)]}'
{"specs/juno/composite-tokens.rst":[{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"8cf16c14070bddfa0f808f5587fecf8299a15c2e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"1ae5cdf2_456d0232","updated":"2014-05-30 16:46:58.000000000","message":"This will be renamed joint token.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"6e80f63eac0321ee08686aee3d0454bf96ba426f","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"https://blueprints.launchpad.net/keystone/+spec/composite-tokens"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"The concept behind composite tokens is to provide a secure mechanism to work"},{"line_number":16,"context_line":"with data stored externally to the service the user is directly interacting"},{"line_number":17,"context_line":"with. In many cases it is important to ensure the user has a means to perform"},{"line_number":18,"context_line":"CRUD actions on the data, but always gated via a third party. In some cases"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_2446eb7c","line":15,"updated":"2014-05-29 16:34:44.000000000","message":"Data storage is one important use case, but I think there are other uses to.\n\nEg in glance images are uploaded by nova when it takes a snapshot; images can potentially also be uploaded directly to Glance by end users.\n\nCurrently you have to deploy a minimum of two Glance nodes, each with different policies so that you can allow all users to take snapshots while restricting direct upload with a role. With composites you can get the desired effect with just one node.\n\nI\u0027m not sure how best to describe this, but perhaps mentioning something about allowing services to perform operations differently based on whether the request has come directly from a user or via another openstack service?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c61047dbd4aa8315b84a98d694107faf4329abc3","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"https://blueprints.launchpad.net/keystone/+spec/composite-tokens"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"The concept behind composite tokens is to provide a secure mechanism to work"},{"line_number":16,"context_line":"with data stored externally to the service the user is directly interacting"},{"line_number":17,"context_line":"with. In many cases it is important to ensure the user has a means to perform"},{"line_number":18,"context_line":"CRUD actions on the data, but always gated via a third party. In some cases"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_4f529d14","line":15,"in_reply_to":"3ae8d1ca_2446eb7c","updated":"2014-05-29 22:44:21.000000000","message":"Good point. I\u0027ll see if I can come up with something...","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"6e80f63eac0321ee08686aee3d0454bf96ba426f","unresolved":false,"context_lines":[{"line_number":26,"context_line":"               |                    |                                  "},{"line_number":27,"context_line":"               +--------------------+-+                               "},{"line_number":28,"context_line":"                                      |                               "},{"line_number":29,"context_line":"                                      | Update Img in Glance         "},{"line_number":30,"context_line":"                                      | (user token scoped to project)                  "},{"line_number":31,"context_line":"                                      |                                      "},{"line_number":32,"context_line":"    +----------------+                |                                "}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_ca5f11e4","line":29,"updated":"2014-05-29 16:34:44.000000000","message":"nit - \u0027Update Img in Glance\u0027 -\u003e \u0027Access Img Data\u0027 (see below)","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c61047dbd4aa8315b84a98d694107faf4329abc3","unresolved":false,"context_lines":[{"line_number":26,"context_line":"               |                    |                                  "},{"line_number":27,"context_line":"               +--------------------+-+                               "},{"line_number":28,"context_line":"                                      |                               "},{"line_number":29,"context_line":"                                      | Update Img in Glance         "},{"line_number":30,"context_line":"                                      | (user token scoped to project)                  "},{"line_number":31,"context_line":"                                      |                                      "},{"line_number":32,"context_line":"    +----------------+                |                                "}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_8f5ca527","line":29,"in_reply_to":"3ae8d1ca_ca5f11e4","updated":"2014-05-29 22:44:21.000000000","message":"Done in next patch","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"6e80f63eac0321ee08686aee3d0454bf96ba426f","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    +----------------+            |                |                   "},{"line_number":36,"context_line":"                                  +---+------------+                   "},{"line_number":37,"context_line":"                                      |                                "},{"line_number":38,"context_line":"                                      | Update to Img          "},{"line_number":39,"context_line":"                                      | Comp. Token(User, glance) now"},{"line_number":40,"context_line":"                                      | Glance Service Role                               "},{"line_number":41,"context_line":"                                  +---v------------+                   "}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_4a21414c","line":38,"updated":"2014-05-29 16:34:44.000000000","message":"nit - \u0027Update to Img\u0027 -\u003e \u0027Access Img Data\u0027 (again see below)","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c61047dbd4aa8315b84a98d694107faf4329abc3","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    +----------------+            |                |                   "},{"line_number":36,"context_line":"                                  +---+------------+                   "},{"line_number":37,"context_line":"                                      |                                "},{"line_number":38,"context_line":"                                      | Update to Img          "},{"line_number":39,"context_line":"                                      | Comp. Token(User, glance) now"},{"line_number":40,"context_line":"                                      | Glance Service Role                               "},{"line_number":41,"context_line":"                                  +---v------------+                   "}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_ef4a8954","line":38,"in_reply_to":"3ae8d1ca_4a21414c","updated":"2014-05-29 22:44:21.000000000","message":"same as line 29","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"6e80f63eac0321ee08686aee3d0454bf96ba426f","unresolved":false,"context_lines":[{"line_number":60,"context_line":"``Swift``."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"With the new composite key system the ``Glance Service User`` would have the"},{"line_number":63,"context_line":"required ``Role`` to update an image. End users would never be granted the"},{"line_number":64,"context_line":"``Glance`` specific role. The ``Glance Service User`` would not have the role"},{"line_number":65,"context_line":"scoped to the owning Project. The ``End User``\u0027s token would include the"},{"line_number":66,"context_line":"appropriate ``Role`` to interact with ``Glance`` and be scoped to the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_ca755199","line":63,"updated":"2014-05-29 16:34:44.000000000","message":"\u003e the ``Glance Service User`` would have the required ``Role`` to update an image.\n\nnit - updating an image is a metadata operation only (actual image data is immutable) ... basically if we change \u0027update an image\u0027 to \u0027access image data\u0027 we\u0027re good here :-)","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c61047dbd4aa8315b84a98d694107faf4329abc3","unresolved":false,"context_lines":[{"line_number":60,"context_line":"``Swift``."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"With the new composite key system the ``Glance Service User`` would have the"},{"line_number":63,"context_line":"required ``Role`` to update an image. End users would never be granted the"},{"line_number":64,"context_line":"``Glance`` specific role. The ``Glance Service User`` would not have the role"},{"line_number":65,"context_line":"scoped to the owning Project. The ``End User``\u0027s token would include the"},{"line_number":66,"context_line":"appropriate ``Role`` to interact with ``Glance`` and be scoped to the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_4f79bd92","line":63,"in_reply_to":"3ae8d1ca_ca755199","updated":"2014-05-29 22:44:21.000000000","message":"Done in next patch.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"6e80f63eac0321ee08686aee3d0454bf96ba426f","unresolved":false,"context_lines":[{"line_number":62,"context_line":"With the new composite key system the ``Glance Service User`` would have the"},{"line_number":63,"context_line":"required ``Role`` to update an image. End users would never be granted the"},{"line_number":64,"context_line":"``Glance`` specific role. The ``Glance Service User`` would not have the role"},{"line_number":65,"context_line":"scoped to the owning Project. The ``End User``\u0027s token would include the"},{"line_number":66,"context_line":"appropriate ``Role`` to interact with ``Glance`` and be scoped to the"},{"line_number":67,"context_line":"``Project`` that owns the image."},{"line_number":68,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_8a6349db","line":65,"updated":"2014-05-29 16:34:44.000000000","message":"Just to be 100% clear - by \u0027owning Project\u0027 you mean the User\u0027s project?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c61047dbd4aa8315b84a98d694107faf4329abc3","unresolved":false,"context_lines":[{"line_number":62,"context_line":"With the new composite key system the ``Glance Service User`` would have the"},{"line_number":63,"context_line":"required ``Role`` to update an image. End users would never be granted the"},{"line_number":64,"context_line":"``Glance`` specific role. The ``Glance Service User`` would not have the role"},{"line_number":65,"context_line":"scoped to the owning Project. The ``End User``\u0027s token would include the"},{"line_number":66,"context_line":"appropriate ``Role`` to interact with ``Glance`` and be scoped to the"},{"line_number":67,"context_line":"``Project`` that owns the image."},{"line_number":68,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_afaec1e5","line":65,"in_reply_to":"3ae8d1ca_8a6349db","updated":"2014-05-29 22:44:21.000000000","message":"The project that would own the image, e.g. the project the user was scoped to when creating the image (iirc that is how that works)","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"6e80f63eac0321ee08686aee3d0454bf96ba426f","unresolved":false,"context_lines":[{"line_number":74,"context_line":"   ``Glance Service User Credentials``) and the ``End User``\u0027s token to request"},{"line_number":75,"context_line":"   a ``Composite Token``. This new ``Composite Token`` will be scoped to the"},{"line_number":76,"context_line":"   ``End User``\u0027s project scope and include the ``Roles`` from the ``End"},{"line_number":77,"context_line":"   User``\u0027s token and the ``Glance Service Token``."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"3. ``Glance`` will now use the ``Composite Token`` to make the appropriate"},{"line_number":80,"context_line":"   request to ``Swift`` to update the image data. ``Swift`` will use policy"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3ae8d1ca_0a7e596b","line":77,"updated":"2014-05-29 16:34:44.000000000","message":"Will it be possible to include a subset of roles, or will we just go all or nothing? Thanks","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"c1b1cfce200eaa9b64acc2dc225c9efeef88c338","unresolved":false,"context_lines":[{"line_number":74,"context_line":"   ``Glance Service User Credentials``) and the ``End User``\u0027s token to request"},{"line_number":75,"context_line":"   a ``Composite Token``. This new ``Composite Token`` will be scoped to the"},{"line_number":76,"context_line":"   ``End User``\u0027s project scope and include the ``Roles`` from the ``End"},{"line_number":77,"context_line":"   User``\u0027s token and the ``Glance Service Token``."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"3. ``Glance`` will now use the ``Composite Token`` to make the appropriate"},{"line_number":80,"context_line":"   request to ``Swift`` to update the image data. ``Swift`` will use policy"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_e1aff029","line":77,"in_reply_to":"1ae5cdf2_0f69758b","updated":"2014-05-30 11:05:41.000000000","message":"For the user, yes, I think we wouldn\u0027t remove any of their roles. But potentially a service user may only want to grant a subset of his roles. (I say potentially -- I\u0027m not 100% sure how important that would be...)","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c61047dbd4aa8315b84a98d694107faf4329abc3","unresolved":false,"context_lines":[{"line_number":74,"context_line":"   ``Glance Service User Credentials``) and the ``End User``\u0027s token to request"},{"line_number":75,"context_line":"   a ``Composite Token``. This new ``Composite Token`` will be scoped to the"},{"line_number":76,"context_line":"   ``End User``\u0027s project scope and include the ``Roles`` from the ``End"},{"line_number":77,"context_line":"   User``\u0027s token and the ``Glance Service Token``."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"3. ``Glance`` will now use the ``Composite Token`` to make the appropriate"},{"line_number":80,"context_line":"   request to ``Swift`` to update the image data. ``Swift`` will use policy"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_0f69758b","line":77,"in_reply_to":"3ae8d1ca_0a7e596b","updated":"2014-05-29 22:44:21.000000000","message":"The issue with using a subset is you wont know what the policy engine is looking for. There is no reason we couldn\u0027t limit the roles returned (a simple filter would work), but which roles are important for the service you\u0027re interacting with?\n\nI need to perform CRUD on an external service, what roles are needed for that? How do we know what roles are needed. A deployer could decide to require an Admin role on the project and the service user\u0027s role as well.\n\nIt\u0027s just a black box to know what to add/remove/etc and still succeed with the subsequent request to an external service.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"8bc1b0f0710fde058143889ae8c236a772143360","unresolved":false,"context_lines":[{"line_number":75,"context_line":"   a ``Composite Token``. This new ``Composite Token`` will be scoped to the"},{"line_number":76,"context_line":"   ``End User``\u0027s project scope and include the ``Roles`` from the ``End"},{"line_number":77,"context_line":"   User``\u0027s token and the ``Glance Service Token``."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"3. ``Glance`` will now use the ``Composite Token`` to make the appropriate"},{"line_number":80,"context_line":"   request to ``Swift`` to update the image data. ``Swift`` will use policy"},{"line_number":81,"context_line":"   to ensure only users scoped to the correct ``Project`` and having the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_56e78340","line":78,"updated":"2014-05-30 12:55:01.000000000","message":"Until I read these comments, I had not appreciated that all the roles from the Service Token are copied to the Composite Token. I had assumed only the role(s) that contributed to  being allowed create a composite would be copied. For example, if the policy is something like:\n\n    identity:create_composite: role:xxx or role:yyy\n\nAnd the service token has xxx, yyy and zzz roles, only xxx, yyy would be copied.\n\nI\u0027m not saying this is what *should* happen -- just that I had made an assumption.\n\nCan you clarify: what controls will be have on the roles in the service token? Is it an unscoped token, or scoped to some arbitrary project? There was mention at the summit of project hierarchies -- there is no mention on that here.\n\nApologies if some of these questions are naive; not knowing enough background we may be using confusing terminology","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":75,"context_line":"   a ``Composite Token``. This new ``Composite Token`` will be scoped to the"},{"line_number":76,"context_line":"   ``End User``\u0027s project scope and include the ``Roles`` from the ``End"},{"line_number":77,"context_line":"   User``\u0027s token and the ``Glance Service Token``."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"3. ``Glance`` will now use the ``Composite Token`` to make the appropriate"},{"line_number":80,"context_line":"   request to ``Swift`` to update the image data. ``Swift`` will use policy"},{"line_number":81,"context_line":"   to ensure only users scoped to the correct ``Project`` and having the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_6a03b00f","line":78,"in_reply_to":"1ae5cdf2_56e78340","updated":"2014-05-30 15:01:18.000000000","message":"Don\u0027t apologize, I\u0027d rather be explicit and have a good spec than gloss over and miss something important.\n\nThe service user\u0027s token could be unscoped or scoped. However, if it is scoped there is potential for a \"common\" scope to not exist. this would prevent the composite token from being issued. \n\nNot restricting this to scoped or unscoped handles the future looking project hierarchies (and the verbiage about narrowest common scope). I explicitly chose to leave hierarchy verbiage out of this spec, but leaving it open to work within the hierarchies once developed. \n\nWRT specific role requesting:\nI\u0027d like to support explicit request of role delegation / role requesting on token issuance, but again, in this case how does the service know what the external API\u0027s policy is going to be. If you arbitrarily remove roles, you could end up with a composite token that doesn\u0027t meet your needs. \n\nIt\u0027s a lack of being able to know what the next request will need that makes limiting roles so difficult.