)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4d80f00366777b6f98ceec9b8e2afe8ef95bdcc5","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Web Authentication for SAML federated Keystone"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Add Specification for Web Authentication"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: I128ad0175f79741b13bc8df337f592e344558cf4"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":6,"id":"1ae5cdf2_9fa59749","line":9,"updated":"2014-06-16 16:12:59.000000000","message":"add bp link?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":11045,"name":"Bob Thyne","email":"bob.thyne@hp.com","username":"bobt"},"change_message_id":"5b8f21f1c0b54b2204133e48621ea8830d2ddf17","unresolved":false,"context_lines":[{"line_number":7,"context_line":"Web Authentication for SAML federated Keystone"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Add Specification for Web Authentication"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: I128ad0175f79741b13bc8df337f592e344558cf4"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"1ae5cdf2_559c03c0","line":10,"updated":"2014-06-21 02:05:16.000000000","message":"We need the security impact flag \"SecurityImpact\"","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"}],"specs/juno/saml-web-authn.rst":[{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"df87002b9bd13670efdfcd99c4950bda376589b7","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Web authentication for SAML federated keystone"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"  https://blueprints.launchpad.net/keystone/+spec/saml-web-authn"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_70b0e38b","line":8,"updated":"2014-06-01 06:27:10.000000000","message":"Title overline too short","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":11,"context_line":"  https://blueprints.launchpad.net/keystone/+spec/saml-web-authn"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Implement a web page for user login through web portals (like Horizon). The"},{"line_number":14,"context_line":"page authenticates users in either case: normal or federated Keystone."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_cc63b7da","line":14,"updated":"2014-06-02 20:07:34.000000000","message":"What is the normal case here?\n\nSuggest rewording this sentence for clarity.","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"df87002b9bd13670efdfcd99c4950bda376589b7","unresolved":false,"context_lines":[{"line_number":21,"context_line":"application should implement a delegation mechanism in order to get the token"},{"line_number":22,"context_line":"on behalf of the user. Using the delegation, the web application should"},{"line_number":23,"context_line":"authenticate the user with the same authentication mechanism of Keystone and"},{"line_number":24,"context_line":"contact an Identity Provider enabled in Keystone. The provider will return"},{"line_number":25,"context_line":"special credentials the web application can forward to keystone in order to"},{"line_number":26,"context_line":"authenticate the user. Generally, Keystone has to communicate with the Identity"},{"line_number":27,"context_line":"Provider using the credentials coming from the Web Application in order to get"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_e109992d","line":24,"updated":"2014-06-01 06:27:10.000000000","message":"s/enabled in/trusted by/ ?","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"fb3eb2033a76f9d7fe0cd8318d98cb7531dc4864","unresolved":false,"context_lines":[{"line_number":28,"context_line":"user information."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"This approach has some problems with technologies like SAML2.0 where the"},{"line_number":31,"context_line":"delegation mechanism is quite new and supported only in few implementations and"},{"line_number":32,"context_line":"not supported by current IdPs."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Finally, this require to implement similar authentication mechanisms in both"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_6dc80123","line":31,"updated":"2014-06-02 08:28:25.000000000","message":"Are you talking about the ECP? \nAnyway, for the blueprint: a link to the spec for \u0027delegation mechanism\u0027 could be useful, I think.","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"874200c964edc7f566d869bda4b6f928ab7bbf02","unresolved":false,"context_lines":[{"line_number":31,"context_line":"delegation mechanism is quite new and supported only in few implementations and"},{"line_number":32,"context_line":"not supported by current IdPs."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Finally, this require to implement similar authentication mechanisms in both"},{"line_number":35,"context_line":"Keystone and the web applications which could be overkill for many web"},{"line_number":36,"context_line":"applications."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_dd48f05d","line":34,"updated":"2014-05-31 13:15:59.000000000","message":"Merge this with the paragraph above.  \"Finally, this requires the implementation of ...\"","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":36,"context_line":"applications."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"Another drawback of the current implementation is related to the user"},{"line_number":39,"context_line":"credentials verification during the not federated authentication. The user has"},{"line_number":40,"context_line":"to provide the credentials to Horizon (or other web application) and these are"},{"line_number":41,"context_line":"forwarded to Keystone for the authentication. Therefore, if an organisation"},{"line_number":42,"context_line":"would create a portal performing several tasks requiring the interaction with a"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_6c81c349","line":39,"updated":"2014-06-02 20:07:34.000000000","message":"during the non-federated*?","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":45,"context_line":"external organisation raising and this may bring many security issues. As a"},{"line_number":46,"context_line":"result, the web application and Keystone must be managed by the same"},{"line_number":47,"context_line":"organisation. For projects in universities and other research organisations,"},{"line_number":48,"context_line":"where is common to have resources providers and application providers, this"},{"line_number":49,"context_line":"could be a limitation."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_cc91f79a","line":48,"updated":"2014-06-02 20:07:34.000000000","message":"it is common*","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"fb3eb2033a76f9d7fe0cd8318d98cb7531dc4864","unresolved":false,"context_lines":[{"line_number":46,"context_line":"result, the web application and Keystone must be managed by the same"},{"line_number":47,"context_line":"organisation. For projects in universities and other research organisations,"},{"line_number":48,"context_line":"where is common to have resources providers and application providers, this"},{"line_number":49,"context_line":"could be a limitation."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_261c5313","line":49,"updated":"2014-06-02 08:28:25.000000000","message":"so if I understood the paragraph above correctly, you are saying that it\u0027s bad to pass my credentials to a horizon, that will later utilize Keystone\u0027s API and authn there (I assume there would be no credentials leak, since all traffic should be encrypted).\nBut if we talk about classic use case (no federation involved at the moment), and you have a public cloud account, all the information is stored in their backed, including user and password. So you are not using your home institute\u0027s credentials, but use those at the public cloud.","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"df87002b9bd13670efdfcd99c4950bda376589b7","unresolved":false,"context_lines":[{"line_number":54,"context_line":""},{"line_number":55,"context_line":"The current workflow implemented in Horizon requires the user to provide the"},{"line_number":56,"context_line":"credentials to Horizon and this will use the credential with Keystone API to"},{"line_number":57,"context_line":"get a token. This workflow should change so Horizon does not ask the"},{"line_number":58,"context_line":"credentials but redirect the user agent to Keystone for the authentication."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The communication between Horizon and Keystone can implement the OAuth 2.0"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_01d0454f","line":57,"updated":"2014-06-01 06:27:10.000000000","message":"does not ask *for* the credentials","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"df87002b9bd13670efdfcd99c4950bda376589b7","unresolved":false,"context_lines":[{"line_number":55,"context_line":"The current workflow implemented in Horizon requires the user to provide the"},{"line_number":56,"context_line":"credentials to Horizon and this will use the credential with Keystone API to"},{"line_number":57,"context_line":"get a token. This workflow should change so Horizon does not ask the"},{"line_number":58,"context_line":"credentials but redirect the user agent to Keystone for the authentication."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The communication between Horizon and Keystone can implement the OAuth 2.0"},{"line_number":61,"context_line":"protocol. The workflow to implement makes use of the *Authorisation Code* as"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_21c46191","line":58,"updated":"2014-06-01 06:27:10.000000000","message":"s/redirect/redirects/","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":58,"context_line":"credentials but redirect the user agent to Keystone for the authentication."},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"The communication between Horizon and Keystone can implement the OAuth 2.0"},{"line_number":61,"context_line":"protocol. The workflow to implement makes use of the *Authorisation Code* as"},{"line_number":62,"context_line":"*Authorisation Grant*. This is a special token returned to the the web server"},{"line_number":63,"context_line":"and it can be used to get the real token for the communication."},{"line_number":64,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_acc02b7d","line":61,"updated":"2014-06-02 20:07:34.000000000","message":"Suggest referencing a link to the OAuth 2.0 protocol or extension.","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"fb3eb2033a76f9d7fe0cd8318d98cb7531dc4864","unresolved":false,"context_lines":[{"line_number":63,"context_line":"and it can be used to get the real token for the communication."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":66,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" asking for user credentials. In case of"},{"line_number":67,"context_line":"federation this page has to be protected with the federated login and never"},{"line_number":68,"context_line":"shown to the user (or shown to select the authentication provider(s))."},{"line_number":69,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_c6ac8fa3","line":66,"updated":"2014-06-02 08:28:25.000000000","message":"\"login page\" \u003d\u003d web page displayed in browser, right? How would it differ from today\u0027s Horizon login page apart from the fact, that an authorization code would be returned?\nIs it for the ease of building other \u0027horizon like\u0027 services?","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":96,"context_line":"then not impact in the data model is expected for the authentication."},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"A table with the list of web application granted to use Keystone for the"},{"line_number":99,"context_line":"authentication has to be managed."},{"line_number":100,"context_line":""},{"line_number":101,"context_line":"REST API Impact"},{"line_number":102,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_2c0a5bd2","line":99,"updated":"2014-06-02 20:07:34.000000000","message":"So this blueprint will require a database migration, right?","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"fb3eb2033a76f9d7fe0cd8318d98cb7531dc4864","unresolved":false,"context_lines":[{"line_number":126,"context_line":"an administrative token in the header. The resources to add to the API is **webaccesses**"},{"line_number":127,"context_line":"and the method are:"},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"* (POST) ``/v3/webaccesses`` Add a web application to the list"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"  Normal Response Codes 201"},{"line_number":132,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_269ff351","line":129,"updated":"2014-06-02 08:28:25.000000000","message":"all these methods would be required for every proposed implementation or just for the last one (paragraph starting on line 85)?","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"874200c964edc7f566d869bda4b6f928ab7bbf02","unresolved":false,"context_lines":[{"line_number":134,"context_line":"  unauthorized (401), forbidden (403), badMethod (405)"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"  Request parameters"},{"line_number":137,"context_line":"\u003c\u003c\u003c\u003c\u003c\u003c\u003c HEAD"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":140,"context_line":"  "}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_9d3e68b7","line":137,"updated":"2014-05-31 13:15:59.000000000","message":"You\u0027ve got a merge issue here.  Remove this.","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"df87002b9bd13670efdfcd99c4950bda376589b7","unresolved":false,"context_lines":[{"line_number":138,"context_line":""},{"line_number":139,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":140,"context_line":"  "},{"line_number":141,"context_line":"\u003e\u003e\u003e\u003e\u003e\u003e\u003e db89a94d7f49d01aabf19b736904ccd042523368"},{"line_number":142,"context_line":"  +-----------------+---------+---------------+--------------------------------+"},{"line_number":143,"context_line":"  | Parameter       | Style   | Type          | Description                    |"},{"line_number":144,"context_line":"  +\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_3e09dc31","line":141,"updated":"2014-06-01 06:27:10.000000000","message":"Looks like unerased conflict markup - lines 137-141 to be removed?","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":138,"context_line":""},{"line_number":139,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":140,"context_line":"  "},{"line_number":141,"context_line":"\u003e\u003e\u003e\u003e\u003e\u003e\u003e db89a94d7f49d01aabf19b736904ccd042523368"},{"line_number":142,"context_line":"  +-----------------+---------+---------------+--------------------------------+"},{"line_number":143,"context_line":"  | Parameter       | Style   | Type          | Description                    |"},{"line_number":144,"context_line":"  +\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_ecff93a8","line":141,"in_reply_to":"1ae5cdf2_3e09dc31","updated":"2014-06-02 20:07:34.000000000","message":"http://git-scm.com/book/en/Git-Branching-Basic-Branching-and-Merging#Basic-Merge-Conflicts","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":186,"context_line":"  +-----------------+---------+---------------+--------------------------------+"},{"line_number":187,"context_line":"  | secret          | plain   | xsd:string    | Secret code to authenticate the|"},{"line_number":188,"context_line":"  | (Optional)      |         |               | application                    |"},{"line_number":189,"context_line":"  +-----------------+---------+---------------+--------------------------------+"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"  Example"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_6ce2a304","line":189,"updated":"2014-06-02 20:07:34.000000000","message":"suggest converting these tables into a list for easier readability. Maybe something like https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#services-v3services","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":199,"context_line":"\t    \"urldomain\": \"domain.xx\","},{"line_number":200,"context_line":"\t    \"redirecturl\": \"--optional--\","},{"line_number":201,"context_line":"\t    \"secret\": \"XXXXXXXXXXXXXXXXXXX\""},{"line_number":202,"context_line":"\t}"},{"line_number":203,"context_line":"     }"},{"line_number":204,"context_line":""},{"line_number":205,"context_line":"  Response: ::"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_cc1bb719","line":202,"updated":"2014-06-02 20:07:34.000000000","message":"use spaces instead of tabs","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":210,"context_line":"\t    \"enabled\": true,"},{"line_number":211,"context_line":"\t    \"id\": \"--webaccess-id--\","},{"line_number":212,"context_line":"\t    \"links\": {"},{"line_number":213,"context_line":"\t      \"self\": \"http://identity:35357/v3/webaccesses/--webaccess-id--\""},{"line_number":214,"context_line":"\t    },"},{"line_number":215,"context_line":"\t    \"name\": \"web application name\","},{"line_number":216,"context_line":"\t    \"urldomain\": \"domain.xx\","}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_0cd59f1b","line":213,"updated":"2014-06-02 20:07:34.000000000","message":"https*","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":221,"context_line":""},{"line_number":222,"context_line":""},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"* (GET) ``/v3/webaccesses`` List the web applications"},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"  Normal Response Codes 200"},{"line_number":227,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_2ca6dbc1","line":224,"updated":"2014-06-02 20:07:34.000000000","message":"could format this section similar to https://github.com/openstack/identity-api/blob/master/v3/src/markdown/identity-api-v3.md#catalog","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":299,"context_line":"\t    \"urldomain\": \"domain.xx\","},{"line_number":300,"context_line":"\t    \"redirecturl\": \"--optional--\""},{"line_number":301,"context_line":"\t    \"secret\": \"XXXXXXXXXXXXXXXXXXX\""},{"line_number":302,"context_line":"\t  }"},{"line_number":303,"context_line":"       ]"},{"line_number":304,"context_line":"     }"},{"line_number":305,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_4cb247e7","line":302,"updated":"2014-06-02 20:07:34.000000000","message":"same comment as above.","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":344,"context_line":"  +-----------------+---------+---------------+--------------------------------+"},{"line_number":345,"context_line":"  | secret          | plain   | xsd:string    | Secret code to authenticate the|"},{"line_number":346,"context_line":"  | (Optional)      |         |               | application                    |"},{"line_number":347,"context_line":"  +-----------------+---------+---------------+--------------------------------+"},{"line_number":348,"context_line":""},{"line_number":349,"context_line":"  Example ::"},{"line_number":350,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_acc66b47","line":347,"updated":"2014-06-02 20:07:34.000000000","message":"same comment as above","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":392,"context_line":""},{"line_number":393,"context_line":"The mechanism has not impact on the token generation and management but only to"},{"line_number":394,"context_line":"the way it is provided to third applications. The adopted protocol is standard"},{"line_number":395,"context_line":"and quite adopted so it should not add additional security problem."},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"No other security problems foreseen."