"line_number":422,"context_line":"creating a new token type that would potentially never expire and have custom"},{"line_number":423,"context_line":"validation."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"Implementing API Key management as normal CRUD with default policy that normal"},{"line_number":426,"context_line":"Users have access to adds the ability without Deployer work."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_1d7077dc","line":423,"updated":"2017-05-25 16:03:11.000000000","message":"Apparently this section being sooner in the document would have helped me...","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":420,"context_line":"keystone model and is consistent with others APIs providing application"},{"line_number":421,"context_line":"authentication. It also avoids the security and performance implications of"},{"line_number":422,"context_line":"creating a new token type that would potentially never expire and have custom"},{"line_number":423,"context_line":"validation."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"Implementing API Key management as normal CRUD with default policy that normal"},{"line_number":426,"context_line":"Users have access to adds the ability without Deployer work."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_fc0d6835","line":423,"updated":"2017-05-19 20:09:44.000000000","message":"One of the things we talked about as a keystone group at the PTG was the usage of typical API keys. The way we\u0027re wanting to enforce the usage here makes API keys a mechanism for obtaining a scoped token. Some argued that the traditional usage of just being able to use them to authenticate was desirable as well.\n\nIn the first case we\u0027re requiring the applications using API keys to understand OpenStack\u0027s (specifically keystone\u0027s) concept of scoping to a project. In the second we\u0027re ignoring that and just allowing the API key to be used straight-up. The first kinda makes me think what we\u0027re doing is an application specific password, the second seems more like an API key IMO.\n\nI\u0027m not sure what the right answer is here, but it probably needs some input from the folks writing the application?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":420,"context_line":"keystone model and is consistent with others APIs providing application"},{"line_number":421,"context_line":"authentication. It also avoids the security and performance implications of"},{"line_number":422,"context_line":"creating a new token type that would potentially never expire and have custom"},{"line_number":423,"context_line":"validation."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"Implementing API Key management as normal CRUD with default policy that normal"},{"line_number":426,"context_line":"Users have access to adds the ability without Deployer work."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_3f149843","line":423,"in_reply_to":"df140735_3ff5cbed","updated":"2017-06-03 19:28:24.000000000","message":"moved to the early part of the Proposed Solution","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":420,"context_line":"keystone model and is consistent with others APIs providing application"},{"line_number":421,"context_line":"authentication. It also avoids the security and performance implications of"},{"line_number":422,"context_line":"creating a new token type that would potentially never expire and have custom"},{"line_number":423,"context_line":"validation."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"Implementing API Key management as normal CRUD with default policy that normal"},{"line_number":426,"context_line":"Users have access to adds the ability without Deployer work."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_3ff5cbed","line":423,"in_reply_to":"ff0f0b1f_1d7077dc","updated":"2017-06-02 16:50:45.000000000","message":"Then let\u0027s move it up to be at the end of the problem description perhaps?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":420,"context_line":"keystone model and is consistent with others APIs providing application"},{"line_number":421,"context_line":"authentication. It also avoids the security and performance implications of"},{"line_number":422,"context_line":"creating a new token type that would potentially never expire and have custom"},{"line_number":423,"context_line":"validation."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"Implementing API Key management as normal CRUD with default policy that normal"},{"line_number":426,"context_line":"Users have access to adds the ability without Deployer work."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_b50ed038","line":423,"in_reply_to":"ff0f0b1f_fc0d6835","updated":"2017-05-21 22:04:47.000000000","message":"From my end, most all of the things out there, including keystoneauth, treat project_id as part of the auth information. (the distinction between \"I want a scoped token\" and \"I want to authenticate\" in an OpenStack context doesn\u0027t really exist for folks consuming the API - a project is simply part of the info you have to provide to authenticate.\n\nIf that wasn\u0027t the case and instead you just authenticated - I literally don\u0027t know how interacting with any of the other services would work. The Nova API call is GET /v2/servers without a project id passed anywhere - because it\u0027s in the token.\n\nSo - from my end, I would be _strongly_ opposed to treating this differently than how password auth works today - because all of the things would need to rewritten. If we treat it as an application specific password, then the only thing that has to change is going from auth_type\u003d\u0027Password\u0027, username\u003d\u0027foo\u0027, password\u003d\u0027secret\u0027, project_id\u003d\u0027xxx\u0027 to auth_type\u003d\u0027api_key\u0027, id\u003d\u0027123\u0027, secret\u003d\u0027xxx\u0027 and all of the existing usage patterns can continue to work.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":423,"context_line":"validation."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"Implementing API Key management as normal CRUD with default policy that normal"},{"line_number":426,"context_line":"Users have access to adds the ability without Deployer work."},{"line_number":427,"context_line":""},{"line_number":428,"context_line":"Implementing API Keys consumption as an auth-type plugin means that any Client"},{"line_number":429,"context_line":"code that supports pluggable auth in any way should be able to easily consume"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_9c28ac86","line":426,"updated":"2017-05-19 20:09:44.000000000","message":"I assume \"Deployer work\" here means modifying policy to open this up from consumers?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":423,"context_line":"validation."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"Implementing API Key management as normal CRUD with default policy that normal"},{"line_number":426,"context_line":"Users have access to adds the ability without Deployer work."},{"line_number":427,"context_line":""},{"line_number":428,"context_line":"Implementing API Keys consumption as an auth-type plugin means that any Client"},{"line_number":429,"context_line":"code that supports pluggable auth in any way should be able to easily consume"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_1f11d452","line":426,"in_reply_to":"ff0f0b1f_95098c32","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":423,"context_line":"validation."},{"line_number":424,"context_line":""},{"line_number":425,"context_line":"Implementing API Key management as normal CRUD with default policy that normal"},{"line_number":426,"context_line":"Users have access to adds the ability without Deployer work."},{"line_number":427,"context_line":""},{"line_number":428,"context_line":"Implementing API Keys consumption as an auth-type plugin means that any Client"},{"line_number":429,"context_line":"code that supports pluggable auth in any way should be able to easily consume"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_95098c32","line":426,"in_reply_to":"ff0f0b1f_9c28ac86","updated":"2017-05-21 22:04:47.000000000","message":"Oh - \"Deployer work\" here means \"setting up an OAuth service or setting up a half-LDAP/half-password backend\" or something like that. It\u0027ll just be a new thing in the next release of keystone and no new services needed by the deployer. I\u0027ll clarify that.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"a925673a5d1a1558ed21e85b0eca2af367767a07","unresolved":false,"context_lines":[{"line_number":431,"context_line":"authentication should have a compelling motivation to add it."},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"Alternatives"},{"line_number":434,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"Just use OAuth. Keystone already supports OAuth-based authentication. However,"},{"line_number":437,"context_line":"adding OAuth on top of an existing Auth system is a deployer opt-in task that"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_33008aab","line":434,"updated":"2017-05-22 12:32:21.000000000","message":"could we implement the same with trusts created to the service user with a subset of roles a given user has?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"455eb176627356393bdde27172270c865a1cbd2c","unresolved":false,"context_lines":[{"line_number":431,"context_line":"authentication should have a compelling motivation to add it."},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"Alternatives"},{"line_number":434,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"Just use OAuth. Keystone already supports OAuth-based authentication. However,"},{"line_number":437,"context_line":"adding OAuth on top of an existing Auth system is a deployer opt-in task that"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_3e5291df","line":434,"in_reply_to":"ff0f0b1f_33008aab","updated":"2017-05-22 13:13:17.000000000","message":"I will add an entry for that.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":431,"context_line":"authentication should have a compelling motivation to add it."},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"Alternatives"},{"line_number":434,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"Just use OAuth. Keystone already supports OAuth-based authentication. However,"},{"line_number":437,"context_line":"adding OAuth on top of an existing Auth system is a deployer opt-in task that"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_df16bc49","line":434,"in_reply_to":"ff0f0b1f_3e5291df","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0433e9130aa087f9facd3401160f86954b4008ba","unresolved":false,"context_lines":[{"line_number":437,"context_line":"adding OAuth on top of an existing Auth system is a deployer opt-in task that"},{"line_number":438,"context_line":"involves considerable deployer effort. If the goal is to add support for a"},{"line_number":439,"context_line":"concept that will always dependably exist, OAuth represents too high of a"},{"line_number":440,"context_line":"burden to be reasonable."},{"line_number":441,"context_line":""},{"line_number":442,"context_line":"On naming: GCE uses the term \"Service Account\" and discusses the concept of"},{"line_number":443,"context_line":"\"Application Access\". Both could be useful alternate terms to API Key."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_ed81fbfc","line":440,"updated":"2017-05-22 23:22:02.000000000","message":"I think the thoughts from Zane and Sean in this post http://lists.openstack.org/pipermail/openstack-dev/2017-May/116893.html need to be captured here - namely that OAuth is user-centric and a primary requirement of this spec is for keys to be project-owned.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":437,"context_line":"adding OAuth on top of an existing Auth system is a deployer opt-in task that"},{"line_number":438,"context_line":"involves considerable deployer effort. If the goal is to add support for a"},{"line_number":439,"context_line":"concept that will always dependably exist, OAuth represents too high of a"},{"line_number":440,"context_line":"burden to be reasonable."},{"line_number":441,"context_line":""},{"line_number":442,"context_line":"On naming: GCE uses the term \"Service Account\" and discusses the concept of"},{"line_number":443,"context_line":"\"Application Access\". Both could be useful alternate terms to API Key."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_bf29c88a","line":440,"in_reply_to":"df140735_ffdab375","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":437,"context_line":"adding OAuth on top of an existing Auth system is a deployer opt-in task that"},{"line_number":438,"context_line":"involves considerable deployer effort. If the goal is to add support for a"},{"line_number":439,"context_line":"concept that will always dependably exist, OAuth represents too high of a"},{"line_number":440,"context_line":"burden to be reasonable."},{"line_number":441,"context_line":""},{"line_number":442,"context_line":"On naming: GCE uses the term \"Service Account\" and discusses the concept of"},{"line_number":443,"context_line":"\"Application Access\". Both could be useful alternate terms to API Key."}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_ffdab375","line":440,"in_reply_to":"ff0f0b1f_ed81fbfc","updated":"2017-06-02 16:50:45.000000000","message":"agree","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"2b128c5af121e6ea06d6be3c17291149baeda60a","unresolved":false,"context_lines":[{"line_number":444,"context_line":"Drawbacks are that \"Service Account\" uses the word \"account\" which may run"},{"line_number":445,"context_line":"afoul of understanding. And \"application access\", while clearer, is a little"},{"line_number":446,"context_line":"confusing for people using the concept for general automation and not for"},{"line_number":447,"context_line":"\"an application\". \"Application Access\" did inspire the naming of \"API Access\"."},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"Github exposes a similar concept as \"Integrations\" which are special account"},{"line_number":450,"context_line":"intended to be used for non-human API access, such as bots or other automation."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_20254eac","line":447,"updated":"2017-05-25 16:03:11.000000000","message":"My desire to use the term \"API Key\" was based on my (apparent) misconception of what this was going to be. Since these are in fact _not_ api keys as commonly understood, I think a different name is warranted.\n\nUnless of course we decide we do want api keys, in which case, disco.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"72c26f4fcd932208f69b0f341ee0170c89ef7a3c","unresolved":false,"context_lines":[{"line_number":444,"context_line":"Drawbacks are that \"Service Account\" uses the word \"account\" which may run"},{"line_number":445,"context_line":"afoul of understanding. And \"application access\", while clearer, is a little"},{"line_number":446,"context_line":"confusing for people using the concept for general automation and not for"},{"line_number":447,"context_line":"\"an application\". \"Application Access\" did inspire the naming of \"API Access\"."},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"Github exposes a similar concept as \"Integrations\" which are special account"},{"line_number":450,"context_line":"intended to be used for non-human API access, such as bots or other automation."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_cf48fd5d","line":447,"in_reply_to":"ff0f0b1f_20254eac","updated":"2017-05-25 19:14:07.000000000","message":"Do you have a reference that describes that commonly understood model? The github workflow you described is also what comes to my mind when using this term, but I\u0027m not sure that\u0027s really authoritative. The wikipedia article is pretty nonspecific. I think we\u0027re all a little confused about this.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"3d980ab393faf603915cf8b800294a432c686907","unresolved":false,"context_lines":[{"line_number":444,"context_line":"Drawbacks are that \"Service Account\" uses the word \"account\" which may run"},{"line_number":445,"context_line":"afoul of understanding. And \"application access\", while clearer, is a little"},{"line_number":446,"context_line":"confusing for people using the concept for general automation and not for"},{"line_number":447,"context_line":"\"an application\". \"Application Access\" did inspire the naming of \"API Access\"."},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"Github exposes a similar concept as \"Integrations\" which are special account"},{"line_number":450,"context_line":"intended to be used for non-human API access, such as bots or other automation."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_a4b60bdc","line":447,"in_reply_to":"ff0f0b1f_cf48fd5d","updated":"2017-05-25 19:59:38.000000000","message":"Citation needed? Yeah, I\u0027m not sure I can give one, it\u0027s basically just part of the common parlance I\u0027ve been using for \u003e10 years of making HTTP APIs with other people but it extremely likely that it just happened to be the term within the group I was in, which was relatively the same for that period.\n\nI do, however, think a lot of other people will be misled.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":446,"context_line":"confusing for people using the concept for general automation and not for"},{"line_number":447,"context_line":"\"an application\". \"Application Access\" did inspire the naming of \"API Access\"."},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"Github exposes a similar concept as \"Integrations\" which are special account"},{"line_number":450,"context_line":"intended to be used for non-human API access, such as bots or other automation."},{"line_number":451,"context_line":"They are similarly intended to be a project-level resource rather than a"},{"line_number":452,"context_line":"user-level resource. \"Integration\" could be a name for this. However, the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_7c50380b","line":449,"updated":"2017-05-19 20:09:44.000000000","message":"accounts*","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":446,"context_line":"confusing for people using the concept for general automation and not for"},{"line_number":447,"context_line":"\"an application\". \"Application Access\" did inspire the naming of \"API Access\"."},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"Github exposes a similar concept as \"Integrations\" which are special account"},{"line_number":450,"context_line":"intended to be used for non-human API access, such as bots or other automation."},{"line_number":451,"context_line":"They are similarly intended to be a project-level resource rather than a"},{"line_number":452,"context_line":"user-level resource. \"Integration\" could be a name for this. However, the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_7f1fb05a","line":449,"in_reply_to":"ff0f0b1f_7c50380b","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":446,"context_line":"confusing for people using the concept for general automation and not for"},{"line_number":447,"context_line":"\"an application\". \"Application Access\" did inspire the naming of \"API Access\"."},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"Github exposes a similar concept as \"Integrations\" which are special account"},{"line_number":450,"context_line":"intended to be used for non-human API access, such as bots or other automation."},{"line_number":451,"context_line":"They are similarly intended to be a project-level resource rather than a"},{"line_number":452,"context_line":"user-level resource. \"Integration\" could be a name for this. However, the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_bf679bb7","line":449,"in_reply_to":"ff0f0b1f_7c50380b","updated":"2017-06-02 16:50:45.000000000","message":"This whole bit needs to be changed. Turns out github is also renaming those things \"Apps\"\n\nPerhaps we should re-think calling them \"app keys\" - or maybe \"access key\" or \"app authorization\"\n\nOne of the problems is that the places that don\u0027t use the term \"api key\" use some form of the word \"token\" -which I think any use of in this context would confuse way more things than it would solve.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"0433e9130aa087f9facd3401160f86954b4008ba","unresolved":false,"context_lines":[{"line_number":453,"context_line":"Github concept goes hand-in-hand with a catalog of services that people can"},{"line_number":454,"context_line":"register to do things on their accouts, which is well out of scope for this"},{"line_number":455,"context_line":"proposal, so using that term is likely to cause more confusion that good."},{"line_number":456,"context_line":""},{"line_number":457,"context_line":"Security Impact"},{"line_number":458,"context_line":"---------------"},{"line_number":459,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_6dfbab46","line":456,"updated":"2017-05-22 23:22:02.000000000","message":"There have been a lot of proposals for solving different subsets of this use cases imagined here. For the sake of future-proofing this idea, it would be good if they were all mentioned and discounted here.\n\n\nTokens with subsets of roles - https://review.openstack.org/#/c/186979\nSolves the POLP problem but is still user-centric, and token expiry makes it insufficient for use by applications.