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"cc046fe27720aea6c2e545c0a5e1583276fe33a9","unresolved":false,"context_lines":[{"line_number":93,"context_line":"resolve the narrowest available scope between the tokens and return a new"},{"line_number":94,"context_line":"token containing the composite information."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"* New Auth API will be protected by policy, allowing a deployer to ensure only"},{"line_number":97,"context_line":"  a ``Service User`` can create a ``Composite Token``"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* If a sufficiently narrow scope cannot be resolved from the provided token"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_33c84e74","line":96,"updated":"2014-05-30 10:02:43.000000000","message":"To clarify: the Service User is given a role such as \"service\". The policy will say that you need the \"service\" role to use this API? The reason I ask is to confirm that a deployer could create \"cinder_service\" and \"glance_service\" roles, edit the Keystone policy file to allow either to create composite tokens. However, in Swift, it\u0027s policy file will give cinder_service and glance_service different access (i.e., Glance would not be allowed access Cinder account and visa versa)","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"4349a0921a65c455d0b7c185d812360828db7be2","unresolved":false,"context_lines":[{"line_number":93,"context_line":"resolve the narrowest available scope between the tokens and return a new"},{"line_number":94,"context_line":"token containing the composite information."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"* New Auth API will be protected by policy, allowing a deployer to ensure only"},{"line_number":97,"context_line":"  a ``Service User`` can create a ``Composite Token``"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* If a sufficiently narrow scope cannot be resolved from the provided token"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_e167f0e8","line":96,"in_reply_to":"1ae5cdf2_33c84e74","updated":"2014-05-30 10:45:59.000000000","message":"An alternative would be to just have one \u0027service\u0027 role entry in the keystone policy, and give both the \u0027service\u0027 role and a \u0027glance_service\u0027 role to the glance service user.\n\nInterestingly we commented previously about whether all roles, or a subset of roles would be included in a composite; in this case just including the \u0027glance_service\u0027 role and not the \u0027service\u0027 role in the composite would mean that the composite itself would\nnot then include the -- presumably unrequired -- \u0027service\u0027 role.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":93,"context_line":"resolve the narrowest available scope between the tokens and return a new"},{"line_number":94,"context_line":"token containing the composite information."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"* New Auth API will be protected by policy, allowing a deployer to ensure only"},{"line_number":97,"context_line":"  a ``Service User`` can create a ``Composite Token``"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* If a sufficiently narrow scope cannot be resolved from the provided token"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_e5f8d3e7","line":96,"in_reply_to":"1ae5cdf2_e167f0e8","updated":"2014-05-30 15:01:18.000000000","message":"Policy enforcement is not hard-coded (e.g. role named \"service\" can access this API). the deployer could change that to anything desired (e.g. a role called \"i_like_openstack\").\n\nWithout extracting that at runtime form the policy (I\u0027m concerned about trying to reach into the depths of a data object trying to extract that data).\n\n---\nClarification: You could have a \"service\" role that allows access to create composite tokens, however the cinder service user might also have \u0027cinder_service_role\u0027 which would end up in the composite token.\n\nAlternatively, the deployer could have a complex policy rule that says:\ncinder_service_user or glance_service_user or nova_service_user ...","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"96de9304e6bcb83fa9d877efb5d6e79db79c4613","unresolved":false,"context_lines":[{"line_number":93,"context_line":"resolve the narrowest available scope between the tokens and return a new"},{"line_number":94,"context_line":"token containing the composite information."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"* New Auth API will be protected by policy, allowing a deployer to ensure only"},{"line_number":97,"context_line":"  a ``Service User`` can create a ``Composite Token``"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"* If a sufficiently narrow scope cannot be resolved from the provided token"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_459347fa","line":96,"in_reply_to":"1ae5cdf2_e5f8d3e7","updated":"2014-05-30 15:16:03.000000000","message":"Yup. I guess I just meant that it may be possible to avoid having to deploy a new  policy.json on the keystone server in order to support a new service X.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"cc046fe27720aea6c2e545c0a5e1583276fe33a9","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"* A ``Composite Token`` must always be a scoped token."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"* ``Composite Tokens`` can never be re-scoped to a new project."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Alternatives"},{"line_number":111,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_f376e6d7","line":108,"updated":"2014-05-30 10:02:43.000000000","message":"At the Swift end, I have not figured out how we remap the project and service access to different accounts. As you know Swift explicitly exposes the full path, including the account, to end-users. So the \"normal\" path for a project is /v1/AUTH_\u003cproject_id\u003e. For this use case, Glance might use either /v1/IMAGE_\u003cproject_id\u003e or something such as /v1/AUTH_\u003cproject_id\u003e_image.\n\nI\u0027m leaning towards the /v1/IMAGE_\u003cproject\u003e option because in the Swift pipeline, the auth architecture uses a \"reseller\" prefix concept. In principal, you could use Keystone to manage AUTH_* accounts and something else (e.g., swauth) to manage BLAH_* accounts. Not sure if anyone does this, but it means we could configure the pipeline to have three instances of keystoneauth -- one for AUTH_*, one for IMAGE_* and one for BLOCK_* -- each with their own policy file.\n\nAnother consideration is how to expose the path to the service. For a \"normal\" user, the /v1/AUTH_\u003cproject_id\u003e in the catalog (as publicURL entry). Would Glance take this path and edit it, changing \"AUTH_\" to \"IMAGE_\"? Seems clunky. This suggests that we should have a imageURL and blockURL endpoint in the catalog.\n\nAll of this is mostly orthogonal to *this* spec. However, I mention this because if we *do* add extra elements to the catalog, is there any way (and value?) for Keysone to not expose the imageURL and blockURL endpoints unless the requester has the \"service\" role?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"* A ``Composite Token`` must always be a scoped token."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"* ``Composite Tokens`` can never be re-scoped to a new project."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"Alternatives"},{"line_number":111,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_e52b732e","line":108,"in_reply_to":"1ae5cdf2_f376e6d7","updated":"2014-05-30 15:01:18.000000000","message":"I\u0027d like to table this / move outside of this spec. It\u0027s good discussion but not within scope of this proposal.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"f255aaae70d304a4aca67bdd28f5777127eac03b","unresolved":false,"context_lines":[{"line_number":130,"context_line":"-----------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"The Token will need to contain the new ``Composite`` information. This will"},{"line_number":133,"context_line":"be similar in structure to the ``Trust`` data."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"REST API Impact"},{"line_number":136,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_02093a31","line":133,"updated":"2014-05-30 12:46:37.000000000","message":"I think in general the UX should probably be consistent with Trusts where possible. Ie someone familiar with using the Trusts api shouldn\u0027t be \u0027surprised\u0027 with how the composites api works.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":130,"context_line":"-----------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"The Token will need to contain the new ``Composite`` information. This will"},{"line_number":133,"context_line":"be similar in structure to the ``Trust`` data."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"REST API Impact"},{"line_number":136,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_0a3f8c26","line":133,"in_reply_to":"1ae5cdf2_02093a31","updated":"2014-05-30 15:01:18.000000000","message":"I disagree, I don\u0027t want a duplication of the trust / delegation system. This is specifically issuance of a new token combining elements of the previous token. \n\nIn all cases the new token is just a token, it doesn\u0027t have CRUD operations, it doesn\u0027t do anything special. It is just a token.  Making this look like trusts would make it significantly heavier weight.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"96de9304e6bcb83fa9d877efb5d6e79db79c4613","unresolved":false,"context_lines":[{"line_number":130,"context_line":"-----------------"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"The Token will need to contain the new ``Composite`` information. This will"},{"line_number":133,"context_line":"be similar in structure to the ``Trust`` data."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"REST API Impact"},{"line_number":136,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_854aaf81","line":133,"in_reply_to":"1ae5cdf2_0a3f8c26","updated":"2014-05-30 15:16:03.000000000","message":"Ok, makes sense, thanks.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1762680102628ca46b1045823ebdc0129367e5ab","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"REST API Impact"},{"line_number":136,"context_line":"---------------"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"* New Composite Auth API"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  * Takes multiple ``Tokens`` as body data and produces a new ``Composite"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_19e7ec13","line":137,"updated":"2014-05-30 13:35:32.000000000","message":"Will we be adding API calls for listing, viewing, revoking (deleting) composite tokens? Or will those operations be done via the traditional token URLs?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"REST API Impact"},{"line_number":136,"context_line":"---------------"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"* New Composite Auth API"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  * Takes multiple ``Tokens`` as body data and produces a new ``Composite"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_8a2c7c4c","line":137,"in_reply_to":"1ae5cdf2_19e7ec13","updated":"2014-05-30 15:01:18.000000000","message":"Done via the traditional mechanisms for v3 API","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1762680102628ca46b1045823ebdc0129367e5ab","unresolved":false,"context_lines":[{"line_number":135,"context_line":"REST API Impact"},{"line_number":136,"context_line":"---------------"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"* New Composite Auth API"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  * Takes multiple ``Tokens`` as body data and produces a new ``Composite"},{"line_number":141,"context_line":"    Token`` of the narrowest possible scope. This new ``Composite Token`` will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_99a13cac","line":138,"updated":"2014-05-30 13:35:32.000000000","message":"Who can revoke a composite token?\n\nThe \u0027compositor\u0027 (ie user who created the composite) or the \u0027compositee\u0027 or both?\nIn the case of a chain (eg nova-\u003eglance-\u003eswift) can any user in the chain revoke?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"96de9304e6bcb83fa9d877efb5d6e79db79c4613","unresolved":false,"context_lines":[{"line_number":135,"context_line":"REST API Impact"},{"line_number":136,"context_line":"---------------"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"* New Composite Auth API"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  * Takes multiple ``Tokens`` as body data and produces a new ``Composite"},{"line_number":141,"context_line":"    Token`` of the narrowest possible scope. This new ``Composite Token`` will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_a536cb01","line":138,"in_reply_to":"1ae5cdf2_4aad1488","updated":"2014-05-30 15:16:03.000000000","message":"Again, makes sense -- thanks!","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":135,"context_line":"REST API Impact"},{"line_number":136,"context_line":"---------------"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"* New Composite Auth API"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"  * Takes multiple ``Tokens`` as body data and produces a new ``Composite"},{"line_number":141,"context_line":"    Token`` of the narrowest possible scope. This new ``Composite Token`` will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_4aad1488","line":138,"in_reply_to":"1ae5cdf2_99a13cac","updated":"2014-05-30 15:01:18.000000000","message":"If the user revokes the parent token (original user token) the composite token would be revoked.\n\nIf the service user\u0027s token is revoked, the composite token would be revoked.\n\nEither an admin or someone holding the composite token could revoke it directly.\n\nThe end user wont know the token directly so should not be able to use it/revoke it directly.\n\nI will clarify this.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"f255aaae70d304a4aca67bdd28f5777127eac03b","unresolved":false,"context_lines":[{"line_number":143,"context_line":""},{"line_number":144,"context_line":"  * Method type: POST"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  * HTTP Response Code: 200"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"    * Composite Token Data will be returned (same as current authentication"},{"line_number":149,"context_line":"      request."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_673770b1","line":146,"updated":"2014-05-30 12:46:37.000000000","message":"Should be 201? (eg as per Trusts)","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":143,"context_line":""},{"line_number":144,"context_line":"  * Method type: POST"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"  * HTTP Response Code: 200"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"    * Composite Token Data will be returned (same as current authentication"},{"line_number":149,"context_line":"      request."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_2a6fe893","line":146,"in_reply_to":"1ae5cdf2_673770b1","updated":"2014-05-30 15:01:18.000000000","message":"This should be the same as v3/auth POST requests. I will be sure they match.\n\nThis isn\u0027t a trust it is a new token being issued.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"cc046fe27720aea6c2e545c0a5e1583276fe33a9","unresolved":false,"context_lines":[{"line_number":152,"context_line":""},{"line_number":153,"context_line":"  * Expected error HTTP Response Code(s):"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"    * 403: No scope can be resolved (e.g. tokens are from different domains)"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    * 403: Either token is expired, revoked, or otherwise invalid"},{"line_number":158,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_538dda7a","line":155,"updated":"2014-05-30 10:02:43.000000000","message":"Wrt: \"No scope can be resolved\": In a multi-domain system, won\u0027t the Glance Service User and the end-user be frequently be in different domains?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"f255aaae70d304a4aca67bdd28f5777127eac03b","unresolved":false,"context_lines":[{"line_number":152,"context_line":""},{"line_number":153,"context_line":"  * Expected error HTTP Response Code(s):"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"    * 403: No scope can be resolved (e.g. tokens are from different domains)"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    * 403: Either token is expired, revoked, or otherwise invalid"},{"line_number":158,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_870abcd0","line":155,"in_reply_to":"1ae5cdf2_538dda7a","updated":"2014-05-30 12:46:37.000000000","message":"I think a 403 is appropriate if the user requesting the composite does not have the required role (as per the keystone policy.json).\n\nIn this \u0027no scope\u0027 case is \u0027400\u0027 more appropriate?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"f255aaae70d304a4aca67bdd28f5777127eac03b","unresolved":false,"context_lines":[{"line_number":154,"context_line":""},{"line_number":155,"context_line":"    * 403: No scope can be resolved (e.g. tokens are from different domains)"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    * 403: Either token is expired, revoked, or otherwise invalid"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    * 401: Policy prevents user from accessing the REST API"},{"line_number":160,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_87d8fc54","line":157,"updated":"2014-05-30 12:46:37.000000000","message":"Should be 401?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":154,"context_line":""},{"line_number":155,"context_line":"    * 403: No scope can be resolved (e.g. tokens are from different domains)"},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    * 403: Either token is expired, revoked, or otherwise invalid"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    * 401: Policy prevents user from accessing the REST API"},{"line_number":160,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_2ada8878","line":157,"in_reply_to":"1ae5cdf2_87d8fc54","updated":"2014-05-30 15:01:18.000000000","message":"agree, Will change next patch.