},{"line_number":398,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_eceeb3b3","line":395,"updated":"2014-06-02 20:07:34.000000000","message":"adopted by what, links to references here might be nice.","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":439,"context_line":"Assignee(s)"},{"line_number":440,"context_line":"-----------"},{"line_number":441,"context_line":""},{"line_number":442,"context_line":"marco-fargetta"},{"line_number":443,"context_line":""},{"line_number":444,"context_line":""},{"line_number":445,"context_line":"Work Items"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_6c3aa337","line":442,"updated":"2014-06-02 20:07:34.000000000","message":"Primary assignee? Is this id the IRC nick, or launchpad id, or both?","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5ca5e85f04fb5e1fd285b2d344650322994c0073","unresolved":false,"context_lines":[{"line_number":459,"context_line":"Testing"},{"line_number":460,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":461,"context_line":""},{"line_number":462,"context_line":"None"},{"line_number":463,"context_line":""},{"line_number":464,"context_line":""},{"line_number":465,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1ae5cdf2_cc4ad7c4","line":462,"updated":"2014-06-02 20:07:34.000000000","message":"Are Tempest tests needed for this?","commit_id":"35a12cdf64edffc7cbd343c2f6228ea4df6ba4fa"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"4a7ca60d095743b85862166362cc84b35bea51b8","unresolved":false,"context_lines":[{"line_number":366,"context_line":""},{"line_number":367,"context_line":""},{"line_number":368,"context_line":""},{"line_number":369,"context_line":"#### Delete the specific web: `DELETE /v3/webaccesses/{webaccess_id}` "},{"line_number":370,"context_line":"  applications"},{"line_number":371,"context_line":""},{"line_number":372,"context_line":"  Normal Response Codes 204"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_8bb89dc9","line":369,"updated":"2014-06-03 11:59:29.000000000","message":"whitespace.","commit_id":"ac8b55b8fa489fec07cd3d7716cedf17c23140d5"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"0a385f565717332e80697cd05707409cc1ecb11e","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Keystone and the web applications which could be overkill for many web"},{"line_number":39,"context_line":"applications."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"The proposed specs as a positive inpact also for the authentication with"},{"line_number":42,"context_line":"username and password because reduce the tranfer of credentials between web"},{"line_number":43,"context_line":"applications and Keystone. Actually, users have to provide their credentials to"},{"line_number":44,"context_line":"Horizon (or other web application) and these are forwarded to Keystone for the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_8033e1a9","line":41,"updated":"2014-06-04 18:55:08.000000000","message":"The proposed specs as a postive inpact.   There are some typos/ grammatical errors here. I\u0027m not sure what you are try to say.\n\nPerhaps you are saying \u0027The design in this blueprint has a positive impact when username and password authentication is used because it reduces the transfer of credentials...\"\n\nIf my interpretation is correct I still need you to explain how it reduces the credentials. Give a comparison example between the two approaches so we can see the reduction","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"916a685d43488b3bac1be7136199d4ea4f48172b","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Keystone and the web applications which could be overkill for many web"},{"line_number":39,"context_line":"applications."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"The proposed specs as a positive inpact also for the authentication with"},{"line_number":42,"context_line":"username and password because reduce the tranfer of credentials between web"},{"line_number":43,"context_line":"applications and Keystone. Actually, users have to provide their credentials to"},{"line_number":44,"context_line":"Horizon (or other web application) and these are forwarded to Keystone for the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_245cc64a","line":41,"in_reply_to":"1ae5cdf2_3e113352","updated":"2014-06-05 15:08:33.000000000","message":"@Brad and @Marek. The description provided by Marek is correct. In the scenario I was referring to, the credentials are provided only to the keystone where the user is registered. This is good if there are different portals, managed by different companies/organisations, accessing the same cloud.\n\n@Marek. The *authorisation code* is defined by OAuth 2.0 protocol. You may consider this as a temporary token the user get after the authentication. This can be converted to a real token by the (web) application. Using the authorisation code instead of a token is good because even if the authroisation code is \"stolen\" it cannot be used to access the API.\n\nBTW. I was not including many details from OAuth specifications but if you think they are useful I can add more details.","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"ba47b4de38047b40728f4b297d0962deb382360e","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Keystone and the web applications which could be overkill for many web"},{"line_number":39,"context_line":"applications."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"The proposed specs as a positive inpact also for the authentication with"},{"line_number":42,"context_line":"username and password because reduce the tranfer of credentials between web"},{"line_number":43,"context_line":"applications and Keystone. Actually, users have to provide their credentials to"},{"line_number":44,"context_line":"Horizon (or other web application) and these are forwarded to Keystone for the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_3e113352","line":41,"in_reply_to":"1ae5cdf2_8033e1a9","updated":"2014-06-05 11:40:18.000000000","message":"@Brad. After reading the bp couple of times I think Marco has in mind following situation: (suppose there is no federation involved at the moment.)\n\nThere is a Keystone@IBM and guys at ACME deployed their own Horizon-like webpage.  It will do what keystoneclient does, but it\u0027s shiny nice webpage that utilizes Keystone API. Now, Marco, as ACME employee wants to use Keystone@IBM. He goes to that webpage and instead of passing user/pass stored in Keystone@IBM backend to the webapp, he wants to be redirected to this Magic webpage tied directly to Keystone@IBM (see line 69 in this bp) and only then authenticate himself by passing his username and password. He later wants to get redirected again to AMCE\u0027s webpage and since he has authenticated himself, get access to his projects, VM, volumens and so on. \n\nThis is how I understood his description and Marco\u0027s concerns are mainly about passing credentials to his company\u0027s webpage, later to be used to authenticate at Keystone@IBM. He wants  his browser directly send credentials to Keystone@IBM. \n\nWhat is unclear to me (it\u0027s not specified in this bp) what is this *authorization code* thats returned after the user authenticates himself. Is it  something identifying the user or just a web portal (looks like the latter option).","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5379453e4fbbb08a5af44f1b9bd26f5e2850fefa","unresolved":false,"context_lines":[{"line_number":52,"context_line":"providers and application providers could be different."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Proposed Change"},{"line_number":56,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The current workflow implemented in Horizon requires the user to provide the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_c33ed3d9","line":55,"updated":"2014-06-04 19:33:44.000000000","message":"I think it would be really helpful if you could give a detailed workflow on how everything works together.\n\n1) Admin creates a webaccess resource\n\n2) User goes to a log in page (whats the URL of this?, how can we make accomodate multiple IdPs?)\n\n3) Once Auth\u0027ed Keystone performs a POST to /auth/tokens with \"authorisation-code\"? \n\nIs the authorization code the same as the webaccess secret?","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"cae5abbb03990425213f5bff23810e0859818308","unresolved":false,"context_lines":[{"line_number":52,"context_line":"providers and application providers could be different."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Proposed Change"},{"line_number":56,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The current workflow implemented in Horizon requires the user to provide the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_885cc41a","line":55,"in_reply_to":"1ae5cdf2_77575926","updated":"2014-06-05 16:40:50.000000000","message":"I would prefer to not send OpenStack token using the user agent unless it has to be used by the user in some ways. Therefore I think the use of the authorisation code, as specified in the protocol, is better. For the implementation I am currently evaluating how to implement the specs and I am not yet sure but I agree it seems some effort is needed. Keystone core developer opinion would be very useful on that.","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"ba47b4de38047b40728f4b297d0962deb382360e","unresolved":false,"context_lines":[{"line_number":52,"context_line":"providers and application providers could be different."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Proposed Change"},{"line_number":56,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The current workflow implemented in Horizon requires the user to provide the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_5e1c3f6a","line":55,"in_reply_to":"1ae5cdf2_c33ed3d9","updated":"2014-06-05 11:40:18.000000000","message":"++ on that question on authorization code and webaccess code (actually it correctly rephrases my own from line 76).\n\nIF webaccess code \u003d\u003d authorization code I don\u0027t see how the users would be by identified.","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"916a685d43488b3bac1be7136199d4ea4f48172b","unresolved":false,"context_lines":[{"line_number":52,"context_line":"providers and application providers could be different."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Proposed Change"},{"line_number":56,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The current workflow implemented in Horizon requires the user to provide the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_cfe6dbe7","line":55,"in_reply_to":"1ae5cdf2_c33ed3d9","updated":"2014-06-05 15:08:33.000000000","message":"I will add a workflow but in the meantime I try to answer your question:\n\n- Admin create a webaccess and register the URL and other details of the application and provide an ID and the secret\n\n- User go to the application for the log-in\n\n- User is redirect to Keystone, together with the ID of the application and other info\n\n- User authenticate with username/password, SAML, or other according to the configuration of Keystone\n\n- User is send back to the application with the *authorisation code*. This identify the user\n\n- The application send the *authorisation code* to keystone in order to get the token. The request contain the application ID and the *secret* which is used to authenticate the application.\n\nTherefore, the *authorisation code* identify the user whereas the application ID and the secret identify the application\n\nThis workflow is more or less in OAuth 2.0.","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"0b4d9c08ea2d29a5f41f87ed8108d1ba13005ffb","unresolved":false,"context_lines":[{"line_number":52,"context_line":"providers and application providers could be different."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Proposed Change"},{"line_number":56,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The current workflow implemented in Horizon requires the user to provide the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_77575926","line":55,"in_reply_to":"1ae5cdf2_cfe6dbe7","updated":"2014-06-05 16:07:54.000000000","message":"Thanks. This puts some light on your proposal.\n\nHowever, there might be some gap to be filled:\n\nSuppose there is this Keystone webpage. We protect the URL with Shibboleth (or whatever), user does Federated authn on that, the SAML2 assertion is mapped into local groups, and finally an unscoped token can be produced. If you assume the user is redirected back to the application with the *authorization code* only, you will need  somehow tie together this *authorization code* with an unscoped token. This could be done in the backend, but I think there is some effort to have non persisten tokens? So maybe instead of authorization code you should use OpenStack token-like objects? \n\n@Keysone cores - what are your opinions on that?","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"0a385f565717332e80697cd05707409cc1ecb11e","unresolved":false,"context_lines":[{"line_number":60,"context_line":"get a token. This workflow should change so Horizon does not ask for the"},{"line_number":61,"context_line":"credentials but redirects the user agent to Keystone for the authentication."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The communication between Horizon and Keystone can implement the OAuth 2.0"},{"line_number":64,"context_line":"protocol (see `OAUTH2.0 Specs \u003chttp://tools.ietf.org/html/rfc6749\u003e`_). The"},{"line_number":65,"context_line":"workflow to implement makes use of the *Authorisation Code* as *Authorisation"},{"line_number":66,"context_line":"Grant*. This is a special token returned to the the web server and it can be"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_80e4c1e1","line":63,"updated":"2014-06-04 18:55:08.000000000","message":"Isn\u0027t there currently a security vulnerability with OAuth 2.0?","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"916a685d43488b3bac1be7136199d4ea4f48172b","unresolved":false,"context_lines":[{"line_number":60,"context_line":"get a token. This workflow should change so Horizon does not ask for the"},{"line_number":61,"context_line":"credentials but redirects the user agent to Keystone for the authentication."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The communication between Horizon and Keystone can implement the OAuth 2.0"},{"line_number":64,"context_line":"protocol (see `OAUTH2.0 Specs \u003chttp://tools.ietf.org/html/rfc6749\u003e`_). The"},{"line_number":65,"context_line":"workflow to implement makes use of the *Authorisation Code* as *Authorisation"},{"line_number":66,"context_line":"Grant*. This is a special token returned to the the web server and it can be"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_af318f5b","line":63,"in_reply_to":"1ae5cdf2_80e4c1e1","updated":"2014-06-05 15:08:33.000000000","message":"If you refer to the Covert Redirect it seems there is an easy fix. It is important to verify\nthe redirect URL. If you refer to others I do not know. Could you post a link to the vulnerability?","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"0a385f565717332e80697cd05707409cc1ecb11e","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Grant*. This is a special token returned to the the web server and it can be"},{"line_number":67,"context_line":"used to get the real token for the communication."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":70,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" asking for user credentials. In case of"},{"line_number":71,"context_line":"federation this page has to be protected with the federated login and never"},{"line_number":72,"context_line":"shown to the user (or shown to select the authentication provider(s))."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_8067614c","line":69,"updated":"2014-06-04 18:55:08.000000000","message":"If Keystone implements a login page that ends up putting Keystone in the web content rendering business. Which means Keystone has to worry about supporting style options, language translation options for the login page, and possibility in the future accessibility options.  Not too mention having to come up with a page style that everybody likes.  This can be a significance amount of baggage that needs to be added to Keystone to support this.  I really need to understand why this has to be implemented with Keystone providing a login page as opposed to Keystone providing some type of restful API for this sort of thing.","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"ba47b4de38047b40728f4b297d0962deb382360e","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Grant*. This is a special token returned to the the web server and it can be"},{"line_number":67,"context_line":"used to get the real token for the communication."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":70,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" asking for user credentials. In case of"},{"line_number":71,"context_line":"federation this page has to be protected with the federated login and never"},{"line_number":72,"context_line":"shown to the user (or shown to select the authentication provider(s))."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_be2c639a","line":69,"in_reply_to":"1ae5cdf2_8067614c","updated":"2014-06-05 11:40:18.000000000","message":"++","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"916a685d43488b3bac1be7136199d4ea4f48172b","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Grant*. This is a special token returned to the the web server and it can be"},{"line_number":67,"context_line":"used to get the real token for the communication."},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":70,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" asking for user credentials. In case of"},{"line_number":71,"context_line":"federation this page has to be protected with the federated login and never"},{"line_number":72,"context_line":"shown to the user (or shown to select the authentication provider(s))."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_efa1d746","line":69,"in_reply_to":"1ae5cdf2_8067614c","updated":"2014-06-05 15:08:33.000000000","message":"You are right for the work it requires. Although it should be something very simple that user can easily customise using a template.\n\nBy the way, the main problem I would solve is the login with SAML IdP where the API is not a real option. If you want to use a current IdP to login in keystone then you cannot access the API from a different web application.\n\nAs said before you need a delegation mechanism not supported by any IdP in Europe AFAIK. Moving the login in keystone solve the problem because you can implement the login with SAML\n\nAfter I start to write I was thinking that this will benefit other authentication mechanism like OpenID and OAuth2.0. I am not sure if they support the delegation but using them from keystone is far more easier than log-in in a different application and then delegate the authentication into keystone","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"0a385f565717332e80697cd05707409cc1ecb11e","unresolved":false,"context_lines":[{"line_number":69,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":70,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" asking for user credentials. In case of"},{"line_number":71,"context_line":"federation this page has to be protected with the federated login and never"},{"line_number":72,"context_line":"shown to the user (or shown to select the authentication provider(s))."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"After the login, whatever the used method, users are sent back to the web"},{"line_number":75,"context_line":"application with a POST containing the authorisation code. This code can be"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_00f7d18b","line":72,"updated":"2014-06-04 18:55:08.000000000","message":"So if this page is never shown to the user, who is using this web page?","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"916a685d43488b3bac1be7136199d4ea4f48172b","unresolved":false,"context_lines":[{"line_number":69,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":70,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" asking for user credentials. In case of"},{"line_number":71,"context_line":"federation this page has to be protected with the federated login and never"},{"line_number":72,"context_line":"shown to the user (or shown to select the authentication provider(s))."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"After the login, whatever the used method, users are sent back to the web"},{"line_number":75,"context_line":"application with a POST containing the authorisation code. This code can be"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_6fa4e74a","line":72,"in_reply_to":"1ae5cdf2_00f7d18b","updated":"2014-06-05 15:08:33.000000000","message":"If you use SAML the page will not be visible in the browser but it will be just a redirect. If you use other systems then it depend. If you use multiple system you\nshould have a list with the options","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"98aa5f4f21db4ef5ec3732a47999f40ca3d00c72","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"After the login, whatever the used method, users are sent back to the web"},{"line_number":75,"context_line":"application with a POST containing the authorisation code. This code can be"},{"line_number":76,"context_line":"used by the web server to get the token from Keystone."