\n\n\nAdditional user credentials - https://review.openstack.org/#/c/389870\nSolves the POLP problem and enhances security for service users, but again, user-centric.\n\n\nStandalone trusts - https://review.openstack.org/#/c/396634\nI\u0027m not actually sure why this is off the table.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":453,"context_line":"Github concept goes hand-in-hand with a catalog of services that people can"},{"line_number":454,"context_line":"register to do things on their accouts, which is well out of scope for this"},{"line_number":455,"context_line":"proposal, so using that term is likely to cause more confusion that good."},{"line_number":456,"context_line":""},{"line_number":457,"context_line":"Security Impact"},{"line_number":458,"context_line":"---------------"},{"line_number":459,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_5f24ecae","line":456,"in_reply_to":"df140735_9fa297ad","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":453,"context_line":"Github concept goes hand-in-hand with a catalog of services that people can"},{"line_number":454,"context_line":"register to do things on their accouts, which is well out of scope for this"},{"line_number":455,"context_line":"proposal, so using that term is likely to cause more confusion that good."},{"line_number":456,"context_line":""},{"line_number":457,"context_line":"Security Impact"},{"line_number":458,"context_line":"---------------"},{"line_number":459,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_9fa297ad","line":456,"in_reply_to":"ff0f0b1f_6dfbab46","updated":"2017-06-02 16:50:45.000000000","message":"Agree with including.\n\nStandalone trusts still require project and role assignments, which are admin operations. We could implement this as \"make it possible to create a trust that starts with the role assignments of a given user on a project\" ... but we\u0027d still need the next step of specific api access lists, so then we\u0027d need to add that feature to trusts broadly ... and then it feels like maybe we just did this but bolted it on to trusts? Or maybe that\u0027s what the actual backend impl would wind up being?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"a925673a5d1a1558ed21e85b0eca2af367767a07","unresolved":false,"context_lines":[{"line_number":460,"context_line":"This would have a positive security impact:"},{"line_number":461,"context_line":""},{"line_number":462,"context_line":"* Instead of having a Service User for each service, all services can use a"},{"line_number":463,"context_line":"  single Service User and multiple API Keys. This decreases the attack vector"},{"line_number":464,"context_line":"  of gaining access to privileged operations by reducing the number of accounts"},{"line_number":465,"context_line":"  to attack."},{"line_number":466,"context_line":"* User names and passwords are kept out of configuration files. While API Keys"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_736ba2b6","line":463,"range":{"start_line":463,"start_character":0,"end_line":463,"end_character":43},"updated":"2017-05-22 12:32:21.000000000","message":"one of the restrictions said the user would only have a max of 5 keys, so would we only be able to have 5 services ?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"455eb176627356393bdde27172270c865a1cbd2c","unresolved":false,"context_lines":[{"line_number":460,"context_line":"This would have a positive security impact:"},{"line_number":461,"context_line":""},{"line_number":462,"context_line":"* Instead of having a Service User for each service, all services can use a"},{"line_number":463,"context_line":"  single Service User and multiple API Keys. This decreases the attack vector"},{"line_number":464,"context_line":"  of gaining access to privileged operations by reducing the number of accounts"},{"line_number":465,"context_line":"  to attack."},{"line_number":466,"context_line":"* User names and passwords are kept out of configuration files. While API Keys"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_de0b95d3","line":463,"range":{"start_line":463,"start_character":0,"end_line":463,"end_character":43},"in_reply_to":"ff0f0b1f_736ba2b6","updated":"2017-05-22 13:13:17.000000000","message":"I would expect that to be an admin-settable quota (similar to quotas on servers, ports, etc) - so hopefully the cloud admin does not limit themselves to 5 api keys if they need keys for 10 services :)\n\nWill add clarification.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3afec73d97a2f7d2ab567e8a6ed72bdcf5320915","unresolved":false,"context_lines":[{"line_number":460,"context_line":"This would have a positive security impact:"},{"line_number":461,"context_line":""},{"line_number":462,"context_line":"* Instead of having a Service User for each service, all services can use a"},{"line_number":463,"context_line":"  single Service User and multiple API Keys. This decreases the attack vector"},{"line_number":464,"context_line":"  of gaining access to privileged operations by reducing the number of accounts"},{"line_number":465,"context_line":"  to attack."},{"line_number":466,"context_line":"* User names and passwords are kept out of configuration files. While API Keys"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_99d3f7d5","line":463,"range":{"start_line":463,"start_character":0,"end_line":463,"end_character":43},"in_reply_to":"ff0f0b1f_de0b95d3","updated":"2017-05-22 13:54:34.000000000","message":"++","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":462,"context_line":"* Instead of having a Service User for each service, all services can use a"},{"line_number":463,"context_line":"  single Service User and multiple API Keys. This decreases the attack vector"},{"line_number":464,"context_line":"  of gaining access to privileged operations by reducing the number of accounts"},{"line_number":465,"context_line":"  to attack."},{"line_number":466,"context_line":"* User names and passwords are kept out of configuration files. While API Keys"},{"line_number":467,"context_line":"  are still extremely sensitive, if compromised they do not allow attackers to"},{"line_number":468,"context_line":"  glean service user password conventions from configuration."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_9cd2ec5b","line":465,"updated":"2017-05-19 20:09:44.000000000","message":"This might be something we can tackle in the future, but another cool thing about this is that you can have a single Service User with the nova_service, cinder_service, neutron_service roles. Then Deployers could create API keys for the Service User scoped to the role requires for that endpoint, which further limits the API access based on the role without losing the audibility of a single service user.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":462,"context_line":"* Instead of having a Service User for each service, all services can use a"},{"line_number":463,"context_line":"  single Service User and multiple API Keys. This decreases the attack vector"},{"line_number":464,"context_line":"  of gaining access to privileged operations by reducing the number of accounts"},{"line_number":465,"context_line":"  to attack."},{"line_number":466,"context_line":"* User names and passwords are kept out of configuration files. While API Keys"},{"line_number":467,"context_line":"  are still extremely sensitive, if compromised they do not allow attackers to"},{"line_number":468,"context_line":"  glean service user password conventions from configuration."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_e009242c","line":465,"in_reply_to":"ff0f0b1f_9cd2ec5b","updated":"2017-05-21 22:04:47.000000000","message":"That might is a good argument for why an optional role list in the api key is a good idea. Like - I grok why a Deployer would want that- and how they could understand to use it. As a Consumer doing so is pretty opaque - but this use case I like!","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":469,"context_line":"* API Keys will grow the ability to have limited access, so a move to them is"},{"line_number":470,"context_line":"  a further step towards limited access keys."},{"line_number":471,"context_line":"* API Keys can be gracefully rotated out of use and deleted periodically,"},{"line_number":472,"context_line":"  allowing Consumers and Deployers a mechanism to prevent compromised Users."},{"line_number":473,"context_line":""},{"line_number":474,"context_line":"There is an inherent risk with adding a new credential type and changing"},{"line_number":475,"context_line":"authentication details. One such risk would be the allowing of many credentials"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_3c73e0b3","line":472,"updated":"2017-05-19 20:09:44.000000000","message":"++ \n\n.. compromised Users without requiring swapping credentials in short amounts of time that might cause service interruption or downtime.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":469,"context_line":"* API Keys will grow the ability to have limited access, so a move to them is"},{"line_number":470,"context_line":"  a further step towards limited access keys."},{"line_number":471,"context_line":"* API Keys can be gracefully rotated out of use and deleted periodically,"},{"line_number":472,"context_line":"  allowing Consumers and Deployers a mechanism to prevent compromised Users."},{"line_number":473,"context_line":""},{"line_number":474,"context_line":"There is an inherent risk with adding a new credential type and changing"},{"line_number":475,"context_line":"authentication details. One such risk would be the allowing of many credentials"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_3f3db8c3","line":472,"in_reply_to":"df140735_5fa87f8a","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":469,"context_line":"* API Keys will grow the ability to have limited access, so a move to them is"},{"line_number":470,"context_line":"  a further step towards limited access keys."},{"line_number":471,"context_line":"* API Keys can be gracefully rotated out of use and deleted periodically,"},{"line_number":472,"context_line":"  allowing Consumers and Deployers a mechanism to prevent compromised Users."},{"line_number":473,"context_line":""},{"line_number":474,"context_line":"There is an inherent risk with adding a new credential type and changing"},{"line_number":475,"context_line":"authentication details. One such risk would be the allowing of many credentials"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_5fa87f8a","line":472,"in_reply_to":"ff0f0b1f_3c73e0b3","updated":"2017-06-02 16:50:45.000000000","message":"agree","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"a925673a5d1a1558ed21e85b0eca2af367767a07","unresolved":false,"context_lines":[{"line_number":487,"context_line":"  Services should be able to leverage this feature to improve the overall"},{"line_number":488,"context_line":"  security of their Applications."},{"line_number":489,"context_line":"* Consumers who do not start using API Keys should experience no impact."},{"line_number":490,"context_line":"* Consumers can gracefully rotate API Keys for an Application with no"},{"line_number":491,"context_line":"  downtime."},{"line_number":492,"context_line":""},{"line_number":493,"context_line":"Performance Impact"},{"line_number":494,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_b3f01aff","line":491,"range":{"start_line":490,"start_character":1,"end_line":491,"end_character":11},"updated":"2017-05-22 12:32:21.000000000","message":"how? when an API key is deleted or rotated the service config files with the API keys would still need to be updated, correct? so the problem of needing to update the config files persists","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":487,"context_line":"  Services should be able to leverage this feature to improve the overall"},{"line_number":488,"context_line":"  security of their Applications."},{"line_number":489,"context_line":"* Consumers who do not start using API Keys should experience no impact."},{"line_number":490,"context_line":"* Consumers can gracefully rotate API Keys for an Application with no"},{"line_number":491,"context_line":"  downtime."},{"line_number":492,"context_line":""},{"line_number":493,"context_line":"Performance Impact"},{"line_number":494,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_1f3af4ca","line":491,"range":{"start_line":490,"start_character":1,"end_line":491,"end_character":11},"in_reply_to":"df140735_3fadcb9a","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3afec73d97a2f7d2ab567e8a6ed72bdcf5320915","unresolved":false,"context_lines":[{"line_number":487,"context_line":"  Services should be able to leverage this feature to improve the overall"},{"line_number":488,"context_line":"  security of their Applications."},{"line_number":489,"context_line":"* Consumers who do not start using API Keys should experience no impact."},{"line_number":490,"context_line":"* Consumers can gracefully rotate API Keys for an Application with no"},{"line_number":491,"context_line":"  downtime."},{"line_number":492,"context_line":""},{"line_number":493,"context_line":"Performance Impact"},{"line_number":494,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_b9e7dbac","line":491,"range":{"start_line":490,"start_character":1,"end_line":491,"end_character":11},"in_reply_to":"ff0f0b1f_5e20a548","updated":"2017-05-22 13:54:34.000000000","message":"thanks for clarifying, it\u0027d be nice to add this process somewhere so it\u0027s clear to other reviewers too :-)","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"455eb176627356393bdde27172270c865a1cbd2c","unresolved":false,"context_lines":[{"line_number":487,"context_line":"  Services should be able to leverage this feature to improve the overall"},{"line_number":488,"context_line":"  security of their Applications."},{"line_number":489,"context_line":"* Consumers who do not start using API Keys should experience no impact."},{"line_number":490,"context_line":"* Consumers can gracefully rotate API Keys for an Application with no"},{"line_number":491,"context_line":"  downtime."},{"line_number":492,"context_line":""},{"line_number":493,"context_line":"Performance Impact"},{"line_number":494,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_5e20a548","line":491,"range":{"start_line":490,"start_character":1,"end_line":491,"end_character":11},"in_reply_to":"ff0f0b1f_b3f01aff","updated":"2017-05-22 13:13:17.000000000","message":"If a key is deleted without the user going through a rotation, yes - the user will need to update files.\n\nIf the user wants to rotate API keys for an Application with no downtime - they can use the following process:\n- Create new API Key\n- Update config files to use the new API Key\n- Delete old API Key\n\nThe main point about graceful rotation is that it allows you to have 2 valid keys simultaneously for a period of time, so that things work while you are updating the config.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"80f47318b455086b030cefa07932cd7927b2a982","unresolved":false,"context_lines":[{"line_number":487,"context_line":"  Services should be able to leverage this feature to improve the overall"},{"line_number":488,"context_line":"  security of their Applications."},{"line_number":489,"context_line":"* Consumers who do not start using API Keys should experience no impact."},{"line_number":490,"context_line":"* Consumers can gracefully rotate API Keys for an Application with no"},{"line_number":491,"context_line":"  downtime."},{"line_number":492,"context_line":""},{"line_number":493,"context_line":"Performance Impact"},{"line_number":494,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_3fadcb9a","line":491,"range":{"start_line":490,"start_character":1,"end_line":491,"end_character":11},"in_reply_to":"ff0f0b1f_b9e7dbac","updated":"2017-06-02 16:50:45.000000000","message":"agree","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":493,"context_line":"Performance Impact"},{"line_number":494,"context_line":"------------------"},{"line_number":495,"context_line":""},{"line_number":496,"context_line":"None"},{"line_number":497,"context_line":""},{"line_number":498,"context_line":"Other Deployer Impact"},{"line_number":499,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_fca9e8dc","line":496,"updated":"2017-05-19 20:09:44.000000000","message":"I\u0027m not sure if we need to note this here or not, but this should have the same performance impact as username/password authentication today since keystone needs to compare hashes to get an answer.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":493,"context_line":"Performance Impact"},{"line_number":494,"context_line":"------------------"},{"line_number":495,"context_line":""},{"line_number":496,"context_line":"None"},{"line_number":497,"context_line":""},{"line_number":498,"context_line":"Other Deployer Impact"},{"line_number":499,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_ff32a0f1","line":496,"in_reply_to":"ff0f0b1f_800ee82f","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":493,"context_line":"Performance Impact"},{"line_number":494,"context_line":"------------------"},{"line_number":495,"context_line":""},{"line_number":496,"context_line":"None"},{"line_number":497,"context_line":""},{"line_number":498,"context_line":"Other Deployer Impact"},{"line_number":499,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_800ee82f","line":496,"in_reply_to":"ff0f0b1f_fca9e8dc","updated":"2017-05-21 22:04:47.000000000","message":"Good call. It\u0027s mostly \"None\" - but with specifics. :)","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"a925673a5d1a1558ed21e85b0eca2af367767a07","unresolved":false,"context_lines":[{"line_number":500,"context_line":""},{"line_number":501,"context_line":"Deployers should notice the following maintenance improvements:"},{"line_number":502,"context_line":""},{"line_number":503,"context_line":"* Deployers only need to enforce security on a single service account instead"},{"line_number":504,"context_line":"  of multiple."},{"line_number":505,"context_line":"* Password rotation policies for service account no longer require immediately"},{"line_number":506,"context_line":"  redeploying service configuration files. A User password change does not"},{"line_number":507,"context_line":"  affect the existing API Keys in the various service configuration files."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_3352cadf","line":504,"range":{"start_line":503,"start_character":2,"end_line":504,"end_character":14},"updated":"2017-05-22 12:32:21.000000000","message":"couldn\u0027t this be accomplished today by just creating a single service user?","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"455eb176627356393bdde27172270c865a1cbd2c","unresolved":false,"context_lines":[{"line_number":500,"context_line":""},{"line_number":501,"context_line":"Deployers should notice the following maintenance improvements:"},{"line_number":502,"context_line":""},{"line_number":503,"context_line":"* Deployers only need to enforce security on a single service account instead"},{"line_number":504,"context_line":"  of multiple."},{"line_number":505,"context_line":"* Password rotation policies for service account no longer require immediately"},{"line_number":506,"context_line":"  redeploying service configuration files. A User password change does not"},{"line_number":507,"context_line":"  affect the existing API Keys in the various service configuration files."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_be8101fe","line":504,"range":{"start_line":503,"start_character":2,"end_line":504,"end_character":14},"in_reply_to":"ff0f0b1f_3352cadf","updated":"2017-05-22 13:13:17.000000000","message":"To a degree, yes. But then that single account could not be limited in what it can do and would need the access for all of the services.\n\nIf you use API Keys, once we have the ability to limit what they can do, you could have one \"Service User\" that uses a 2-factor auth, then for that Service User you could create an API Key for Nova that can talk to neutron and glance and cinder and ironic and an API key for cinder that can talk to nova and glance but not neutron.\n\nI\u0027ll try to flesh that out a little more so it\u0027s clearer.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"3afec73d97a2f7d2ab567e8a6ed72bdcf5320915","unresolved":false,"context_lines":[{"line_number":500,"context_line":""},{"line_number":501,"context_line":"Deployers should notice the following maintenance improvements:"},{"line_number":502,"context_line":""},{"line_number":503,"context_line":"* Deployers only need to enforce security on a single service account instead"},{"line_number":504,"context_line":"  of multiple."},{"line_number":505,"context_line":"* Password rotation policies for service account no longer require immediately"},{"line_number":506,"context_line":"  redeploying service configuration files. A User password change does not"},{"line_number":507,"context_line":"  affect the existing API Keys in the various service configuration files."