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"f255aaae70d304a4aca67bdd28f5777127eac03b","unresolved":false,"context_lines":[{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    * 403: Either token is expired, revoked, or otherwise invalid"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    * 401: Policy prevents user from accessing the REST API"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"    * 400: Malformed Token Data provided (malformed request)"},{"line_number":162,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_67d3f038","line":159,"updated":"2014-05-30 12:46:37.000000000","message":"should be 403 I think?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":156,"context_line":""},{"line_number":157,"context_line":"    * 403: Either token is expired, revoked, or otherwise invalid"},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"    * 401: Policy prevents user from accessing the REST API"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"    * 400: Malformed Token Data provided (malformed request)"},{"line_number":162,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_ea81804b","line":159,"in_reply_to":"1ae5cdf2_67d3f038","updated":"2014-05-30 15:01:18.000000000","message":"Agree will change in the next patch.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"f255aaae70d304a4aca67bdd28f5777127eac03b","unresolved":false,"context_lines":[{"line_number":163,"context_line":"    * 400: Provided Token Count is not 2. Composite Tokens can only be created"},{"line_number":164,"context_line":"      from 2 valid tokens."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"  * URL: ``v3/auth/composite``"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"  * JSON schema definition::"},{"line_number":169,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_e753806a","line":166,"updated":"2014-05-30 12:46:37.000000000","message":"I pasted a typical trust interation from devstack here:\nhttp://paste.openstack.org/show/82178/\n\nThe trust URL seems to be: /v3/OS-TRUST/trusts\n(if you\u0027ve a link to the trust api docs can you let me know what it is? Thanks.)\n\nI\u0027m not sure why OS-TRUST is in the URL path, but wonder should we be consistent with that? eg:\n\n /v3/OS-COMPOSITE/composites","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":163,"context_line":"    * 400: Provided Token Count is not 2. Composite Tokens can only be created"},{"line_number":164,"context_line":"      from 2 valid tokens."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"  * URL: ``v3/auth/composite``"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"  * JSON schema definition::"},{"line_number":169,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_4a4b5459","line":166,"in_reply_to":"1ae5cdf2_e753806a","updated":"2014-05-30 15:01:18.000000000","message":"I was hoping to keep this as directly part of V3 auth rather than as a full blown extension, trusts have CRUD capabilities, this is just a special request for a token.\n\nIn theory this could even just be joined to the same code that runs under v3/auth itself.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"f255aaae70d304a4aca67bdd28f5777127eac03b","unresolved":false,"context_lines":[{"line_number":165,"context_line":""},{"line_number":166,"context_line":"  * URL: ``v3/auth/composite``"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"  * JSON schema definition::"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"       tokens \u003d ["},{"line_number":171,"context_line":"        \u003cv3 or later token format\u003e,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_62d03e54","line":168,"updated":"2014-05-30 12:46:37.000000000","message":"should we explicitly say this is the schema for the request?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":165,"context_line":""},{"line_number":166,"context_line":"  * URL: ``v3/auth/composite``"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"  * JSON schema definition::"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"       tokens \u003d ["},{"line_number":171,"context_line":"        \u003cv3 or later token format\u003e,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_caa5a405","line":168,"in_reply_to":"1ae5cdf2_62d03e54","updated":"2014-05-30 15:01:18.000000000","message":"Yes, and it\u0027ll just be the token IDs. Not the whole token format.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"f255aaae70d304a4aca67bdd28f5777127eac03b","unresolved":false,"context_lines":[{"line_number":170,"context_line":"       tokens \u003d ["},{"line_number":171,"context_line":"        \u003cv3 or later token format\u003e,"},{"line_number":172,"context_line":"        \u003cv3 or later token format\u003e"},{"line_number":173,"context_line":"       ]"},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"  * JSON schema definition for the response data if any: same as standard auth"},{"line_number":176,"context_line":"    request and token response."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_820aaad0","line":173,"updated":"2014-05-30 12:46:37.000000000","message":"When creating a trust the trustor\u0027s token is passed in with the x-auth-token header. Would it make any sense to be consistent with that? ie pass the \u0027compositor\u0027s token is as a header, and just include the \u0027compositee\u0027s token in the json body?\n\nTo clarify: By \u0027v3 or later token format\u0027 do you mean the token id, or the whole thing (json/service catalog etc)?\n\nDo we need/want the project id? User ids?\n \nIf we want to allow granting a subset of the \u0027compositor\u0027s roles (I\u0027m not sure yet if we do) then that role set would also be in the request body. (We can reference trusts to see how they list roles.)","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":170,"context_line":"       tokens \u003d ["},{"line_number":171,"context_line":"        \u003cv3 or later token format\u003e,"},{"line_number":172,"context_line":"        \u003cv3 or later token format\u003e"},{"line_number":173,"context_line":"       ]"},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"  * JSON schema definition for the response data if any: same as standard auth"},{"line_number":176,"context_line":"    request and token response."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_a5a6cbbf","line":173,"in_reply_to":"1ae5cdf2_820aaad0","updated":"2014-05-30 15:01:18.000000000","message":"I\u0027m not opposed to using headers instead of body data. I think the JSON blob in body will be easier to understand/work with/debug.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"96de9304e6bcb83fa9d877efb5d6e79db79c4613","unresolved":false,"context_lines":[{"line_number":170,"context_line":"       tokens \u003d ["},{"line_number":171,"context_line":"        \u003cv3 or later token format\u003e,"},{"line_number":172,"context_line":"        \u003cv3 or later token format\u003e"},{"line_number":173,"context_line":"       ]"},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"  * JSON schema definition for the response data if any: same as standard auth"},{"line_number":176,"context_line":"    request and token response."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_e07361af","line":173,"in_reply_to":"1ae5cdf2_a5a6cbbf","updated":"2014-05-30 15:16:03.000000000","message":"Ok. I think making it clear which is the \"service user\" token versus the regular user\u0027s token would be good; not sure if a list does that tbh.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"f255aaae70d304a4aca67bdd28f5777127eac03b","unresolved":false,"context_lines":[{"line_number":173,"context_line":"       ]"},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"  * JSON schema definition for the response data if any: same as standard auth"},{"line_number":176,"context_line":"    request and token response."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"* Policy for the new API should be restricted to service users only. This"},{"line_number":179,"context_line":"  should result in a new service-user ``Role`` for most installations. Any"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_c23af235","line":176,"updated":"2014-05-30 12:46:37.000000000","message":"Should we also have some of the features of a trust json response?\neg\n\n\"OS-TRUST:trust\", user ids etc?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":173,"context_line":"       ]"},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"  * JSON schema definition for the response data if any: same as standard auth"},{"line_number":176,"context_line":"    request and token response."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"* Policy for the new API should be restricted to service users only. This"},{"line_number":179,"context_line":"  should result in a new service-user ``Role`` for most installations. Any"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_c582f7ff","line":176,"in_reply_to":"1ae5cdf2_c23af235","updated":"2014-05-30 15:01:18.000000000","message":"The data returned would be just like a normal token. I\u0027ll clarify in next patchset here but:\n\nx-subject-token: \u003cnew token id\u003e\n\nbody: \u003ctoken data\u003e","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1762680102628ca46b1045823ebdc0129367e5ab","unresolved":false,"context_lines":[{"line_number":174,"context_line":""},{"line_number":175,"context_line":"  * JSON schema definition for the response data if any: same as standard auth"},{"line_number":176,"context_line":"    request and token response."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"* Policy for the new API should be restricted to service users only. This"},{"line_number":179,"context_line":"  should result in a new service-user ``Role`` for most installations. Any"},{"line_number":180,"context_line":"  service user will need to be assigned this role."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_19ca8c4f","line":177,"updated":"2014-05-30 13:35:32.000000000","message":"Re expiration of a token -- would the composite inherit the expiration time of the user\u0027s token, or work in the same way as trusts?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":174,"context_line":""},{"line_number":175,"context_line":"  * JSON schema definition for the response data if any: same as standard auth"},{"line_number":176,"context_line":"    request and token response."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"* Policy for the new API should be restricted to service users only. This"},{"line_number":179,"context_line":"  should result in a new service-user ``Role`` for most installations. Any"},{"line_number":180,"context_line":"  service user will need to be assigned this role."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_a5940b38","line":177,"in_reply_to":"1ae5cdf2_19ca8c4f","updated":"2014-05-30 15:01:18.000000000","message":"I\u0027ll clarify next patchset, I was thinking that the token would inherit the shortest of the two expiration time stamps (service user token or end user token).\n\nCurrently rescoped tokens inherit their parent token\u0027s expiration.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1762680102628ca46b1045823ebdc0129367e5ab","unresolved":false,"context_lines":[{"line_number":206,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":207,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"  User provided data will be handled. Only PKI tokens will be supported, each"},{"line_number":210,"context_line":"  Token provided will be validated via CMS, checked against revocation, and"},{"line_number":211,"context_line":"  verified not expired."},{"line_number":212,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_998f7c23","line":209,"updated":"2014-05-30 13:35:32.000000000","message":"Hmm, we might want support for UUID tokens (I\u0027ll need to check). Would that be a problem? Does Trusts support both types? Are UUIDs being retired?","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":206,"context_line":"* Does this change involve using or parsing user-provided data? This could"},{"line_number":207,"context_line":"  be directly at the API level or indirectly such as changes to a cache layer."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"  User provided data will be handled. Only PKI tokens will be supported, each"},{"line_number":210,"context_line":"  Token provided will be validated via CMS, checked against revocation, and"},{"line_number":211,"context_line":"  verified not expired."},{"line_number":212,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_6f55821c","line":209,"in_reply_to":"1ae5cdf2_998f7c23","updated":"2014-05-30 15:01:18.000000000","message":"This line is likely in-accurate as if keystone is configured to issue UUID tokens, it would return a UUID token here.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"cc046fe27720aea6c2e545c0a5e1583276fe33a9","unresolved":false,"context_lines":[{"line_number":272,"context_line":"  The changes to the services leveraging the ``Composite Token`` implementation"},{"line_number":273,"context_line":"  should be (mostly) transparent, as the scope and roles from the original"},{"line_number":274,"context_line":"  token would be maintained."},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"Developer Impact"},{"line_number":277,"context_line":"----------------"},{"line_number":278,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_b3129e60","line":275,"updated":"2014-05-30 10:02:43.000000000","message":"It might be worth mentioning that users using the current backing stores will need to migrate data to the new Swift account layout if they want to take advantage of this scheme. However, this is outside the scope of this spec.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":272,"context_line":"  The changes to the services leveraging the ``Composite Token`` implementation"},{"line_number":273,"context_line":"  should be (mostly) transparent, as the scope and roles from the original"},{"line_number":274,"context_line":"  token would be maintained."},{"line_number":275,"context_line":""},{"line_number":276,"context_line":"Developer Impact"},{"line_number":277,"context_line":"----------------"},{"line_number":278,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_cfb6968a","line":275,"in_reply_to":"1ae5cdf2_b3129e60","updated":"2014-05-30 15:01:18.000000000","message":"Not sure if this is implied or not from the changes to services line. I\u0027ll think about how i can phrase this without being too swift specific (if i had to list every possible change to every service this spec would be huge)","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1762680102628ca46b1045823ebdc0129367e5ab","unresolved":false,"context_lines":[{"line_number":299,"context_line":"  Morgan Fainberg (mdrnstm)"},{"line_number":300,"context_line":""},{"line_number":301,"context_line":"Other contributors:"},{"line_number":302,"context_line":"  TBD"},{"line_number":303,"context_line":""},{"line_number":304,"context_line":"Work Items"},{"line_number":305,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_59f2549b","line":302,"updated":"2014-05-30 13:35:32.000000000","message":"hopefully me :-)","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":299,"context_line":"  Morgan Fainberg (mdrnstm)"},{"line_number":300,"context_line":""},{"line_number":301,"context_line":"Other contributors:"},{"line_number":302,"context_line":"  TBD"},{"line_number":303,"context_line":""},{"line_number":304,"context_line":"Work Items"},{"line_number":305,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_efd6f2c4","line":302,"in_reply_to":"1ae5cdf2_59f2549b","updated":"2014-05-30 15:01:18.000000000","message":"I\u0027ll add you for sure in the next patchset.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"1762680102628ca46b1045823ebdc0129367e5ab","unresolved":false,"context_lines":[{"line_number":332,"context_line":"As services start to leverage the ``Composite Tokens`` Tempest tests will"},{"line_number":333,"context_line":"need to be developed to validate CRUD operations through the service and"},{"line_number":334,"context_line":"prevention of CRUD operations around the service (e.g. ``Glance`` using"},{"line_number":335,"context_line":"``Swift`` as storage for images)"},{"line_number":336,"context_line":""},{"line_number":337,"context_line":""},{"line_number":338,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_b97ef8e2","line":335,"updated":"2014-05-30 13:35:32.000000000","message":"Also tempest functional tests.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"41e620cee97499b9832df305f7f35ac522b353d5","unresolved":false,"context_lines":[{"line_number":332,"context_line":"As services start to leverage the ``Composite Tokens`` Tempest tests will"},{"line_number":333,"context_line":"need to be developed to validate CRUD operations through the service and"},{"line_number":334,"context_line":"prevention of CRUD operations around the service (e.g. ``Glance`` using"},{"line_number":335,"context_line":"``Swift`` as storage for images)"},{"line_number":336,"context_line":""},{"line_number":337,"context_line":""},{"line_number":338,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_afccea36","line":335,"in_reply_to":"1ae5cdf2_b97ef8e2","updated":"2014-05-30 15:01:18.000000000","message":"Will add in next patchset.","commit_id":"b63ef53e43e9262562b60a3b55a9a7e57faa1589"}],"specs/juno/service-tokens.rst":[{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e8d630b5cb2c4ab1328079b68554df0771f258be","unresolved":false,"context_lines":[{"line_number":2,"context_line":" This work is licensed under a Creative Commons Attribution 3.0 Unported"},{"line_number":3,"context_line":" License."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Service Token Composite Authorization"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_451135ab","line":5,"updated":"2014-06-03 02:49:45.000000000","message":"What kind of license is this? I have never seen it before. Is this an OpenStack convention?","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d396862dd4829e99bd6b4c9df1ee3175c3e687df","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/service-tokens\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The concept behind the service token is to provide a mechanism to allow"},{"line_number":15,"context_line":"services to handle request in a different manner if the request is received"},{"line_number":16,"context_line":"from the user directly or via another OpenStack service."