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_91e8a3e3","line":76,"updated":"2014-06-04 12:00:42.000000000","message":"is *authorization code* the \u0027secret\u0027 from webaccess objects (API described starting at line 134)? \n\nIf not, where is \u0027secret\u0027 used?","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"0b4d9c08ea2d29a5f41f87ed8108d1ba13005ffb","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"After the login, whatever the used method, users are sent back to the web"},{"line_number":75,"context_line":"application with a POST containing the authorisation code. This code can be"},{"line_number":76,"context_line":"used by the web server to get the token from Keystone."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_776bd984","line":76,"in_reply_to":"1ae5cdf2_874ce09f","updated":"2014-06-05 16:07:54.000000000","message":"Right. You mentioned OAuth2.0 as one of three options so I got lost whether it\u0027s OAuth2.0 specific attribute or custom one.","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"916a685d43488b3bac1be7136199d4ea4f48172b","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"After the login, whatever the used method, users are sent back to the web"},{"line_number":75,"context_line":"application with a POST containing the authorisation code. This code can be"},{"line_number":76,"context_line":"used by the web server to get the token from Keystone."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_874ce09f","line":76,"in_reply_to":"1ae5cdf2_91e8a3e3","updated":"2014-06-05 15:08:33.000000000","message":"the secret is defined in the OAuth 2.0 protocol and it is used to authenticate the client converting the *authorisation code* in token. There is a detailed example in google page you may have a look: https://developers.google.com/accounts/docs/OAuth2WebServer","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"0a385f565717332e80697cd05707409cc1ecb11e","unresolved":false,"context_lines":[{"line_number":85,"context_line":"implementation. However, for the web application there are many libraries to"},{"line_number":86,"context_line":"implement the authentication using OAuth2.0 so it could be better supported."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Another alternative could be to move the user authentication in an external"},{"line_number":89,"context_line":"service (could be also Horizon) and then use this service as an authentication"},{"line_number":90,"context_line":"provider for Keystone and the web application. In this scenario Keystone and"},{"line_number":91,"context_line":"Horizon should use the same service and share something similar to the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_c0eb2976","line":88,"updated":"2014-06-04 18:55:08.000000000","message":"This actually feels like the more appopriate approach than adding a login page to Keystone","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"916a685d43488b3bac1be7136199d4ea4f48172b","unresolved":false,"context_lines":[{"line_number":85,"context_line":"implementation. However, for the web application there are many libraries to"},{"line_number":86,"context_line":"implement the authentication using OAuth2.0 so it could be better supported."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Another alternative could be to move the user authentication in an external"},{"line_number":89,"context_line":"service (could be also Horizon) and then use this service as an authentication"},{"line_number":90,"context_line":"provider for Keystone and the web application. In this scenario Keystone and"},{"line_number":91,"context_line":"Horizon should use the same service and share something similar to the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_1ea2b24a","line":88,"in_reply_to":"1ae5cdf2_c0eb2976","updated":"2014-06-05 15:08:33.000000000","message":"Actually, in the last summit there was a discussion about the possibility to separate the authentication part of keystone from the authorisation (which manage the tokens). If this is the case then the authentication part could become this new service and we can discuss how this can support the scenario I was highlighting","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"0a385f565717332e80697cd05707409cc1ecb11e","unresolved":false,"context_lines":[{"line_number":105,"context_line":"REST API Impact"},{"line_number":106,"context_line":"---------------"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"The API ``/v3/auth/tokens`` (POST) should be modified to accept *Authorisation"},{"line_number":109,"context_line":"Code* in order to return the user Token. Therefore the only change is to add"},{"line_number":110,"context_line":"``authorisation-code`` among the option of the ``methods`` attribute. Therefore a"},{"line_number":111,"context_line":"request could be, in the simplest case of unscoped token: ::"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_c07089de","line":108,"updated":"2014-06-04 18:55:08.000000000","message":"I\u0027m confused. At the top you say this is a web page but this section makes it seem like its just new resful API\u0027s  I really can\u0027t tell if both are needed by the design","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"916a685d43488b3bac1be7136199d4ea4f48172b","unresolved":false,"context_lines":[{"line_number":105,"context_line":"REST API Impact"},{"line_number":106,"context_line":"---------------"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"The API ``/v3/auth/tokens`` (POST) should be modified to accept *Authorisation"},{"line_number":109,"context_line":"Code* in order to return the user Token. Therefore the only change is to add"},{"line_number":110,"context_line":"``authorisation-code`` among the option of the ``methods`` attribute. Therefore a"},{"line_number":111,"context_line":"request could be, in the simplest case of unscoped token: ::"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_7e573626","line":108,"in_reply_to":"1ae5cdf2_c07089de","updated":"2014-06-05 15:08:33.000000000","message":"These API are to register the web applications which can use Keystone for login.\nThis could be done in configuration but I was thinking the API could give more flexibility to manage these application. If you think it is better to keep simple then hte configuration approach could be considered","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5379453e4fbbb08a5af44f1b9bd26f5e2850fefa","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Request parameters"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":143,"context_line":"| Parameter       | Style   | Type          | Description                    |"},{"line_number":144,"context_line":"+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+"},{"line_number":145,"context_line":"| X-Auth-Token    | header  |  xsd:string   | A valid authentication token   |"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_437c83b5","line":142,"updated":"2014-06-04 19:33:44.000000000","message":"++ I really like the tables, but I think they might be moved to identity-api specs. (once the keystone spec is approved).","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"916a685d43488b3bac1be7136199d4ea4f48172b","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Request parameters"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":143,"context_line":"| Parameter       | Style   | Type          | Description                    |"},{"line_number":144,"context_line":"+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+"},{"line_number":145,"context_line":"| X-Auth-Token    | header  |  xsd:string   | A valid authentication token   |"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_61115b51","line":142,"in_reply_to":"1ae5cdf2_437c83b5","updated":"2014-06-05 15:08:33.000000000","message":"++","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5379453e4fbbb08a5af44f1b9bd26f5e2850fefa","unresolved":false,"context_lines":[{"line_number":397,"context_line":""},{"line_number":398,"context_line":"No other security problems foreseen."},{"line_number":399,"context_line":""},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"Notifications Impact"},{"line_number":402,"context_line":"--------------------"},{"line_number":403,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_e3266fcd","line":400,"updated":"2014-06-04 19:33:44.000000000","message":"What about when updating / deleting a webaccess resrouce? Do we have to revoke tokens?","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"0b4d9c08ea2d29a5f41f87ed8108d1ba13005ffb","unresolved":false,"context_lines":[{"line_number":397,"context_line":""},{"line_number":398,"context_line":"No other security problems foreseen."},{"line_number":399,"context_line":""},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"Notifications Impact"},{"line_number":402,"context_line":"--------------------"},{"line_number":403,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_57f7bdd2","line":400,"in_reply_to":"1ae5cdf2_2123d3a7","updated":"2014-06-05 16:07:54.000000000","message":"steve++","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"916a685d43488b3bac1be7136199d4ea4f48172b","unresolved":false,"context_lines":[{"line_number":397,"context_line":""},{"line_number":398,"context_line":"No other security problems foreseen."},{"line_number":399,"context_line":""},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"Notifications Impact"},{"line_number":402,"context_line":"--------------------"},{"line_number":403,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_2123d3a7","line":400,"in_reply_to":"1ae5cdf2_e3266fcd","updated":"2014-06-05 15:08:33.000000000","message":"I did not consider this case but I think you are right. Token released to the application should be removed","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5379453e4fbbb08a5af44f1b9bd26f5e2850fefa","unresolved":false,"context_lines":[{"line_number":446,"context_line":"Work Items"},{"line_number":447,"context_line":"----------"},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"* Login page"},{"line_number":450,"context_line":"* Authorisation code generation"},{"line_number":451,"context_line":"* Translate authorisation code to token (change the ``/v3/auth/tokens``)"},{"line_number":452,"context_line":"* Implement the API ``/v3/webaccesses``"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_a310e759","line":449,"updated":"2014-06-04 19:33:44.000000000","message":"where would this code live? in horizon or keystone?","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"916a685d43488b3bac1be7136199d4ea4f48172b","unresolved":false,"context_lines":[{"line_number":446,"context_line":"Work Items"},{"line_number":447,"context_line":"----------"},{"line_number":448,"context_line":""},{"line_number":449,"context_line":"* Login page"},{"line_number":450,"context_line":"* Authorisation code generation"},{"line_number":451,"context_line":"* Translate authorisation code to token (change the ``/v3/auth/tokens``)"},{"line_number":452,"context_line":"* Implement the API ``/v3/webaccesses``"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1ae5cdf2_816107d5","line":449,"in_reply_to":"1ae5cdf2_a310e759","updated":"2014-06-05 15:08:33.000000000","message":"Keystone.","commit_id":"b558f0731c55a63b28fe3f7bcf0e9dbb52ea2374"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"d8dd92cba0ef59c813772bc475827225a680c731","unresolved":false,"context_lines":[{"line_number":94,"context_line":"     |  Web       |          \u0026 Redirection URI               |"},{"line_number":95,"context_line":"     | Application|                                          |"},{"line_number":96,"context_line":"     | (Horizon)  |\u003c---(E)----- Access Token ----------------\u0027"},{"line_number":97,"context_line":"     +------------+ "},{"line_number":98,"context_line":""},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"The steps in the flow are:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_ae27b1c8","line":97,"updated":"2014-06-06 12:24:20.000000000","message":"whitespace","commit_id":"48cd0c3d326b0849b2e149f12add9d32571d7978"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"d8dd92cba0ef59c813772bc475827225a680c731","unresolved":false,"context_lines":[{"line_number":130,"context_line":"authentication provider(s) (like a SAML Discovery Service)."},{"line_number":131,"context_line":"After the login, whatever the used method for the authentication, users are"},{"line_number":132,"context_line":"sent back to the web application which can retrieve the token from Keystone."},{"line_number":133,"context_line":""},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Alternatives"},{"line_number":136,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_f1fc35b7","line":133,"updated":"2014-06-06 12:24:20.000000000","message":"We have already discussed that but I think it should be worth adding to the spec some detailed description of federated case. There couple of probles that need to be tackled: \n- how do websso makes Keystone fetch mapping rules from the database (in other words how the idp registered in the Keystone along with protocol would be selected)\n- in case the authorization code is being returned, we should write in the spec how to tie unscoped token together with an authorization code.\n\nIf there is no solution ready for that I think some NOTEs pointing those challenges out should be added to the spec (personally I would make a separated chapter for federation within websso) so nobody forgets about it!","commit_id":"48cd0c3d326b0849b2e149f12add9d32571d7978"},{"author":{"_account_id":5956,"name":"Kristy Siu","email":"kwss@kent.ac.uk","username":"kwss"},"change_message_id":"40c9838c5d6e221c2591fb0fa7d458a41a322303","unresolved":false,"context_lines":[{"line_number":183,"context_line":""},{"line_number":184,"context_line":"An additional API should be provided to enable and disable the web applications"},{"line_number":185,"context_line":"communicating with Keystone. This is for administrators so all of them require"},{"line_number":186,"context_line":"an administrative token in the header. The resources to add to the API is **webaccesses**"},{"line_number":187,"context_line":"and the method are:"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"#### Add a web application to the list: `POST /v3/webaccesses`"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_8d65b6b0","line":186,"updated":"2014-06-13 12:35:30.000000000","message":"I think \"webaccesses\" reads a bit strangely, perhaps it should just be webaccess?","commit_id":"48cd0c3d326b0849b2e149f12add9d32571d7978"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c08b1e894d68fd93b5e1554f50bbd861e04a3116","unresolved":false,"context_lines":[{"line_number":183,"context_line":""},{"line_number":184,"context_line":"An additional API should be provided to enable and disable the web applications"},{"line_number":185,"context_line":"communicating with Keystone. This is for administrators so all of them require"},{"line_number":186,"context_line":"an administrative token in the header. The resources to add to the API is **webaccesses**"},{"line_number":187,"context_line":"and the method are:"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"#### Add a web application to the list: `POST /v3/webaccesses`"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_c9514065","line":186,"in_reply_to":"1ae5cdf2_8d65b6b0","updated":"2014-06-16 09:58:47.000000000","message":"+1","commit_id":"48cd0c3d326b0849b2e149f12add9d32571d7978"},{"author":{"_account_id":5956,"name":"Kristy Siu","email":"kwss@kent.ac.uk","username":"kwss"},"change_message_id":"40c9838c5d6e221c2591fb0fa7d458a41a322303","unresolved":false,"context_lines":[{"line_number":361,"context_line":"   }"},{"line_number":362,"context_line":""},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"#### List the web applications: `GET /v3/webaccesses/{webaccess_id}`"},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"Normal Response Codes 200"},{"line_number":367,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_2d22e251","line":364,"updated":"2014-06-13 12:35:30.000000000","message":"List the -\u003e Get a","commit_id":"48cd0c3d326b0849b2e149f12add9d32571d7978"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c08b1e894d68fd93b5e1554f50bbd861e04a3116","unresolved":false,"context_lines":[{"line_number":361,"context_line":"   }"},{"line_number":362,"context_line":""},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"#### List the web applications: `GET /v3/webaccesses/{webaccess_id}`"},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"Normal Response Codes 200"},{"line_number":367,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1ae5cdf2_899d780d","line":364,"in_reply_to":"1ae5cdf2_2d22e251","updated":"2014-06-16 09:58:47.000000000","message":"Done","commit_id":"48cd0c3d326b0849b2e149f12add9d32571d7978"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4d80f00366777b6f98ceec9b8e2afe8ef95bdcc5","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Web authentication for SAML federated keystone"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp saml-web-authn"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_bfba536f","line":8,"updated":"2014-06-16 16:12:59.000000000","message":"Keystone*","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":5,"context_line":" http://creativecommons.org/licenses/by/3.0/legalcode"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Web authentication for SAML federated keystone"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp saml-web-authn"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_c18a8b19","line":8,"in_reply_to":"1ae5cdf2_bfba536f","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":14,"context_line":"Implement a web page for user login through web portals (like Horizon). The"},{"line_number":15,"context_line":"page authenticates users with the authentication method set in Keystone (it can"},{"line_number":16,"context_line":"be simple authentication with username/password or a federated authentication"},{"line_number":17,"context_line":"with SAML and/or other techbologies) and then send the user back to the portal."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_4c745436","line":17,"updated":"2014-06-16 15:16:16.000000000","message":"typo: any other technology","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":14,"context_line":"Implement a web page for user login through web portals (like Horizon). The"},{"line_number":15,"context_line":"page authenticates users with the authentication method set in Keystone (it can"},{"line_number":16,"context_line":"be simple authentication with username/password or a federated authentication"},{"line_number":17,"context_line":"with SAML and/or other techbologies) and then send the user back to the portal."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Problem Description"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_01855306","line":17,"in_reply_to":"1ae5cdf2_4c745436","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4d80f00366777b6f98ceec9b8e2afe8ef95bdcc5","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"With the current design, in case of federated user authentication, a web"},{"line_number":24,"context_line":"application should implement a delegation mechanism in order to get the token"},{"line_number":25,"context_line":"on behalf of the user. Using the delegation, the web application should"},{"line_number":26,"context_line":"authenticate the user with the same authentication mechanism of Keystone and"},{"line_number":27,"context_line":"contact an Identity Provider trusted by Keystone. The provider will return"},{"line_number":28,"context_line":"special credentials the web application can forward to keystone in order to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_7f2d2ba8","line":25,"updated":"2014-06-16 16:12:59.000000000","message":"This sounds similar to https://review.openstack.org/#/c/99908/","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"With the current design, in case of federated user authentication, a web"},{"line_number":24,"context_line":"application should implement a delegation mechanism in order to get the token"},{"line_number":25,"context_line":"on behalf of the user. Using the delegation, the web application should"},{"line_number":26,"context_line":"authenticate the user with the same authentication mechanism of Keystone and"},{"line_number":27,"context_line":"contact an Identity Provider trusted by Keystone. The provider will return"},{"line_number":28,"context_line":"special credentials the web application can forward to keystone in order to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_2125ef09","line":25,"in_reply_to":"1ae5cdf2_7f2d2ba8","updated":"2014-06-19 09:28:17.000000000","message":"There are several similarities but it solves a different problem. The aim of this spec is to move the authentication in Keystone whereas in the spec provided the focus is on delegating the authorisation. Therefore, this spec applies only to web tools needing to authenticate users. The following delegation could follow the same model proposed in that spec, as alternative to OAuth, but it requires a new spec I guess.