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_b99c7b0e","line":504,"range":{"start_line":503,"start_character":2,"end_line":504,"end_character":14},"in_reply_to":"ff0f0b1f_be8101fe","updated":"2017-05-22 13:54:34.000000000","message":"Nice this makes sense, same users, same set of roles (in keystone), but different authorization levels according to their respective API keys","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":526,"context_line":"Other contributors:"},{"line_number":527,"context_line":""},{"line_number":528,"context_line":"- Ron De Rose"},{"line_number":529,"context_line":"- Anthony Washington"},{"line_number":530,"context_line":"- TBD"},{"line_number":531,"context_line":""},{"line_number":532,"context_line":"Work Items"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_9c378cb1","line":529,"updated":"2017-05-19 20:09:44.000000000","message":"I\u0027m not sure how active Anthony is anymore :( \n\nIt would be great to get confirmation from him on if he has the bandwidth to do any of this. His IRC nick is antwash. Same is probably true for Ron (rderose).","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":526,"context_line":"Other contributors:"},{"line_number":527,"context_line":""},{"line_number":528,"context_line":"- Ron De Rose"},{"line_number":529,"context_line":"- Anthony Washington"},{"line_number":530,"context_line":"- TBD"},{"line_number":531,"context_line":""},{"line_number":532,"context_line":"Work Items"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_4018d073","line":529,"in_reply_to":"ff0f0b1f_9c378cb1","updated":"2017-05-21 22:04:47.000000000","message":"Cool - I mostly left both of them on there to avoid \u0027taking over\u0027 and seeming exclusionary. Should definitely double check with them.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":547,"context_line":"#. Notify deployment projects about using API Keys"},{"line_number":548,"context_line":"   (Devstack, OpenStack-Ansible, Tripleo, OpenStack Puppet, etc)"},{"line_number":549,"context_line":""},{"line_number":550,"context_line":"#. Notify non-Python SDKs about using API Keys (Fog, gohpercloud, JClouds)"},{"line_number":551,"context_line":""},{"line_number":552,"context_line":"Dependencies"},{"line_number":553,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_bc4ff032","line":550,"updated":"2017-05-19 20:09:44.000000000","message":"gophercloud*","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"8fbd9daef89fd9e5026aeca48a7ebcb64ff52214","unresolved":false,"context_lines":[{"line_number":547,"context_line":"#. Notify deployment projects about using API Keys"},{"line_number":548,"context_line":"   (Devstack, OpenStack-Ansible, Tripleo, OpenStack Puppet, etc)"},{"line_number":549,"context_line":""},{"line_number":550,"context_line":"#. Notify non-Python SDKs about using API Keys (Fog, gohpercloud, JClouds)"},{"line_number":551,"context_line":""},{"line_number":552,"context_line":"Dependencies"},{"line_number":553,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"df140735_df2fdc85","line":550,"in_reply_to":"ff0f0b1f_bc4ff032","updated":"2017-06-03 19:28:24.000000000","message":"Done","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"67c9ae185976025c22997a95cee090525ea95289","unresolved":false,"context_lines":[{"line_number":557,"context_line":"Documentation Impact"},{"line_number":558,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":559,"context_line":""},{"line_number":560,"context_line":"The documentation team, along with the documentation liaison for keystone"},{"line_number":561,"context_line":"should update the installation guide to account for API Keys and Service"},{"line_number":562,"context_line":"Users. The user guides should also be updated to reflect the ability for"},{"line_number":563,"context_line":"Users to use API Keys for application authentication."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_bc681087","line":560,"updated":"2017-05-19 20:09:44.000000000","message":"++ we\u0027re currently without any docs liaison at the moment as a result of the OSIC fallout. I can be on point for this until we get another person in this capacity.","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"a6a7236c1099af2d08e0da564010e083dc2c01e4","unresolved":false,"context_lines":[{"line_number":557,"context_line":"Documentation Impact"},{"line_number":558,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":559,"context_line":""},{"line_number":560,"context_line":"The documentation team, along with the documentation liaison for keystone"},{"line_number":561,"context_line":"should update the installation guide to account for API Keys and Service"},{"line_number":562,"context_line":"Users. The user guides should also be updated to reflect the ability for"},{"line_number":563,"context_line":"Users to use API Keys for application authentication."}],"source_content_type":"text/x-rst","patch_set":9,"id":"ff0f0b1f_20295c89","line":560,"in_reply_to":"ff0f0b1f_bc681087","updated":"2017-05-21 22:04:47.000000000","message":"Awesome!","commit_id":"edc0108aa28bc5e646281a23d989e4bd317b9ea5"},{"author":{"_account_id":11564,"name":"Chris Dent","email":"cdent@anticdent.org","username":"chdent"},"change_message_id":"49ce760e3211ccf96d677a0903cd3f2f21ccc09e","unresolved":false,"context_lines":[{"line_number":132,"context_line":"this fits within the keystone model and is consistent with others APIs"},{"line_number":133,"context_line":"providing application authentication. It also avoids the security and"},{"line_number":134,"context_line":"performance implications of creating a new token type that would potentially"},{"line_number":135,"context_line":"never expire and have custom validation."},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"API Key Management"},{"line_number":138,"context_line":"------------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"df140735_5c1a9616","line":135,"updated":"2017-06-05 18:39:15.000000000","message":"very useful clarification, thanks","commit_id":"c11d0f4921164fb6716055bc2cc32a4a44009a06"}],"specs/keystone/pike/app-keys.rst":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"d7f3a311ebded276de325eaa51729fae292d17c2","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"App Keys"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp app-keys \u003chttps://blueprints.launchpad.net/keystone/+spec/app-keys\u003e`_"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5ff73747_99eba576","line":8,"range":{"start_line":8,"start_character":0,"end_line":8,"end_character":8},"updated":"2017-04-28 22:18:53.000000000","message":"Is there background for this name? Trying to google it comes up with \"API keys\" which is definitely not the same thing","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"740ea11d0795b5d6bb96589f81ae376a95b1f570","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"App Keys"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp app-keys \u003chttps://blueprints.launchpad.net/keystone/+spec/app-keys\u003e`_"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5ff73747_86df9e0b","line":8,"range":{"start_line":8,"start_character":0,"end_line":8,"end_character":8},"in_reply_to":"5ff73747_99eba576","updated":"2017-05-02 03:21:51.000000000","message":"Yeah, there are cloud providers that have an application keys type feature.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":16421,"name":"Edmund Rhudy","email":"erhudy@bloomberg.net","username":"erhudy"},"change_message_id":"1dc7764922d2d631c9ba893a0f9ca67182a76c6a","unresolved":false,"context_lines":[{"line_number":43,"context_line":"App keys will have the following characteristics:"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"* Must be immutable"},{"line_number":46,"context_line":"* Allow for limits, e.g. 5 app keys per user."},{"line_number":47,"context_line":"* Can only contain roles that the user has on a project."},{"line_number":48,"context_line":"* The key secret is only exposed once, in the create key API response."},{"line_number":49,"context_line":"* Cannot be able to create or delete app keys"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_81e738e5","line":46,"updated":"2017-04-06 19:41:44.000000000","message":"Does this imply that app keys will be tied to a particular user? If so, would they all immediately be deactivated if that user\u0027s account were deactivated?\n\nAn alternative is to have the app keys linked to a particular project so that a particular user being deactivated won\u0027t break anything they ever created using app keys (for example, user X sets up a CI/CD pipeline, then leaves the company, but the CI/CD pipeline should continue to run unimpaired). Maybe both user and project-level app keys would be appropriate.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"69ba1dfd266f213ba3f41fd126984cb7fb40cd48","unresolved":false,"context_lines":[{"line_number":43,"context_line":"App keys will have the following characteristics:"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"* Must be immutable"},{"line_number":46,"context_line":"* Allow for limits, e.g. 5 app keys per user."},{"line_number":47,"context_line":"* Can only contain roles that the user has on a project."},{"line_number":48,"context_line":"* The key secret is only exposed once, in the create key API response."},{"line_number":49,"context_line":"* Cannot be able to create or delete app keys"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_61d434be","line":46,"in_reply_to":"bff0334d_81e738e5","updated":"2017-04-06 19:49:57.000000000","message":"Yes, the app keys would be tied to a user and a project. And if the user was disabled, the app keys would also be disabled. Project level app keys is an interesting idea...","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":16421,"name":"Edmund Rhudy","email":"erhudy@bloomberg.net","username":"erhudy"},"change_message_id":"1dc7764922d2d631c9ba893a0f9ca67182a76c6a","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"* Must be immutable"},{"line_number":46,"context_line":"* Allow for limits, e.g. 5 app keys per user."},{"line_number":47,"context_line":"* Can only contain roles that the user has on a project."},{"line_number":48,"context_line":"* The key secret is only exposed once, in the create key API response."},{"line_number":49,"context_line":"* Cannot be able to create or delete app keys"},{"line_number":50,"context_line":"* Should support the ability to expire"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_41fa5075","line":47,"updated":"2017-04-06 19:41:44.000000000","message":"Would the user be able to explicitly select which role or roles the app key would be able to have? In light of my comment above, if project-level app keys were considered an appropriate addition, how would the role selection there work?","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"69ba1dfd266f213ba3f41fd126984cb7fb40cd48","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"* Must be immutable"},{"line_number":46,"context_line":"* Allow for limits, e.g. 5 app keys per user."},{"line_number":47,"context_line":"* Can only contain roles that the user has on a project."},{"line_number":48,"context_line":"* The key secret is only exposed once, in the create key API response."},{"line_number":49,"context_line":"* Cannot be able to create or delete app keys"},{"line_number":50,"context_line":"* Should support the ability to expire"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_61a2f44d","line":47,"in_reply_to":"bff0334d_41fa5075","updated":"2017-04-06 19:49:57.000000000","message":"Yes, the user would be able to select the roles to associate with the app key. The role selection would be based on the user\u0027s role assignments for a particular project.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"c0b6ad019544dc250ce3d206f65958988286c87f","unresolved":false,"context_lines":[{"line_number":48,"context_line":"* The key secret is only exposed once, in the create key API response."},{"line_number":49,"context_line":"* Cannot be able to create or delete app keys"},{"line_number":50,"context_line":"* Should support the ability to expire"},{"line_number":51,"context_line":"* Should have a description field"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"By default, any user with at least a member role on a project should be able to"},{"line_number":54,"context_line":"list, add, and delete app keys for their account. For example, adding an app"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_bef01969","line":51,"updated":"2017-04-06 20:16:58.000000000","message":"I would suggest looking at what amazon does here.\n\nThey have a way to specify a document that describes objects in addition to just roles for this use case.\n\nFor the use case this is targeted at, you totally may want to give a vm access to move a cinder volume or delete a vm on the project. but not for all of them on the project. just the one they need to change.\n\nThis could be done by adding acl\u0027s for apps on every single openstack project, but that will scale badly, be error prone, be hard for the operator to manage, and hard for the user to actually provision the app acls properly. Allowing it to be associate directly to the app key, and handed out to the services that need it would be much better.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":14495,"name":"Adam Heczko","email":"aheczko@mirantis.com","username":"aheczko-mirantis"},"change_message_id":"8f7de4a390d5b4958a4969eabbbecb4863bd56f6","unresolved":false,"context_lines":[{"line_number":48,"context_line":"* The key secret is only exposed once, in the create key API response."},{"line_number":49,"context_line":"* Cannot be able to create or delete app keys"},{"line_number":50,"context_line":"* Should support the ability to expire"},{"line_number":51,"context_line":"* Should have a description field"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"By default, any user with at least a member role on a project should be able to"},{"line_number":54,"context_line":"list, add, and delete app keys for their account. For example, adding an app"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_f92469c8","line":51,"in_reply_to":"bff0334d_bef01969","updated":"2017-04-07 07:06:58.000000000","message":"+1 to follow amazon way. That would be also extremely useful for e.g. granting access to only subset of barbican keys.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"4cbf665efed9d9e31b912e3a0795a4a1cb5fd33c","unresolved":false,"context_lines":[{"line_number":48,"context_line":"* The key secret is only exposed once, in the create key API response."},{"line_number":49,"context_line":"* Cannot be able to create or delete app keys"},{"line_number":50,"context_line":"* Should support the ability to expire"},{"line_number":51,"context_line":"* Should have a description field"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"By default, any user with at least a member role on a project should be able to"},{"line_number":54,"context_line":"list, add, and delete app keys for their account. For example, adding an app"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_ee4ca89f","line":51,"in_reply_to":"bff0334d_bef01969","updated":"2017-04-07 01:38:57.000000000","message":"Exactly, you\u0027d only want to only give the app key access that it needs (move a volume or delete a vm...). The way I\u0027m defining this here, is when creating the app key, you\u0027ll specify the project and roles to associate.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"d7f3a311ebded276de325eaa51729fae292d17c2","unresolved":false,"context_lines":[{"line_number":82,"context_line":"    }"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"The id in the response is the app key identifier and would be returned in get"},{"line_number":85,"context_line":"or list API calls. However, the secret would be a random string and only"},{"line_number":86,"context_line":"returned via the create API call."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Once created, an app key can be used for authentication to request a scoped"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5ff73747_d9300d59","line":85,"range":{"start_line":85,"start_character":28,"end_line":85,"end_character":63},"updated":"2017-04-28 22:18:53.000000000","message":"How is it generated?","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"740ea11d0795b5d6bb96589f81ae376a95b1f570","unresolved":false,"context_lines":[{"line_number":82,"context_line":"    }"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"The id in the response is the app key identifier and would be returned in get"},{"line_number":85,"context_line":"or list API calls. However, the secret would be a random string and only"},{"line_number":86,"context_line":"returned via the create API call."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Once created, an app key can be used for authentication to request a scoped"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5ff73747_26368a52","line":85,"range":{"start_line":85,"start_character":28,"end_line":85,"end_character":63},"in_reply_to":"5ff73747_d9300d59","updated":"2017-05-02 03:21:51.000000000","message":"Not yet defined, but would likely look for a python library that would generate a random string/number. And would ensure that it would be unique and long enough to be secure.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"c0b6ad019544dc250ce3d206f65958988286c87f","unresolved":false,"context_lines":[{"line_number":108,"context_line":"We can validate the app key by matching a hash of the key secret associated"},{"line_number":109,"context_line":"with the id using passlib, similar to how we do password authentication. We"},{"line_number":110,"context_line":"would also validate the app key roles, ensuring that the roles associated with"},{"line_number":111,"context_line":"the app key are still assigned to the user."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"This improves security as app keys will have limited access; can be rotated and"},{"line_number":114,"context_line":"securely stored in configuration files. Especially for users that do not have"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_9e667529","line":111,"updated":"2017-04-06 20:16:58.000000000","message":"For ldap (ad) there needs to be some way to validate the user is still enabled too. Otherwise, a user could allocate an app with full rights to use when their account gets disabled.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"4cbf665efed9d9e31b912e3a0795a4a1cb5fd33c","unresolved":false,"context_lines":[{"line_number":108,"context_line":"We can validate the app key by matching a hash of the key secret associated"},{"line_number":109,"context_line":"with the id using passlib, similar to how we do password authentication. We"},{"line_number":110,"context_line":"would also validate the app key roles, ensuring that the roles associated with"},{"line_number":111,"context_line":"the app key are still assigned to the user."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"This improves security as app keys will have limited access; can be rotated and"},{"line_number":114,"context_line":"securely stored in configuration files. Especially for users that do not have"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_8e3e3cd8","line":111,"in_reply_to":"bff0334d_9e667529","updated":"2017-04-07 01:38:57.000000000","message":"True, there should be an enabled attribute associated with ldap.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"c0b6ad019544dc250ce3d206f65958988286c87f","unresolved":false,"context_lines":[{"line_number":137,"context_line":"------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Continue with trusts and using OAuth authentication. The OAuth work flow is"},{"line_number":140,"context_line":"similar to that of app keys and it can be worked on and improved."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Security Impact"},{"line_number":143,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_1e5b8554","line":140,"updated":"2017-04-06 20:16:58.000000000","message":"I think there is a middle alternative... an api like suggested in the main section, but implemented by trusts? IE, do provide a new api so that users can create a small number of service users with trusts in a sql backed domain that always exists.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"740ea11d0795b5d6bb96589f81ae376a95b1f570","unresolved":false,"context_lines":[{"line_number":137,"context_line":"------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Continue with trusts and using OAuth authentication. The OAuth work flow is"},{"line_number":140,"context_line":"similar to that of app keys and it can be worked on and improved."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Security Impact"},{"line_number":143,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5ff73747_a6f61a5c","line":140,"in_reply_to":"5ff73747_b981c1c5","updated":"2017-05-02 03:21:51.000000000","message":"This option fits nicely within the current keystone architecture and completely solves the use case. Implementing OAuth2 is a much bigger effort and this approach doesn\u0027t prevent us from doing that in the future.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"4cbf665efed9d9e31b912e3a0795a4a1cb5fd33c","unresolved":false,"context_lines":[{"line_number":137,"context_line":"------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Continue with trusts and using OAuth authentication. The OAuth work flow is"},{"line_number":140,"context_line":"similar to that of app keys and it can be worked on and improved."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Security Impact"},{"line_number":143,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_2e2f30a2","line":140,"in_reply_to":"bff0334d_1e5b8554","updated":"2017-04-07 01:38:57.000000000","message":"++","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"d7f3a311ebded276de325eaa51729fae292d17c2","unresolved":false,"context_lines":[{"line_number":137,"context_line":"------------"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Continue with trusts and using OAuth authentication. The OAuth work flow is"},{"line_number":140,"context_line":"similar to that of app keys and it can be worked on and improved."