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Simple Example Request Workflow::"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_d296e4ef","line":15,"updated":"2014-06-03 06:19:55.000000000","message":"pluralize it: handle requests \n\nor singularize it: handle a request\n\n(2nd instance of request, too)","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e8d630b5cb2c4ab1328079b68554df0771f258be","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Simple Example Request Workflow::"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    +----------------+"},{"line_number":21,"context_line":"    |      User      |"},{"line_number":22,"context_line":"    +-------+--------+"},{"line_number":23,"context_line":"            | Access Image Data Request"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_a52119fd","line":20,"updated":"2014-06-03 02:49:45.000000000","message":"LOVE THE DIAGRAM!!! Awesome!!! This helps a lot!","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d396862dd4829e99bd6b4c9df1ee3175c3e687df","unresolved":false,"context_lines":[{"line_number":43,"context_line":"the request is made directly to the service instead of via an intermediary"},{"line_number":44,"context_line":"service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"In the example example workflow above, accessing the IMG data can only occur"},{"line_number":47,"context_line":"via the ``Glance Service``. If the user directly accesses the data via the"},{"line_number":48,"context_line":"``Swift API``, the policy would enforce a ``HTTP 403 FORBIDDEN``. This is to"},{"line_number":49,"context_line":"ensure that the user cannot perform an update (maintain data integrity) of the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_727350e7","line":46,"updated":"2014-06-03 06:19:55.000000000","message":"s/IMG/image \n\nI don\u0027t like it when acronyms appear out of no where","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e8d630b5cb2c4ab1328079b68554df0771f258be","unresolved":false,"context_lines":[{"line_number":43,"context_line":"the request is made directly to the service instead of via an intermediary"},{"line_number":44,"context_line":"service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"In the example example workflow above, accessing the IMG data can only occur"},{"line_number":47,"context_line":"via the ``Glance Service``. If the user directly accesses the data via the"},{"line_number":48,"context_line":"``Swift API``, the policy would enforce a ``HTTP 403 FORBIDDEN``. This is to"},{"line_number":49,"context_line":"ensure that the user cannot perform an update (maintain data integrity) of the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_258509d0","line":46,"updated":"2014-06-03 02:49:45.000000000","message":"typo, two of the words \"example\" in the sentence","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":43,"context_line":"the request is made directly to the service instead of via an intermediary"},{"line_number":44,"context_line":"service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"In the example example workflow above, accessing the IMG data can only occur"},{"line_number":47,"context_line":"via the ``Glance Service``. If the user directly accesses the data via the"},{"line_number":48,"context_line":"``Swift API``, the policy would enforce a ``HTTP 403 FORBIDDEN``. This is to"},{"line_number":49,"context_line":"ensure that the user cannot perform an update (maintain data integrity) of the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_7456c92b","line":46,"in_reply_to":"1ae5cdf2_727350e7","updated":"2014-06-03 15:54:37.000000000","message":"Done in next patch.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e8d630b5cb2c4ab1328079b68554df0771f258be","unresolved":false,"context_lines":[{"line_number":44,"context_line":"service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"In the example example workflow above, accessing the IMG data can only occur"},{"line_number":47,"context_line":"via the ``Glance Service``. If the user directly accesses the data via the"},{"line_number":48,"context_line":"``Swift API``, the policy would enforce a ``HTTP 403 FORBIDDEN``. This is to"},{"line_number":49,"context_line":"ensure that the user cannot perform an update (maintain data integrity) of the"},{"line_number":50,"context_line":"image without the ``Glance Service`` being aware of it."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_656e3131","line":47,"updated":"2014-06-03 02:49:45.000000000","message":"Great concrete example!","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e8d630b5cb2c4ab1328079b68554df0771f258be","unresolved":false,"context_lines":[{"line_number":59,"context_line":"User``\u0027s token and present the ``Swift`` service with the information from both"},{"line_number":60,"context_line":"tokens. ``Swift`` will then make a policy decision, now capable of enforcing"},{"line_number":61,"context_line":"that the request came from ``Glance`` instead of directly through the"},{"line_number":62,"context_line":"``Swift API``."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Proposed Change"},{"line_number":65,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_e561613a","line":62,"updated":"2014-06-03 02:49:45.000000000","message":"The problem description is simply fantastic.  It is a much easier read.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"743d837534c4e39ff77b6e6cbd54eaea87a9b398","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This will allow the policy engine running inside the service to make policy"},{"line_number":74,"context_line":"decisions on the data provided from both tokens and/or respond differently"},{"line_number":75,"context_line":"based upon the presence of (or lack of presence of) either token."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_6bf7d159","line":75,"updated":"2014-06-03 13:06:39.000000000","message":"In patch set 1 there was a mention of \u0027chaining\u0027 composite tokens (ie the original approach), eg if the request path was Nova-\u003eGlance-\u003eSwift then both glance and nova roles would be present when the swift api was eventually called. With the new approach there is no longer the ability to do that (I think), ie in the above example swift will not be aware that the request will have passed via nova. \n\nIt\u0027s not obvious to me if that\u0027s a problem, but should we still mention it briefly as a design limitation?\n\nAs an aside, in some ways we\u0027re using roles to denote service context which is arguably something slightly different (I don\u0027t have a problem with this).","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This will allow the policy engine running inside the service to make policy"},{"line_number":74,"context_line":"decisions on the data provided from both tokens and/or respond differently"},{"line_number":75,"context_line":"based upon the presence of (or lack of presence of) either token."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_d4515d37","line":75,"in_reply_to":"1ae5cdf2_6bf7d159","updated":"2014-06-03 15:54:37.000000000","message":"Done in next patch. - I\u0027ll work on this verbiage.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5b04c549cb57b0520581dbfac37bc7ebce1b0f21","unresolved":false,"context_lines":[{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This will allow the policy engine running inside the service to make policy"},{"line_number":74,"context_line":"decisions on the data provided from both tokens and/or respond differently"},{"line_number":75,"context_line":"based upon the presence of (or lack of presence of) either token."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_2f9ab1c5","line":75,"in_reply_to":"1ae5cdf2_d4515d37","updated":"2014-06-06 17:33:53.000000000","message":"Added in the Alternatives section.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e8d630b5cb2c4ab1328079b68554df0771f258be","unresolved":false,"context_lines":[{"line_number":80,"context_line":"* Extend the Trust system to support more specific delegation of roles."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  Extending the Trust system and delegation capabilities would provide a"},{"line_number":83,"context_line":"  significantly more difficult UX for the end user. It would require delegating"},{"line_number":84,"context_line":"  a Role to the service user explicitly and then making the request. The"},{"line_number":85,"context_line":"  Service would need to know about the explicit Trust and know to scope"},{"line_number":86,"context_line":"  a token to that Trust."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_455f7572","line":83,"updated":"2014-06-03 02:49:45.000000000","message":"I would not use UX. I would go ahead and say user experience","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":80,"context_line":"* Extend the Trust system to support more specific delegation of roles."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  Extending the Trust system and delegation capabilities would provide a"},{"line_number":83,"context_line":"  significantly more difficult UX for the end user. It would require delegating"},{"line_number":84,"context_line":"  a Role to the service user explicitly and then making the request. The"},{"line_number":85,"context_line":"  Service would need to know about the explicit Trust and know to scope"},{"line_number":86,"context_line":"  a token to that Trust."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_147105e0","line":83,"in_reply_to":"1ae5cdf2_455f7572","updated":"2014-06-03 15:54:37.000000000","message":"Done in next patch","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"743d837534c4e39ff77b6e6cbd54eaea87a9b398","unresolved":false,"context_lines":[{"line_number":92,"context_line":"  exclusively."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"  This does not resolve the desire to secure the data from CRUD operations"},{"line_number":95,"context_line":"  circumventing the service (e.g. ``Glance`` storing images in ``Swift``)"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Data Model Impact"},{"line_number":98,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_ebe041fc","line":95,"updated":"2014-06-03 13:06:39.000000000","message":"I think it would be useful to briefly mention why we decided against the composite token approach (where two tokens were combined to form a single token).","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":92,"context_line":"  exclusively."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"  This does not resolve the desire to secure the data from CRUD operations"},{"line_number":95,"context_line":"  circumventing the service (e.g. ``Glance`` storing images in ``Swift``)"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Data Model Impact"},{"line_number":98,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_b465b11f","line":95,"in_reply_to":"1ae5cdf2_ebe041fc","updated":"2014-06-03 15:54:37.000000000","message":"Done in next patch.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e8d630b5cb2c4ab1328079b68554df0771f258be","unresolved":false,"context_lines":[{"line_number":160,"context_line":"Performance Impact"},{"line_number":161,"context_line":"------------------"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"* Decoding the information from ``X-SERVICE-TOKEN`` header requires extra calls"},{"line_number":164,"context_line":"  to CMS (subprocess) or request to ``Keystone`` in the case of UUID tokens."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"Other Deployer Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_c5f8e54b","line":163,"updated":"2014-06-03 02:49:45.000000000","message":"How big is X-SERVICE-TOKEN expected to be?  Is this adding like another 1K to the header?  That may not be well received by our stakeholders","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":160,"context_line":"Performance Impact"},{"line_number":161,"context_line":"------------------"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"* Decoding the information from ``X-SERVICE-TOKEN`` header requires extra calls"},{"line_number":164,"context_line":"  to CMS (subprocess) or request to ``Keystone`` in the case of UUID tokens."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"Other Deployer Impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_742de9a7","line":163,"in_reply_to":"1ae5cdf2_c5f8e54b","updated":"2014-06-03 15:54:37.000000000","message":"It will be another PKI token. I will state that this token will explicitly be sans catalog, etc.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"743d837534c4e39ff77b6e6cbd54eaea87a9b398","unresolved":false,"context_lines":[{"line_number":161,"context_line":"------------------"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"* Decoding the information from ``X-SERVICE-TOKEN`` header requires extra calls"},{"line_number":164,"context_line":"  to CMS (subprocess) or request to ``Keystone`` in the case of UUID tokens."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"Other Deployer Impact"},{"line_number":167,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_0e22db51","line":164,"updated":"2014-06-03 13:06:39.000000000","message":"Should we mention caching the service token? ie The username/password of the service user will be stored in a config file -- I guess we\u0027ll be caching the service token where possible to avoid an additional round trip.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":161,"context_line":"------------------"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"* Decoding the information from ``X-SERVICE-TOKEN`` header requires extra calls"},{"line_number":164,"context_line":"  to CMS (subprocess) or request to ``Keystone`` in the case of UUID tokens."},{"line_number":165,"context_line":""},{"line_number":166,"context_line":"Other Deployer Impact"},{"line_number":167,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_f410195b","line":164,"in_reply_to":"1ae5cdf2_0e22db51","updated":"2014-06-03 15:54:37.000000000","message":"I\u0027ll consider this in the next patch. Unsure.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"743d837534c4e39ff77b6e6cbd54eaea87a9b398","unresolved":false,"context_lines":[{"line_number":195,"context_line":""},{"line_number":196,"context_line":"  The changes to the services leveraging the composite authorization"},{"line_number":197,"context_line":"  implementation should be (mostly) transparent. It will be a policy deployment"},{"line_number":198,"context_line":"  to enable (at most)."},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"Developer Impact"},{"line_number":201,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_9101ac07","line":198,"updated":"2014-06-03 13:06:39.000000000","message":"Currently Glance, when using the single tenant model, has no way to perform an automated rolling change of the backend swift password, ie without causing an interruption in service. This is because rolling out the new password (eg via chef) is not instantaneous and each nodes will retain the old password for a period of time; requests hitting the nodes which haven\u0027t updated yet will receive a 401.\n\nWe should explicitly state that there will be a way to perform an automated rolling upgrade of a service user password change.\n\nThis might have to be done by having two service users and (1) rolling out a second service user credential\u0027s then (2) changing the original service user\u0027s credentials then optionally (3) rolling out the original service user\u0027s new credentials.\n\nBasically I think there should be no \u0027state\u0027 associated with a particular service user to allow password changes/make accidental deletion of a particular service user not a big deal.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5b04c549cb57b0520581dbfac37bc7ebce1b0f21","unresolved":false,"context_lines":[{"line_number":195,"context_line":""},{"line_number":196,"context_line":"  The changes to the services leveraging the composite authorization"},{"line_number":197,"context_line":"  implementation should be (mostly) transparent. It will be a policy deployment"},{"line_number":198,"context_line":"  to enable (at most)."},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"Developer Impact"},{"line_number":201,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_6f6cb909","line":198,"in_reply_to":"1ae5cdf2_37152340","updated":"2014-06-06 17:33:53.000000000","message":"This isn\u0027t really in scope with this change (should be proposed separately). \nThis is already an issue wth the auth_token middleware user today.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":195,"context_line":""},{"line_number":196,"context_line":"  The changes to the services leveraging the composite authorization"},{"line_number":197,"context_line":"  implementation should be (mostly) transparent. It will be a policy deployment"},{"line_number":198,"context_line":"  to enable (at most)."},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"Developer Impact"},{"line_number":201,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_37152340","line":198,"in_reply_to":"1ae5cdf2_9101ac07","updated":"2014-06-03 15:54:37.000000000","message":"I\u0027ll work on how to phrase this.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"e8d630b5cb2c4ab1328079b68554df0771f258be","unresolved":false,"context_lines":[{"line_number":205,"context_line":""},{"line_number":206,"context_line":"* Developers would need to leverage the new ``Session`` object from"},{"line_number":207,"context_line":"  ``keystoneclient`` for authentication to external services to ensure the"},{"line_number":208,"context_line":"  ``X-SERVICE-TOKEN`` is properly populated when making requests to"},{"line_number":209,"context_line":"  external OpenStack services."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_c58f05cb","line":208,"updated":"2014-06-03 02:49:45.000000000","message":"Should this also mention needed updates to the policy files for services to support this?","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"5b04c549cb57b0520581dbfac37bc7ebce1b0f21","unresolved":false,"context_lines":[{"line_number":205,"context_line":""},{"line_number":206,"context_line":"* Developers would need to leverage the new ``Session`` object from"},{"line_number":207,"context_line":"  ``keystoneclient`` for authentication to external services to ensure the"},{"line_number":208,"context_line":"  ``X-SERVICE-TOKEN`` is properly populated when making requests to"},{"line_number":209,"context_line":"  external OpenStack services."