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":23,"context_line":"With the current design, in case of federated user authentication, a web"},{"line_number":24,"context_line":"application should implement a delegation mechanism in order to get the token"},{"line_number":25,"context_line":"on behalf of the user. Using the delegation, the web application should"},{"line_number":26,"context_line":"authenticate the user with the same authentication mechanism of Keystone and"},{"line_number":27,"context_line":"contact an Identity Provider trusted by Keystone. The provider will return"},{"line_number":28,"context_line":"special credentials the web application can forward to keystone in order to"},{"line_number":29,"context_line":"authenticate the user. Generally, Keystone has to communicate with the Identity"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8c29fcf4","line":26,"updated":"2014-06-16 15:16:16.000000000","message":"I think the following phrase is not clear:\n\u0027the web application should authenticate the user with the same authentication mechanism of Keystone\u0027. Do you mean that the web application should authenticate against Keystone on behalf of the user ?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":23,"context_line":"With the current design, in case of federated user authentication, a web"},{"line_number":24,"context_line":"application should implement a delegation mechanism in order to get the token"},{"line_number":25,"context_line":"on behalf of the user. Using the delegation, the web application should"},{"line_number":26,"context_line":"authenticate the user with the same authentication mechanism of Keystone and"},{"line_number":27,"context_line":"contact an Identity Provider trusted by Keystone. The provider will return"},{"line_number":28,"context_line":"special credentials the web application can forward to keystone in order to"},{"line_number":29,"context_line":"authenticate the user. Generally, Keystone has to communicate with the Identity"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_0170f3da","line":26,"in_reply_to":"1ae5cdf2_8c29fcf4","updated":"2014-06-19 09:28:17.000000000","message":"I mean that the web application authenticate the user and send a \"token\" (SAML or other) to keystone and then keystone has to authenticate the user again using the token. This requires that both the web application and Keystone are using the same IdP for the authentication.\n\nI\u0027ll try to re-phrase it.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4d80f00366777b6f98ceec9b8e2afe8ef95bdcc5","unresolved":false,"context_lines":[{"line_number":25,"context_line":"on behalf of the user. Using the delegation, the web application should"},{"line_number":26,"context_line":"authenticate the user with the same authentication mechanism of Keystone and"},{"line_number":27,"context_line":"contact an Identity Provider trusted by Keystone. The provider will return"},{"line_number":28,"context_line":"special credentials the web application can forward to keystone in order to"},{"line_number":29,"context_line":"authenticate the user. Generally, Keystone has to communicate with the Identity"},{"line_number":30,"context_line":"Provider using the credentials coming from the Web Application in order to get"},{"line_number":31,"context_line":"user information."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_821b8072","line":28,"updated":"2014-06-16 16:12:59.000000000","message":"Keystone*","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":25,"context_line":"on behalf of the user. Using the delegation, the web application should"},{"line_number":26,"context_line":"authenticate the user with the same authentication mechanism of Keystone and"},{"line_number":27,"context_line":"contact an Identity Provider trusted by Keystone. The provider will return"},{"line_number":28,"context_line":"special credentials the web application can forward to keystone in order to"},{"line_number":29,"context_line":"authenticate the user. Generally, Keystone has to communicate with the Identity"},{"line_number":30,"context_line":"Provider using the credentials coming from the Web Application in order to get"},{"line_number":31,"context_line":"user information."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_2176cfd8","line":28,"in_reply_to":"1ae5cdf2_821b8072","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4d80f00366777b6f98ceec9b8e2afe8ef95bdcc5","unresolved":false,"context_lines":[{"line_number":31,"context_line":"user information."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This approach has some problems with technologies like SAML2.0 where the"},{"line_number":34,"context_line":"delegation mechanism is quite new and supported only in few implementations and"},{"line_number":35,"context_line":"not supported by current IdPs (see `SAML ECP"},{"line_number":36,"context_line":"\u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/ECP\u003e`_ ). Therefore, this"},{"line_number":37,"context_line":"requires the implementation of a similar authentication mechanisms in both"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_423898d4","line":34,"updated":"2014-06-16 16:12:59.000000000","message":"supports only a few implementations and is not supported by current...*","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":31,"context_line":"user information."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This approach has some problems with technologies like SAML2.0 where the"},{"line_number":34,"context_line":"delegation mechanism is quite new and supported only in few implementations and"},{"line_number":35,"context_line":"not supported by current IdPs (see `SAML ECP"},{"line_number":36,"context_line":"\u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/ECP\u003e`_ ). Therefore, this"},{"line_number":37,"context_line":"requires the implementation of a similar authentication mechanisms in both"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_fc5acaf0","line":34,"in_reply_to":"1ae5cdf2_423898d4","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This approach has some problems with technologies like SAML2.0 where the"},{"line_number":34,"context_line":"delegation mechanism is quite new and supported only in few implementations and"},{"line_number":35,"context_line":"not supported by current IdPs (see `SAML ECP"},{"line_number":36,"context_line":"\u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/ECP\u003e`_ ). Therefore, this"},{"line_number":37,"context_line":"requires the implementation of a similar authentication mechanisms in both"},{"line_number":38,"context_line":"Keystone and the web applications which could be overkill for many web"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_cc0a2479","line":35,"updated":"2014-06-16 15:16:16.000000000","message":"According to Shibboleth\u0027s wiki, the ECP authentication delegation mechanism is implemented into Shibboleth\u0027s IdP: \n\"Within the Shibboleth System, the SP includes support for ECP (both basic and delegated variants). The IdP supports extensions that provide the basic and delegated variants.\"\nhttps://wiki.shibboleth.net/confluence/display/SHIB2/ECP .\n\nAlthough the delegation mechanism looks promising, I agree that it may not be widely implemented right now.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"This approach has some problems with technologies like SAML2.0 where the"},{"line_number":34,"context_line":"delegation mechanism is quite new and supported only in few implementations and"},{"line_number":35,"context_line":"not supported by current IdPs (see `SAML ECP"},{"line_number":36,"context_line":"\u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/ECP\u003e`_ ). Therefore, this"},{"line_number":37,"context_line":"requires the implementation of a similar authentication mechanisms in both"},{"line_number":38,"context_line":"Keystone and the web applications which could be overkill for many web"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_dcaa6e84","line":35,"in_reply_to":"1ae5cdf2_cc0a2479","updated":"2014-06-19 09:28:17.000000000","message":"Actually, I am not sure about the future because it seems quite complex and there are other simpler solutions for the scenario covered by the delegation. Of course if it will be widely supported then this is the way to go","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":11717,"name":"Ryan Oshima","email":"ryan.oshima@hp.com","username":"RyanOshima"},"change_message_id":"df5350475b5dedae4b13d0874a90064222570510","unresolved":false,"context_lines":[{"line_number":41,"context_line":"The design in this blueprint has a positive impact when username and password"},{"line_number":42,"context_line":"authentication is used because it limits the visibility of the credentials only to"},{"line_number":43,"context_line":"Keystone. With the current implementation, users have to provide their"},{"line_number":44,"context_line":"credentials to Horizon (or other web application) and these are forwarded to"},{"line_number":45,"context_line":"Keystone for the authentication. Therefore, if an organisation would create a"},{"line_number":46,"context_line":"portal performing action in a remote cloud managed by a different organisation,"},{"line_number":47,"context_line":"users have to provide to the application their credentials to access the remote"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_de971839","line":44,"updated":"2014-06-16 20:08:41.000000000","message":"\"other\"-\u003e\"another\"","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":41,"context_line":"The design in this blueprint has a positive impact when username and password"},{"line_number":42,"context_line":"authentication is used because it limits the visibility of the credentials only to"},{"line_number":43,"context_line":"Keystone. With the current implementation, users have to provide their"},{"line_number":44,"context_line":"credentials to Horizon (or other web application) and these are forwarded to"},{"line_number":45,"context_line":"Keystone for the authentication. Therefore, if an organisation would create a"},{"line_number":46,"context_line":"portal performing action in a remote cloud managed by a different organisation,"},{"line_number":47,"context_line":"users have to provide to the application their credentials to access the remote"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_dc818efc","line":44,"in_reply_to":"1ae5cdf2_de971839","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":42,"context_line":"authentication is used because it limits the visibility of the credentials only to"},{"line_number":43,"context_line":"Keystone. With the current implementation, users have to provide their"},{"line_number":44,"context_line":"credentials to Horizon (or other web application) and these are forwarded to"},{"line_number":45,"context_line":"Keystone for the authentication. Therefore, if an organisation would create a"},{"line_number":46,"context_line":"portal performing action in a remote cloud managed by a different organisation,"},{"line_number":47,"context_line":"users have to provide to the application their credentials to access the remote"},{"line_number":48,"context_line":"cloud. In this case the credential are provided to an external organisation"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_0b003b01","line":45,"updated":"2014-06-17 16:43:00.000000000","message":"\"would create\" --\u003e \"creates\"?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":42,"context_line":"authentication is used because it limits the visibility of the credentials only to"},{"line_number":43,"context_line":"Keystone. With the current implementation, users have to provide their"},{"line_number":44,"context_line":"credentials to Horizon (or other web application) and these are forwarded to"},{"line_number":45,"context_line":"Keystone for the authentication. Therefore, if an organisation would create a"},{"line_number":46,"context_line":"portal performing action in a remote cloud managed by a different organisation,"},{"line_number":47,"context_line":"users have to provide to the application their credentials to access the remote"},{"line_number":48,"context_line":"cloud. In this case the credential are provided to an external organisation"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_5c757e30","line":45,"in_reply_to":"1ae5cdf2_0b003b01","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Keystone. With the current implementation, users have to provide their"},{"line_number":44,"context_line":"credentials to Horizon (or other web application) and these are forwarded to"},{"line_number":45,"context_line":"Keystone for the authentication. Therefore, if an organisation would create a"},{"line_number":46,"context_line":"portal performing action in a remote cloud managed by a different organisation,"},{"line_number":47,"context_line":"users have to provide to the application their credentials to access the remote"},{"line_number":48,"context_line":"cloud. In this case the credential are provided to an external organisation"},{"line_number":49,"context_line":"bringing several security issues. As a result, the web application and Keystone"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_ab7587cd","line":46,"updated":"2014-06-17 16:43:00.000000000","message":"\"action\" --\u003e \"an action\" or \"actions\"","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Keystone. With the current implementation, users have to provide their"},{"line_number":44,"context_line":"credentials to Horizon (or other web application) and these are forwarded to"},{"line_number":45,"context_line":"Keystone for the authentication. Therefore, if an organisation would create a"},{"line_number":46,"context_line":"portal performing action in a remote cloud managed by a different organisation,"},{"line_number":47,"context_line":"users have to provide to the application their credentials to access the remote"},{"line_number":48,"context_line":"cloud. In this case the credential are provided to an external organisation"},{"line_number":49,"context_line":"bringing several security issues. As a result, the web application and Keystone"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_3c76f23f","line":46,"in_reply_to":"1ae5cdf2_ab7587cd","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":11717,"name":"Ryan Oshima","email":"ryan.oshima@hp.com","username":"RyanOshima"},"change_message_id":"df5350475b5dedae4b13d0874a90064222570510","unresolved":false,"context_lines":[{"line_number":49,"context_line":"bringing several security issues. As a result, the web application and Keystone"},{"line_number":50,"context_line":"must be managed by the same organisation and this could be a limitation since"},{"line_number":51,"context_line":"in many research projects running in universities and other research"},{"line_number":52,"context_line":"organisations resources providers and application providers could be different."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_dee558dd","line":52,"updated":"2014-06-16 20:08:41.000000000","message":"\"resources\"-\u003e\"resource\"","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":49,"context_line":"bringing several security issues. As a result, the web application and Keystone"},{"line_number":50,"context_line":"must be managed by the same organisation and this could be a limitation since"},{"line_number":51,"context_line":"in many research projects running in universities and other research"},{"line_number":52,"context_line":"organisations resources providers and application providers could be different."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"Proposed Change"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_9cdc661a","line":52,"in_reply_to":"1ae5cdf2_dee558dd","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":56,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The current workflow implemented in Horizon requires the user to provide the"},{"line_number":59,"context_line":"credentials to Horizon and this will use the credential with Keystone API to"},{"line_number":60,"context_line":"get a token. This workflow should change so Horizon does not ask for the"},{"line_number":61,"context_line":"credentials but redirects the user agent to Keystone for the authentication."},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_cc58648d","line":59,"updated":"2014-06-16 15:16:16.000000000","message":"wording: .. requires the user to provide his credentials to Horizon, which will use the credentials ..","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":56,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"The current workflow implemented in Horizon requires the user to provide the"},{"line_number":59,"context_line":"credentials to Horizon and this will use the credential with Keystone API to"},{"line_number":60,"context_line":"get a token. This workflow should change so Horizon does not ask for the"},{"line_number":61,"context_line":"credentials but redirects the user agent to Keystone for the authentication."},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_dcfd0e70","line":59,"in_reply_to":"1ae5cdf2_cc58648d","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The communication between Horizon and Keystone can implement the OAuth 2.0"},{"line_number":64,"context_line":"protocol (see `OAUTH2.0 Specs \u003chttp://tools.ietf.org/html/rfc6749\u003e`_). The"},{"line_number":65,"context_line":"workflow to implement makes use of the *Authorisation Code* as *Authorisation"},{"line_number":66,"context_line":"Grant*. This is a special token returned to the the web server and it can be"},{"line_number":67,"context_line":"used to get the real token for the communication. The workflow should be"},{"line_number":68,"context_line":"similar to the one illustrated in the following figure (based on figure 3, page"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_cce6a4b0","line":65,"updated":"2014-06-16 15:16:16.000000000","message":"(nit) *Authorization Code*, *Authorization Grant* . Although authorisation is correct, it\u0027s written with a \u0027z\u0027 in the RFC.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":"The communication between Horizon and Keystone can implement the OAuth 2.0"},{"line_number":64,"context_line":"protocol (see `OAUTH2.0 Specs \u003chttp://tools.ietf.org/html/rfc6749\u003e`_). The"},{"line_number":65,"context_line":"workflow to implement makes use of the *Authorisation Code* as *Authorisation"},{"line_number":66,"context_line":"Grant*. This is a special token returned to the the web server and it can be"},{"line_number":67,"context_line":"used to get the real token for the communication. The workflow should be"},{"line_number":68,"context_line":"similar to the one illustrated in the following figure (based on figure 3, page"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_11959c3f","line":65,"in_reply_to":"1ae5cdf2_cce6a4b0","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":100,"context_line":"The steps in the flow are:"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"A. The web application redirect the user agent to the Authorisation Server. In"},{"line_number":103,"context_line":"   the redirection the client ID and other information (i.e., redirect URI) are"},{"line_number":104,"context_line":"   included."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"B. The authorisation server verify the client and authenticates the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_2c8468b0","line":103,"updated":"2014-06-16 15:16:16.000000000","message":"IMHO, it\u0027s not clear what \"the client\" is refering to, since it has been replaced by the \u0027Web Application\u0027 in the diagram. I\u0027d replace it with \"the web application\".