},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"Security Impact"},{"line_number":143,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5ff73747_b981c1c5","line":140,"in_reply_to":"bff0334d_2e2f30a2","updated":"2017-04-28 22:18:53.000000000","message":"Why is OAuth not the best option? It\u0027s an industry standard that we wouldn\u0027t have to reinvent.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":9237,"name":"Kevin Fox","email":"kevin@efox.cc","username":"kfox1111"},"change_message_id":"c0b6ad019544dc250ce3d206f65958988286c87f","unresolved":false,"context_lines":[{"line_number":188,"context_line":"  service configuration files. Once a password is changes for the service, the"},{"line_number":189,"context_line":"  existing app keys in the various service configuration files will still"},{"line_number":190,"context_line":"  work."},{"line_number":191,"context_line":"* Operators can gracefully rotate app keys through a deployment. A set of"},{"line_number":192,"context_line":"  services can use two different app keys at the same time allowing a smooth"},{"line_number":193,"context_line":"  migration. Once all services are using the new app key, the old app key"},{"line_number":194,"context_line":"  can be deleted. With service accounts and passwords, this would require"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_a12b5c80","line":191,"range":{"start_line":191,"start_character":2,"end_line":191,"end_character":11},"updated":"2017-04-06 20:16:58.000000000","message":"Not just operators, but apps themselves too.","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"4cbf665efed9d9e31b912e3a0795a4a1cb5fd33c","unresolved":false,"context_lines":[{"line_number":188,"context_line":"  service configuration files. Once a password is changes for the service, the"},{"line_number":189,"context_line":"  existing app keys in the various service configuration files will still"},{"line_number":190,"context_line":"  work."},{"line_number":191,"context_line":"* Operators can gracefully rotate app keys through a deployment. A set of"},{"line_number":192,"context_line":"  services can use two different app keys at the same time allowing a smooth"},{"line_number":193,"context_line":"  migration. Once all services are using the new app key, the old app key"},{"line_number":194,"context_line":"  can be deleted. With service accounts and passwords, this would require"}],"source_content_type":"text/x-rst","patch_set":5,"id":"bff0334d_8e175c52","line":191,"range":{"start_line":191,"start_character":2,"end_line":191,"end_character":11},"in_reply_to":"bff0334d_a12b5c80","updated":"2017-04-07 01:38:57.000000000","message":"++","commit_id":"12c502f292d5448fa9a6edc501f35bbfc3d25927"}],"specs/keystone/pike/application-credentials.rst":[{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2c8eae4d58a7c803532e45677d86ae866cde7a16","unresolved":false,"context_lines":[{"line_number":127,"context_line":"  accepting a list of roles that is a subset of the creating User\u0027s roles in"},{"line_number":128,"context_line":"  that project."},{"line_number":129,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":130,"context_line":"* Cannot create or delete Application Credentials."},{"line_number":131,"context_line":"* Support expiration."},{"line_number":132,"context_line":"* Support deletion."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_b5e07798","line":130,"updated":"2017-06-08 01:48:00.000000000","message":"\"Application credentials cannot create: other application credentials, turst, OAUTH consumers, perform role assignments, change passwords, or in any other way modify the account of the user that creates the Application Credential/\"","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"2213d3be93aa7a9a5f9923005001747556446a46","unresolved":false,"context_lines":[{"line_number":127,"context_line":"  accepting a list of roles that is a subset of the creating User\u0027s roles in"},{"line_number":128,"context_line":"  that project."},{"line_number":129,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":130,"context_line":"* Cannot create or delete Application Credentials."},{"line_number":131,"context_line":"* Support expiration."},{"line_number":132,"context_line":"* Support deletion."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_63ab301d","line":130,"in_reply_to":"bf091321_a734bf4b","updated":"2017-06-08 16:48:39.000000000","message":"Maybe:\n\n Limited ability to manipulate identity objects. (see `Limitations Imposed`)","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b937b7b19448f202b663649b529c12cf141cdc4e","unresolved":false,"context_lines":[{"line_number":127,"context_line":"  accepting a list of roles that is a subset of the creating User\u0027s roles in"},{"line_number":128,"context_line":"  that project."},{"line_number":129,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":130,"context_line":"* Cannot create or delete Application Credentials."},{"line_number":131,"context_line":"* Support expiration."},{"line_number":132,"context_line":"* Support deletion."},{"line_number":133,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_a734bf4b","line":130,"in_reply_to":"bf091321_b5e07798","updated":"2017-06-08 12:32:46.000000000","message":"Specific restrictions on the powers of app creds are covered in the \"Limitations Imposed\" section, which we can expand on. This bullet point is just meant to highlight that app creds can\u0027t recursively spawn more of themselves.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2c8eae4d58a7c803532e45677d86ae866cde7a16","unresolved":false,"context_lines":[{"line_number":129,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":130,"context_line":"* Cannot create or delete Application Credentials."},{"line_number":131,"context_line":"* Support expiration."},{"line_number":132,"context_line":"* Support deletion."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Application Credentials will be treated as credentials and not authorization"},{"line_number":135,"context_line":"tokens, as this fits within the keystone model and is consistent with others"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_55e91b7e","line":132,"updated":"2017-06-08 01:48:00.000000000","message":"THe user that creates them can delete them?","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b937b7b19448f202b663649b529c12cf141cdc4e","unresolved":false,"context_lines":[{"line_number":129,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":130,"context_line":"* Cannot create or delete Application Credentials."},{"line_number":131,"context_line":"* Support expiration."},{"line_number":132,"context_line":"* Support deletion."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Application Credentials will be treated as credentials and not authorization"},{"line_number":135,"context_line":"tokens, as this fits within the keystone model and is consistent with others"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_c77d73e8","line":132,"in_reply_to":"bf091321_55e91b7e","updated":"2017-06-08 12:32:46.000000000","message":"Once a user creates it is effectively no longer tied to it, so any user with a write-allowed role in the project can delete them.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"2213d3be93aa7a9a5f9923005001747556446a46","unresolved":false,"context_lines":[{"line_number":129,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":130,"context_line":"* Cannot create or delete Application Credentials."},{"line_number":131,"context_line":"* Support expiration."},{"line_number":132,"context_line":"* Support deletion."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Application Credentials will be treated as credentials and not authorization"},{"line_number":135,"context_line":"tokens, as this fits within the keystone model and is consistent with others"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_039a3413","line":132,"in_reply_to":"bf091321_c77d73e8","updated":"2017-06-08 16:48:39.000000000","message":"Maybe:\n\n  Support deletion by any user with a write-allowed role in the project\n\nThe project-scoping of this resource keeps getting missed, so it\u0027s worth highlighting.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2c8eae4d58a7c803532e45677d86ae866cde7a16","unresolved":false,"context_lines":[{"line_number":141,"context_line":"---------------------------------"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"By default, any User with at least a member role on a Project should be able to"},{"line_number":144,"context_line":"list, add, and delete Application Credentials. For example, adding an"},{"line_number":145,"context_line":"Application Credentials:"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_1503a344","line":144,"updated":"2017-06-08 01:48:00.000000000","message":"\"their own application credentials\"","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b937b7b19448f202b663649b529c12cf141cdc4e","unresolved":false,"context_lines":[{"line_number":141,"context_line":"---------------------------------"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"By default, any User with at least a member role on a Project should be able to"},{"line_number":144,"context_line":"list, add, and delete Application Credentials. For example, adding an"},{"line_number":145,"context_line":"Application Credentials:"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_87ee5b86","line":144,"in_reply_to":"bf091321_1503a344","updated":"2017-06-08 12:32:46.000000000","message":"These are tied to projects, not to users. Really this should read \"any User with at least a member role on a Project should be able to list, add, and delete Application Credentials for that project.\"","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"2213d3be93aa7a9a5f9923005001747556446a46","unresolved":false,"context_lines":[{"line_number":141,"context_line":"---------------------------------"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"By default, any User with at least a member role on a Project should be able to"},{"line_number":144,"context_line":"list, add, and delete Application Credentials. For example, adding an"},{"line_number":145,"context_line":"Application Credentials:"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"::"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_634fb0bd","line":144,"in_reply_to":"bf091321_87ee5b86","updated":"2017-06-08 16:48:39.000000000","message":"Yes - colleen is correct.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2c8eae4d58a7c803532e45677d86ae866cde7a16","unresolved":false,"context_lines":[{"line_number":196,"context_line":"    {"},{"line_number":197,"context_line":"        \"application_credential\": {"},{"line_number":198,"context_line":"            \"id\": \"aa4541d9-0bc0-44f5-b02d-a9d922df7cbd\","},{"line_number":199,"context_line":"            \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\","},{"line_number":200,"context_line":"            \"name:\" \"backup\","},{"line_number":201,"context_line":"            \"description\": \"Backup job...\","},{"line_number":202,"context_line":"            \"allow\": false,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_55b7db87","line":199,"updated":"2017-06-08 01:48:00.000000000","message":"would like to be able to auto-generate the secrets here.  Provide a mutually exclusive field which is autogenerate-secret: True.  Default value to false.  But we should specify that autogeneration of secrets is preferred.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b937b7b19448f202b663649b529c12cf141cdc4e","unresolved":false,"context_lines":[{"line_number":196,"context_line":"    {"},{"line_number":197,"context_line":"        \"application_credential\": {"},{"line_number":198,"context_line":"            \"id\": \"aa4541d9-0bc0-44f5-b02d-a9d922df7cbd\","},{"line_number":199,"context_line":"            \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\","},{"line_number":200,"context_line":"            \"name:\" \"backup\","},{"line_number":201,"context_line":"            \"description\": \"Backup job...\","},{"line_number":202,"context_line":"            \"allow\": false,"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_ca033a0d","line":199,"in_reply_to":"bf091321_55b7db87","updated":"2017-06-08 12:32:46.000000000","message":"auto-generation is already the default, see the request example above which does not include the secret, and the paragraph starting on line 235 discussing user-generated secrets.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2c8eae4d58a7c803532e45677d86ae866cde7a16","unresolved":false,"context_lines":[{"line_number":222,"context_line":"          `random.choice` should be replaced for Python 3 with"},{"line_number":223,"context_line":"          `secrets.choice`."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"`role_ids` is informational and can be used by the User to verify that the"},{"line_number":226,"context_line":"Application Credential has the roles expected."},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"`creator_id` contains the `id` of the User who created the Application"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_f5adcf31","line":225,"updated":"2017-06-08 01:48:00.000000000","message":"\"optional\" not \"informational\".  If specified, must be honored.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"2213d3be93aa7a9a5f9923005001747556446a46","unresolved":false,"context_lines":[{"line_number":222,"context_line":"          `random.choice` should be replaced for Python 3 with"},{"line_number":223,"context_line":"          `secrets.choice`."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"`role_ids` is informational and can be used by the User to verify that the"},{"line_number":226,"context_line":"Application Credential has the roles expected."},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"`creator_id` contains the `id` of the User who created the Application"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_c33f9cd4","line":225,"in_reply_to":"bf091321_a79eff04","updated":"2017-06-08 16:48:39.000000000","message":"No, that is not accurate.\n\nrole_ids is information returned from the API informing the creator of the Application Credential what roles the Application Credential was created with. The Application Credential does not have anything to do with honoring or not honoring role assignments. An Application Credential is used to get a token, and consumers of that token are the ones that have to honor the roles.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b937b7b19448f202b663649b529c12cf141cdc4e","unresolved":false,"context_lines":[{"line_number":222,"context_line":"          `random.choice` should be replaced for Python 3 with"},{"line_number":223,"context_line":"          `secrets.choice`."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"`role_ids` is informational and can be used by the User to verify that the"},{"line_number":226,"context_line":"Application Credential has the roles expected."},{"line_number":227,"context_line":""},{"line_number":228,"context_line":"`creator_id` contains the `id` of the User who created the Application"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_a79eff04","line":225,"in_reply_to":"bf091321_f5adcf31","updated":"2017-06-08 12:32:46.000000000","message":"Done","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2c8eae4d58a7c803532e45677d86ae866cde7a16","unresolved":false,"context_lines":[{"line_number":349,"context_line":""},{"line_number":350,"context_line":"::"},{"line_number":351,"context_line":""},{"line_number":352,"context_line":"    POST /v3/auth/tokens"},{"line_number":353,"context_line":""},{"line_number":354,"context_line":".. code-block:: json"},{"line_number":355,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_354a2780","line":352,"updated":"2017-06-08 01:48:00.000000000","message":"Please see the trust-token response and honor that approach here.  Ideally, we would respond with a trust token, Trustee is the creator.  Never support impersonation.  Trustee is the application credential itself.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b937b7b19448f202b663649b529c12cf141cdc4e","unresolved":false,"context_lines":[{"line_number":349,"context_line":""},{"line_number":350,"context_line":"::"},{"line_number":351,"context_line":""},{"line_number":352,"context_line":"    POST /v3/auth/tokens"},{"line_number":353,"context_line":""},{"line_number":354,"context_line":".. code-block:: json"},{"line_number":355,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_c5c0cb53","line":352,"in_reply_to":"bf091321_354a2780","updated":"2017-06-08 12:32:46.000000000","message":"Since these are tied to projects and not to users the trustee would be nearly irrelevant information in an auth request or response.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"2213d3be93aa7a9a5f9923005001747556446a46","unresolved":false,"context_lines":[{"line_number":349,"context_line":""},{"line_number":350,"context_line":"::"},{"line_number":351,"context_line":""},{"line_number":352,"context_line":"    POST /v3/auth/tokens"},{"line_number":353,"context_line":""},{"line_number":354,"context_line":".. code-block:: json"},{"line_number":355,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_2eff5f02","line":352,"in_reply_to":"bf091321_c5c0cb53","updated":"2017-06-08 16:48:39.000000000","message":"I repsonded in a top-level response already, but trusts are inappropriate for this for many reasons.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"2c8eae4d58a7c803532e45677d86ae866cde7a16","unresolved":false,"context_lines":[{"line_number":385,"context_line":"Since API Access Lists are not implemented at this stage, Keystone"},{"line_number":386,"context_line":"will explicitly block tokens generated from an Application Credential from"},{"line_number":387,"context_line":"doing the following:"},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"* POST /projects/{}/application_credentials"},{"line_number":390,"context_line":"* DELETE /projects/{}/application_credentials/{}"},{"line_number":391,"context_line":"* POST /users"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_b5551720","line":388,"updated":"2017-06-08 01:48:00.000000000","message":"We should probably do the same for Trust tokens, then.\n\nAlso, make sure role assignments are excluded.\n\nAn Application Credential Token should never get the Admin role.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"2213d3be93aa7a9a5f9923005001747556446a46","unresolved":false,"context_lines":[{"line_number":385,"context_line":"Since API Access Lists are not implemented at this stage, Keystone"},{"line_number":386,"context_line":"will explicitly block tokens generated from an Application Credential from"},{"line_number":387,"context_line":"doing the following:"},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"* POST /projects/{}/application_credentials"},{"line_number":390,"context_line":"* DELETE /projects/{}/application_credentials/{}"},{"line_number":391,"context_line":"* POST /users"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_ee560707","line":388,"in_reply_to":"bf091321_2a80768b","updated":"2017-06-08 16:48:39.000000000","message":"Yes. Coleen is correct. In fact, using automation to automate admin functions is a perfectly legitimate use case. We do this in our cloud management today - we just do it by putting our admin password into a config file, and we cannot safely rotate that password.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b937b7b19448f202b663649b529c12cf141cdc4e","unresolved":false,"context_lines":[{"line_number":385,"context_line":"Since API Access Lists are not implemented at this stage, Keystone"},{"line_number":386,"context_line":"will explicitly block tokens generated from an Application Credential from"},{"line_number":387,"context_line":"doing the following:"},{"line_number":388,"context_line":""},{"line_number":389,"context_line":"* POST /projects/{}/application_credentials"},{"line_number":390,"context_line":"* DELETE /projects/{}/application_credentials/{}"},{"line_number":391,"context_line":"* POST /users"}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_2a80768b","line":388,"in_reply_to":"bf091321_b5551720","updated":"2017-06-08 12:32:46.000000000","message":"\u003e Also, make sure role assignments are excluded.\n\nOkay\n\n\u003e An Application Credential Token should never get the Admin role.\n\nThe design is for the credential to inherit the roles of the creating user. It will need the admin role for some of its primary use cases, such as service users that need to perform service-to-service requests, or for tasks that a cloud administrator wants to automate.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"b937b7b19448f202b663649b529c12cf141cdc4e","unresolved":false,"context_lines":[{"line_number":398,"context_line":".. note:: It might be simpler and safer for now to just block a token"},{"line_number":399,"context_line":"          generated from an Application Credential from doing any action in"},{"line_number":400,"context_line":"          Keystone altogether. This would check for an \"application_credential\""},{"line_number":401,"context_line":"          value in the \"methods\" key of a token object."},{"line_number":402,"context_line":""},{"line_number":403,"context_line":"In the follow up to this spec where API Access Lists are defined, this"},{"line_number":404,"context_line":"built-in blacklist should be migrated to being content in that system."