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_6adca747","line":208,"in_reply_to":"1ae5cdf2_771b2b73","updated":"2014-06-06 17:33:53.000000000","message":"Put this in the documentation section.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":205,"context_line":""},{"line_number":206,"context_line":"* Developers would need to leverage the new ``Session`` object from"},{"line_number":207,"context_line":"  ``keystoneclient`` for authentication to external services to ensure the"},{"line_number":208,"context_line":"  ``X-SERVICE-TOKEN`` is properly populated when making requests to"},{"line_number":209,"context_line":"  external OpenStack services."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_771b2b73","line":208,"in_reply_to":"1ae5cdf2_c58f05cb","updated":"2014-06-03 15:54:37.000000000","message":"++","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"743d837534c4e39ff77b6e6cbd54eaea87a9b398","unresolved":false,"context_lines":[{"line_number":206,"context_line":"* Developers would need to leverage the new ``Session`` object from"},{"line_number":207,"context_line":"  ``keystoneclient`` for authentication to external services to ensure the"},{"line_number":208,"context_line":"  ``X-SERVICE-TOKEN`` is properly populated when making requests to"},{"line_number":209,"context_line":"  external OpenStack services."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_2bc94959","line":209,"updated":"2014-06-03 13:06:39.000000000","message":"FWIW we did a proof of concept with this approach a while back here: \thttps://review.openstack.org/#/c/88366/\n\nObviously this doesn\u0027t use the new session object -- so it\u0027s probably stale.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d396862dd4829e99bd6b4c9df1ee3175c3e687df","unresolved":false,"context_lines":[{"line_number":215,"context_line":"Assignee(s)"},{"line_number":216,"context_line":"-----------"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"Who is leading the writing of the code? Or is this a blueprint where you\u0027re"},{"line_number":219,"context_line":"throwing it out there to see who picks it up?"},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"If more than one person is working on the implementation, please designate the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_f21cc079","line":218,"updated":"2014-06-03 06:19:55.000000000","message":"drop the boilerplate text","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":215,"context_line":"Assignee(s)"},{"line_number":216,"context_line":"-----------"},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"Who is leading the writing of the code? Or is this a blueprint where you\u0027re"},{"line_number":219,"context_line":"throwing it out there to see who picks it up?"},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"If more than one person is working on the implementation, please designate the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_d72ddf96","line":218,"in_reply_to":"1ae5cdf2_f21cc079","updated":"2014-06-03 15:54:37.000000000","message":"But I like boilerplates! Done in next patch.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"743d837534c4e39ff77b6e6cbd54eaea87a9b398","unresolved":false,"context_lines":[{"line_number":225,"context_line":"  Morgan Fainberg (mdrnstm)"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"Other contributors:"},{"line_number":228,"context_line":"  TBD"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"Work Items"},{"line_number":231,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_0efadb74","line":228,"updated":"2014-06-03 13:06:39.000000000","message":"still happy to help :-)","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":225,"context_line":"  Morgan Fainberg (mdrnstm)"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"Other contributors:"},{"line_number":228,"context_line":"  TBD"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"Work Items"},{"line_number":231,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_f71e5b5e","line":228,"in_reply_to":"1ae5cdf2_0efadb74","updated":"2014-06-03 15:54:37.000000000","message":"Will add you.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d396862dd4829e99bd6b4c9df1ee3175c3e687df","unresolved":false,"context_lines":[{"line_number":243,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"None"},{"line_number":246,"context_line":""},{"line_number":247,"context_line":"Testing"},{"line_number":248,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":249,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_1214cc4c","line":246,"updated":"2014-06-03 06:19:55.000000000","message":"add a new line here","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":243,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"None"},{"line_number":246,"context_line":""},{"line_number":247,"context_line":"Testing"},{"line_number":248,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":249,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_5739cfd5","line":246,"in_reply_to":"1ae5cdf2_1214cc4c","updated":"2014-06-03 15:54:37.000000000","message":"Done in next patch.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d396862dd4829e99bd6b4c9df1ee3175c3e687df","unresolved":false,"context_lines":[{"line_number":266,"context_line":"References"},{"line_number":267,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"Most of this was discussed at the OpenStack summit between Keystone team and"},{"line_number":270,"context_line":"other project teams."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_9207fc1b","line":269,"updated":"2014-06-03 06:19:55.000000000","message":"between the*","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"db640dc05ecc745d4423544895b47dc4ccdfa074","unresolved":false,"context_lines":[{"line_number":266,"context_line":"References"},{"line_number":267,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"Most of this was discussed at the OpenStack summit between Keystone team and"},{"line_number":270,"context_line":"other project teams."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_972fd787","line":269,"in_reply_to":"1ae5cdf2_9207fc1b","updated":"2014-06-03 15:54:37.000000000","message":"Done in next patch.","commit_id":"2097806fa169f216da7bc2afea936532060c2d5c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"73212514a51dd58ec1840fd2d9bcdbf24cbb2ff2","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/service-tokens\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The concept behind the service token is to provide a mechanism to allow"},{"line_number":15,"context_line":"a service to handle request in a different manner if the request is received"},{"line_number":16,"context_line":"from the user directly or via another OpenStack service."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Simple Example Request Workflow::"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_d6863813","line":15,"updated":"2014-06-07 05:34:38.000000000","message":"typo: handle request should be \"handle a request\"","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"7a03eb52ca18f51125649e329a6b3189ea5c1331","unresolved":false,"context_lines":[{"line_number":12,"context_line":"\u003chttps://blueprints.launchpad.net/keystone/+spec/service-tokens\u003e`_"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"The concept behind the service token is to provide a mechanism to allow"},{"line_number":15,"context_line":"a service to handle request in a different manner if the request is received"},{"line_number":16,"context_line":"from the user directly or via another OpenStack service."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Simple Example Request Workflow::"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_96ad398b","line":15,"in_reply_to":"1ae5cdf2_d6863813","updated":"2014-06-10 16:15:43.000000000","message":"Done in next patch.","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"61120b1bd2f8fc3dfb1b1ea744ac6086a6635cef","unresolved":false,"context_lines":[{"line_number":20,"context_line":"    +----------------+"},{"line_number":21,"context_line":"    |      User      |"},{"line_number":22,"context_line":"    +-------+--------+"},{"line_number":23,"context_line":"            | Access Image Data Request"},{"line_number":24,"context_line":"            | X-AUTH-TOKEN: \u003cend user token\u003e"},{"line_number":25,"context_line":"            | X-SERVICE-TOKEN: None"},{"line_number":26,"context_line":"            |"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_f58f1ccb","line":23,"updated":"2014-06-11 22:08:33.000000000","message":"We already have the concept of service token. For token validation X-Auth-Token has to be service_token or admin_token. (ie) the user who has the role service or admin.\n\nIn  you proposal can\u0027t I hit directly swfit using glance\u0027s service account and user\u0027s account totally bypassing glance. Just because the you have X-Service-Account header doesn\u0027t mean that the request came from the  service. \n\nCan this be solved differently?  A resource x can be accessed if the it has specific role? All we need is  swift need to alow users with different role to update glance images.","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"49714124d1a19dbd8a1be72848689fafc97a7dd1","unresolved":false,"context_lines":[{"line_number":20,"context_line":"    +----------------+"},{"line_number":21,"context_line":"    |      User      |"},{"line_number":22,"context_line":"    +-------+--------+"},{"line_number":23,"context_line":"            | Access Image Data Request"},{"line_number":24,"context_line":"            | X-AUTH-TOKEN: \u003cend user token\u003e"},{"line_number":25,"context_line":"            | X-SERVICE-TOKEN: None"},{"line_number":26,"context_line":"            |"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_726a0782","line":23,"in_reply_to":"1ae5cdf2_f58f1ccb","updated":"2014-06-13 11:56:33.000000000","message":"\u003e We already have the concept of service token.\n\nWe have the concept of a service role, but I don\u0027t think that\u0027s exactly the same thing. I imagine the new mechanism will require that a service token (as defined by this spec) is considered a valid service token only if it contains the service role.\n\n\u003e In you proposal can\u0027t I hit directly swfit using glance\u0027s service account and user\u0027s account totally bypassing glance.\n\nYou can access your image data directly in swift -- but only if you know the service account credentials which are not known to standard users.\nCompare this with the current multi tenant case where you can access your images directly by default, or with the single tenant case where you can access all images directly if you acquire the backend credentials.\n\n\u003e Can this be solved differently? A resource x can be accessed if the it has specific role?\n\nCan you clarify please?","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"3bfd488de7cedb71114c803fc1ee98d0b0b21693","unresolved":false,"context_lines":[{"line_number":47,"context_line":"via the ``Glance Service``. If the user directly accesses the data via the"},{"line_number":48,"context_line":"``Swift API``, the policy would enforce a ``HTTP 403 FORBIDDEN``. This is to"},{"line_number":49,"context_line":"ensure that the user cannot perform an update (maintain data integrity) of the"},{"line_number":50,"context_line":"image without the ``Glance Service`` being aware of it."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The ``End User`` would make a request to ``Glance`` presenting the standard"},{"line_number":53,"context_line":"``Auth Token``. The ``auth_token`` middleware running in ``Glance`` will"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_435bf52d","line":50,"updated":"2014-06-10 16:00:21.000000000","message":"Does Glance also maintain the checksum of the image? If so, allowing user to do direct update would surely break the checksum.","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"7a03eb52ca18f51125649e329a6b3189ea5c1331","unresolved":false,"context_lines":[{"line_number":47,"context_line":"via the ``Glance Service``. If the user directly accesses the data via the"},{"line_number":48,"context_line":"``Swift API``, the policy would enforce a ``HTTP 403 FORBIDDEN``. This is to"},{"line_number":49,"context_line":"ensure that the user cannot perform an update (maintain data integrity) of the"},{"line_number":50,"context_line":"image without the ``Glance Service`` being aware of it."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The ``End User`` would make a request to ``Glance`` presenting the standard"},{"line_number":53,"context_line":"``Auth Token``. The ``auth_token`` middleware running in ``Glance`` will"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_766d0d99","line":50,"in_reply_to":"1ae5cdf2_435bf52d","updated":"2014-06-10 16:15:43.000000000","message":"Sure. That could be another case.","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"73212514a51dd58ec1840fd2d9bcdbf24cbb2ff2","unresolved":false,"context_lines":[{"line_number":54,"context_line":"authorize the ``End User`` to make the API request for the image data."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"``Glance`` will then make the request to ``Swift`` presenting both the ``End"},{"line_number":57,"context_line":"User``\u0027s token and the ``Glance Service User``\u0027s token. The middleware running"},{"line_number":58,"context_line":"in ``Swift`` with decode both the ``End User``\u0027s token and the ``Glance Service"},{"line_number":59,"context_line":"User``\u0027s token and present the ``Swift`` service with the information from both"},{"line_number":60,"context_line":"tokens. ``Swift`` will then make a policy decision, now capable of enforcing"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_16c6e049","line":57,"updated":"2014-06-07 05:34:38.000000000","message":"Why User``\u0027s instead of User\u0027s`` ? The s ends up being the wrong font.   I tried User\u0027s`` on https://www.tele3.cz/jbar/rest/rest.html  and it worked just fine\n\nSame question for the other similar examples in this paragraph as well","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"7a03eb52ca18f51125649e329a6b3189ea5c1331","unresolved":false,"context_lines":[{"line_number":54,"context_line":"authorize the ``End User`` to make the API request for the image data."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"``Glance`` will then make the request to ``Swift`` presenting both the ``End"},{"line_number":57,"context_line":"User``\u0027s token and the ``Glance Service User``\u0027s token. The middleware running"},{"line_number":58,"context_line":"in ``Swift`` with decode both the ``End User``\u0027s token and the ``Glance Service"},{"line_number":59,"context_line":"User``\u0027s token and present the ``Swift`` service with the information from both"},{"line_number":60,"context_line":"tokens. ``Swift`` will then make a policy decision, now capable of enforcing"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_f63afd96","line":57,"in_reply_to":"1ae5cdf2_16c6e049","updated":"2014-06-10 16:15:43.000000000","message":"the difference is that \u0027Glance Service User\u0027 is the entity that is supposed to be in the \"block\", the entity does not include the apostrophe+s it isn\u0027t\n\n\"Glance Service Users\u0027s\" it is belonging to the \"Glance Service User\".","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"3bfd488de7cedb71114c803fc1ee98d0b0b21693","unresolved":false,"context_lines":[{"line_number":65,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The ``Keystone`` ``auth_token`` middleware will be modified to accept a second"},{"line_number":68,"context_line":"token header: ``X-SERVICE-TOKEN``. If presented with the ``X-SERVICE-TOKEN``"},{"line_number":69,"context_line":"header, it will decode the data from the service token and present it to the"},{"line_number":70,"context_line":"underlying service in the same way it presents the data decoded from the"},{"line_number":71,"context_line":"``X-AUTH-TOKEN`` header."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_e31241b3","line":68,"updated":"2014-06-10 16:00:21.000000000","message":"I think we may want to make the auth_token middleware generic, in the sense that the header in which to look for the token and the prefix of the headers in which to convey the token information. For example,\n\n [filter:authtoken]\n paste.filter_factory \u003d keystoneclient.middleware.auth_token:filter_factory\n auth_token_header \u003d X-Auth-Token\n token_info_headers_prefix \u003d\n\n [filter:serviceauthtoken]\n paste.filter_factory \u003d keystoneclient.middleware.auth_token:filter_factory\n auth_token_header \u003d X-Service-Token\n token_info_headers_prefix \u003d service\n\nIn the pipeline, we would have both filters\n\n someservice \u003d ... authtoken serviceauthtoken ...","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"7a03eb52ca18f51125649e329a6b3189ea5c1331","unresolved":false,"context_lines":[{"line_number":65,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The ``Keystone`` ``auth_token`` middleware will be modified to accept a second"},{"line_number":68,"context_line":"token header: ``X-SERVICE-TOKEN``. If presented with the ``X-SERVICE-TOKEN``"},{"line_number":69,"context_line":"header, it will decode the data from the service token and present it to the"},{"line_number":70,"context_line":"underlying service in the same way it presents the data decoded from the"},{"line_number":71,"context_line":"``X-AUTH-TOKEN`` header."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_961a9915","line":68,"in_reply_to":"1ae5cdf2_e31241b3","updated":"2014-06-10 16:15:43.000000000","message":"Are you suggesting that we support N number of token headers (one filter per header) and it is all collapsed down? I\u0027m not sure I like that approach.\n\nIt likely would be a significant refactor of how auth_token works (it currently strips a whole bunch of headers off). I would rather not take on a massive auth_token refactor as well to support this new feature.","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"eff35c17f085f8d9c988ecf4e1448431d09ad643","unresolved":false,"context_lines":[{"line_number":67,"context_line":"The ``Keystone`` ``auth_token`` middleware will be modified to accept a second"},{"line_number":68,"context_line":"token header: ``X-SERVICE-TOKEN``. If presented with the ``X-SERVICE-TOKEN``"},{"line_number":69,"context_line":"header, it will decode the data from the service token and present it to the"},{"line_number":70,"context_line":"underlying service in the same way it presents the data decoded from the"},{"line_number":71,"context_line":"``X-AUTH-TOKEN`` header."