\n\n-\u003e In the redirection, the web application ID and ...","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4d80f00366777b6f98ceec9b8e2afe8ef95bdcc5","unresolved":false,"context_lines":[{"line_number":103,"context_line":"   the redirection the client ID and other information (i.e., redirect URI) are"},{"line_number":104,"context_line":"   included."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"B. The authorisation server verify the client and authenticates the"},{"line_number":107,"context_line":"   user (a control on whether the user grants the web application"},{"line_number":108,"context_line":"   request could be performed)."},{"line_number":109,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_825380e1","line":106,"updated":"2014-06-16 16:12:59.000000000","message":"verifies*","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":105,"context_line":""},{"line_number":106,"context_line":"B. The authorisation server verify the client and authenticates the"},{"line_number":107,"context_line":"   user (a control on whether the user grants the web application"},{"line_number":108,"context_line":"   request could be performed)."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"C. The authorisation server redirect the user agent back to the"},{"line_number":111,"context_line":"   redirect URI in the web application with the authorisation code and"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_0caecc2f","line":108,"updated":"2014-06-16 15:16:16.000000000","message":"Mmh, I think the RFC is clearer:\n\n   (B)  The authorization server authenticates the user (via\n        the user-agent) and establishes whether the user\n        grants or denies the web application\u0027s access request.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":107,"context_line":"   user (a control on whether the user grants the web application"},{"line_number":108,"context_line":"   request could be performed)."},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"C. The authorisation server redirect the user agent back to the"},{"line_number":111,"context_line":"   redirect URI in the web application with the authorisation code and"},{"line_number":112,"context_line":"   some other information provided at step A (like the state of the"},{"line_number":113,"context_line":"   application)."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8e7e1969","line":110,"updated":"2014-06-17 16:43:00.000000000","message":"*redirects","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":112,"context_line":"   some other information provided at step A (like the state of the"},{"line_number":113,"context_line":"   application)."},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"D. The client uses the authorisation code to request the access token"},{"line_number":116,"context_line":"   (it can be a keystone unscoped token) to the authentication"},{"line_number":117,"context_line":"   server. In order to be identified, the client include in the"},{"line_number":118,"context_line":"   request its ID and the secret."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8c61fc13","line":115,"updated":"2014-06-16 15:16:16.000000000","message":"The web application uses ...","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":114,"context_line":""},{"line_number":115,"context_line":"D. The client uses the authorisation code to request the access token"},{"line_number":116,"context_line":"   (it can be a keystone unscoped token) to the authentication"},{"line_number":117,"context_line":"   server. In order to be identified, the client include in the"},{"line_number":118,"context_line":"   request its ID and the secret."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"E. The authorisation server verifies the client, validates the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8ef539ef","line":117,"updated":"2014-06-17 16:43:00.000000000","message":"*includes","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":117,"context_line":"   server. In order to be identified, the client include in the"},{"line_number":118,"context_line":"   request its ID and the secret."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"E. The authorisation server verifies the client, validates the"},{"line_number":121,"context_line":"   authorisation code and the other information, and if the request is"},{"line_number":122,"context_line":"   valid an access token is delivered"},{"line_number":123,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8c2f3ca7","line":120,"updated":"2014-06-16 15:16:16.000000000","message":"\u0027web application\u0027 would be clearer than \u0027client\u0027. What is behind the \u0027verification\u0027 ?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":120,"context_line":"E. The authorisation server verifies the client, validates the"},{"line_number":121,"context_line":"   authorisation code and the other information, and if the request is"},{"line_number":122,"context_line":"   valid an access token is delivered"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":""},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"To implement the protocol Keystone has to implement a login page"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8c165c57","line":123,"updated":"2014-06-16 15:16:16.000000000","message":"Maybe, you could just copy/paste the RFC section there. I find it clearer than the adaptation to the Web application / Keystone context.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":120,"context_line":"E. The authorisation server verifies the client, validates the"},{"line_number":121,"context_line":"   authorisation code and the other information, and if the request is"},{"line_number":122,"context_line":"   valid an access token is delivered"},{"line_number":123,"context_line":""},{"line_number":124,"context_line":""},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"To implement the protocol Keystone has to implement a login page"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_b18dc833","line":123,"in_reply_to":"1ae5cdf2_8c165c57","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":""},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":127,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirect the users"},{"line_number":128,"context_line":"for the login. In case of SAML federation this page has to be protected with"},{"line_number":129,"context_line":"the federated login and never shown to the user, or shown to select the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8e437912","line":126,"updated":"2014-06-17 16:43:00.000000000","message":"\"protocol, Keystone\"","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":""},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":127,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirect the users"},{"line_number":128,"context_line":"for the login. In case of SAML federation this page has to be protected with"},{"line_number":129,"context_line":"the federated login and never shown to the user, or shown to select the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_f184b0d4","line":126,"in_reply_to":"1ae5cdf2_8e437912","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":124,"context_line":""},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":127,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirect the users"},{"line_number":128,"context_line":"for the login. In case of SAML federation this page has to be protected with"},{"line_number":129,"context_line":"the federated login and never shown to the user, or shown to select the"},{"line_number":130,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_0e6689bb","line":127,"updated":"2014-06-17 16:43:00.000000000","message":"*redirects","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":124,"context_line":""},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":127,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirect the users"},{"line_number":128,"context_line":"for the login. In case of SAML federation this page has to be protected with"},{"line_number":129,"context_line":"the federated login and never shown to the user, or shown to select the"},{"line_number":130,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_5173a415","line":127,"in_reply_to":"1ae5cdf2_0e6689bb","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":127,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirect the users"},{"line_number":128,"context_line":"for the login. In case of SAML federation this page has to be protected with"},{"line_number":129,"context_line":"the federated login and never shown to the user, or shown to select the"},{"line_number":130,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"},{"line_number":131,"context_line":"for the apache can implement the Discovery Protocol which allow the user to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8edff939","line":128,"updated":"2014-06-17 16:43:00.000000000","message":"\"federation, this\"","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":125,"context_line":""},{"line_number":126,"context_line":"To implement the protocol Keystone has to implement a login page"},{"line_number":127,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirect the users"},{"line_number":128,"context_line":"for the login. In case of SAML federation this page has to be protected with"},{"line_number":129,"context_line":"the federated login and never shown to the user, or shown to select the"},{"line_number":130,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"},{"line_number":131,"context_line":"for the apache can implement the Discovery Protocol which allow the user to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_9160cc36","line":128,"in_reply_to":"1ae5cdf2_8edff939","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":128,"context_line":"for the login. In case of SAML federation this page has to be protected with"},{"line_number":129,"context_line":"the federated login and never shown to the user, or shown to select the"},{"line_number":130,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"},{"line_number":131,"context_line":"for the apache can implement the Discovery Protocol which allow the user to"},{"line_number":132,"context_line":"select the Identity Provider for the authentication. However, the use of an"},{"line_number":133,"context_line":"external Discovery Service is not mandatory and the login page could impement"},{"line_number":134,"context_line":"the Discovery for the user. This is useful in case the list of IdPs in the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_eeef9de7","line":131,"updated":"2014-06-17 16:43:00.000000000","message":"*allows","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":128,"context_line":"for the login. In case of SAML federation this page has to be protected with"},{"line_number":129,"context_line":"the federated login and never shown to the user, or shown to select the"},{"line_number":130,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"},{"line_number":131,"context_line":"for the apache can implement the Discovery Protocol which allow the user to"},{"line_number":132,"context_line":"select the Identity Provider for the authentication. However, the use of an"},{"line_number":133,"context_line":"external Discovery Service is not mandatory and the login page could impement"},{"line_number":134,"context_line":"the Discovery for the user. This is useful in case the list of IdPs in the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_f1d2f0cf","line":131,"in_reply_to":"1ae5cdf2_eeef9de7","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":130,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"},{"line_number":131,"context_line":"for the apache can implement the Discovery Protocol which allow the user to"},{"line_number":132,"context_line":"select the Identity Provider for the authentication. However, the use of an"},{"line_number":133,"context_line":"external Discovery Service is not mandatory and the login page could impement"},{"line_number":134,"context_line":"the Discovery for the user. This is useful in case the list of IdPs in the"},{"line_number":135,"context_line":"federation has to be limited to a subset and only this subset has to be shown"},{"line_number":136,"context_line":"to the user. Currently, the list of IdPs enabled is managed by Keystone so it"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_2f3c5abf","line":133,"updated":"2014-06-16 15:16:16.000000000","message":"typo: the login page could implement","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":130,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"},{"line_number":131,"context_line":"for the apache can implement the Discovery Protocol which allow the user to"},{"line_number":132,"context_line":"select the Identity Provider for the authentication. However, the use of an"},{"line_number":133,"context_line":"external Discovery Service is not mandatory and the login page could impement"},{"line_number":134,"context_line":"the Discovery for the user. This is useful in case the list of IdPs in the"},{"line_number":135,"context_line":"federation has to be limited to a subset and only this subset has to be shown"},{"line_number":136,"context_line":"to the user. Currently, the list of IdPs enabled is managed by Keystone so it"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_1102fc3d","line":133,"in_reply_to":"1ae5cdf2_2f3c5abf","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":134,"context_line":"the Discovery for the user. This is useful in case the list of IdPs in the"},{"line_number":135,"context_line":"federation has to be limited to a subset and only this subset has to be shown"},{"line_number":136,"context_line":"to the user. Currently, the list of IdPs enabled is managed by Keystone so it"},{"line_number":137,"context_line":"is easier to manage the list inside Keystone otherwise the list should be"},{"line_number":138,"context_line":"managed by apache and keystone making the configuration more complicated."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"After the login, whatever the used method for the authentication, users are"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_aec83557","line":137,"updated":"2014-06-17 16:43:00.000000000","message":"\"inside Keystone, otherwise\"","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":134,"context_line":"the Discovery for the user. This is useful in case the list of IdPs in the"},{"line_number":135,"context_line":"federation has to be limited to a subset and only this subset has to be shown"},{"line_number":136,"context_line":"to the user. Currently, the list of IdPs enabled is managed by Keystone so it"},{"line_number":137,"context_line":"is easier to manage the list inside Keystone otherwise the list should be"},{"line_number":138,"context_line":"managed by apache and keystone making the configuration more complicated."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"After the login, whatever the used method for the authentication, users are"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_71f50050","line":137,"in_reply_to":"1ae5cdf2_aec83557","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":135,"context_line":"federation has to be limited to a subset and only this subset has to be shown"},{"line_number":136,"context_line":"to the user. Currently, the list of IdPs enabled is managed by Keystone so it"},{"line_number":137,"context_line":"is easier to manage the list inside Keystone otherwise the list should be"},{"line_number":138,"context_line":"managed by apache and keystone making the configuration more complicated."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"After the login, whatever the used method for the authentication, users are"},{"line_number":141,"context_line":"sent back to the web application which can retrieve the token from Keystone."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_2e87c513","line":138,"updated":"2014-06-17 16:43:00.000000000","message":"*Apache\n*Keystone","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":135,"context_line":"federation has to be limited to a subset and only this subset has to be shown"},{"line_number":136,"context_line":"to the user. Currently, the list of IdPs enabled is managed by Keystone so it"},{"line_number":137,"context_line":"is easier to manage the list inside Keystone otherwise the list should be"},{"line_number":138,"context_line":"managed by apache and keystone making the configuration more complicated."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"After the login, whatever the used method for the authentication, users are"},{"line_number":141,"context_line":"sent back to the web application which can retrieve the token from Keystone."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_d1b25495","line":138,"in_reply_to":"1ae5cdf2_2e87c513","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":137,"context_line":"is easier to manage the list inside Keystone otherwise the list should be"},{"line_number":138,"context_line":"managed by apache and keystone making the configuration more complicated."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"After the login, whatever the used method for the authentication, users are"},{"line_number":141,"context_line":"sent back to the web application which can retrieve the token from Keystone."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_6fb4a235","line":140,"updated":"2014-06-16 15:16:16.000000000","message":"wording: whatever the method used for authentication","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":137,"context_line":"is easier to manage the list inside Keystone otherwise the list should be"},{"line_number":138,"context_line":"managed by apache and keystone making the configuration more complicated."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"After the login, whatever the used method for the authentication, users are"},{"line_number":141,"context_line":"sent back to the web application which can retrieve the token from Keystone."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_31ad3832","line":140,"in_reply_to":"1ae5cdf2_6fb4a235","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":151,"context_line":"implement the authentication using OAuth2.0 so it could be better supported."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Another alternative could be to move the user authentication in an external"},{"line_number":154,"context_line":"service (could be also Horizon) and then use this service as an authentication"},{"line_number":155,"context_line":"provider for Keystone and the web application. In this scenario Keystone and"},{"line_number":156,"context_line":"Horizon should use the same service and share something similar to the"},{"line_number":157,"context_line":"authentication code. In this case only the authentication plug-in for Keystone"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_afecea2a","line":154,"updated":"2014-06-16 15:16:16.000000000","message":"The external service could be an IdP..\n\nIn the context of this blueprint (SAML federated keystone), we are already relying on an external (SAML enabled) IdP. So there\u0027s no need to \u0027move\u0027 the user authentication in an external service since it\u0027s already done (or am I missing something ?)","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":151,"context_line":"implement the authentication using OAuth2.0 so it could be better supported."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"Another alternative could be to move the user authentication in an external"},{"line_number":154,"context_line":"service (could be also Horizon) and then use this service as an authentication"},{"line_number":155,"context_line":"provider for Keystone and the web application. In this scenario Keystone and"},{"line_number":156,"context_line":"Horizon should use the same service and share something similar to the"},{"line_number":157,"context_line":"authentication code. In this case only the authentication plug-in for Keystone"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_7128a097","line":154,"in_reply_to":"1ae5cdf2_afecea2a","updated":"2014-06-19 09:28:17.000000000","message":"The external service has to be the entity inside OpenStack registered in the IdP and responsible to convert SAML assertion in something recognised by Keystone and Horizon","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":154,"context_line":"service (could be also Horizon) and then use this service as an authentication"},{"line_number":155,"context_line":"provider for Keystone and the web application. In this scenario Keystone and"},{"line_number":156,"context_line":"Horizon should use the same service and share something similar to the"},{"line_number":157,"context_line":"authentication code. In this case only the authentication plug-in for Keystone"},{"line_number":158,"context_line":"has to be implemented but the workflow is more complex and require extra"},{"line_number":159,"context_line":"services which are not needed."