}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_a5083728","line":401,"updated":"2017-06-08 12:32:46.000000000","message":"Making a note that this seems really unfortunate to me because a major potential user of this features is deployment tools which will need to be able to interact with keystone, including creating users and projects. But this is something we can iterate on.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"2213d3be93aa7a9a5f9923005001747556446a46","unresolved":false,"context_lines":[{"line_number":398,"context_line":".. note:: It might be simpler and safer for now to just block a token"},{"line_number":399,"context_line":"          generated from an Application Credential from doing any action in"},{"line_number":400,"context_line":"          Keystone altogether. This would check for an \"application_credential\""},{"line_number":401,"context_line":"          value in the \"methods\" key of a token object."},{"line_number":402,"context_line":""},{"line_number":403,"context_line":"In the follow up to this spec where API Access Lists are defined, this"},{"line_number":404,"context_line":"built-in blacklist should be migrated to being content in that system."}],"source_content_type":"text/x-rst","patch_set":14,"id":"bf091321_8e666bed","line":401,"in_reply_to":"bf091321_a5083728","updated":"2017-06-08 16:48:39.000000000","message":"I think we should maybe be clearer that the hard-block on identity API use is *ONLY* until such a time as we have the follow up API action exclusion support. Once that is in place, there is zero reason to not allow \na user to create application credentials that can do these things.","commit_id":"068c538085eb048966a2b944cde0da867f18e528"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"14130a218e155c947306fd0c0dcfee349690e934","unresolved":false,"context_lines":[{"line_number":113,"context_line":"          specification does not match.  The name \u0027Application Credentials\u0027 is"},{"line_number":114,"context_line":"          chosen instead to be a generic term describing vaguely what this is"},{"line_number":115,"context_line":"          intended to be, which is identification information intended for use"},{"line_number":116,"context_line":"          only by applications."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":".. _`on the mailing list`: http://lists.openstack.org/pipermail/openstack-dev/2017-May/116596.html"},{"line_number":119,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_699b07c9","line":116,"updated":"2017-06-08 22:59:10.000000000","message":"++ awesome clarification here","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":122,"context_line":"* Immutable."},{"line_number":123,"context_line":"* Allow for optionally setting limits, e.g. 5 Application Credentials per User"},{"line_number":124,"context_line":"  or Project, to prevent abuse of the resource."},{"line_number":125,"context_line":"* Exist within a Project."},{"line_number":126,"context_line":"* Assigned the current role the creating User has on a Project, optionally"},{"line_number":127,"context_line":"  accepting a list of roles that is a subset of the creating User\u0027s roles in"},{"line_number":128,"context_line":"  that project."}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_8c8e6976","line":125,"range":{"start_line":125,"start_character":2,"end_line":125,"end_character":25},"updated":"2017-06-08 23:23:17.000000000","message":"This is unclear, the credential is tied to a project? A scope? etc.\n\nThis is likely just wording issue(s) - can be corrected in a fdollowup.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":122,"context_line":"* Immutable."},{"line_number":123,"context_line":"* Allow for optionally setting limits, e.g. 5 Application Credentials per User"},{"line_number":124,"context_line":"  or Project, to prevent abuse of the resource."},{"line_number":125,"context_line":"* Exist within a Project."},{"line_number":126,"context_line":"* Assigned the current role the creating User has on a Project, optionally"},{"line_number":127,"context_line":"  accepting a list of roles that is a subset of the creating User\u0027s roles in"},{"line_number":128,"context_line":"  that project."}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_d7689c22","line":125,"range":{"start_line":125,"start_character":2,"end_line":125,"end_character":25},"in_reply_to":"bf091321_8c8e6976","updated":"2017-06-09 07:41:34.000000000","message":"Attempted to clarify","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":128,"context_line":"  that project."},{"line_number":129,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":130,"context_line":"* Limited ability to manipulate identity objects (see `Limitations Imposed`_)"},{"line_number":131,"context_line":"* Support expiration."},{"line_number":132,"context_line":"* Support deletion by any user with a write-allowed role in the project."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Application Credentials will be treated as credentials and not authorization"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_8ce30934","line":131,"range":{"start_line":131,"start_character":2,"end_line":131,"end_character":21},"updated":"2017-06-08 23:23:17.000000000","message":"Expiration should be *required* when creating these. An expiration of 0 (or -1 or whatever) would denote unlimited.\n\nI want the spec to be clear here, an expiration is *required* even if it means no expiration.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":128,"context_line":"  that project."},{"line_number":129,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":130,"context_line":"* Limited ability to manipulate identity objects (see `Limitations Imposed`_)"},{"line_number":131,"context_line":"* Support expiration."},{"line_number":132,"context_line":"* Support deletion by any user with a write-allowed role in the project."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Application Credentials will be treated as credentials and not authorization"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_97e0e498","line":131,"range":{"start_line":131,"start_character":2,"end_line":131,"end_character":21},"in_reply_to":"bf091321_8ce30934","updated":"2017-06-09 07:41:34.000000000","message":"One of the primary use cases and reasons we\u0027re not just building on OAuth or keystone tokens for this is that for most automated tasks we don\u0027t want these keys to expire. I would argue that most operators would not set an expiration on these and would revoke them manually when needed.\n\nAs I\u0027m writing this I\u0027m thinking about how painful expiring SSL certs are and realizing that we do that anyway for security. So you\u0027re probably right, but can we hash this out in a followup?","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":129,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":130,"context_line":"* Limited ability to manipulate identity objects (see `Limitations Imposed`_)"},{"line_number":131,"context_line":"* Support expiration."},{"line_number":132,"context_line":"* Support deletion by any user with a write-allowed role in the project."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"Application Credentials will be treated as credentials and not authorization"},{"line_number":135,"context_line":"tokens, as this fits within the keystone model and is consistent with others"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_4cd7314d","line":132,"range":{"start_line":132,"start_character":2,"end_line":132,"end_character":72},"updated":"2017-06-08 23:23:17.000000000","message":"Ah is this what you mean by exists within a \"project\".","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":161,"context_line":"        }"},{"line_number":162,"context_line":"    }"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"`name` must be unique within a given Project, but `name` is only guaranteed to"},{"line_number":165,"context_line":"be unique within its Project. This is consistent with how the other keystone"},{"line_number":166,"context_line":"resources operate. `name` may be useful for Consumers who want human readable"},{"line_number":167,"context_line":"config files."},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"`description` is a long description for storing information about the purpose"},{"line_number":170,"context_line":"of the Application Credential. It is mostly useful in reports or listings of"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_8cbc2906","line":167,"range":{"start_line":164,"start_character":0,"end_line":167,"end_character":13},"updated":"2017-06-08 23:23:17.000000000","message":"Good.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":170,"context_line":"of the Application Credential. It is mostly useful in reports or listings of"},{"line_number":171,"context_line":"Application Credential."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"`expires_at` is when the Application Credential expires. \u0027null\u0027 means that the"},{"line_number":174,"context_line":"Application Credential does not automatically expire. `expires_at` is in `ISO"},{"line_number":175,"context_line":"Date Time Format`_ and is assumed to be in UTC if an explicit timezone offset"},{"line_number":176,"context_line":"is not included."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":179,"context_line":"Application Credential starts with. Its contents are currently undefined but is"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_8c51c9db","line":176,"range":{"start_line":173,"start_character":0,"end_line":176,"end_character":16},"updated":"2017-06-08 23:23:17.000000000","message":"See above, suggest noting that even if \"null\" this is required. Just cover our bases (neither of my comments on this bit are -1 worthy)","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"14130a218e155c947306fd0c0dcfee349690e934","unresolved":false,"context_lines":[{"line_number":178,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":179,"context_line":"Application Credential starts with. Its contents are currently undefined but is"},{"line_number":180,"context_line":"included for forward compatibility. Values other than the empty list or"},{"line_number":181,"context_line":"omitting the field are currently an error."},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since"},{"line_number":184,"context_line":"Application Credentials are immutable, the contents of this list will be copied"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_c994538e","line":181,"updated":"2017-06-08 22:59:10.000000000","message":"When we are in the process of documenting this feature, we should wrap this with a big red sticker that explicitly calls out this last sentence.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5452f41524557c1b9aea7241e7f58e2c05f44279","unresolved":false,"context_lines":[{"line_number":178,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":179,"context_line":"Application Credential starts with. Its contents are currently undefined but is"},{"line_number":180,"context_line":"included for forward compatibility. Values other than the empty list or"},{"line_number":181,"context_line":"omitting the field are currently an error."},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since"},{"line_number":184,"context_line":"Application Credentials are immutable, the contents of this list will be copied"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_b98e32ce","line":181,"in_reply_to":"9f0e0f27_97f9044f","updated":"2017-06-09 14:20:17.000000000","message":"No - not necessarily. It was just a thought that ran through my mind as I read this.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":178,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":179,"context_line":"Application Credential starts with. Its contents are currently undefined but is"},{"line_number":180,"context_line":"included for forward compatibility. Values other than the empty list or"},{"line_number":181,"context_line":"omitting the field are currently an error."},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since"},{"line_number":184,"context_line":"Application Credentials are immutable, the contents of this list will be copied"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_97f9044f","line":181,"in_reply_to":"bf091321_c994538e","updated":"2017-06-09 07:41:34.000000000","message":"Are you asking for that documentation note to be included in this spec?","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"14130a218e155c947306fd0c0dcfee349690e934","unresolved":false,"context_lines":[{"line_number":187,"context_line":"or ID that cannot be found is an error. There are no pre-defined API Access"},{"line_number":188,"context_line":"Lists yet but it is included for forward compatibility. As values that cannot"},{"line_number":189,"context_line":"be found are creation errors and there are no actual objects, any value other"},{"line_number":190,"context_line":"than null or omitting the field is an error."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"Response example:"},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_a9911f9c","line":190,"updated":"2017-06-08 22:59:10.000000000","message":"Same comment here as on line 181.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":214,"context_line":"`secret` is a random string and only returned via the create API call."},{"line_number":215,"context_line":"Keystone will only store a hash of the `secret` and not the `secret` itself,"},{"line_number":216,"context_line":"so a lost `secret` is unrecoverable. Subsequent queries of an Application"},{"line_number":217,"context_line":"Credential will always return `null` in the secret field."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":".. note:: Identifying the correct way to generate an acceptable secret needs"},{"line_number":220,"context_line":"          to be done. Nova generates admin passwords on server creation, which"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_ac1b6d19","line":217,"range":{"start_line":217,"start_character":0,"end_line":217,"end_character":57},"updated":"2017-06-08 23:23:17.000000000","message":"Do not return Null or anything, Omit the \"secret\" on GETs. Responding with Null is less correct since it will *always* be null in GETs","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5452f41524557c1b9aea7241e7f58e2c05f44279","unresolved":false,"context_lines":[{"line_number":214,"context_line":"`secret` is a random string and only returned via the create API call."},{"line_number":215,"context_line":"Keystone will only store a hash of the `secret` and not the `secret` itself,"},{"line_number":216,"context_line":"so a lost `secret` is unrecoverable. Subsequent queries of an Application"},{"line_number":217,"context_line":"Credential will always return `null` in the secret field."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":".. note:: Identifying the correct way to generate an acceptable secret needs"},{"line_number":220,"context_line":"          to be done. Nova generates admin passwords on server creation, which"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_59b71688","line":217,"in_reply_to":"9f0e0f27_57992c1d","updated":"2017-06-09 14:20:17.000000000","message":"++","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":214,"context_line":"`secret` is a random string and only returned via the create API call."},{"line_number":215,"context_line":"Keystone will only store a hash of the `secret` and not the `secret` itself,"},{"line_number":216,"context_line":"so a lost `secret` is unrecoverable. Subsequent queries of an Application"},{"line_number":217,"context_line":"Credential will always return `null` in the secret field."},{"line_number":218,"context_line":""},{"line_number":219,"context_line":".. note:: Identifying the correct way to generate an acceptable secret needs"},{"line_number":220,"context_line":"          to be done. Nova generates admin passwords on server creation, which"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_57992c1d","line":217,"range":{"start_line":217,"start_character":0,"end_line":217,"end_character":57},"in_reply_to":"bf091321_ac1b6d19","updated":"2017-06-09 07:41:34.000000000","message":"Okay","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":222,"context_line":"          `random.choice` should be replaced for Python 3 with"},{"line_number":223,"context_line":"          `secrets.choice`."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"`role_ids` is informational and can be used by the User to verify that the"},{"line_number":226,"context_line":"Application Credential inherited the roles that it was expected to inherit from"},{"line_number":227,"context_line":"its creator. This is not a policy enforcement, it is simply for human"},{"line_number":228,"context_line":"validation."},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"`creator_id` contains the `id` of the User who created the Application"},{"line_number":231,"context_line":"Credential. It can be used by other Consumers who have a User with access to"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_8c18a91d","line":228,"range":{"start_line":225,"start_character":0,"end_line":228,"end_character":11},"updated":"2017-06-08 23:23:17.000000000","message":"IDs or Role Names? We use Role Names in most everything in OpenStack today. IDs are used internal to keystone for referencing only.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":222,"context_line":"          `random.choice` should be replaced for Python 3 with"},{"line_number":223,"context_line":"          `secrets.choice`."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"`role_ids` is informational and can be used by the User to verify that the"},{"line_number":226,"context_line":"Application Credential inherited the roles that it was expected to inherit from"},{"line_number":227,"context_line":"its creator. This is not a policy enforcement, it is simply for human"},{"line_number":228,"context_line":"validation."},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"`creator_id` contains the `id` of the User who created the Application"},{"line_number":231,"context_line":"Credential. It can be used by other Consumers who have a User with access to"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_f76ba01c","line":228,"range":{"start_line":225,"start_character":0,"end_line":228,"end_character":11},"in_reply_to":"bf091321_8c18a91d","updated":"2017-06-09 07:41:34.000000000","message":"Changed to role names","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":234,"context_line":"an existing User, it can be inferred that it was created by a User that was"},{"line_number":235,"context_line":"deleted."},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"If the Consumer prefers to generate their own `secret`, they can do so and"},{"line_number":238,"context_line":"provide it in the create call. Keystone will store a hash of the given"},{"line_number":239,"context_line":"`secret`. Keystone will return the secret once upon creation in the same way it"},{"line_number":240,"context_line":"would if it was generated, but will not store the secret itself nor return it"},{"line_number":241,"context_line":"after the initial creation."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"A User can list the existing Application Credentials for a Project:"},{"line_number":244,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_2cdd1d42","line":241,"range":{"start_line":237,"start_character":0,"end_line":241,"end_character":27},"updated":"2017-06-08 23:23:17.000000000","message":"Suggest require a minimum secret length. This likely has PCI-DSS implications (Can be addressed in a followup, but prior to the code landing in a release)","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":234,"context_line":"an existing User, it can be inferred that it was created by a User that was"},{"line_number":235,"context_line":"deleted."},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"If the Consumer prefers to generate their own `secret`, they can do so and"},{"line_number":238,"context_line":"provide it in the create call. Keystone will store a hash of the given"},{"line_number":239,"context_line":"`secret`. Keystone will return the secret once upon creation in the same way it"},{"line_number":240,"context_line":"would if it was generated, but will not store the secret itself nor return it"},{"line_number":241,"context_line":"after the initial creation."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"A User can list the existing Application Credentials for a Project:"},{"line_number":244,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_379eb807","line":241,"range":{"start_line":237,"start_character":0,"end_line":241,"end_character":27},"in_reply_to":"bf091321_2cdd1d42","updated":"2017-06-09 07:41:34.000000000","message":"Let\u0027s hash that out in a followup.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":253,"context_line":"        {"},{"line_number":254,"context_line":"            \"id\": \"aa4541d9-0bc0-44f5-b02d-a9d922df7cbd\","},{"line_number":255,"context_line":"            \"name:\" \"backup\","},{"line_number":256,"context_line":"            \"secret\": null,"},{"line_number":257,"context_line":"            \"description\": \"Backup job...\","},{"line_number":258,"context_line":"            \"allow\": false,"},{"line_number":259,"context_line":"            \"expires_at\": \"2017-11-06T15:32:17.000000\","}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_cce34105","line":256,"range":{"start_line":256,"start_character":0,"end_line":256,"end_character":27},"updated":"2017-06-08 23:23:17.000000000","message":"See above comment.