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This will allow the policy engine running inside the service to make policy"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_f44a30ab","line":70,"updated":"2014-06-09 13:16:04.000000000","message":"\u003e ...and present it to the underlying service in the same way it presents...\n\nHow presented? Specifically, which bits of the service token are represented? For example, HTTP_X_PROJECT_ID is presumably set to the project id from the user\u0027s token -- not the service token. Whereas, HTTP_X_ROLES will have the  user token roles AND then the service roles appended?\n\nOr, will be new variables in the environment (HTTP_X_SERVICE_ROLES, HTTP_X_SERVICE_PROJECT_ID, etc.)?","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"7a03eb52ca18f51125649e329a6b3189ea5c1331","unresolved":false,"context_lines":[{"line_number":67,"context_line":"The ``Keystone`` ``auth_token`` middleware will be modified to accept a second"},{"line_number":68,"context_line":"token header: ``X-SERVICE-TOKEN``. If presented with the ``X-SERVICE-TOKEN``"},{"line_number":69,"context_line":"header, it will decode the data from the service token and present it to the"},{"line_number":70,"context_line":"underlying service in the same way it presents the data decoded from the"},{"line_number":71,"context_line":"``X-AUTH-TOKEN`` header."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This will allow the policy engine running inside the service to make policy"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_f692fd49","line":70,"in_reply_to":"1ae5cdf2_83f41dd0","updated":"2014-06-10 16:15:43.000000000","message":"All the relevant information will be prefixed with service, and presented as separate headers (in the cases where relevant).\n\nThe policy engine should be able to support %(service_user_id) for example.\n\nI think your example can be roughly translated to policy DSL, we support AND and OR constructs (and precedence as well iirc).","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"3bfd488de7cedb71114c803fc1ee98d0b0b21693","unresolved":false,"context_lines":[{"line_number":67,"context_line":"The ``Keystone`` ``auth_token`` middleware will be modified to accept a second"},{"line_number":68,"context_line":"token header: ``X-SERVICE-TOKEN``. If presented with the ``X-SERVICE-TOKEN``"},{"line_number":69,"context_line":"header, it will decode the data from the service token and present it to the"},{"line_number":70,"context_line":"underlying service in the same way it presents the data decoded from the"},{"line_number":71,"context_line":"``X-AUTH-TOKEN`` header."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"This will allow the policy engine running inside the service to make policy"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_83f41dd0","line":70,"in_reply_to":"1ae5cdf2_f44a30ab","updated":"2014-06-10 16:00:21.000000000","message":"I agree. We should explicitly list the new headers here. I presume composite here only applicable to the union of roles. Otherwise, we may need changes to the policy engine. For example, I am not sure if policy engine can handle this\n\n\"some_api\": \"user_id:%(user_id)s and user_id:%(user_id)s\",\n\"some_other_api\": \"project_id:%(project_id)s and project_id:%(project_id)s\",","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"3bfd488de7cedb71114c803fc1ee98d0b0b21693","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"* Extend the Trust system to support more specific delegation of roles."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  Extending the Trust system and delegation capabilities would provide a"},{"line_number":83,"context_line":"  significantly more difficult user experience for the end user. It would"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_e3eec18a","line":80,"updated":"2014-06-10 16:00:21.000000000","message":"OAUTH?","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"7a03eb52ca18f51125649e329a6b3189ea5c1331","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Alternatives"},{"line_number":78,"context_line":"------------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"* Extend the Trust system to support more specific delegation of roles."},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"  Extending the Trust system and delegation capabilities would provide a"},{"line_number":83,"context_line":"  significantly more difficult user experience for the end user. It would"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_f6d3dd5c","line":80,"in_reply_to":"1ae5cdf2_e3eec18a","updated":"2014-06-10 16:15:43.000000000","message":"OAuTH in it\u0027s current implementation needs explicit reauthorization on a fixed window (can be set to unlimited). Without changing (and breaking) that model, it\u0027s not really usable. I don\u0027t see it as a viable option, whereas trusts are already (by default) unlimited / non-expiring.","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":455,"name":"Stuart McLaren","email":"stuart.mclaren@hpe.com","username":"stuart-mclaren"},"change_message_id":"8d2964ddb68e6ec6ab236344581bde02d34fbcca","unresolved":false,"context_lines":[{"line_number":256,"context_line":"* KeystoneClient session object support for ``X-SERVICE-TOKEN``"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"* Cross Project collaboration to leverage and/or document policy"},{"line_number":259,"context_line":"  recommendations that use the data from ``X-SERVICE-TOKEN`` for enforcement."},{"line_number":260,"context_line":""},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_7c2e0ca7","line":259,"updated":"2014-06-09 11:03:25.000000000","message":"Not sure if it\u0027s implicit in the above, but I think it would be useful to pin down how the service token/user roles/policy.json would work together by, eg:\n\n(1) defining the policy.json format for service tokens and (2) state that the \u0027and\u0027 logical operator policy logic will be used. For example if we decide that an operation requires the service token to have the \u0027glance\u0027 role, and the user token to have \u0027role1\u0027 then policy.json might look something like:\n\n\n {\n    \"some_action\": \"service:glance\" and \"role1\"\n }","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"0efca64d376c436e4006eb05f73fdc64ea9e81c7","unresolved":false,"context_lines":[{"line_number":256,"context_line":"* KeystoneClient session object support for ``X-SERVICE-TOKEN``"},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"* Cross Project collaboration to leverage and/or document policy"},{"line_number":259,"context_line":"  recommendations that use the data from ``X-SERVICE-TOKEN`` for enforcement."},{"line_number":260,"context_line":""},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_f3ca5419","line":259,"in_reply_to":"1ae5cdf2_7c2e0ca7","updated":"2014-06-16 17:20:05.000000000","message":"Without specifying exactly what the policy will look like, I\u0027ll add some clarifying text to indicate this in the next patch.","commit_id":"98cd10089756b90cbe9b2a9d109614b3ef49950c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"806589f9edae3c30e5a37f6f24399ad02fdd07c8","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"``Glance`` will then make the request to ``Swift`` presenting both the ``End"},{"line_number":57,"context_line":"User``\u0027s token and the ``Glance Service User``\u0027s token. The middleware running"},{"line_number":58,"context_line":"in ``Swift`` with decode both the ``End User``\u0027s token and the ``Glance Service"},{"line_number":59,"context_line":"User``\u0027s token and present the ``Swift`` service with the information from both"},{"line_number":60,"context_line":"tokens. ``Swift`` will then make a policy decision, now capable of enforcing"},{"line_number":61,"context_line":"that the request came from ``Glance`` instead of directly through the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_19b51f7e","line":58,"updated":"2014-06-16 18:20:49.000000000","message":"will?*","commit_id":"42a6b294c79afc507545546f0c4c1a592d2bf99b"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"2960fe9d8850036def9a64225bc8064937c2c00b","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"``Glance`` will then make the request to ``Swift`` presenting both the ``End"},{"line_number":57,"context_line":"User``\u0027s token and the ``Glance Service User``\u0027s token. The middleware running"},{"line_number":58,"context_line":"in ``Swift`` with decode both the ``End User``\u0027s token and the ``Glance Service"},{"line_number":59,"context_line":"User``\u0027s token and present the ``Swift`` service with the information from both"},{"line_number":60,"context_line":"tokens. ``Swift`` will then make a policy decision, now capable of enforcing"},{"line_number":61,"context_line":"that the request came from ``Glance`` instead of directly through the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_0b1064a7","line":58,"in_reply_to":"1ae5cdf2_19b51f7e","updated":"2014-06-16 20:28:24.000000000","message":"yep","commit_id":"42a6b294c79afc507545546f0c4c1a592d2bf99b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"806589f9edae3c30e5a37f6f24399ad02fdd07c8","unresolved":false,"context_lines":[{"line_number":69,"context_line":"header, it will decode the data from the service token and present it to the"},{"line_number":70,"context_line":"underlying service in the same manner that the data from ``X-AUTH-TOKEN`` is"},{"line_number":71,"context_line":"presented. The new data decoded from the ``X-SERVICE-TOKEN`` will use"},{"line_number":72,"context_line":"separate and distinct nameing indicating it originated from the "},{"line_number":73,"context_line":"``X-SERVICE-TOKEN`` (e.g. if ``HTTP_X_ROLES`` was extracted from the"},{"line_number":74,"context_line":"``X-AUTH-TOKEN`` header, the service equivalent will be "},{"line_number":75,"context_line":"``HTTP_X_SERVICE_ROLES``)."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_b97c2bb7","line":72,"updated":"2014-06-16 18:20:49.000000000","message":"naming*","commit_id":"42a6b294c79afc507545546f0c4c1a592d2bf99b"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"2960fe9d8850036def9a64225bc8064937c2c00b","unresolved":false,"context_lines":[{"line_number":69,"context_line":"header, it will decode the data from the service token and present it to the"},{"line_number":70,"context_line":"underlying service in the same manner that the data from ``X-AUTH-TOKEN`` is"},{"line_number":71,"context_line":"presented. The new data decoded from the ``X-SERVICE-TOKEN`` will use"},{"line_number":72,"context_line":"separate and distinct nameing indicating it originated from the "},{"line_number":73,"context_line":"``X-SERVICE-TOKEN`` (e.g. if ``HTTP_X_ROLES`` was extracted from the"},{"line_number":74,"context_line":"``X-AUTH-TOKEN`` header, the service equivalent will be "},{"line_number":75,"context_line":"``HTTP_X_SERVICE_ROLES``)."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_ab1050ac","line":72,"in_reply_to":"1ae5cdf2_b97c2bb7","updated":"2014-06-16 20:28:24.000000000","message":"ugh whitespace!!! fixed naming and whitespace in next patch.","commit_id":"42a6b294c79afc507545546f0c4c1a592d2bf99b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"806589f9edae3c30e5a37f6f24399ad02fdd07c8","unresolved":false,"context_lines":[{"line_number":71,"context_line":"presented. The new data decoded from the ``X-SERVICE-TOKEN`` will use"},{"line_number":72,"context_line":"separate and distinct nameing indicating it originated from the "},{"line_number":73,"context_line":"``X-SERVICE-TOKEN`` (e.g. if ``HTTP_X_ROLES`` was extracted from the"},{"line_number":74,"context_line":"``X-AUTH-TOKEN`` header, the service equivalent will be "},{"line_number":75,"context_line":"``HTTP_X_SERVICE_ROLES``)."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This will allow the policy engine running inside the service to make policy"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_5975e7ca","line":74,"updated":"2014-06-16 18:20:49.000000000","message":"remove trailing whitespace","commit_id":"42a6b294c79afc507545546f0c4c1a592d2bf99b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"806589f9edae3c30e5a37f6f24399ad02fdd07c8","unresolved":false,"context_lines":[{"line_number":312,"context_line":"  and other project teams."},{"line_number":313,"context_line":""},{"line_number":314,"context_line":"* Previous Example implementation: https://review.openstack.org/#/c/88366/"},{"line_number":315,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_74638add","line":315,"updated":"2014-06-16 18:20:49.000000000","message":"We could reference Dolph\u0027s writeup of composite tokens couldn\u0027t we? \n\nhttp://dolphm.com/openstack-juno-design-summit-outcomes-for-keystone/","commit_id":"42a6b294c79afc507545546f0c4c1a592d2bf99b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"943e5d1ea55aa43ec708682de5d2b048627fd5bb","unresolved":false,"context_lines":[{"line_number":72,"context_line":"separate and distinct naming indicating it originated from the"},{"line_number":73,"context_line":"``X-SERVICE-TOKEN`` (e.g. if ``HTTP_X_ROLES`` was extracted from the"},{"line_number":74,"context_line":"``X-AUTH-TOKEN`` header, the service equivalent will be"},{"line_number":75,"context_line":"``HTTP_X_SERVICE_ROLES``)."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This will allow the policy engine running inside the service to make policy"},{"line_number":78,"context_line":"decisions on the data provided from both tokens and/or respond differently"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_9deb8ddb","line":75,"updated":"2014-06-18 06:04:36.000000000","message":"HTTP_X_SERVICE_SERVICE_CATALOG?","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d0369425ff1feeef7da88e4ad82ed80084bbd634","unresolved":false,"context_lines":[{"line_number":114,"context_line":"  Keystone eliminates the benefit of decoding/validating PKI tokens locally"},{"line_number":115,"context_line":"  in the ``auth_token`` middleware. Complex policy decisions based upon the"},{"line_number":116,"context_line":"  entire request path would be an extreme edge case and does not justify the"},{"line_number":117,"context_line":"  overhead of extra round-trips to the Keystone service."},{"line_number":118,"context_line":""},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"* OAUTH"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_a83d8d2e","line":117,"updated":"2014-06-17 15:58:05.000000000","message":"agree","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d0369425ff1feeef7da88e4ad82ed80084bbd634","unresolved":false,"context_lines":[{"line_number":126,"context_line":"  the OAuth system to conform to the new use-cases would change the way"},{"line_number":127,"context_line":"  users currently interact (and expect OAuth) to function, potentially"},{"line_number":128,"context_line":"  breaking the contract defined in the OAuth APIs and requiring end users"},{"line_number":129,"context_line":"  to update all tools/scripts/etc that currently utilize the OAuth system."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Data Model Impact"},{"line_number":132,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_285fbd76","line":129,"updated":"2014-06-17 15:58:05.000000000","message":"* Multiple X-Auth-Token headers, rather than a new header\n\nCan you make any guarantees about order/priority of headers? Can you associate a single identity with the request? You\u0027d also be able to stack tokens as requests are passed around, for whatever that\u0027s worth.","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"84354afa009ff8e73ddae2942ac6b8550471f234","unresolved":false,"context_lines":[{"line_number":126,"context_line":"  the OAuth system to conform to the new use-cases would change the way"},{"line_number":127,"context_line":"  users currently interact (and expect OAuth) to function, potentially"},{"line_number":128,"context_line":"  breaking the contract defined in the OAuth APIs and requiring end users"},{"line_number":129,"context_line":"  to update all tools/scripts/etc that currently utilize the OAuth system."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Data Model Impact"},{"line_number":132,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_c0f51252","line":129,"in_reply_to":"1ae5cdf2_285fbd76","updated":"2014-06-18 17:48:54.000000000","message":"HTTP Spec says if you duplicate a header concatenate them with a \u0027,\u0027 and then it is the responsibility of whatever is consuming the header to know to split them.\n\nAs it stands with PKI tokens we are dangerously close to the limit a single header can convey (even with PKIZ we\u0027re not doing great). This isn\u0027t even really an alternative.\n\n\nhttp://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2 :\n\nMultiple message-header fields with the same field-name MAY be present in a message if and only if the entire field-value for that header field is defined as a comma-separated list [i.e., #(values)]. It MUST be possible to combine the multiple header fields into one \"field-name: field-value\" pair, without changing the semantics of the message, by appending each subsequent field-value to the first, each separated by a comma. The order in which header fields with the same field-name are received is therefore significant to the interpretation of the combined field value, and thus a proxy MUST NOT change the order of these field values when a message is forwarded.","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"3829701f25a1df281f615468bb56e669e5190a36","unresolved":false,"context_lines":[{"line_number":137,"context_line":"REST API Impact"},{"line_number":138,"context_line":"---------------"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"None"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_e34c0179","line":140,"updated":"2014-06-17 23:01:39.000000000","message":"Is there no REST API impact (or at least REST API doc impact) with the creation of the new Token object \u0027X-Service-Token\u0027? And the requirement of having both X-Auth-Token and X-Service-Token?","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"84354afa009ff8e73ddae2942ac6b8550471f234","unresolved":false,"context_lines":[{"line_number":137,"context_line":"REST API Impact"},{"line_number":138,"context_line":"---------------"},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"None"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"Security Impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_e063ee17","line":140,"in_reply_to":"1ae5cdf2_e34c0179","updated":"2014-06-18 17:48:54.000000000","message":"The REST APIs are unaffected. Policy enforcement may (but is not required) change. The new header is, for all intents and purposes, optional. The data will be extracted and presented to the underlying service to do policy enforcement.","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"3829701f25a1df281f615468bb56e669e5190a36","unresolved":false,"context_lines":[{"line_number":148,"context_line":""},{"line_number":149,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"  Yes"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":154,"context_line":"  a new way to access sensitive information or a new way to login?"