},{"line_number":160,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_0fc23e86","line":157,"updated":"2014-06-16 15:16:16.000000000","message":"Do you mean that Horizon and Keystone will have a common authentication code ?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":154,"context_line":"service (could be also Horizon) and then use this service as an authentication"},{"line_number":155,"context_line":"provider for Keystone and the web application. In this scenario Keystone and"},{"line_number":156,"context_line":"Horizon should use the same service and share something similar to the"},{"line_number":157,"context_line":"authentication code. In this case only the authentication plug-in for Keystone"},{"line_number":158,"context_line":"has to be implemented but the workflow is more complex and require extra"},{"line_number":159,"context_line":"services which are not needed."},{"line_number":160,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_143aeacc","line":157,"in_reply_to":"1ae5cdf2_0fc23e86","updated":"2014-06-19 09:28:17.000000000","message":"this could be an option","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":156,"context_line":"Horizon should use the same service and share something similar to the"},{"line_number":157,"context_line":"authentication code. In this case only the authentication plug-in for Keystone"},{"line_number":158,"context_line":"has to be implemented but the workflow is more complex and require extra"},{"line_number":159,"context_line":"services which are not needed."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Data Model Impact"},{"line_number":162,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8f03aebd","line":159,"updated":"2014-06-16 15:16:16.000000000","message":"Well, as said in the previous comment, in the context of this blueprint we are already relying on an external IdP. I don\u0027t understand why we would require an extra service here.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":161,"context_line":"Data Model Impact"},{"line_number":162,"context_line":"-----------------"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"If the authentication code is in cache and not stored made persistent in a DB"},{"line_number":165,"context_line":"then not impact in the data model is expected for the authentication."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"A table with the list of web application granted to use Keystone for the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_0fcf9e58","line":164,"updated":"2014-06-16 15:16:16.000000000","message":"Sorry, I don\u0027t understand what is not stored in a DB.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":161,"context_line":"Data Model Impact"},{"line_number":162,"context_line":"-----------------"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"If the authentication code is in cache and not stored made persistent in a DB"},{"line_number":165,"context_line":"then not impact in the data model is expected for the authentication."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"A table with the list of web application granted to use Keystone for the"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_54e39233","line":164,"in_reply_to":"1ae5cdf2_0fcf9e58","updated":"2014-06-19 09:28:17.000000000","message":"I was reffering to the authorisation code provieded to horizon, my mistake","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":165,"context_line":"then not impact in the data model is expected for the authentication."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"A table with the list of web application granted to use Keystone for the"},{"line_number":168,"context_line":"authentication has to be managed."},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"REST API Impact"},{"line_number":171,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8f93aeff","line":168,"updated":"2014-06-16 15:16:16.000000000","message":"Is it really useful? If the app has the authz code, I\u0027d say that it already means that the user trust the web application and want it to be able to get a token on his behalf.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":165,"context_line":"then not impact in the data model is expected for the authentication."},{"line_number":166,"context_line":""},{"line_number":167,"context_line":"A table with the list of web application granted to use Keystone for the"},{"line_number":168,"context_line":"authentication has to be managed."},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"REST API Impact"},{"line_number":171,"context_line":"---------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_d45402c8","line":168,"in_reply_to":"1ae5cdf2_8f93aeff","updated":"2014-06-19 09:28:17.000000000","message":"There is a vulnerability (see Security Impact section) where it is possible to stolen the token from an application by modifying the url where the token is returned. Register the application solve the problem (and many companies using the protocol require to register the application)","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":179,"context_line":"      \"auth\": {"},{"line_number":180,"context_line":"          \"identity\": {"},{"line_number":181,"context_line":"            \"methods\": ["},{"line_number":182,"context_line":"                \"authorisation-code\""},{"line_number":183,"context_line":"            ],"},{"line_number":184,"context_line":"            \"authorisation-code\": {"},{"line_number":185,"context_line":"                \"code\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_4fa8c620","line":182,"updated":"2014-06-16 15:16:16.000000000","message":"I\u0027d prefer \"authorization code\". I think it\u0027s more more widely used with a \u0027z\u0027.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"69589306a033dca2b79ce4d1e5dfa426a4a455d2","unresolved":false,"context_lines":[{"line_number":179,"context_line":"      \"auth\": {"},{"line_number":180,"context_line":"          \"identity\": {"},{"line_number":181,"context_line":"            \"methods\": ["},{"line_number":182,"context_line":"                \"authorisation-code\""},{"line_number":183,"context_line":"            ],"},{"line_number":184,"context_line":"            \"authorisation-code\": {"},{"line_number":185,"context_line":"                \"code\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_ff2e7cf9","line":182,"in_reply_to":"1ae5cdf2_4fa8c620","updated":"2014-06-17 09:22:17.000000000","message":"++","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":179,"context_line":"      \"auth\": {"},{"line_number":180,"context_line":"          \"identity\": {"},{"line_number":181,"context_line":"            \"methods\": ["},{"line_number":182,"context_line":"                \"authorisation-code\""},{"line_number":183,"context_line":"            ],"},{"line_number":184,"context_line":"            \"authorisation-code\": {"},{"line_number":185,"context_line":"                \"code\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_f4101e02","line":182,"in_reply_to":"1ae5cdf2_4fa8c620","updated":"2014-06-19 09:28:17.000000000","message":"I would prefer the British spelling. Is there a rule for the project?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4d80f00366777b6f98ceec9b8e2afe8ef95bdcc5","unresolved":false,"context_lines":[{"line_number":195,"context_line":"an administrative token in the header. The resources to add to the API is **webaccess**"},{"line_number":196,"context_line":"and the method are:"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"#### Add a web application to the list: `POST /v3/webaccess`"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"Normal Response Codes 201"},{"line_number":201,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_a22a3c8e","line":198,"updated":"2014-06-16 16:12:59.000000000","message":"Is this going to be an extension or included in the core v3 API?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":195,"context_line":"an administrative token in the header. The resources to add to the API is **webaccess**"},{"line_number":196,"context_line":"and the method are:"},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"#### Add a web application to the list: `POST /v3/webaccess`"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"Normal Response Codes 201"},{"line_number":201,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_746fae60","line":198,"in_reply_to":"1ae5cdf2_a22a3c8e","updated":"2014-06-19 09:28:17.000000000","message":"Actually, this could be an extension in case you want to use this authentication model for Horizon but if this become the only way for the authentication then it is better to move them in the core API.\n\nHowever, I have not preference on this point. Do other keystone developers would comment?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":223,"context_line":"| redirecturl     | plain   | xsd:string    | Redirect url after login       |"},{"line_number":224,"context_line":"| (Optional)      |         |               |                                |"},{"line_number":225,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":226,"context_line":"| secret          | plain   | xsd:string    | Secret code to authenticate    |"},{"line_number":227,"context_line":"| (Optional)      |         |               | the application                |"},{"line_number":228,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":229,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_ea2340a5","line":226,"updated":"2014-06-16 15:16:16.000000000","message":"What about using some cryptographic algorithm to authenticate the app if needs be?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":223,"context_line":"| redirecturl     | plain   | xsd:string    | Redirect url after login       |"},{"line_number":224,"context_line":"| (Optional)      |         |               |                                |"},{"line_number":225,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":226,"context_line":"| secret          | plain   | xsd:string    | Secret code to authenticate    |"},{"line_number":227,"context_line":"| (Optional)      |         |               | the application                |"},{"line_number":228,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":229,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_683c2a30","line":226,"in_reply_to":"1ae5cdf2_ea2340a5","updated":"2014-06-19 09:28:17.000000000","message":"This is possible. Would you use the cryptographic authentication as exclusive or as an option?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":232,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":233,"context_line":"| Parameter       | Style   | Type          | Description                    |"},{"line_number":234,"context_line":"+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+"},{"line_number":235,"context_line":"| links           | plain   |  csapi:dict   | Policy links                   |"},{"line_number":236,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":237,"context_line":"| description     | plain   | xsd:string    | The web application            |"},{"line_number":238,"context_line":"| (Optional)      |         |               | description                    |"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_0a3dcc2c","line":235,"updated":"2014-06-16 15:16:16.000000000","message":"What are these links for ?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":232,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":233,"context_line":"| Parameter       | Style   | Type          | Description                    |"},{"line_number":234,"context_line":"+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+"},{"line_number":235,"context_line":"| links           | plain   |  csapi:dict   | Policy links                   |"},{"line_number":236,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":237,"context_line":"| description     | plain   | xsd:string    | The web application            |"},{"line_number":238,"context_line":"| (Optional)      |         |               | description                    |"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_283dc2dd","line":235,"in_reply_to":"1ae5cdf2_0a3dcc2c","updated":"2014-06-19 09:28:17.000000000","message":"Actually, I am not sure how they are used but all identity APIs implementing a GET or a POST I have seen have this parameter so I thought it was needed somehow.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":276,"context_line":"       \"enabled\": true,"},{"line_number":277,"context_line":"       \"id\": \"--webaccess-id--\","},{"line_number":278,"context_line":"       \"links\": {"},{"line_number":279,"context_line":"\t \"self\": \"https://identity:35357/v3/webaccess/--webaccess-id--\""},{"line_number":280,"context_line":"       },"},{"line_number":281,"context_line":"       \"name\": \"web application name\","},{"line_number":282,"context_line":"       \"urldomain\": \"domain.xx\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_4ad99421","line":279,"updated":"2014-06-16 15:16:16.000000000","message":"You should replace tabulations with spaces.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":276,"context_line":"       \"enabled\": true,"},{"line_number":277,"context_line":"       \"id\": \"--webaccess-id--\","},{"line_number":278,"context_line":"       \"links\": {"},{"line_number":279,"context_line":"\t \"self\": \"https://identity:35357/v3/webaccess/--webaccess-id--\""},{"line_number":280,"context_line":"       },"},{"line_number":281,"context_line":"       \"name\": \"web application name\","},{"line_number":282,"context_line":"       \"urldomain\": \"domain.xx\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_480cce42","line":279,"in_reply_to":"1ae5cdf2_4ad99421","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":317,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":318,"context_line":"| Parameter       | Style   | Type          | Description                    |"},{"line_number":319,"context_line":"+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+"},{"line_number":320,"context_line":"| links           | plain   |  csapi:dict   | Policy links                   |"},{"line_number":321,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":322,"context_line":"| description     | plain   | xsd:string    | The web application            |"},{"line_number":323,"context_line":"| (Optional)      |         |               | description                    |"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_aa7cd8ec","line":320,"updated":"2014-06-16 15:16:16.000000000","message":"What are these links for ?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":339,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":340,"context_line":""},{"line_number":341,"context_line":"Example ::"},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"   {"},{"line_number":344,"context_line":"      \"webaccess\": ["},{"line_number":345,"context_line":"\t{"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_ae0af524","line":342,"updated":"2014-06-17 16:43:00.000000000","message":"like above should you provide \"Example Request\" too?  Or at least say the following is an \"Example Response\"","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":339,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":340,"context_line":""},{"line_number":341,"context_line":"Example ::"},{"line_number":342,"context_line":""},{"line_number":343,"context_line":"   {"},{"line_number":344,"context_line":"      \"webaccess\": ["},{"line_number":345,"context_line":"\t{"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_e7fe89ae","line":342,"in_reply_to":"1ae5cdf2_ae0af524","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":342,"context_line":""},{"line_number":343,"context_line":"   {"},{"line_number":344,"context_line":"      \"webaccess\": ["},{"line_number":345,"context_line":"\t{"},{"line_number":346,"context_line":"\t  \"description\": \"desc of web application\","},{"line_number":347,"context_line":"\t  \"enabled\": true,"},{"line_number":348,"context_line":"\t  \"id\": \"--webaccess-id--\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_ea01806b","line":345,"updated":"2014-06-16 15:16:16.000000000","message":"Use spaces instead of tabulations.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":342,"context_line":""},{"line_number":343,"context_line":"   {"},{"line_number":344,"context_line":"      \"webaccess\": ["},{"line_number":345,"context_line":"\t{"},{"line_number":346,"context_line":"\t  \"description\": \"desc of web application\","},{"line_number":347,"context_line":"\t  \"enabled\": true,"},{"line_number":348,"context_line":"\t  \"id\": \"--webaccess-id--\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_87f4e5f1","line":345,"in_reply_to":"1ae5cdf2_ea01806b","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":391,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":392,"context_line":"| Parameter       | Style   | Type          | Description                    |"},{"line_number":393,"context_line":"+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d+"},{"line_number":394,"context_line":"| links           | plain   |  csapi:dict   | Policy links                   |"},{"line_number":395,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":396,"context_line":"| description     | plain   | xsd:string    | The web application            |"},{"line_number":397,"context_line":"| (Optional)      |         |               | description                    |"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_4aa8b420","line":394,"updated":"2014-06-16 15:16:16.000000000","message":"What are these links for ?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":9622,"name":"Cindy Lu","email":"clu@us.ibm.com","username":"clu14"},"change_message_id":"a8bfc641036ca5043b8e9db95ce4aa4e3ab3883f","unresolved":false,"context_lines":[{"line_number":413,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":414,"context_line":""},{"line_number":415,"context_line":"Example ::"},{"line_number":416,"context_line":""},{"line_number":417,"context_line":"   {"},{"line_number":418,"context_line":"      \"webaccess\": {"},{"line_number":419,"context_line":"\t  \"description\": \"desc of web application\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_b90cfd3a","line":416,"updated":"2014-06-17 16:43:00.000000000","message":"\"Example Response\"","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":413,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":414,"context_line":""},{"line_number":415,"context_line":"Example ::"},{"line_number":416,"context_line":""},{"line_number":417,"context_line":"   {"},{"line_number":418,"context_line":"      \"webaccess\": {"},{"line_number":419,"context_line":"\t  \"description\": \"desc of web application\","}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_07137501","line":416,"in_reply_to":"1ae5cdf2_b90cfd3a","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":416,"context_line":""},{"line_number":417,"context_line":"   {"},{"line_number":418,"context_line":"      \"webaccess\": {"},{"line_number":419,"context_line":"\t  \"description\": \"desc of web application\","},{"line_number":420,"context_line":"\t  \"enabled\": true,"},{"line_number":421,"context_line":"\t  \"id\": \"--webaccess-id--\","},{"line_number":422,"context_line":"\t  \"links\": {"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_8ac55c0c","line":419,"updated":"2014-06-16 15:16:16.000000000","message":"tabs","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":416,"context_line":""},{"line_number":417,"context_line":"   {"},{"line_number":418,"context_line":"      \"webaccess\": {"},{"line_number":419,"context_line":"\t  \"description\": \"desc of web application\","},{"line_number":420,"context_line":"\t  \"enabled\": true,"},{"line_number":421,"context_line":"\t  \"id\": \"--webaccess-id--\","},{"line_number":422,"context_line":"\t  \"links\": {"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_67d99955","line":419,"in_reply_to":"1ae5cdf2_8ac55c0c","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":11717,"name":"Ryan Oshima","email":"ryan.oshima@hp.com","username":"RyanOshima"},"change_message_id":"df5350475b5dedae4b13d0874a90064222570510","unresolved":false,"context_lines":[{"line_number":455,"context_line":"Security Impact"},{"line_number":456,"context_line":"---------------"},{"line_number":457,"context_line":""},{"line_number":458,"context_line":"The mechanism has not impact on the token generation and management but only to"},{"line_number":459,"context_line":"the way it is provided to third applications. The OAuth2.0 protocol proposed is"},{"line_number":460,"context_line":"standard and adopted by many organisation (like DropBox, Facebook, Google,"},{"line_number":461,"context_line":"Microsoft, etc...) so it has proven to be robust and secure as well."