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":253,"context_line":"        {"},{"line_number":254,"context_line":"            \"id\": \"aa4541d9-0bc0-44f5-b02d-a9d922df7cbd\","},{"line_number":255,"context_line":"            \"name:\" \"backup\","},{"line_number":256,"context_line":"            \"secret\": null,"},{"line_number":257,"context_line":"            \"description\": \"Backup job...\","},{"line_number":258,"context_line":"            \"allow\": false,"},{"line_number":259,"context_line":"            \"expires_at\": \"2017-11-06T15:32:17.000000\","}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_fa114555","line":256,"range":{"start_line":256,"start_character":0,"end_line":256,"end_character":27},"in_reply_to":"bf091321_cce34105","updated":"2017-06-09 07:41:34.000000000","message":"Done","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":269,"context_line":""},{"line_number":270,"context_line":"::"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    GET /v3/projects/{project_id}/application_credentials"},{"line_number":273,"context_line":""},{"line_number":274,"context_line":".. code-block:: json"},{"line_number":275,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_1a0d1937","line":272,"updated":"2017-06-09 07:41:34.000000000","message":"Fixed this to refer to an ID","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":278,"context_line":"        {"},{"line_number":279,"context_line":"            \"id\": \"aa4541d9-0bc0-44f5-b02d-a9d922df7cbd\","},{"line_number":280,"context_line":"            \"name:\" \"backup\","},{"line_number":281,"context_line":"            \"secret\": null,"},{"line_number":282,"context_line":"            \"description\": \"Backup job...\","},{"line_number":283,"context_line":"            \"allow\": false,"},{"line_number":284,"context_line":"            \"expires_at\": \"2017-11-06T15:32:17.000000\","}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_6cbc35dc","line":281,"range":{"start_line":281,"start_character":0,"end_line":281,"end_character":27},"updated":"2017-06-08 23:23:17.000000000","message":"See above comment","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":278,"context_line":"        {"},{"line_number":279,"context_line":"            \"id\": \"aa4541d9-0bc0-44f5-b02d-a9d922df7cbd\","},{"line_number":280,"context_line":"            \"name:\" \"backup\","},{"line_number":281,"context_line":"            \"secret\": null,"},{"line_number":282,"context_line":"            \"description\": \"Backup job...\","},{"line_number":283,"context_line":"            \"allow\": false,"},{"line_number":284,"context_line":"            \"expires_at\": \"2017-11-06T15:32:17.000000\","}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_17a3b451","line":281,"range":{"start_line":281,"start_character":0,"end_line":281,"end_character":27},"in_reply_to":"bf091321_6cbc35dc","updated":"2017-06-09 07:41:34.000000000","message":"Okay","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"14130a218e155c947306fd0c0dcfee349690e934","unresolved":false,"context_lines":[{"line_number":362,"context_line":"                    \"application_credential\""},{"line_number":363,"context_line":"                ],"},{"line_number":364,"context_line":"                \"application_credential\": {"},{"line_number":365,"context_line":"                    \"name\": \"backup\","},{"line_number":366,"context_line":"                    \"project_id\": \"1a6f968a-cebe-4265-9b36-f3ca2801296c\","},{"line_number":367,"context_line":"                    \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\""},{"line_number":368,"context_line":"                }"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_a91b5f19","line":365,"updated":"2017-06-08 22:59:10.000000000","message":"We could make this similar to how we include domain information when project or user names are used:\n\n  {  \n      \"auth\":{  \n          \"identity\":{  \n              \"methods\":[  \n                  \"application_credential\"\n              ],\n              \"application_credential\":{  \n                  \"project\":{  \n                      \"id\u0027: \"a6f968a-cebe-4265-9b36-f3ca2801296c\"\n                  },\n                  \"name\":\"backup\",\n                  \"secret\":\"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\"\n              }\n          }\n      }\n  }","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":362,"context_line":"                    \"application_credential\""},{"line_number":363,"context_line":"                ],"},{"line_number":364,"context_line":"                \"application_credential\": {"},{"line_number":365,"context_line":"                    \"name\": \"backup\","},{"line_number":366,"context_line":"                    \"project_id\": \"1a6f968a-cebe-4265-9b36-f3ca2801296c\","},{"line_number":367,"context_line":"                    \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\""},{"line_number":368,"context_line":"                }"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_37b7d889","line":365,"in_reply_to":"bf091321_0cbb79e2","updated":"2017-06-09 07:41:34.000000000","message":"Done","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":362,"context_line":"                    \"application_credential\""},{"line_number":363,"context_line":"                ],"},{"line_number":364,"context_line":"                \"application_credential\": {"},{"line_number":365,"context_line":"                    \"name\": \"backup\","},{"line_number":366,"context_line":"                    \"project_id\": \"1a6f968a-cebe-4265-9b36-f3ca2801296c\","},{"line_number":367,"context_line":"                    \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\""},{"line_number":368,"context_line":"                }"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_0cbb79e2","line":365,"in_reply_to":"bf091321_a91b5f19","updated":"2017-06-08 23:23:17.000000000","message":"++","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":364,"context_line":"                \"application_credential\": {"},{"line_number":365,"context_line":"                    \"name\": \"backup\","},{"line_number":366,"context_line":"                    \"project_id\": \"1a6f968a-cebe-4265-9b36-f3ca2801296c\","},{"line_number":367,"context_line":"                    \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\""},{"line_number":368,"context_line":"                }"},{"line_number":369,"context_line":"            }"},{"line_number":370,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_cc910155","line":367,"range":{"start_line":367,"start_character":20,"end_line":367,"end_character":79},"updated":"2017-06-08 23:23:17.000000000","message":"I have thoughts on this... but generally speaking I think it would derail the concept too far to criticize this choice too much.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"3e0b496baacc95f6b4a629aca8344017efe8a6c6","unresolved":false,"context_lines":[{"line_number":364,"context_line":"                \"application_credential\": {"},{"line_number":365,"context_line":"                    \"name\": \"backup\","},{"line_number":366,"context_line":"                    \"project_id\": \"1a6f968a-cebe-4265-9b36-f3ca2801296c\","},{"line_number":367,"context_line":"                    \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\""},{"line_number":368,"context_line":"                }"},{"line_number":369,"context_line":"            }"},{"line_number":370,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7f231b9d_dfc1d782","line":367,"range":{"start_line":367,"start_character":20,"end_line":367,"end_character":79},"in_reply_to":"9f0e0f27_f70cc043","updated":"2017-06-09 17:24:37.000000000","message":"It would be far far more drastic. Not worth de-railing here.\n\nThis is quite sufficient and not missing the mark to force crazy re-working.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":364,"context_line":"                \"application_credential\": {"},{"line_number":365,"context_line":"                    \"name\": \"backup\","},{"line_number":366,"context_line":"                    \"project_id\": \"1a6f968a-cebe-4265-9b36-f3ca2801296c\","},{"line_number":367,"context_line":"                    \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\""},{"line_number":368,"context_line":"                }"},{"line_number":369,"context_line":"            }"},{"line_number":370,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_f70cc043","line":367,"range":{"start_line":367,"start_character":20,"end_line":367,"end_character":79},"in_reply_to":"bf091321_cc910155","updated":"2017-06-09 07:41:34.000000000","message":"Do you think it should be a header instead?\n\nAre your thoughts things that we can address in a followup or are they drastic?","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"14130a218e155c947306fd0c0dcfee349690e934","unresolved":false,"context_lines":[{"line_number":462,"context_line":"user-level resource. \"Integration\" could be a name for this. However, the"},{"line_number":463,"context_line":"Github concept goes hand-in-hand with a catalog of services that people can"},{"line_number":464,"context_line":"register to do things on their accouts, which is well out of scope for this"},{"line_number":465,"context_line":"proposal, so using that term is likely to cause more confusion that good."},{"line_number":466,"context_line":""},{"line_number":467,"context_line":".. _`Enhance tokens`: https://review.openstack.org/#/c/186979"},{"line_number":468,"context_line":".. _`Enhance users`: https://review.openstack.org/#/c/389870"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_29d18fce","line":465,"updated":"2017-06-08 22:59:10.000000000","message":"nit: than?","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":462,"context_line":"user-level resource. \"Integration\" could be a name for this. However, the"},{"line_number":463,"context_line":"Github concept goes hand-in-hand with a catalog of services that people can"},{"line_number":464,"context_line":"register to do things on their accouts, which is well out of scope for this"},{"line_number":465,"context_line":"proposal, so using that term is likely to cause more confusion that good."},{"line_number":466,"context_line":""},{"line_number":467,"context_line":".. _`Enhance tokens`: https://review.openstack.org/#/c/186979"},{"line_number":468,"context_line":".. _`Enhance users`: https://review.openstack.org/#/c/389870"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_d7209cb3","line":465,"in_reply_to":"bf091321_29d18fce","updated":"2017-06-09 07:41:34.000000000","message":"Done","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"14130a218e155c947306fd0c0dcfee349690e934","unresolved":false,"context_lines":[{"line_number":477,"context_line":"  single Service User and multiple Application Credentials. This decreases the"},{"line_number":478,"context_line":"  attack vector of gaining access to privileged operations by reducing the"},{"line_number":479,"context_line":"  number of accounts to attack."},{"line_number":480,"context_line":"* User names and passwords are kept out of configuration files. While"},{"line_number":481,"context_line":"* Application Credentials are still extremely sensitive, if compromised they do"},{"line_number":482,"context_line":"  not allow attackers to glean service user password conventions from"},{"line_number":483,"context_line":"  configuration."}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_49f5e356","line":480,"updated":"2017-06-08 22:59:10.000000000","message":"While? This seems like it\u0027s suppose to be continued with \"Application...\" but it looks like it rendered as a new list item.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5452f41524557c1b9aea7241e7f58e2c05f44279","unresolved":false,"context_lines":[{"line_number":477,"context_line":"  single Service User and multiple Application Credentials. This decreases the"},{"line_number":478,"context_line":"  attack vector of gaining access to privileged operations by reducing the"},{"line_number":479,"context_line":"  number of accounts to attack."},{"line_number":480,"context_line":"* User names and passwords are kept out of configuration files. While"},{"line_number":481,"context_line":"* Application Credentials are still extremely sensitive, if compromised they do"},{"line_number":482,"context_line":"  not allow attackers to glean service user password conventions from"},{"line_number":483,"context_line":"  configuration."}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_596cb607","line":480,"in_reply_to":"9f0e0f27_5735acf6","updated":"2017-06-09 14:20:17.000000000","message":"Why not just switch to emacs?!\n\n/me ducks","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":477,"context_line":"  single Service User and multiple Application Credentials. This decreases the"},{"line_number":478,"context_line":"  attack vector of gaining access to privileged operations by reducing the"},{"line_number":479,"context_line":"  number of accounts to attack."},{"line_number":480,"context_line":"* User names and passwords are kept out of configuration files. While"},{"line_number":481,"context_line":"* Application Credentials are still extremely sensitive, if compromised they do"},{"line_number":482,"context_line":"  not allow attackers to glean service user password conventions from"},{"line_number":483,"context_line":"  configuration."}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_5735acf6","line":480,"in_reply_to":"bf091321_0c893922","updated":"2017-06-09 07:41:34.000000000","message":"yep, vim was trying to be smart","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"83d4302ac4748d89cf02685ed04d732920b79f25","unresolved":false,"context_lines":[{"line_number":477,"context_line":"  single Service User and multiple Application Credentials. This decreases the"},{"line_number":478,"context_line":"  attack vector of gaining access to privileged operations by reducing the"},{"line_number":479,"context_line":"  number of accounts to attack."},{"line_number":480,"context_line":"* User names and passwords are kept out of configuration files. While"},{"line_number":481,"context_line":"* Application Credentials are still extremely sensitive, if compromised they do"},{"line_number":482,"context_line":"  not allow attackers to glean service user password conventions from"},{"line_number":483,"context_line":"  configuration."}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_0c893922","line":480,"in_reply_to":"bf091321_49f5e356","updated":"2017-06-08 23:23:17.000000000","message":"++ This looks like a typo.","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"14130a218e155c947306fd0c0dcfee349690e934","unresolved":false,"context_lines":[{"line_number":482,"context_line":"  not allow attackers to glean service user password conventions from"},{"line_number":483,"context_line":"  configuration."},{"line_number":484,"context_line":"* Application Credentials will grow the ability to have limited access, so a"},{"line_number":485,"context_line":"  move to them is a further step towards limited access credentials."},{"line_number":486,"context_line":"* Application Credentials can be gracefully rotated out of use and deleted"},{"line_number":487,"context_line":"  periodically, allowing Consumers and Deployers a mechanism to prevent"},{"line_number":488,"context_line":"  compromised Users without requiring swapping credentials in short amounts of"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_e9039741","line":485,"updated":"2017-06-08 22:59:10.000000000","message":"nit: s/further//","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":482,"context_line":"  not allow attackers to glean service user password conventions from"},{"line_number":483,"context_line":"  configuration."},{"line_number":484,"context_line":"* Application Credentials will grow the ability to have limited access, so a"},{"line_number":485,"context_line":"  move to them is a further step towards limited access credentials."},{"line_number":486,"context_line":"* Application Credentials can be gracefully rotated out of use and deleted"},{"line_number":487,"context_line":"  periodically, allowing Consumers and Deployers a mechanism to prevent"},{"line_number":488,"context_line":"  compromised Users without requiring swapping credentials in short amounts of"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_174a947f","line":485,"in_reply_to":"bf091321_e9039741","updated":"2017-06-09 07:41:34.000000000","message":"Done","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"14130a218e155c947306fd0c0dcfee349690e934","unresolved":false,"context_lines":[{"line_number":502,"context_line":""},{"line_number":503,"context_line":"* Consumers who have Applications that monitor or interact with OpenStack"},{"line_number":504,"context_line":"  Services should be able to leverage this feature to improve the overall"},{"line_number":505,"context_line":"  security of their Applications."},{"line_number":506,"context_line":"* Consumers who do not start using Application Credentials should experience no"},{"line_number":507,"context_line":"  impact. Consumers can gracefully rotate Application Credentials for an"},{"line_number":508,"context_line":"  Application with no downtime by creating a new Application Credential,"}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_699547e4","line":505,"updated":"2017-06-08 22:59:10.000000000","message":"nit: security and manageability*","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":502,"context_line":""},{"line_number":503,"context_line":"* Consumers who have Applications that monitor or interact with OpenStack"},{"line_number":504,"context_line":"  Services should be able to leverage this feature to improve the overall"},{"line_number":505,"context_line":"  security of their Applications."},{"line_number":506,"context_line":"* Consumers who do not start using Application Credentials should experience no"},{"line_number":507,"context_line":"  impact. Consumers can gracefully rotate Application Credentials for an"},{"line_number":508,"context_line":"  Application with no downtime by creating a new Application Credential,"}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_57500c33","line":505,"in_reply_to":"bf091321_699547e4","updated":"2017-06-09 07:41:34.000000000","message":"Done","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"14130a218e155c947306fd0c0dcfee349690e934","unresolved":false,"context_lines":[{"line_number":523,"context_line":""},{"line_number":524,"context_line":"* Deployers only need to enforce security on a single service account instead"},{"line_number":525,"context_line":"  of multiple."},{"line_number":526,"context_line":"* Password rotation policies for service account no longer require immediately"},{"line_number":527,"context_line":"  redeploying service configuration files. A User password change does not"},{"line_number":528,"context_line":"  affect the existing Application Credential in the various service"},{"line_number":529,"context_line":"  configuration files."}],"source_content_type":"text/x-rst","patch_set":15,"id":"bf091321_69be6766","line":526,"updated":"2017-06-08 22:59:10.000000000","message":"nit: accounts","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"c4560b9ab0c425d1d7527664dfd09defe008f5fc","unresolved":false,"context_lines":[{"line_number":523,"context_line":""},{"line_number":524,"context_line":"* Deployers only need to enforce security on a single service account instead"},{"line_number":525,"context_line":"  of multiple."},{"line_number":526,"context_line":"* Password rotation policies for service account no longer require immediately"},{"line_number":527,"context_line":"  redeploying service configuration files. A User password change does not"},{"line_number":528,"context_line":"  affect the existing Application Credential in the various service"},{"line_number":529,"context_line":"  configuration files."}],"source_content_type":"text/x-rst","patch_set":15,"id":"9f0e0f27_774b1087","line":526,"in_reply_to":"bf091321_69be6766","updated":"2017-06-09 07:41:34.000000000","message":"Done","commit_id":"ddebf19ab6eddccc5828e1a09d44dfdac6ab561a"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"1ca716dccedf93cfa879eafe4645f10f9dab23f0","unresolved":false,"context_lines":[{"line_number":155,"context_line":"            \"name:\" \"backup\","},{"line_number":156,"context_line":"            \"description\": \"Backup job...\","},{"line_number":157,"context_line":"            \"expires_at\": \"2017-11-06T15:32:17.000000\","},{"line_number":158,"context_line":"            \"allow\": true,"},{"line_number":159,"context_line":"            \"api_access_list\": [],"},{"line_number":160,"context_line":"            \"api_access\": \"157aa4d6-6601-4729-bebe-f3399d994a59\""},{"line_number":161,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":16,"id":"7f231b9d_36459871","line":158,"range":{"start_line":158,"start_character":12,"end_line":158,"end_character":25},"updated":"2017-06-09 15:31:39.000000000","message":"Is allow intended to be a flag for disabling the credential?","commit_id":"de5e53ea6accfb9bebfea8433275f6c5d82b089f"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"e3343ef1832cb5e0fea4712c4949dfbe8265df3f","unresolved":false,"context_lines":[{"line_number":155,"context_line":"            \"name:\" \"backup\","},{"line_number":156,"context_line":"            \"description\": \"Backup job...