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_40d4cbbc","line":151,"updated":"2014-06-17 23:01:39.000000000","message":"Can we be explicit in exactly what sensitive data is touched? e.g. New token \u0027X-Service-Token\u0027 is created which stores role related information ...","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"84354afa009ff8e73ddae2942ac6b8550471f234","unresolved":false,"context_lines":[{"line_number":148,"context_line":""},{"line_number":149,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"  Yes"},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":154,"context_line":"  a new way to access sensitive information or a new way to login?"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_e0312e0c","line":151,"in_reply_to":"1ae5cdf2_40d4cbbc","updated":"2014-06-18 17:48:54.000000000","message":"I can expand on this.","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"3829701f25a1df281f615468bb56e669e5190a36","unresolved":false,"context_lines":[{"line_number":153,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":154,"context_line":"  a new way to access sensitive information or a new way to login?"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"  Yes"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":159,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_40868bdc","line":156,"updated":"2014-06-17 23:01:39.000000000","message":"Under REST API Impact there is no mention of a change. Can we be more explicit here in what has changed?","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"84354afa009ff8e73ddae2942ac6b8550471f234","unresolved":false,"context_lines":[{"line_number":153,"context_line":"* Does this change alter the API in a way that may impact security, such as"},{"line_number":154,"context_line":"  a new way to access sensitive information or a new way to login?"},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"  Yes"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"* Does this change involve cryptography or hashing?"},{"line_number":159,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_403d82dc","line":156,"in_reply_to":"1ae5cdf2_40868bdc","updated":"2014-06-18 17:48:54.000000000","message":"Can expand some on this.","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d0369425ff1feeef7da88e4ad82ed80084bbd634","unresolved":false,"context_lines":[{"line_number":202,"context_line":"* A service should attempt to re-use it\u0027s service token as long as the token"},{"line_number":203,"context_line":"  is not expired. This will limit round-trips to Keystone to request a new"},{"line_number":204,"context_line":"  token to provide in the ``X-SERVICE-TOKEN`` header. Each service will be"},{"line_number":205,"context_line":"  responsible for refreshing it\u0027s service token as needed."},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"Other Deployer Impact"},{"line_number":208,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_08d5a1e4","line":205,"updated":"2014-06-17 15:58:05.000000000","message":"* the request overhead due to the included token(s) doubles","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"84354afa009ff8e73ddae2942ac6b8550471f234","unresolved":false,"context_lines":[{"line_number":202,"context_line":"* A service should attempt to re-use it\u0027s service token as long as the token"},{"line_number":203,"context_line":"  is not expired. This will limit round-trips to Keystone to request a new"},{"line_number":204,"context_line":"  token to provide in the ``X-SERVICE-TOKEN`` header. Each service will be"},{"line_number":205,"context_line":"  responsible for refreshing it\u0027s service token as needed."},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"Other Deployer Impact"},{"line_number":208,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_a02ba693","line":205,"in_reply_to":"1ae5cdf2_08d5a1e4","updated":"2014-06-18 17:48:54.000000000","message":"Will add the info.","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"943e5d1ea55aa43ec708682de5d2b048627fd5bb","unresolved":false,"context_lines":[{"line_number":247,"context_line":"* Developers will need to leverage the new ``Session`` object from"},{"line_number":248,"context_line":"  ``keystoneclient`` for authentication to external services to ensure the"},{"line_number":249,"context_line":"  ``X-SERVICE-TOKEN`` is properly populated when making requests to"},{"line_number":250,"context_line":"  external OpenStack services."},{"line_number":251,"context_line":""},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_dd1435a1","line":250,"updated":"2014-06-18 06:04:36.000000000","message":"Is using the Session object mandatory for this capability? Seem like just simply a matter of passing the extra X-Service-Token HTTP header.","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"84354afa009ff8e73ddae2942ac6b8550471f234","unresolved":false,"context_lines":[{"line_number":247,"context_line":"* Developers will need to leverage the new ``Session`` object from"},{"line_number":248,"context_line":"  ``keystoneclient`` for authentication to external services to ensure the"},{"line_number":249,"context_line":"  ``X-SERVICE-TOKEN`` is properly populated when making requests to"},{"line_number":250,"context_line":"  external OpenStack services."},{"line_number":251,"context_line":""},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8310744f","line":250,"in_reply_to":"1ae5cdf2_dd1435a1","updated":"2014-06-18 17:48:54.000000000","message":"I see this as a scope of the change. While someone could just pass the enw header, it will not work out of the gate. It requires changes outside the scope of this spec to accomplish, therefore, not listed as an alternative.","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"ec02e98e3debbc0da6536847ae0f1827a01f7a4e","unresolved":false,"context_lines":[{"line_number":273,"context_line":"* Cross Project collaboration to leverage and/or document policy"},{"line_number":274,"context_line":"  recommendations that use the data from ``X-SERVICE-TOKEN`` for enforcement."},{"line_number":275,"context_line":""},{"line_number":276,"context_line":""},{"line_number":277,"context_line":"Dependencies"},{"line_number":278,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":279,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_98d55be7","line":276,"updated":"2014-06-18 06:35:56.000000000","message":"Some sample code included as one of the work items would be nice.","commit_id":"f7e3e52d4d72c3744970556c5ac1a96d3fa5d8f7"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"08e1d3de1aef95146830546bf542baab4c538657","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    +-------v---------+"},{"line_number":28,"context_line":"    |     Glance      |"},{"line_number":29,"context_line":"    +-------+---------+"},{"line_number":30,"context_line":"            | Access Image Data Request"},{"line_number":31,"context_line":"            | X-AUTH-TOKEN: \u003coriginal end user token\u003e"},{"line_number":32,"context_line":"            | X-SERVICE-TOKEN: \u003cglance service user token\u003e"},{"line_number":33,"context_line":"            |"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_f2f73258","line":30,"updated":"2014-06-19 01:44:46.000000000","message":"As of today in case of UUID tokens\nAuth Middleware gets\n  X-Auth-Token : \u003c User\u0027s token \u003e  which it send as X-Subject-Token to keystone and\n  Glances service token is send as X-Auth-Token\n\nAssuming we are using UUID token,   Glance service token is same as that of X-Service-Token\n\nWhy can\u0027t the service token that is already used by services can be used? \n\nWe already have this in keystone.  User\u0027s can\u0027t validate token and only services can validate the token. That\u0027s why we have service tole defined in keystone and have policy based on that. But in practice everyone use \"admin\" token","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"65372f915d0bc90ba37bcd76742503ac26c026cf","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    +-------v---------+"},{"line_number":28,"context_line":"    |     Glance      |"},{"line_number":29,"context_line":"    +-------+---------+"},{"line_number":30,"context_line":"            | Access Image Data Request"},{"line_number":31,"context_line":"            | X-AUTH-TOKEN: \u003coriginal end user token\u003e"},{"line_number":32,"context_line":"            | X-SERVICE-TOKEN: \u003cglance service user token\u003e"},{"line_number":33,"context_line":"            |"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_96d795be","line":30,"in_reply_to":"1ae5cdf2_21ce9c5a","updated":"2014-06-20 03:36:41.000000000","message":"Thanks for the detail response.  This is the change that is going to happen in middleware.  keystone server doesn\u0027t come into picture and doesn\u0027t even need to know about this additional header.\n\nDo you see a case  where glance service( other service) token need to go 2 level down?\nGlance -\u003eswfit _\u003e Some other Service Y","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"7c5df85c0f1fbbff0a81e9fd314702fa788116b8","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    +-------v---------+"},{"line_number":28,"context_line":"    |     Glance      |"},{"line_number":29,"context_line":"    +-------+---------+"},{"line_number":30,"context_line":"            | Access Image Data Request"},{"line_number":31,"context_line":"            | X-AUTH-TOKEN: \u003coriginal end user token\u003e"},{"line_number":32,"context_line":"            | X-SERVICE-TOKEN: \u003cglance service user token\u003e"},{"line_number":33,"context_line":"            |"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_98f8767d","line":30,"in_reply_to":"1ae5cdf2_96d795be","updated":"2014-06-22 16:48:24.000000000","message":"@Haneef,\n\nThe original concept using true composite tokens had this benefit. However, after some rather extensive discussions the benefit of knowing that a request came from Nova and then to Glance before Swift seemed to be a real edgecase. Rarely the multiple service information matters. And the added overhead was very high (needing to ask keystone each step of the way).\n\nI don\u0027t think we need the multiple service information in most cases, and if we _Really_ do, we can evaluate adding that type of support.\n\nThat is unless you have a clear use case now. I\u0027m happy to extend this spec to include that if I have more than \u0027it might be useful\u0027 (I just don\u0027t have a use-case in mind that requires it).\n\nThanks for the feedback!","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":860,"name":"Donagh McCabe","email":"donagh.mccabe@gmail.com","username":"donagh-mccabe"},"change_message_id":"04e24bcb875ffd8e69d3d423952ea29d5a8eb132","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    +-------v---------+"},{"line_number":28,"context_line":"    |     Glance      |"},{"line_number":29,"context_line":"    +-------+---------+"},{"line_number":30,"context_line":"            | Access Image Data Request"},{"line_number":31,"context_line":"            | X-AUTH-TOKEN: \u003coriginal end user token\u003e"},{"line_number":32,"context_line":"            | X-SERVICE-TOKEN: \u003cglance service user token\u003e"},{"line_number":33,"context_line":"            |"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_21ce9c5a","line":30,"in_reply_to":"1ae5cdf2_f2f73258","updated":"2014-06-19 10:44:39.000000000","message":"I\u0027m not sure exactly what your question is. I can interpret the question as one of two:\n\n1/ Why do we need X-SERVICE-TOKEN?\n\n2/ Is the \u003cglance service user token\u003e special? \n\nAnswer 1:\n\nWhen you say \"as of today\", you are really referring to Glance\u0027s default config where Glance stores all images in a dedicated Swift account (i.e., project) owned by the Glance Service User. In this setup, Swift never sees the \u003cend user token\u003e. The flow looks like:\n\n    User\n        |  Access Image Data Request\n        |  X-AUTH-TOKEN: \u003cend user token\u003e  (project: \u003cuser-project\u003e\n        |\n        v\n    Glance\n        |  Access Image Data Request\n        |  X-AUTH-TOKEN: \u003cglance service user token\u003e   (project: \u003cglance-project\u003e)\n        |\n        v\n    Swift path: /v1/AUTH_\u003cglance-project\u003e\n\nIn this mode, Glance\u0027s Auth middleware validates \u003cend user token\u003e and Swift\u0027s Auth middleware validates \u003cglance service user token\u003e\n\nAn alternate mode for Glance (and the default for Cinder) is for images to be stored in the user\u0027s Swift account (no dedicated image account). The flow looks like:\n\n   User\n        |  Access Image Data Request\n        |  X-AUTH-TOKEN: \u003cend user token\u003e  (project: \u003cuser-project\u003e\n        |\n        v\n    Glance\n        |  Access Image Data Request\n        |  X-AUTH-TOKEN: \u003cend user token\u003e   (project: \u003cuser-project\u003e)\n        |\n        v\n    Swift path: /v1/AUTH_\u003cuser-project\u003e\n\nGlance simply passes on the \u003cend user token\u003e in it\u0027s request to Swift. However, this opens up this problem:\n\n   User\n        |  Delete object request\n        |  X-AUTH-TOKEN: \u003cend user token\u003e  (project: \u003cuser-project\u003e\n        |\n        v\n    Swift path: /v1/AUTH_\u003cuser-project\u003e\n\ni.e., the user has by-passed Glance. Glance db has a record of the image, but the user has deleted it!\n\nThe purpose of adding X-SERVICE-TOKEN is that you prevent this by-pass.\n\nAnswer 2:\n\nIn the proposed flow, when Glance receives the request from the user, the Auth middleware sends \u003cend user token\u003e to Keystone in X-SUBJECT-TOKEN and it\u0027s own \u003cglance service use token\u003e in X-AUTH-TOKEN. No change for current behavior.\n\nIt then makes a request to Swift with X-AUTH-TOKEN:\u003cend user token\u003e and X-SERVICE-TOKEN:\u003cglance service user token\u003e. When the request arrives in Swift, the Auth middleware will make two requests to Keystone to validate. Both will use \u003cswift service user token\u003e in X-AUTH-TOKEN and X-SUBJECT-TOKEN contains first \u003cend user token\u003e and then \u003cglance service user token\u003e.\n\nSo, yes, the \u003cglance service user token\u003e can be used for both situations. The policy in Swift would probably not use \"admin\" since the end user could have that role for \u003cuser-project\u003e.","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"88b95713f35dc275fb4111dc4572b1b2d3c1ebfa","unresolved":false,"context_lines":[{"line_number":90,"context_line":"  know to scope a token to that Trust."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"  This does not resolve the desire to secure the data from CRUD operations"},{"line_number":93,"context_line":"  circumventing the service (e.g. ``Glance`` storing images in ``Swift``)"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"* Continue to simply utilize the user\u0027s permission and bearer token"},{"line_number":96,"context_line":"  exclusively."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_29ef7a1f","line":93,"updated":"2014-06-18 21:07:36.000000000","message":"Nit: Missing period","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"88b95713f35dc275fb4111dc4572b1b2d3c1ebfa","unresolved":false,"context_lines":[{"line_number":96,"context_line":"  exclusively."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"  This does not resolve the desire to secure the data from CRUD operations"},{"line_number":99,"context_line":"  circumventing the service (e.g. ``Glance`` storing images in ``Swift``)"},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"* A composite token requested from Keystone, which combines both original"},{"line_number":102,"context_line":"  tokens into a new token."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_89ddee72","line":99,"updated":"2014-06-18 21:07:36.000000000","message":"Nit: Missing period","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"88b95713f35dc275fb4111dc4572b1b2d3c1ebfa","unresolved":false,"context_lines":[{"line_number":143,"context_line":"Security Impact"},{"line_number":144,"context_line":"---------------"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Describe any potential security impact on the system.  Some of the items to"},{"line_number":147,"context_line":"consider include:"},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"* Does this change touch sensitive data such as tokens, keys, or user data?"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_e96592af","line":146,"updated":"2014-06-18 21:07:36.000000000","message":"Nit: Double space before \u0027Some\u0027","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"88b95713f35dc275fb4111dc4572b1b2d3c1ebfa","unresolved":false,"context_lines":[{"line_number":157,"context_line":""},{"line_number":158,"context_line":"  Policy enforcement will now have access to the data from the service"},{"line_number":159,"context_line":"  token. This will not change any access to sensitive information without"},{"line_number":160,"context_line":"  and explicit change to the policy for the service behind ``auth_token``"},{"line_number":161,"context_line":"  middleware."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"* Does this change involve cryptography or hashing?"