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_de58f88c","line":458,"updated":"2014-06-16 20:08:41.000000000","message":"\"not\"-\u003e\"no\" \"but only to\"-\u003e\"except for\"","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":455,"context_line":"Security Impact"},{"line_number":456,"context_line":"---------------"},{"line_number":457,"context_line":""},{"line_number":458,"context_line":"The mechanism has not impact on the token generation and management but only to"},{"line_number":459,"context_line":"the way it is provided to third applications. The OAuth2.0 protocol proposed is"},{"line_number":460,"context_line":"standard and adopted by many organisation (like DropBox, Facebook, Google,"},{"line_number":461,"context_line":"Microsoft, etc...) so it has proven to be robust and secure as well."}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_67b0b9fd","line":458,"in_reply_to":"1ae5cdf2_de58f88c","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":467,"context_line":"\u003chttp://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html\u003e`_"},{"line_number":468,"context_line":""},{"line_number":469,"context_line":"Nevertheless, when a web application is disabled or deleted the token released to"},{"line_number":470,"context_line":"this application users should be revoked."},{"line_number":471,"context_line":""},{"line_number":472,"context_line":""},{"line_number":473,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_c5075717","line":470,"updated":"2014-06-16 15:16:16.000000000","message":"I guess it\u0027s the token released to the application that has to be revoked.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":467,"context_line":"\u003chttp://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html\u003e`_"},{"line_number":468,"context_line":""},{"line_number":469,"context_line":"Nevertheless, when a web application is disabled or deleted the token released to"},{"line_number":470,"context_line":"this application users should be revoked."},{"line_number":471,"context_line":""},{"line_number":472,"context_line":""},{"line_number":473,"context_line":"Notifications Impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_e7712946","line":470,"in_reply_to":"1ae5cdf2_c5075717","updated":"2014-06-19 09:28:17.000000000","message":"All the token used by the application for its users","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":491,"context_line":"Other Deployer Impact"},{"line_number":492,"context_line":"---------------------"},{"line_number":493,"context_line":""},{"line_number":494,"context_line":"This change has an impact for the deploy of Horizon or other web tools accessing"},{"line_number":495,"context_line":"to OpenStack. These must be registered in Keystone. The *id*, *secret*, and"},{"line_number":496,"context_line":"endpoint should be configured in the service to perform the login."},{"line_number":497,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_053f7fb6","line":494,"updated":"2014-06-16 15:16:16.000000000","message":"wording: has an impact on the deployment of Horizon","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":491,"context_line":"Other Deployer Impact"},{"line_number":492,"context_line":"---------------------"},{"line_number":493,"context_line":""},{"line_number":494,"context_line":"This change has an impact for the deploy of Horizon or other web tools accessing"},{"line_number":495,"context_line":"to OpenStack. These must be registered in Keystone. The *id*, *secret*, and"},{"line_number":496,"context_line":"endpoint should be configured in the service to perform the login."},{"line_number":497,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_a7a2c197","line":494,"in_reply_to":"1ae5cdf2_053f7fb6","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4d80f00366777b6f98ceec9b8e2afe8ef95bdcc5","unresolved":false,"context_lines":[{"line_number":512,"context_line":"Assignee(s)"},{"line_number":513,"context_line":"-----------"},{"line_number":514,"context_line":""},{"line_number":515,"context_line":"marco-fargetta (launchpad-id)"},{"line_number":516,"context_line":""},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"Work Items"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_a2015c08","line":515,"updated":"2014-06-16 16:12:59.000000000","message":"Name and IRC nick?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":512,"context_line":"Assignee(s)"},{"line_number":513,"context_line":"-----------"},{"line_number":514,"context_line":""},{"line_number":515,"context_line":"marco-fargetta (launchpad-id)"},{"line_number":516,"context_line":""},{"line_number":517,"context_line":""},{"line_number":518,"context_line":"Work Items"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_4709fd93","line":515,"in_reply_to":"1ae5cdf2_a2015c08","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":518,"context_line":"Work Items"},{"line_number":519,"context_line":"----------"},{"line_number":520,"context_line":""},{"line_number":521,"context_line":"The following items has to be implemnted in Keystone:"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":"* Login page"},{"line_number":524,"context_line":"* Authorisation code generation"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_05669fee","line":521,"updated":"2014-06-16 15:16:16.000000000","message":"typo: implemented","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":518,"context_line":"Work Items"},{"line_number":519,"context_line":"----------"},{"line_number":520,"context_line":""},{"line_number":521,"context_line":"The following items has to be implemnted in Keystone:"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":"* Login page"},{"line_number":524,"context_line":"* Authorisation code generation"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_c7f42d89","line":521,"in_reply_to":"1ae5cdf2_05669fee","updated":"2014-06-19 09:28:17.000000000","message":"Done","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":8996,"name":"Florent Flament","email":"contact@florentflament.com","username":"florent"},"change_message_id":"0f736cd4f63f8c116ccb716a2230b1b1fb790237","unresolved":false,"context_lines":[{"line_number":521,"context_line":"The following items has to be implemnted in Keystone:"},{"line_number":522,"context_line":""},{"line_number":523,"context_line":"* Login page"},{"line_number":524,"context_line":"* Authorisation code generation"},{"line_number":525,"context_line":"* Translate authorisation code to token (change the ``/v3/auth/tokens``)"},{"line_number":526,"context_line":"* Implement the API ``/v3/webaccess``"},{"line_number":527,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_655da315","line":524,"updated":"2014-06-16 15:16:16.000000000","message":"Authorization","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"4d80f00366777b6f98ceec9b8e2afe8ef95bdcc5","unresolved":false,"context_lines":[{"line_number":534,"context_line":"Testing"},{"line_number":535,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":536,"context_line":""},{"line_number":537,"context_line":"None"},{"line_number":538,"context_line":""},{"line_number":539,"context_line":""},{"line_number":540,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_c5fd920a","line":537,"updated":"2014-06-16 16:12:59.000000000","message":"Are tempest test cases going to be added for this?","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c529e630e814f3db5c35537ff3d59bfe1e6b5120","unresolved":false,"context_lines":[{"line_number":534,"context_line":"Testing"},{"line_number":535,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":536,"context_line":""},{"line_number":537,"context_line":"None"},{"line_number":538,"context_line":""},{"line_number":539,"context_line":""},{"line_number":540,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1ae5cdf2_47657d43","line":537,"in_reply_to":"1ae5cdf2_c5fd920a","updated":"2014-06-19 09:28:17.000000000","message":"If this is limited to the case when Keystone uses external SAML IdPs I do not think we can write a test but if it become the official way to authenticate Horizon then it is possible to write a test.","commit_id":"56fa94ac7fdd2e610eccb7133ba87d9ab55f603f"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"af0d7862a5a37d891323908f0906d04c79e7c2d6","unresolved":false,"context_lines":[{"line_number":26,"context_line":"on behalf of the user. Using the delegation, the web application has first to"},{"line_number":27,"context_line":"authenticate the user with an identity provider. Beside the authentication, the"},{"line_number":28,"context_line":"provider will return special credentials the web application can forward to"},{"line_number":29,"context_line":"Keystone in order to authenticate the user. Generally, Keystone has to"},{"line_number":30,"context_line":"communicate with the Identity Provider using the credentials coming from the"},{"line_number":31,"context_line":"Web Application in order to get user information. Obviously, in order the"},{"line_number":32,"context_line":"delegation to work both the web application and Keystone should communicate"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_a2da4649","line":29,"updated":"2014-06-23 17:12:46.000000000","message":"I am unclear with what you mean by \"Beside the authentication, the provider will return special credentials the web application can forward to Keystone in order to authenticate the user.\"\n\nIs keystone doing a second authentication? isn\u0027t the point of SSO to authenticate from one source?","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c98c85bcb9132d4d2971408700da0752f7cc9dc3","unresolved":false,"context_lines":[{"line_number":26,"context_line":"on behalf of the user. Using the delegation, the web application has first to"},{"line_number":27,"context_line":"authenticate the user with an identity provider. Beside the authentication, the"},{"line_number":28,"context_line":"provider will return special credentials the web application can forward to"},{"line_number":29,"context_line":"Keystone in order to authenticate the user. Generally, Keystone has to"},{"line_number":30,"context_line":"communicate with the Identity Provider using the credentials coming from the"},{"line_number":31,"context_line":"Web Application in order to get user information. Obviously, in order the"},{"line_number":32,"context_line":"delegation to work both the web application and Keystone should communicate"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_f0cdd3bb","line":29,"in_reply_to":"1ae5cdf2_a2da4649","updated":"2014-06-24 13:09:33.000000000","message":"With SSO you are authenticated by a source and all the services you try to access will contact the source to verify the authentication. This require you have something (e.g. session/cookie/token) the source can use to remember you are authenticated.\nWith the delegation the source will send to the first service some additional credential the service can use to access other services on the user behalf.\n\nIn either case, SSO or delegation, the service needs to communicate with the identity source to authenticate the user.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"41d4a53e7525ba298de54466ab00635bc4519826","unresolved":false,"context_lines":[{"line_number":28,"context_line":"provider will return special credentials the web application can forward to"},{"line_number":29,"context_line":"Keystone in order to authenticate the user. Generally, Keystone has to"},{"line_number":30,"context_line":"communicate with the Identity Provider using the credentials coming from the"},{"line_number":31,"context_line":"Web Application in order to get user information. Obviously, in order the"},{"line_number":32,"context_line":"delegation to work both the web application and Keystone should communicate"},{"line_number":33,"context_line":"with the same identity providers."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_5596c3f0","line":31,"updated":"2014-06-21 04:15:10.000000000","message":"put a \"for\" between order and the","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bf17a000bbebca10a1536319be25fc89abbf0a26","unresolved":false,"context_lines":[{"line_number":28,"context_line":"provider will return special credentials the web application can forward to"},{"line_number":29,"context_line":"Keystone in order to authenticate the user. Generally, Keystone has to"},{"line_number":30,"context_line":"communicate with the Identity Provider using the credentials coming from the"},{"line_number":31,"context_line":"Web Application in order to get user information. Obviously, in order the"},{"line_number":32,"context_line":"delegation to work both the web application and Keystone should communicate"},{"line_number":33,"context_line":"with the same identity providers."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_c59ca06d","line":31,"in_reply_to":"1ae5cdf2_5596c3f0","updated":"2014-06-24 09:14:10.000000000","message":"done.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"af0d7862a5a37d891323908f0906d04c79e7c2d6","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"The design in this blueprint has a positive impact when username and password"},{"line_number":44,"context_line":"authentication is used because it limits the visibility of the credentials only"},{"line_number":45,"context_line":"to Keystone. With the current implementation, users have to provide their"},{"line_number":46,"context_line":"credentials to Horizon (or another web application) and these are forwarded to"},{"line_number":47,"context_line":"Keystone for the authentication. Therefore, if an organisation creates a portal"},{"line_number":48,"context_line":"performing actions in a remote cloud managed by a different organisation, users"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_02c4da3f","line":45,"updated":"2014-06-23 17:12:46.000000000","message":"With SSO and federated auth, would keystone even want to know username/password? I would think not, ideally the username/password would go through the SAML provider and never touch keystone. (likewhen you click \u0027signin\u0027 in gerrit, it redirects you to the LP login not accepts username/passworddirectly)","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c98c85bcb9132d4d2971408700da0752f7cc9dc3","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"The design in this blueprint has a positive impact when username and password"},{"line_number":44,"context_line":"authentication is used because it limits the visibility of the credentials only"},{"line_number":45,"context_line":"to Keystone. With the current implementation, users have to provide their"},{"line_number":46,"context_line":"credentials to Horizon (or another web application) and these are forwarded to"},{"line_number":47,"context_line":"Keystone for the authentication. Therefore, if an organisation creates a portal"},{"line_number":48,"context_line":"performing actions in a remote cloud managed by a different organisation, users"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_706f0394","line":45,"in_reply_to":"1ae5cdf2_02c4da3f","updated":"2014-06-24 13:09:33.000000000","message":"What I would something like gerrit with horizon. If you use SAML is OK but if you are not using SAML I think Horizon should send the user to Keystone for the authentication with username/password.\n\nIn this way Horizon will maintain the same behaviour with federated identities and local identities.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"a312e6d47210d89721b414a4d2c67f5650413543","unresolved":false,"context_lines":[{"line_number":62,"context_line":"API to get a token. This workflow should change so Horizon does not ask for the"},{"line_number":63,"context_line":"credentials but redirects the user agent to Keystone for the authentication."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"The communication between Horizon and Keystone can implement the OAuth 2.0"},{"line_number":66,"context_line":"protocol (see `OAUTH2.0 Specs \u003chttp://tools.ietf.org/html/rfc6749\u003e`_). The"},{"line_number":67,"context_line":"workflow to implement makes use of the *Authorization Code* as *Authorization"},{"line_number":68,"context_line":"Grant*. This is a special token returned to the the web server and it can be"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_95d3d4d4","line":65,"updated":"2014-06-23 09:04:46.000000000","message":"If you are planning to heavily rely on oAuth implementation in Keystone, i\u0027d suggest removing word like \u0027can\u0027.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"6ec69be641b53bad28b6858a7976f1c4471fec95","unresolved":false,"context_lines":[{"line_number":112,"context_line":"                     Figure 3: Authorization Code Flow"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":""},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"   The flow illustrated in Figure 3 includes the following steps:"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"   (A)  The client initiates the flow by directing the resource owner\u0027s"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_0a29639b","line":115,"updated":"2014-06-23 09:03:21.000000000","message":"OK, I need some clarification, some explanation and introduction of actors could be useful.\n\nSo:\n\nClient - Remote webpage, the client is currently authenticating against? \nUser-Agent - Browser installed on my local computer?\nResource Owner - Human being who want to use  cloud services? \nAuthorization Server - Either Keystone with some add-ons or oAuth server (verylikely tied to Keystone)?","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"af0d7862a5a37d891323908f0906d04c79e7c2d6","unresolved":false,"context_lines":[{"line_number":112,"context_line":"                     Figure 3: Authorization Code Flow"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":""},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"   The flow illustrated in Figure 3 includes the following steps:"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"   (A)  The client initiates the flow by directing the resource owner\u0027s"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_6234beac","line":115,"in_reply_to":"1ae5cdf2_0a29639b","updated":"2014-06-23 17:12:46.000000000","message":"++ Please provide some clarification. I can make guesses here, but being explicit will mkae it easier to review//accept this type of change.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c98c85bcb9132d4d2971408700da0752f7cc9dc3","unresolved":false,"context_lines":[{"line_number":112,"context_line":"                     Figure 3: Authorization Code Flow"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":""},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"   The flow illustrated in Figure 3 includes the following steps:"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"   (A)  The client initiates the flow by directing the resource owner\u0027s"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_10bddfd7","line":115,"in_reply_to":"1ae5cdf2_6234beac","updated":"2014-06-24 13:09:33.000000000","message":"In patch 6 I wrote the diagram with the correct actors (Horizon, Keystone, etc...) but I have comment that it was better to replace with the official OAuth specs because they were better and easy to understand.\n\nNow, it seems the opposite. Could you check the diagram in patch 6 and let me know if you prefer that or a different one?","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"af0d7862a5a37d891323908f0906d04c79e7c2d6","unresolved":false,"context_lines":[{"line_number":143,"context_line":"        authorization code, and ensures that the redirection URI"},{"line_number":144,"context_line":"        received matches the URI used to redirect the client in"},{"line_number":145,"context_line":"        step (C).  