\","},{"line_number":157,"context_line":"            \"expires_at\": \"2017-11-06T15:32:17.000000\","},{"line_number":158,"context_line":"            \"allow\": true,"},{"line_number":159,"context_line":"            \"api_access_list\": [],"},{"line_number":160,"context_line":"            \"api_access\": \"157aa4d6-6601-4729-bebe-f3399d994a59\""},{"line_number":161,"context_line":"        }"}],"source_content_type":"text/x-rst","patch_set":16,"id":"7f231b9d_d90e9731","line":158,"range":{"start_line":158,"start_character":12,"end_line":158,"end_character":25},"in_reply_to":"7f231b9d_36459871","updated":"2017-06-09 15:40:32.000000000","message":"That is leftover from an earlier patchset, will remove","commit_id":"de5e53ea6accfb9bebfea8433275f6c5d82b089f"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"1ca716dccedf93cfa879eafe4645f10f9dab23f0","unresolved":false,"context_lines":[{"line_number":175,"context_line":"Date Time Format`_ and is assumed to be in UTC if an explicit timezone offset"},{"line_number":176,"context_line":"is not included."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":179,"context_line":"Application Credential starts with. Its contents are currently undefined but is"},{"line_number":180,"context_line":"included for forward compatibility. Values other than the empty list or"},{"line_number":181,"context_line":"omitting the field are currently an error."}],"source_content_type":"text/x-rst","patch_set":16,"id":"7f231b9d_f68720b6","line":178,"range":{"start_line":178,"start_character":1,"end_line":178,"end_character":16},"updated":"2017-06-09 15:31:39.000000000","message":"I\u0027m not clear as to what this is or how it would be used. More information around api_access and api_access_list would be helpful.","commit_id":"de5e53ea6accfb9bebfea8433275f6c5d82b089f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fc7c59ca5b8575c70638e51ce4b8216275cc18fd","unresolved":false,"context_lines":[{"line_number":175,"context_line":"Date Time Format`_ and is assumed to be in UTC if an explicit timezone offset"},{"line_number":176,"context_line":"is not included."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":179,"context_line":"Application Credential starts with. Its contents are currently undefined but is"},{"line_number":180,"context_line":"included for forward compatibility. Values other than the empty list or"},{"line_number":181,"context_line":"omitting the field are currently an error."}],"source_content_type":"text/x-rst","patch_set":16,"id":"7f231b9d_195e4fe6","line":178,"in_reply_to":"7f231b9d_d99337a3","updated":"2017-06-09 15:44:14.000000000","message":"We could wrap these with notes or warning saying that they aren\u0027t implemented for used in the first iteration.\n\nI do see your point though of not including them in the first go around and just adding them when we need them and understand how we want them to work.","commit_id":"de5e53ea6accfb9bebfea8433275f6c5d82b089f"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"e3343ef1832cb5e0fea4712c4949dfbe8265df3f","unresolved":false,"context_lines":[{"line_number":175,"context_line":"Date Time Format`_ and is assumed to be in UTC if an explicit timezone offset"},{"line_number":176,"context_line":"is not included."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":179,"context_line":"Application Credential starts with. Its contents are currently undefined but is"},{"line_number":180,"context_line":"included for forward compatibility. Values other than the empty list or"},{"line_number":181,"context_line":"omitting the field are currently an error."}],"source_content_type":"text/x-rst","patch_set":16,"id":"7f231b9d_d99337a3","line":178,"range":{"start_line":178,"start_character":1,"end_line":178,"end_character":16},"in_reply_to":"7f231b9d_f68720b6","updated":"2017-06-09 15:40:32.000000000","message":"It\u0027s Monty\u0027s idea for limiting the permissions of a key/credential at a user-facing level, distinct from operator-controlled policies. e.g. setting this to [\u0027POST /servers\u0027] would allow the key to boot servers and implicitly to list networks and everything else that goes along with that. Its definition and usage is definitely not fleshed out. I commented earlier that maybe we shouldn\u0027t include this at all in this first round since it won\u0027t be implemented immediately but we didn\u0027t really land anywhere solid on that.","commit_id":"de5e53ea6accfb9bebfea8433275f6c5d82b089f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8223ce9d62c0d39e0674c3b071b1eb76b75e6fc2","unresolved":false,"context_lines":[{"line_number":177,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":178,"context_line":"Application Credential starts with. Its contents are currently undefined but is"},{"line_number":179,"context_line":"included for forward compatibility. Values other than the empty list or"},{"line_number":180,"context_line":"omitting the field are currently an error."},{"line_number":181,"context_line":""},{"line_number":182,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since"},{"line_number":183,"context_line":"Application Credentials are immutable, the contents of this list will be copied"}],"source_content_type":"text/x-rst","patch_set":17,"id":"7f231b9d_991dbfbf","line":180,"updated":"2017-06-09 15:59:01.000000000","message":"It seems that folks, myself included, are tripping over the intended usage/definition of this attribute and api_access.\n\nMaybe instead of including them in the first revision but not use them, we just omit them entirely and add them when we need them?","commit_id":"cac626e251e6bf0bcc682c5289886beb394438dd"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"5dd285b6e56289ad9ffacef2db60620781d6de65","unresolved":false,"context_lines":[{"line_number":185,"context_line":"that. In future implementations, we believe the following attributes will be"},{"line_number":186,"context_line":"useful:"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":189,"context_line":"Application Credential starts with. Its contents are currently undefined."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since"}],"source_content_type":"text/x-rst","patch_set":18,"id":"7f231b9d_3cb579ef","line":188,"range":{"start_line":188,"start_character":33,"end_line":188,"end_character":46},"updated":"2017-06-09 16:37:33.000000000","message":"Can you provide an example of a list of rules?","commit_id":"b2cbf0b5c7c4818ee74d220a5363ad463ca553cb"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"5dd285b6e56289ad9ffacef2db60620781d6de65","unresolved":false,"context_lines":[{"line_number":188,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":189,"context_line":"Application Credential starts with. Its contents are currently undefined."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since"},{"line_number":192,"context_line":"Application Credentials are immutable, the contents of this list will be copied"},{"line_number":193,"context_line":"to `api_access_list` at creation time rather than stored as a reference. It is"},{"line_number":194,"context_line":"an error to provide both `api_access` and `api_access_list`. Providing a name"},{"line_number":195,"context_line":"or ID that cannot be found is an error."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Response example:"},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"7f231b9d_bc9d0968","line":195,"range":{"start_line":191,"start_character":0,"end_line":195,"end_character":39},"updated":"2017-06-09 16:37:33.000000000","message":"Still not clear on this. Seems like we\u0027re adding complexity here that may not be needed.","commit_id":"b2cbf0b5c7c4818ee74d220a5363ad463ca553cb"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"ea4f0d0381552a8a8834716d697b078d66e3f8b1","unresolved":false,"context_lines":[{"line_number":188,"context_line":"`api_access_list` is an optional list of rules to apply on top of the roles the"},{"line_number":189,"context_line":"Application Credential starts with. Its contents are currently undefined."},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"`api_access` is the name or ID of a pre-defined API Access List. Since"},{"line_number":192,"context_line":"Application Credentials are immutable, the contents of this list will be copied"},{"line_number":193,"context_line":"to `api_access_list` at creation time rather than stored as a reference. It is"},{"line_number":194,"context_line":"an error to provide both `api_access` and `api_access_list`. Providing a name"},{"line_number":195,"context_line":"or ID that cannot be found is an error."},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"Response example:"},{"line_number":198,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"7f231b9d_dc9e8553","line":195,"range":{"start_line":191,"start_character":0,"end_line":195,"end_character":39},"in_reply_to":"7f231b9d_bc9d0968","updated":"2017-06-09 16:40:33.000000000","message":"And if we\u0027re not implementing in this round, then I would prefer not to include this.","commit_id":"b2cbf0b5c7c4818ee74d220a5363ad463ca553cb"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"eb426d5e5288f93b55265cd8d2ca6a895bae047e","unresolved":false,"context_lines":[{"line_number":48,"context_line":"To accomplish this, one will typically store User credentials in a"},{"line_number":49,"context_line":"configuration file, such as `clouds.yaml`_ so that scripts can access the"},{"line_number":50,"context_line":"OpenStack API without Human interaction. Having User credentials in"},{"line_number":51,"context_line":"configuration files and/or embedding them into a virtual machine, creates a"},{"line_number":52,"context_line":"potential security risk."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"* As an OpenStack Consumer, I want to limit the actions that an Application"},{"line_number":55,"context_line":"  can make to a pre-defined subset of what my User otherwise has access to do."}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_eaaa8fd0","line":52,"range":{"start_line":51,"start_character":66,"end_line":52,"end_character":24},"updated":"2017-06-09 18:19:46.000000000","message":"the risk will continue with app creds, wont it? the difference is how you diminish the risk with rotating more often (since there will be no downtime it will be easier to rotate).","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"43dabffbe47c09772750d2ae0b41dc771793bfdc","unresolved":false,"context_lines":[{"line_number":48,"context_line":"To accomplish this, one will typically store User credentials in a"},{"line_number":49,"context_line":"configuration file, such as `clouds.yaml`_ so that scripts can access the"},{"line_number":50,"context_line":"OpenStack API without Human interaction. Having User credentials in"},{"line_number":51,"context_line":"configuration files and/or embedding them into a virtual machine, creates a"},{"line_number":52,"context_line":"potential security risk."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"* As an OpenStack Consumer, I want to limit the actions that an Application"},{"line_number":55,"context_line":"  can make to a pre-defined subset of what my User otherwise has access to do."}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_ea684f22","line":52,"range":{"start_line":51,"start_character":66,"end_line":52,"end_character":24},"in_reply_to":"7f231b9d_eaaa8fd0","updated":"2017-06-09 18:34:20.000000000","message":"It\u0027s also diminished because the creds in the config file will not be the same as used for a federated identity system.","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"eb426d5e5288f93b55265cd8d2ca6a895bae047e","unresolved":false,"context_lines":[{"line_number":51,"context_line":"configuration files and/or embedding them into a virtual machine, creates a"},{"line_number":52,"context_line":"potential security risk."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"* As an OpenStack Consumer, I want to limit the actions that an Application"},{"line_number":55,"context_line":"  can make to a pre-defined subset of what my User otherwise has access to do."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"By using a User\u0027s credentials, the Application will have all of that User\u0027s"},{"line_number":58,"context_line":"access. This is likely more access than needed."}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_8a755b9b","line":55,"range":{"start_line":54,"start_character":3,"end_line":55,"end_character":78},"updated":"2017-06-09 18:19:46.000000000","message":"thsi seems to be possible today already with service users. just assign the minimum necessary roles (as opposed to admin?)","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"43dabffbe47c09772750d2ae0b41dc771793bfdc","unresolved":false,"context_lines":[{"line_number":51,"context_line":"configuration files and/or embedding them into a virtual machine, creates a"},{"line_number":52,"context_line":"potential security risk."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"* As an OpenStack Consumer, I want to limit the actions that an Application"},{"line_number":55,"context_line":"  can make to a pre-defined subset of what my User otherwise has access to do."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"By using a User\u0027s credentials, the Application will have all of that User\u0027s"},{"line_number":58,"context_line":"access. This is likely more access than needed."}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_ea516f64","line":55,"range":{"start_line":54,"start_character":3,"end_line":55,"end_character":78},"in_reply_to":"7f231b9d_8a755b9b","updated":"2017-06-09 18:34:20.000000000","message":"But only admins can do that. I can\u0027t make a thing that can only upload things to swift.","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"eb426d5e5288f93b55265cd8d2ca6a895bae047e","unresolved":false,"context_lines":[{"line_number":58,"context_line":"access. This is likely more access than needed."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"* As a team of OpenStack Consumers, I want to be able to make Applications"},{"line_number":61,"context_line":"  that will not stop working when one of my Team Members leaves, and to be"},{"line_number":62,"context_line":"  able to gracefully manage the rotation of the associated application"},{"line_number":63,"context_line":"  credentials."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"As the use of Automation increases in the world, more and more teams have"},{"line_number":66,"context_line":"problems with automation that was tied to a specific Consumer\u0027s User"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_bf585b56","line":63,"range":{"start_line":61,"start_character":65,"end_line":63,"end_character":14},"updated":"2017-06-09 18:19:46.000000000","message":"this seems almost equal to the usecase below:\n\n    I need to be able to gracefully rotate application credentials.","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"43dabffbe47c09772750d2ae0b41dc771793bfdc","unresolved":false,"context_lines":[{"line_number":58,"context_line":"access. This is likely more access than needed."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"* As a team of OpenStack Consumers, I want to be able to make Applications"},{"line_number":61,"context_line":"  that will not stop working when one of my Team Members leaves, and to be"},{"line_number":62,"context_line":"  able to gracefully manage the rotation of the associated application"},{"line_number":63,"context_line":"  credentials."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"As the use of Automation increases in the world, more and more teams have"},{"line_number":66,"context_line":"problems with automation that was tied to a specific Consumer\u0027s User"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_6af43f5c","line":63,"range":{"start_line":61,"start_character":65,"end_line":63,"end_character":14},"in_reply_to":"7f231b9d_bf585b56","updated":"2017-06-09 18:34:20.000000000","message":"It is - this is more about persisting. Will fix.","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"eb426d5e5288f93b55265cd8d2ca6a895bae047e","unresolved":false,"context_lines":[{"line_number":383,"context_line":"will explicitly block tokens generated from an Application Credential from"},{"line_number":384,"context_line":"doing the following:"},{"line_number":385,"context_line":""},{"line_number":386,"context_line":"* POST /projects/{}/application_credentials"},{"line_number":387,"context_line":"* DELETE /projects/{}/application_credentials/{}"},{"line_number":388,"context_line":"* POST /users"},{"line_number":389,"context_line":"* PATCH /users/{}"},{"line_number":390,"context_line":"* DELETE /users/{}"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_6a09dfdb","line":387,"range":{"start_line":386,"start_character":0,"end_line":387,"end_character":48},"updated":"2017-06-09 18:19:46.000000000","message":"so how will the rotation happen? wasnt the app supposed to be able to rotate its app credentials by itself?","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"43dabffbe47c09772750d2ae0b41dc771793bfdc","unresolved":false,"context_lines":[{"line_number":383,"context_line":"will explicitly block tokens generated from an Application Credential from"},{"line_number":384,"context_line":"doing the following:"},{"line_number":385,"context_line":""},{"line_number":386,"context_line":"* POST /projects/{}/application_credentials"},{"line_number":387,"context_line":"* DELETE /projects/{}/application_credentials/{}"},{"line_number":388,"context_line":"* POST /users"},{"line_number":389,"context_line":"* PATCH /users/{}"},{"line_number":390,"context_line":"* DELETE /users/{}"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_aaf9374e","line":387,"range":{"start_line":386,"start_character":0,"end_line":387,"end_character":48},"in_reply_to":"7f231b9d_6a09dfdb","updated":"2017-06-09 18:34:20.000000000","message":"Nope. A User needs to be able to perform rotation.","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"eb426d5e5288f93b55265cd8d2ca6a895bae047e","unresolved":false,"context_lines":[{"line_number":427,"context_line":""},{"line_number":428,"context_line":"`Enhance tokens`_ by allowing delegation of subsets of roles to a token. This"},{"line_number":429,"context_line":"solves the problem of granting too much access to an application, but it still"},{"line_number":430,"context_line":"necessitates tying an application to a User, and token expiry makes it"},{"line_number":431,"context_line":"insufficient for use by applications."},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"`Enhance users`_ by adding new credential types and then allowing role"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_4a274366","line":430,"range":{"start_line":430,"start_character":22,"end_line":430,"end_character":43},"updated":"2017-06-09 18:19:46.000000000","message":"could be service users (one for each?) as opposed to Human\u0027s User","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"43dabffbe47c09772750d2ae0b41dc771793bfdc","unresolved":false,"context_lines":[{"line_number":427,"context_line":""},{"line_number":428,"context_line":"`Enhance tokens`_ by allowing delegation of subsets of roles to a token. This"},{"line_number":429,"context_line":"solves the problem of granting too much access to an application, but it still"},{"line_number":430,"context_line":"necessitates tying an application to a User, and token expiry makes it"},{"line_number":431,"context_line":"insufficient for use by applications."},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"`Enhance users`_ by adding new credential types and then allowing role"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_ea84cfb3","line":430,"range":{"start_line":430,"start_character":22,"end_line":430,"end_character":43},"in_reply_to":"7f231b9d_4a274366","updated":"2017-06-09 18:34:20.000000000","message":"\"User\" here means Keystone User Object.","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"eb426d5e5288f93b55265cd8d2ca6a895bae047e","unresolved":false,"context_lines":[{"line_number":427,"context_line":""},{"line_number":428,"context_line":"`Enhance tokens`_ by allowing delegation of subsets of roles to a token. This"},{"line_number":429,"context_line":"solves the problem of granting too much access to an application, but it still"},{"line_number":430,"context_line":"necessitates tying an application to a User, and token expiry makes it"},{"line_number":431,"context_line":"insufficient for use by applications."},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"`Enhance users`_ by adding new credential types and then allowing role"},{"line_number":434,"context_line":"assignments to be assigned to credential types instead of users. This doesn\u0027t"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_6ac0bf51","line":431,"range":{"start_line":430,"start_character":45,"end_line":431,"end_character":37},"updated":"2017-06-09 18:19:46.000000000","message":"long running operations? isnt that solved with the ability to validate tokens that have been expired? that\u0027d also allow apps to rotate without downtime since hte old tokens can still be validated? (I dont know much deails on that, just throwing the idea)","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"43dabffbe47c09772750d2ae0b41dc771793bfdc","unresolved":false,"context_lines":[{"line_number":427,"context_line":""},{"line_number":428,"context_line":"`Enhance tokens`_ by allowing delegation of subsets of roles to a token. This"},{"line_number":429,"context_line":"solves the problem of granting too much access to an application, but it still"},{"line_number":430,"context_line":"necessitates tying an application to a User, and token expiry makes it"},{"line_number":431,"context_line":"insufficient for use by applications."