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_d2bc006f","line":160,"updated":"2014-06-18 21:07:36.000000000","message":"Nit: Should be \u0027without an explicit\u0027 ... instead of \u0027without and explicit\u0027","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"88b95713f35dc275fb4111dc4572b1b2d3c1ebfa","unresolved":false,"context_lines":[{"line_number":204,"context_line":"* Decoding the information from ``X-SERVICE-TOKEN`` header requires extra calls"},{"line_number":205,"context_line":"  to CMS (subprocess) or request to ``Keystone`` in the case of UUID tokens."},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"* A service should attempt to re-use it\u0027s service token as long as the token"},{"line_number":208,"context_line":"  is not expired. This will limit round-trips to Keystone to request a new"},{"line_number":209,"context_line":"  token to provide in the ``X-SERVICE-TOKEN`` header. Each service will be"},{"line_number":210,"context_line":"  responsible for refreshing it\u0027s service token as needed."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_497f6617","line":207,"updated":"2014-06-18 21:07:36.000000000","message":"Nit: it\u0027s \u003d\u003e its","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"88b95713f35dc275fb4111dc4572b1b2d3c1ebfa","unresolved":false,"context_lines":[{"line_number":209,"context_line":"  token to provide in the ``X-SERVICE-TOKEN`` header. Each service will be"},{"line_number":210,"context_line":"  responsible for refreshing it\u0027s service token as needed."},{"line_number":211,"context_line":""},{"line_number":212,"context_line":"* the request overhead due to the included token(s) doubles"},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"Other Deployer Impact"},{"line_number":215,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_493e868c","line":212,"updated":"2014-06-18 21:07:36.000000000","message":"Nit:\n- Capitalize \u0027the\u0027\n- missing period at end","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"88b95713f35dc275fb4111dc4572b1b2d3c1ebfa","unresolved":false,"context_lines":[{"line_number":237,"context_line":"  upgrading from the previous release, need to be aware of. Also describe"},{"line_number":238,"context_line":"  any plans to deprecate configuration values or features.  For example, if we"},{"line_number":239,"context_line":"  change the directory name that instances are stored in, how do we handle"},{"line_number":240,"context_line":"  instance directories created before the change landed?  Do we move them?  Do"},{"line_number":241,"context_line":"  we have a special case in the code? Do we assume that the operator will"},{"line_number":242,"context_line":"  recreate all the instances in their cloud?"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_49c76698","line":240,"updated":"2014-06-18 21:07:36.000000000","message":"Double spacing after the two question marks on line #240","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"88b95713f35dc275fb4111dc4572b1b2d3c1ebfa","unresolved":false,"context_lines":[{"line_number":316,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"* Most of this was discussed at the OpenStack summit between the Keystone team"},{"line_number":319,"context_line":"  and other project teams."},{"line_number":320,"context_line":""},{"line_number":321,"context_line":"* Previous Example implementation: https://review.openstack.org/#/c/88366/"},{"line_number":322,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_a622d9b6","line":319,"updated":"2014-06-18 21:07:36.000000000","message":"Remove this first bullet from the reference list - it\u0027s covered via the last reference item (i.e. the summit outcomes summary by Dolph referenced below).","commit_id":"b01d3c11edab5a0ae63eac22085a3184a35f97b4"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cf337c06449753d8f84e5b75a9df27d4a0e40011","unresolved":false,"context_lines":[{"line_number":44,"context_line":"service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"In the example workflow above, accessing the image data can only occur"},{"line_number":47,"context_line":"via the ``Glance Service``. If the user directly accesses the data via the"},{"line_number":48,"context_line":"``Swift API``, the policy would enforce a ``HTTP 403 FORBIDDEN``. This is to"},{"line_number":49,"context_line":"ensure that the user cannot perform an update (maintain data integrity) of the"},{"line_number":50,"context_line":"image without the ``Glance Service`` being aware of it."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_026cd0cf","line":47,"updated":"2014-06-23 20:53:27.000000000","message":"not sure why Glance service and Swift API are ``.","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"1672fb7cd53bbae2254c386dd0587485947543c5","unresolved":false,"context_lines":[{"line_number":44,"context_line":"service."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"In the example workflow above, accessing the image data can only occur"},{"line_number":47,"context_line":"via the ``Glance Service``. If the user directly accesses the data via the"},{"line_number":48,"context_line":"``Swift API``, the policy would enforce a ``HTTP 403 FORBIDDEN``. This is to"},{"line_number":49,"context_line":"ensure that the user cannot perform an update (maintain data integrity) of the"},{"line_number":50,"context_line":"image without the ``Glance Service`` being aware of it."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_4ed8bff0","line":47,"in_reply_to":"1ae5cdf2_026cd0cf","updated":"2014-06-23 22:58:41.000000000","message":"Sure fixed in next patch","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cf337c06449753d8f84e5b75a9df27d4a0e40011","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"In the example workflow above, accessing the image data can only occur"},{"line_number":47,"context_line":"via the ``Glance Service``. If the user directly accesses the data via the"},{"line_number":48,"context_line":"``Swift API``, the policy would enforce a ``HTTP 403 FORBIDDEN``. This is to"},{"line_number":49,"context_line":"ensure that the user cannot perform an update (maintain data integrity) of the"},{"line_number":50,"context_line":"image without the ``Glance Service`` being aware of it."},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_a245dc44","line":48,"updated":"2014-06-23 20:53:27.000000000","message":"lowercase Forbidden","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"1672fb7cd53bbae2254c386dd0587485947543c5","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"In the example workflow above, accessing the image data can only occur"},{"line_number":47,"context_line":"via the ``Glance Service``. If the user directly accesses the data via the"},{"line_number":48,"context_line":"``Swift API``, the policy would enforce a ``HTTP 403 FORBIDDEN``. This is to"},{"line_number":49,"context_line":"ensure that the user cannot perform an update (maintain data integrity) of the"},{"line_number":50,"context_line":"image without the ``Glance Service`` being aware of it."},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_eef0ab68","line":48,"in_reply_to":"1ae5cdf2_a245dc44","updated":"2014-06-23 22:58:41.000000000","message":"Fixed in next.","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cf337c06449753d8f84e5b75a9df27d4a0e40011","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The ``End User`` would make a request to ``Glance`` presenting the standard"},{"line_number":53,"context_line":"``Auth Token``. The ``auth_token`` middleware running in ``Glance`` will"},{"line_number":54,"context_line":"authorize the ``End User`` to make the API request for the image data."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"``Glance`` will then make the request to ``Swift`` presenting both the ``End"},{"line_number":57,"context_line":"User``\u0027s token and the ``Glance Service User``\u0027s token. The middleware running"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_02a3f000","line":54,"updated":"2014-06-23 20:53:27.000000000","message":"are we trying to see how many `` can be used in a paragraph? LOL","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"1672fb7cd53bbae2254c386dd0587485947543c5","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The ``End User`` would make a request to ``Glance`` presenting the standard"},{"line_number":53,"context_line":"``Auth Token``. The ``auth_token`` middleware running in ``Glance`` will"},{"line_number":54,"context_line":"authorize the ``End User`` to make the API request for the image data."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"``Glance`` will then make the request to ``Swift`` presenting both the ``End"},{"line_number":57,"context_line":"User``\u0027s token and the ``Glance Service User``\u0027s token. The middleware running"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_6e201bf9","line":54,"in_reply_to":"1ae5cdf2_02a3f000","updated":"2014-06-23 22:58:41.000000000","message":"``no`` ``we`` ``are`` ``not`` ``,`` ``I`` ``assure`` ``you``\n:)","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cf337c06449753d8f84e5b75a9df27d4a0e40011","unresolved":false,"context_lines":[{"line_number":64,"context_line":"Proposed Change"},{"line_number":65,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The ``Keystone`` ``auth_token`` middleware will be modified to accept a second"},{"line_number":68,"context_line":"token header: ``X-SERVICE-TOKEN``. If presented with the ``X-SERVICE-TOKEN``"},{"line_number":69,"context_line":"header, it will decode the data from the service token and present it to the"},{"line_number":70,"context_line":"underlying service in the same manner that the data from ``X-AUTH-TOKEN`` is"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_02f13001","line":67,"updated":"2014-06-23 20:53:27.000000000","message":"remove `` here.","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"1672fb7cd53bbae2254c386dd0587485947543c5","unresolved":false,"context_lines":[{"line_number":64,"context_line":"Proposed Change"},{"line_number":65,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"The ``Keystone`` ``auth_token`` middleware will be modified to accept a second"},{"line_number":68,"context_line":"token header: ``X-SERVICE-TOKEN``. If presented with the ``X-SERVICE-TOKEN``"},{"line_number":69,"context_line":"header, it will decode the data from the service token and present it to the"},{"line_number":70,"context_line":"underlying service in the same manner that the data from ``X-AUTH-TOKEN`` is"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_8e1d67c1","line":67,"in_reply_to":"1ae5cdf2_02f13001","updated":"2014-06-23 22:58:41.000000000","message":"Done in next patch","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cf337c06449753d8f84e5b75a9df27d4a0e40011","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This will allow the policy engine running inside the service to make policy"},{"line_number":78,"context_line":"decisions on the data provided from both tokens and/or respond differently"},{"line_number":79,"context_line":"based upon the presence of (or lack of presence of) either token."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Alternatives"},{"line_number":82,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_2229cc37","line":79,"updated":"2014-06-23 20:53:27.000000000","message":"I think it would be interesting to see an example policy file.","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"1672fb7cd53bbae2254c386dd0587485947543c5","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This will allow the policy engine running inside the service to make policy"},{"line_number":78,"context_line":"decisions on the data provided from both tokens and/or respond differently"},{"line_number":79,"context_line":"based upon the presence of (or lack of presence of) either token."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"Alternatives"},{"line_number":82,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_4e6a7f1c","line":79,"in_reply_to":"1ae5cdf2_2229cc37","updated":"2014-06-23 22:58:41.000000000","message":"I\u0027ll see if I can craft up some kind of example.","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"cf337c06449753d8f84e5b75a9df27d4a0e40011","unresolved":false,"context_lines":[{"line_number":205,"context_line":"  to CMS (subprocess) or request to ``Keystone`` in the case of UUID tokens."},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"* A service should attempt to re-use its service token as long as the token"},{"line_number":208,"context_line":"  is not expired. This will limit round-trips to Keystone to request a new"},{"line_number":209,"context_line":"  token to provide in the ``X-SERVICE-TOKEN`` header. Each service will be"},{"line_number":210,"context_line":"  responsible for refreshing its service token as needed."},{"line_number":211,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_e207e4c7","line":208,"updated":"2014-06-23 20:53:27.000000000","message":"should say `not \"about to\" expire\"`, since the token could expire while en-route.","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"1672fb7cd53bbae2254c386dd0587485947543c5","unresolved":false,"context_lines":[{"line_number":205,"context_line":"  to CMS (subprocess) or request to ``Keystone`` in the case of UUID tokens."},{"line_number":206,"context_line":""},{"line_number":207,"context_line":"* A service should attempt to re-use its service token as long as the token"},{"line_number":208,"context_line":"  is not expired. This will limit round-trips to Keystone to request a new"},{"line_number":209,"context_line":"  token to provide in the ``X-SERVICE-TOKEN`` header. Each service will be"},{"line_number":210,"context_line":"  responsible for refreshing its service token as needed."},{"line_number":211,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_0e587789","line":208,"in_reply_to":"1ae5cdf2_e207e4c7","updated":"2014-06-23 22:58:41.000000000","message":"Done in next patch","commit_id":"7b276dea8a61ef6b32cbbce7ce6a460d9c82ac71"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6e8a1321a45e862298fb45eab19b6a0f297792da","unresolved":false,"context_lines":[{"line_number":28,"context_line":"    |     Glance      |"},{"line_number":29,"context_line":"    +-------+---------+"},{"line_number":30,"context_line":"            | Access Image Data Request"},{"line_number":31,"context_line":"            | X-AUTH-TOKEN: \u003coriginal end user token\u003e"},{"line_number":32,"context_line":"            | X-SERVICE-TOKEN: \u003cglance service user token\u003e"},{"line_number":33,"context_line":"            |"},{"line_number":34,"context_line":"    +-------v---------+"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_128f9577","line":31,"updated":"2014-06-24 18:01:22.000000000","message":"probably don\u0027t need the word \"original\" here as \"end user token\" is well understood. Anyway, not a big deal.","commit_id":"d61f76cdf22b4f2a17f3dc1436b07e307d305855"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b270686940c8f0be70f646c8b320089dad73dc4","unresolved":false,"context_lines":[{"line_number":72,"context_line":"separate and distinct naming indicating it originated from the"},{"line_number":73,"context_line":"``X-SERVICE-TOKEN`` (e.g. if ``HTTP_X_ROLES`` was extracted from the"},{"line_number":74,"context_line":"``X-AUTH-TOKEN`` header, the service equivalent will be"},{"line_number":75,"context_line":"``HTTP_X_SERVICE_ROLES``)."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This will allow the policy engine running inside the service to make policy"},{"line_number":78,"context_line":"decisions on the data provided from both tokens and/or respond differently"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_a8a552a0","line":75,"updated":"2014-06-26 06:05:57.000000000","message":"might be easier to just append _SERVICE instead, so it would be HTTP_X_ROLES_SERVICE. But no biggie.","commit_id":"d61f76cdf22b4f2a17f3dc1436b07e307d305855"},{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"8735b94269b6747a1f0b868a547d764a8a353538","unresolved":false,"context_lines":[{"line_number":72,"context_line":"separate and distinct naming indicating it originated from the"},{"line_number":73,"context_line":"``X-SERVICE-TOKEN`` (e.g. if ``HTTP_X_ROLES`` was extracted from the"},{"line_number":74,"context_line":"``X-AUTH-TOKEN`` header, the service equivalent will be"},{"line_number":75,"context_line":"``HTTP_X_SERVICE_ROLES``)."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"This will allow the policy engine running inside the service to make policy"},{"line_number":78,"context_line":"decisions on the data provided from both tokens and/or respond differently"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_038d4431","line":75,"in_reply_to":"1ae5cdf2_a8a552a0","updated":"2014-06-26 10:11:54.000000000","message":"+1","commit_id":"d61f76cdf22b4f2a17f3dc1436b07e307d305855"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b270686940c8f0be70f646c8b320089dad73dc4","unresolved":false,"context_lines":[{"line_number":124,"context_line":"  globally configured option. This would require continual re-authentication"},{"line_number":125,"context_line":"  of the access (and/or request) tokens (end user intervention). Modifying"},{"line_number":126,"context_line":"  the OAuth system to conform to the new use-cases would change the way"},{"line_number":127,"context_line":"  users currently interact (and expect OAuth) to function, potentially"},{"line_number":128,"context_line":"  breaking the contract defined in the OAuth APIs and requiring end users"},{"line_number":129,"context_line":"  to update all tools/scripts/etc that currently utilize the OAuth system."},{"line_number":130,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_a841d2a7","line":127,"updated":"2014-06-26 06:05:57.000000000","message":"nit, drop the (), and use commas.","commit_id":"d61f76cdf22b4f2a17f3dc1436b07e307d305855"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6b270686940c8f0be70f646c8b320089dad73dc4","unresolved":false,"context_lines":[{"line_number":317,"context_line":""},{"line_number":318,"context_line":"* Previous Example implementation: https://review.openstack.org/#/c/88366/"},{"line_number":319,"context_line":""},{"line_number":320,"context_line":"* http://dolphm.com/openstack-juno-design-summit-outcomes-for-keystone/#compositetokens"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_285b0287","line":320,"updated":"2014-06-26 06:05:57.000000000","message":"++","commit_id":"d61f76cdf22b4f2a17f3dc1436b07e307d305855"}]}