},{"line_number":432,"context_line":""},{"line_number":433,"context_line":"`Enhance users`_ by adding new credential types and then allowing role"},{"line_number":434,"context_line":"assignments to be assigned to credential types instead of users. This doesn\u0027t"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_8abd5b6a","line":431,"range":{"start_line":430,"start_character":45,"end_line":431,"end_character":37},"in_reply_to":"7f231b9d_6ac0bf51","updated":"2017-06-09 18:34:20.000000000","message":"Yah -it\u0027s not so much an app rotating it\u0027s own credentials, as much as a Consumer being able to create a new credential, update their configs, then delete the old credential.","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"eb426d5e5288f93b55265cd8d2ca6a895bae047e","unresolved":false,"context_lines":[{"line_number":432,"context_line":""},{"line_number":433,"context_line":"`Enhance users`_ by adding new credential types and then allowing role"},{"line_number":434,"context_line":"assignments to be assigned to credential types instead of users. This doesn\u0027t"},{"line_number":435,"context_line":"solve the problem of applications needing to continue running after a User has"},{"line_number":436,"context_line":"been decommissioned."},{"line_number":437,"context_line":""},{"line_number":438,"context_line":"Just use OAuth. Keystone already supports OAuth-based authentication. However,"},{"line_number":439,"context_line":"adding OAuth on top of an existing Auth system is a deployer opt-in task that"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_eacbaf6f","line":436,"range":{"start_line":435,"start_character":62,"end_line":436,"end_character":19},"updated":"2017-06-09 18:19:46.000000000","message":"couldnt this be possible by adding Users for apps?","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"43dabffbe47c09772750d2ae0b41dc771793bfdc","unresolved":false,"context_lines":[{"line_number":432,"context_line":""},{"line_number":433,"context_line":"`Enhance users`_ by adding new credential types and then allowing role"},{"line_number":434,"context_line":"assignments to be assigned to credential types instead of users. This doesn\u0027t"},{"line_number":435,"context_line":"solve the problem of applications needing to continue running after a User has"},{"line_number":436,"context_line":"been decommissioned."},{"line_number":437,"context_line":""},{"line_number":438,"context_line":"Just use OAuth. Keystone already supports OAuth-based authentication. However,"},{"line_number":439,"context_line":"adding OAuth on top of an existing Auth system is a deployer opt-in task that"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_0ab14b90","line":436,"range":{"start_line":435,"start_character":62,"end_line":436,"end_character":19},"in_reply_to":"7f231b9d_eacbaf6f","updated":"2017-06-09 18:34:20.000000000","message":"Yes - but normal consumers do not have the ability to create Users- especially in places using things like LDAP.","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"eb426d5e5288f93b55265cd8d2ca6a895bae047e","unresolved":false,"context_lines":[{"line_number":476,"context_line":"This would have a positive security impact:"},{"line_number":477,"context_line":""},{"line_number":478,"context_line":"* Instead of having a Service User for each service, all services can use a"},{"line_number":479,"context_line":"  single Service User and multiple Application Credentials. This decreases the"},{"line_number":480,"context_line":"  attack vector of gaining access to privileged operations by reducing the"},{"line_number":481,"context_line":"  number of accounts to attack."},{"line_number":482,"context_line":"* User names and passwords are kept out of configuration files. While"},{"line_number":483,"context_line":"  Application Credentials are still extremely sensitive, if compromised they do"},{"line_number":484,"context_line":"  not allow attackers to glean service user password conventions from"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_ea904f51","line":481,"range":{"start_line":479,"start_character":61,"end_line":481,"end_character":31},"updated":"2017-06-09 18:19:46.000000000","message":"but on the other hand this increases the number of app credentials to attack, so it is about the same at the end, no?","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"43dabffbe47c09772750d2ae0b41dc771793bfdc","unresolved":false,"context_lines":[{"line_number":476,"context_line":"This would have a positive security impact:"},{"line_number":477,"context_line":""},{"line_number":478,"context_line":"* Instead of having a Service User for each service, all services can use a"},{"line_number":479,"context_line":"  single Service User and multiple Application Credentials. This decreases the"},{"line_number":480,"context_line":"  attack vector of gaining access to privileged operations by reducing the"},{"line_number":481,"context_line":"  number of accounts to attack."},{"line_number":482,"context_line":"* User names and passwords are kept out of configuration files. While"},{"line_number":483,"context_line":"  Application Credentials are still extremely sensitive, if compromised they do"},{"line_number":484,"context_line":"  not allow attackers to glean service user password conventions from"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_ca7fd3a9","line":481,"range":{"start_line":479,"start_character":61,"end_line":481,"end_character":31},"in_reply_to":"7f231b9d_ea904f51","updated":"2017-06-09 18:34:20.000000000","message":"Potentially over time each of those Credentials will be limited in scope.","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"eb426d5e5288f93b55265cd8d2ca6a895bae047e","unresolved":false,"context_lines":[{"line_number":483,"context_line":"  Application Credentials are still extremely sensitive, if compromised they do"},{"line_number":484,"context_line":"  not allow attackers to glean service user password conventions from"},{"line_number":485,"context_line":"  configuration."},{"line_number":486,"context_line":"* Application Credentials will grow the ability to have limited access, so a"},{"line_number":487,"context_line":"  move to them is a step towards limited access credentials."},{"line_number":488,"context_line":"* Application Credentials can be gracefully rotated out of use and deleted"},{"line_number":489,"context_line":"  periodically, allowing Consumers and Deployers a mechanism to prevent"},{"line_number":490,"context_line":"  compromised Users without requiring swapping credentials in short amounts of"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_8a8e7b25","line":487,"range":{"start_line":486,"start_character":2,"end_line":487,"end_character":60},"updated":"2017-06-09 18:19:46.000000000","message":"if I understood that correctly, limited access will be implemented by limiting the roles that are delegated. so what is different from reducing the number of assigned roles to app creds VS just reducing the number of assigned roles to service Users?","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":2,"name":"Monty Taylor","email":"mordred@inaugust.com","username":"mordred"},"change_message_id":"43dabffbe47c09772750d2ae0b41dc771793bfdc","unresolved":false,"context_lines":[{"line_number":483,"context_line":"  Application Credentials are still extremely sensitive, if compromised they do"},{"line_number":484,"context_line":"  not allow attackers to glean service user password conventions from"},{"line_number":485,"context_line":"  configuration."},{"line_number":486,"context_line":"* Application Credentials will grow the ability to have limited access, so a"},{"line_number":487,"context_line":"  move to them is a step towards limited access credentials."},{"line_number":488,"context_line":"* Application Credentials can be gracefully rotated out of use and deleted"},{"line_number":489,"context_line":"  periodically, allowing Consumers and Deployers a mechanism to prevent"},{"line_number":490,"context_line":"  compromised Users without requiring swapping credentials in short amounts of"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7f231b9d_ea728fe3","line":487,"range":{"start_line":486,"start_character":2,"end_line":487,"end_character":60},"in_reply_to":"7f231b9d_8a8e7b25","updated":"2017-06-09 18:34:20.000000000","message":"The limited roles is just for now. In the next iteration actions will be able to be limited by specific REST calls.","commit_id":"cdc831e077d31f33ec6e9007e24725607253643a"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"10b2a793e4418f5f7c1ff25a1641d9dfe931cead","unresolved":false,"context_lines":[{"line_number":56,"context_line":"  can make to a pre-defined subset of what my User otherwise has access to do."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"By using a User\u0027s credentials, the Application will have all of that User\u0027s"},{"line_number":59,"context_line":"access. This is likely more access than needed. For instance, a regular"},{"line_number":60,"context_line":"Consumer cannot set up an application that can only upload images to Glance but"},{"line_number":61,"context_line":"cannot create or delete servers in Nova."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"* As an OpenStack Consumer and an OpenStack Deployer, I need to be able to"},{"line_number":64,"context_line":"  gracefully rotate application credentials."}],"source_content_type":"text/x-rst","patch_set":21,"id":"7f231b9d_e56520e3","line":61,"range":{"start_line":59,"start_character":48,"end_line":61,"end_character":40},"updated":"2017-06-09 18:52:23.000000000","message":"you would need a separate role for that + policy customization, correct? how different is that with application credentials? I saw you replied in PS19 it will be possible in the future to specify APIs the credential will access, but that would be definitely be something great to ahve for normal users too","commit_id":"99ac820fc87db5418951133656166f10a0d40c94"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"7771f532f443b37d2b49023a1c396a1d48c5c8ad","unresolved":false,"context_lines":[{"line_number":77,"context_line":""},{"line_number":78,"context_line":"As the use of Automation increases in the world, more and more teams have"},{"line_number":79,"context_line":"problems with automation that was tied to a specific Consumer\u0027s User"},{"line_number":80,"context_line":"credentials. The application credentials should be managed as Project level"},{"line_number":81,"context_line":"resources so that all Consumers who have Users with write-allowed roles on the"},{"line_number":82,"context_line":"Project can rotate or delete them as they see fit if membership in their Team"},{"line_number":83,"context_line":"changes."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"* As an OpenStack Deployer, I need to configure some OpenStack Services to be"},{"line_number":86,"context_line":"  able to make API calls to other OpenStack Services."}],"source_content_type":"text/x-rst","patch_set":21,"id":"7f231b9d_0555bc50","line":83,"range":{"start_line":80,"start_character":13,"end_line":83,"end_character":8},"updated":"2017-06-09 19:22:03.000000000","message":"if a Consumer leaves the team, their User will be deleted, when their User is deleted, the Application Credentials would also be deleted (according to L303-304)\n\nWhat would the process look like here? I imagine that would be: Another Consumer in the team would use their User to create another Application Credential with the same roles in the same project before deleting the User of the Consumer who has left.","commit_id":"99ac820fc87db5418951133656166f10a0d40c94"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"10b2a793e4418f5f7c1ff25a1641d9dfe931cead","unresolved":false,"context_lines":[{"line_number":124,"context_line":"* Immutable."},{"line_number":125,"context_line":"* Allow for optionally setting limits, e.g. 5 Application Credentials per User"},{"line_number":126,"context_line":"  or Project, to prevent abuse of the resource."},{"line_number":127,"context_line":"* Assigned the curent roles the creating User has on the Project at creation"},{"line_number":128,"context_line":"  time, or optionally a list of roles that is a subset of the creating User\u0027s"},{"line_number":129,"context_line":"  roles on the Project."},{"line_number":130,"context_line":"* Secret exposed only once at creation time in the create API response."},{"line_number":131,"context_line":"* Limited ability to manipulate identity objects (see `Limitations Imposed`_)"},{"line_number":132,"context_line":"* Support expiration."}],"source_content_type":"text/x-rst","patch_set":21,"id":"7f231b9d_456f34c5","line":129,"range":{"start_line":127,"start_character":2,"end_line":129,"end_character":23},"updated":"2017-06-09 18:52:23.000000000","message":"it would be great to clearly say application credentials can only be created with project scoped tokens","commit_id":"99ac820fc87db5418951133656166f10a0d40c94"},{"author":{"_account_id":4257,"name":"Zane Bitter","email":"zbitter@redhat.com","username":"zaneb"},"change_message_id":"8ff4d48f4522dbccbfa839ab62e93defde0f1bd2","unresolved":false,"context_lines":[{"line_number":131,"context_line":"* Limited ability to manipulate identity objects (see `Limitations Imposed`_)"},{"line_number":132,"context_line":"* Support expiration."},{"line_number":133,"context_line":"* Support deletion by any user with a write-allowed role in the project."},{"line_number":134,"context_line":"* Will be deleted when the associated User is deleted."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Application Credentials will be treated as credentials and not authorization"},{"line_number":137,"context_line":"tokens, as this fits within the keystone model and is consistent with others"}],"source_content_type":"text/x-rst","patch_set":21,"id":"1f1a1f67_cdd19625","line":134,"updated":"2017-07-17 20:20:57.000000000","message":"This seems inconsistent - if one of the User\u0027s roles is revoked then the Application keeps its permissions, but if the User itself is deleted then the Application loses its permissions.","commit_id":"99ac820fc87db5418951133656166f10a0d40c94"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"baddfb381f9785a829df4aed277bf90a05c483ea","unresolved":false,"context_lines":[{"line_number":155,"context_line":"Application Credential Management"},{"line_number":156,"context_line":"---------------------------------"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"By default, any User with at least a member role on a Project should be able to"},{"line_number":159,"context_line":"list, add, and delete Application Credentials for that project. For example,"},{"line_number":160,"context_line":"adding an Application Credentials:"},{"line_number":161,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"7f231b9d_45405408","line":158,"range":{"start_line":158,"start_character":37,"end_line":158,"end_character":48},"updated":"2017-06-09 18:59:40.000000000","message":"This is mildly suspect, but I can give it a pass here. It would be more correct to say:\n\nAny User with an appropriate role for read should be able to list application credentials. A write-enabled role would be able to add and delete application credentials. The default \"member\" role is both read and write enabled.","commit_id":"99ac820fc87db5418951133656166f10a0d40c94"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"baddfb381f9785a829df4aed277bf90a05c483ea","unresolved":false,"context_lines":[{"line_number":203,"context_line":"    {"},{"line_number":204,"context_line":"        \"application_credential\": {"},{"line_number":205,"context_line":"            \"id\": \"aa4541d9-0bc0-44f5-b02d-a9d922df7cbd\","},{"line_number":206,"context_line":"            \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\","},{"line_number":207,"context_line":"            \"name:\" \"backup\","},{"line_number":208,"context_line":"            \"description\": \"Backup job...\","},{"line_number":209,"context_line":"            \"expires_at\": \"2017-11-06T15:32:17.000000\","}],"source_content_type":"text/x-rst","patch_set":21,"id":"7f231b9d_c56c649e","line":206,"range":{"start_line":206,"start_character":12,"end_line":206,"end_character":72},"updated":"2017-06-09 18:59:40.000000000","message":"in a follow up, I might amend the spec to do the following:\n\n    {\n        \"application_credential\": {\n            \"id\": \"aa4541d9-0bc0-44f5-b02d-a9d922df7cbd\",\n            \"name:\" \"backup\",\n            \"description\": \"Backup job...\",\n            \"expires_at\": \"2017-11-06T15:32:17.000000\",\n            \"project_id\": \"1a6f968a-cebe-4265-9b36-f3ca2801296c\",\n            \"user_id\": \"9ac4bbe2-36c7-49ee-b296-59ce7a4d3edf\",\n            \"roles\": [\"Member\"]\n        },\n        \"application_credential_secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\",\n    }\n\nThis can be a follow up or ignored, it makes \"application_credential\" element consistent between get/list and submit","commit_id":"99ac820fc87db5418951133656166f10a0d40c94"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"7820d954283c846c8ab18f3fd6d4c603e4282e05","unresolved":false,"context_lines":[{"line_number":203,"context_line":"    {"},{"line_number":204,"context_line":"        \"application_credential\": {"},{"line_number":205,"context_line":"            \"id\": \"aa4541d9-0bc0-44f5-b02d-a9d922df7cbd\","},{"line_number":206,"context_line":"            \"secret\": \"a49670c3c18b9e079b9cfaf51634f563dc8ae3070db2...\","},{"line_number":207,"context_line":"            \"name:\" \"backup\","},{"line_number":208,"context_line":"            \"description\": \"Backup job...\","},{"line_number":209,"context_line":"            \"expires_at\": \"2017-11-06T15:32:17.000000\","}],"source_content_type":"text/x-rst","patch_set":21,"id":"7f231b9d_e5cbe06f","line":206,"range":{"start_line":206,"start_character":12,"end_line":206,"end_character":72},"in_reply_to":"7f231b9d_c56c649e","updated":"2017-06-09 19:04:14.000000000","message":"I\u0027d be fine the original way, we do that with users and passwords today","commit_id":"99ac820fc87db5418951133656166f10a0d40c94"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"baddfb381f9785a829df4aed277bf90a05c483ea","unresolved":false,"context_lines":[{"line_number":221,"context_line":"so a lost `secret` is unrecoverable. Subsequent queries of an Application"},{"line_number":222,"context_line":"Credential will not return the secret field."},{"line_number":223,"context_line":""},{"line_number":224,"context_line":".. note:: Identifying the correct way to generate an acceptable secret needs"},{"line_number":225,"context_line":"          to be done. Nova generates admin passwords on server creation, which"},{"line_number":226,"context_line":"          is probably a good place to start. If that approach is taken, use of"},{"line_number":227,"context_line":"          `random.choice` should be replaced for Python 3 with"},{"line_number":228,"context_line":"          `secrets.choice`."},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"`roles` is a list of role names. It is informational and can be used by the"},{"line_number":231,"context_line":"Consumer to verify that the Application Credential inherited the roles from"}],"source_content_type":"text/x-rst","patch_set":21,"id":"7f231b9d_252c3846","line":228,"range":{"start_line":224,"start_character":9,"end_line":228,"end_character":27},"updated":"2017-06-09 18:59:40.000000000","message":"A pseudo-random (secure) seed run through a pbkdf system to generate the secret and then stored with the same mechanism as password hashing (re-use the password hash mechanisms?) should be appropriate.","commit_id":"99ac820fc87db5418951133656166f10a0d40c94"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"10b2a793e4418f5f7c1ff25a1641d9dfe931cead","unresolved":false,"context_lines":[{"line_number":232,"context_line":"the User that the Consumer expected. This is not a policy enforcement, it is"},{"line_number":233,"context_line":"simply for human validation."},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"`user_id` contains the `id` of the Creating User. It can be used by other"},{"line_number":236,"context_line":"Consumers who have a User with access to the Project in question to manage and"},{"line_number":237,"context_line":"audit Application Credentials that were created by other Team members."},{"line_number":238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"7f231b9d_255b182f","line":235,"updated":"2017-06-09 18:52:23.000000000","message":"so one would need to use the Service User to create the application credentials for the OpenStack services, correct?\n\nhow does this happen in an automated world? is there a \"brain\" node that keeps the user creds and do the renew on the others when needed?","commit_id":"99ac820fc87db5418951133656166f10a0d40c94"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"baddfb381f9785a829df4aed277bf90a05c483ea","unresolved":false,"context_lines":[{"line_number":304,"context_line":"Application Credential is also deleted."},{"line_number":305,"context_line":""},{"line_number":306,"context_line":".. note:: In the future there may be a way to create a persistent credential,"},{"line_number":307,"context_line":"          but that mechanism is not defined."},{"line_number":308,"context_line":""},{"line_number":309,"context_line":"Aside from deletion, Application Credentials are immutable and may not be"},{"line_number":310,"context_line":"modified."}],"source_content_type":"text/x-rst","patch_set":21,"id":"7f231b9d_a51728ee","line":307,"range":{"start_line":307,"start_character":35,"end_line":307,"end_character":44},"updated":"2017-06-09 18:59:40.000000000","message":"NIT: \"defined in this document\"","commit_id":"99ac820fc87db5418951133656166f10a0d40c94"}]}