If valid, the authorization server responds back with"},{"line_number":146,"context_line":"        an access token and, optionally, a refresh token."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":""},{"line_number":149,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_a7da5849","line":146,"updated":"2014-06-23 17:12:46.000000000","message":"Please clarify on \u0027access token\u0027 and \u0027refresh token\u0027. It is unclear waht the refresh token would be.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c98c85bcb9132d4d2971408700da0752f7cc9dc3","unresolved":false,"context_lines":[{"line_number":143,"context_line":"        authorization code, and ensures that the redirection URI"},{"line_number":144,"context_line":"        received matches the URI used to redirect the client in"},{"line_number":145,"context_line":"        step (C).  If valid, the authorization server responds back with"},{"line_number":146,"context_line":"        an access token and, optionally, a refresh token."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":""},{"line_number":149,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_10923f4b","line":146,"in_reply_to":"1ae5cdf2_a7da5849","updated":"2014-06-24 13:09:33.000000000","message":"The access token can be the current Keystone token. According to OAuth this can have a time limit. To renew the token you have to authenticate again or it is possible to use a refresh token to request a new access token.\n\nThis have to be mapped with the token provided by keystone","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"41d4a53e7525ba298de54466ab00635bc4519826","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":""},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"To implement the protocol, Keystone has to implement a login page"},{"line_number":151,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirects the users"},{"line_number":152,"context_line":"for the login. In case of SAML federation, this page has to be protected with"},{"line_number":153,"context_line":"the federated login and never shown to the user, or shown to select the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_55bde366","line":150,"updated":"2014-06-21 04:15:10.000000000","message":"Can you clarify why keystone has to implement a login page as opposed to simply redirecting the user to the login page of the identity manager.  For example, IBM\u0027s Tivoli Federated Identity manager has a login page so why not redirect to that.  I\u0027m guessing you want keystone to have its own login page because each identity manager may have a different login page and you are using the keystone login page to normalize this process.  This is only a guess on my part so please better justify why Keystone needs to provide its own login page","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c97a52c56dfc7aadabdc2b8c609a896d6e7f7639","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":""},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"To implement the protocol, Keystone has to implement a login page"},{"line_number":151,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirects the users"},{"line_number":152,"context_line":"for the login. In case of SAML federation, this page has to be protected with"},{"line_number":153,"context_line":"the federated login and never shown to the user, or shown to select the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_22c1d62f","line":150,"in_reply_to":"1ae5cdf2_55bde366","updated":"2014-06-23 16:27:04.000000000","message":"@Brad: I think there are two sides of this.  Fist of all, Marco wants to cover also non-federation webauth use case and doesn\u0027t like the idea where user passes his credentials directly to the web portal (Horizon or custom website), that actually acts as a client in this particular case. (I think the concern is: the code of this web portal is not executed on my local machine, so I don\u0027t trust it, and I am afraid of giving my credentials there).  Marco wants this web portal to redirect browser to a endpoint, provided directly by Keystone, where user can pass credentials. And this is what Marco depicts as http(s)://\u003cdomain\u003e:\u003cport\u003e/login . If admins decided to use classic authentication, users in the backend and all that stuff, he wants Keystone to present shiny webpage asking for user/password.\nOn the other hand, if cloud deployers want to use federation, this endpoint would be simply protected by Shibboleth, and then, indeed the whole saml transaction would be initiated, browser would again get redirected, this time to an IdP provided webpage (TFIM authN webpage) for instance.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"af0d7862a5a37d891323908f0906d04c79e7c2d6","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":""},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"To implement the protocol, Keystone has to implement a login page"},{"line_number":151,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirects the users"},{"line_number":152,"context_line":"for the login. In case of SAML federation, this page has to be protected with"},{"line_number":153,"context_line":"the federated login and never shown to the user, or shown to select the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_c70be422","line":150,"in_reply_to":"1ae5cdf2_55bde366","updated":"2014-06-23 17:12:46.000000000","message":"Based on Marek\u0027s comment, I think this needs to be split up into two distinct work-sets. There are clearly two use-cases here. \n\n1. Non Federated (Keystone handles username/password) and horizon/etc redirects to that for security\n2. Federated, works like you would expect and Keystone doesn\u0027t broker the change.\n\nThese are two separate concerns and shuold be broken apart. They can be in the same spec (they are related and likely build on each other), but need to be clearly outlining the subsets of work.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bf17a000bbebca10a1536319be25fc89abbf0a26","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":""},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"To implement the protocol, Keystone has to implement a login page"},{"line_number":151,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirects the users"},{"line_number":152,"context_line":"for the login. In case of SAML federation, this page has to be protected with"},{"line_number":153,"context_line":"the federated login and never shown to the user, or shown to select the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_450a507a","line":150,"in_reply_to":"1ae5cdf2_bf5df37e","updated":"2014-06-24 09:14:10.000000000","message":"Outlining two separated authN methods can indeed be nice. To me they can also  stay in the one spec, as long as we rely on the same architecture and workdlow.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"d73d74b3806b192ada1430226dce921481f4973f","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":""},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"To implement the protocol, Keystone has to implement a login page"},{"line_number":151,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirects the users"},{"line_number":152,"context_line":"for the login. In case of SAML federation, this page has to be protected with"},{"line_number":153,"context_line":"the federated login and never shown to the user, or shown to select the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_bf5df37e","line":150,"in_reply_to":"1ae5cdf2_c70be422","updated":"2014-06-23 20:37:39.000000000","message":"I agree with Morgan.  The two separate concerns need to be broken apart so the two different use cases and motivations for needs are clear","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c98c85bcb9132d4d2971408700da0752f7cc9dc3","unresolved":false,"context_lines":[{"line_number":147,"context_line":""},{"line_number":148,"context_line":""},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"To implement the protocol, Keystone has to implement a login page"},{"line_number":151,"context_line":"\"http(s)://\u003cdomain\u003e:\u003cport\u003e/login\" where the web application redirects the users"},{"line_number":152,"context_line":"for the login. In case of SAML federation, this page has to be protected with"},{"line_number":153,"context_line":"the federated login and never shown to the user, or shown to select the"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_508687dc","line":150,"in_reply_to":"1ae5cdf2_c70be422","updated":"2014-06-24 13:09:33.000000000","message":"I am not sure the two use-case are clearly separated. IMHO you have a login page\nand this can authenticate with username/password or other technologies (SAML, certificates, etc...). Why do you need to strictly separate the two scenarios?","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"db5bab30a77f6640aa337061329595e8d162b773","unresolved":false,"context_lines":[{"line_number":207,"context_line":"                \"authorisation-code\""},{"line_number":208,"context_line":"            ],"},{"line_number":209,"context_line":"            \"authorisation-code\": {"},{"line_number":210,"context_line":"                \"code\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\""},{"line_number":211,"context_line":"            }"},{"line_number":212,"context_line":"        }"},{"line_number":213,"context_line":"      }"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_1bf47785","line":210,"updated":"2014-06-20 17:15:39.000000000","message":"This seems insecure.  How is the auth code verified?  Back channel?","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c98c85bcb9132d4d2971408700da0752f7cc9dc3","unresolved":false,"context_lines":[{"line_number":207,"context_line":"                \"authorisation-code\""},{"line_number":208,"context_line":"            ],"},{"line_number":209,"context_line":"            \"authorisation-code\": {"},{"line_number":210,"context_line":"                \"code\": \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\""},{"line_number":211,"context_line":"            }"},{"line_number":212,"context_line":"        }"},{"line_number":213,"context_line":"      }"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_f09233fb","line":210,"in_reply_to":"1ae5cdf2_1bf47785","updated":"2014-06-24 13:09:33.000000000","message":"This go to back channel so it is possible to limit the access to this by verifying the requester but need additional thinking for sure","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"af0d7862a5a37d891323908f0906d04c79e7c2d6","unresolved":false,"context_lines":[{"line_number":211,"context_line":"            }"},{"line_number":212,"context_line":"        }"},{"line_number":213,"context_line":"      }"},{"line_number":214,"context_line":"  }"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Error code and output of the request remain the same."},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_d9790484","line":214,"updated":"2014-06-23 17:12:46.000000000","message":"I don\u0027t understand how this works. Why do we need a authorization code that then can be exchanged for a token? Why not just respond with a token once the auth is complete?\n\nAs ayoung asked, how is the code verified?","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c98c85bcb9132d4d2971408700da0752f7cc9dc3","unresolved":false,"context_lines":[{"line_number":211,"context_line":"            }"},{"line_number":212,"context_line":"        }"},{"line_number":213,"context_line":"      }"},{"line_number":214,"context_line":"  }"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Error code and output of the request remain the same."},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_09d69a27","line":214,"in_reply_to":"1ae5cdf2_d9790484","updated":"2014-06-24 13:09:33.000000000","message":"The token would go to the user if the authorisation-code is not used. In this scenario only the service can have a token and not the user directly. It is more secure and it is possible to implement a control before to release the token.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"db5bab30a77f6640aa337061329595e8d162b773","unresolved":false,"context_lines":[{"line_number":220,"context_line":"an administrative token in the header. The resources to add to the API is **webaccess**"},{"line_number":221,"context_line":"and the method are:"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"#### Add a web application to the list: `POST /v3/webaccess`"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"Normal Response Codes 201"},{"line_number":226,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_7bde5b12","line":223,"updated":"2014-06-20 17:15:39.000000000","message":"This section needs to address Accepts Headers and content types.  I made a hack at doing HTML rendering a year ago for just this type of use case:\n\nhttps://review.openstack.org/#/c/24443/\n\nProbably means that this URL should have a different middleware stack than the rest of Keystone, one that can do simple Web rendering\n\nAlso, allow for an end user modifiable CSS file for formatting the page.  Keystone will provide a simplistic one that can be replaced by the end user.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"6ec69be641b53bad28b6858a7976f1c4471fec95","unresolved":false,"context_lines":[{"line_number":220,"context_line":"an administrative token in the header. The resources to add to the API is **webaccess**"},{"line_number":221,"context_line":"and the method are:"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"#### Add a web application to the list: `POST /v3/webaccess`"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"Normal Response Codes 201"},{"line_number":226,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_afc0817e","line":223,"in_reply_to":"1ae5cdf2_7bde5b12","updated":"2014-06-23 09:03:21.000000000","message":"@Adam: I think those APIs are to manage a whitelist of webapplications allowed to use this way of authentication.\nWhat you are asking about (probably) is http(s)://\u003cdomain\u003e:\u003cport\u003e/login (see line ~151 above), which was not yet depicted here.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c98c85bcb9132d4d2971408700da0752f7cc9dc3","unresolved":false,"context_lines":[{"line_number":220,"context_line":"an administrative token in the header. The resources to add to the API is **webaccess**"},{"line_number":221,"context_line":"and the method are:"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"#### Add a web application to the list: `POST /v3/webaccess`"},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"Normal Response Codes 201"},{"line_number":226,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_09a4dab7","line":223,"in_reply_to":"1ae5cdf2_afc0817e","updated":"2014-06-24 13:09:33.000000000","message":"+1","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"db5bab30a77f6640aa337061329595e8d162b773","unresolved":false,"context_lines":[{"line_number":319,"context_line":"Error Response Codes identityFault (400, 500, …), badRequest (400),"},{"line_number":320,"context_line":"unauthorized (401), forbidden (403), badMethod (405)"},{"line_number":321,"context_line":""},{"line_number":322,"context_line":"Request parameters"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":325,"context_line":"| Parameter       | Style   | Type          | Description                    |"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_5bea7fa0","line":322,"updated":"2014-06-20 17:15:39.000000000","message":"Could basic-auth be acceptable here, too?","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"c98c85bcb9132d4d2971408700da0752f7cc9dc3","unresolved":false,"context_lines":[{"line_number":319,"context_line":"Error Response Codes identityFault (400, 500, …), badRequest (400),"},{"line_number":320,"context_line":"unauthorized (401), forbidden (403), badMethod (405)"},{"line_number":321,"context_line":""},{"line_number":322,"context_line":"Request parameters"},{"line_number":323,"context_line":""},{"line_number":324,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":325,"context_line":"| Parameter       | Style   | Type          | Description                    |"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_6979de2f","line":322,"in_reply_to":"1ae5cdf2_5bea7fa0","updated":"2014-06-24 13:09:33.000000000","message":"These API should be accessed with an admin token. They are to manage the applications enabled to request tokens.","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"db5bab30a77f6640aa337061329595e8d162b773","unresolved":false,"context_lines":[{"line_number":541,"context_line":""},{"line_number":542,"context_line":"Marco Fargetta"},{"line_number":543,"context_line":"launchpad-id: marco-fargetta (launchpad-id)"},{"line_number":544,"context_line":"IRC nick: fmarco76 "},{"line_number":545,"context_line":""},{"line_number":546,"context_line":"Work Items"},{"line_number":547,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_3b73f34e","line":544,"updated":"2014-06-20 17:15:39.000000000","message":"nit:  whitespace","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bf17a000bbebca10a1536319be25fc89abbf0a26","unresolved":false,"context_lines":[{"line_number":541,"context_line":""},{"line_number":542,"context_line":"Marco Fargetta"},{"line_number":543,"context_line":"launchpad-id: marco-fargetta (launchpad-id)"},{"line_number":544,"context_line":"IRC nick: fmarco76 "},{"line_number":545,"context_line":""},{"line_number":546,"context_line":"Work Items"},{"line_number":547,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_25e0e4cb","line":544,"in_reply_to":"1ae5cdf2_3b73f34e","updated":"2014-06-24 09:14:10.000000000","message":"Done","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"db5bab30a77f6640aa337061329595e8d162b773","unresolved":false,"context_lines":[{"line_number":546,"context_line":"Work Items"},{"line_number":547,"context_line":"----------"},{"line_number":548,"context_line":""},{"line_number":549,"context_line":"The following items has to be implemented in Keystone:"},{"line_number":550,"context_line":""},{"line_number":551,"context_line":"* Login page"},{"line_number":552,"context_line":"* Authorisation code generation"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_5b6eff64","line":549,"updated":"2014-06-20 17:15:39.000000000","message":"has-\u003ehave","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bf17a000bbebca10a1536319be25fc89abbf0a26","unresolved":false,"context_lines":[{"line_number":546,"context_line":"Work Items"},{"line_number":547,"context_line":"----------"},{"line_number":548,"context_line":""},{"line_number":549,"context_line":"The following items has to be implemented in Keystone:"},{"line_number":550,"context_line":""},{"line_number":551,"context_line":"* Login page"},{"line_number":552,"context_line":"* Authorisation code generation"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1ae5cdf2_45e5f0da","line":549,"in_reply_to":"1ae5cdf2_5b6eff64","updated":"2014-06-24 09:14:10.000000000","message":"Done","commit_id":"4ece087560ae10a6978bf02fcb3fd0ce57306c16"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36e3f9866ff5650a2e3506047f3294668e90ee7c","unresolved":false,"context_lines":[{"line_number":38,"context_line":"\u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/ECP\u003e`_ ). Therefore, this"},{"line_number":39,"context_line":"requires the implementation of a similar authentication mechanisms in both"},{"line_number":40,"context_line":"Keystone and the web applications which could be overkill for many web"},{"line_number":41,"context_line":"applications."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"The design in this blueprint has a positive impact when username and password"},{"line_number":44,"context_line":"authentication is used because it limits the visibility of the credentials only"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_2a013a39","line":41,"updated":"2014-06-26 05:02:33.000000000","message":"Why are these overkill? Please elaborate here why you are asserting this \u0027could be overkill\u0027. Should this be listed in \u0027alternatives\u0027?","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"0d9b1f69c7b8852f65a38e78c3d562823103a3d5","unresolved":false,"context_lines":[{"line_number":38,"context_line":"\u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/ECP\u003e`_ ). Therefore, this"},{"line_number":39,"context_line":"requires the implementation of a similar authentication mechanisms in both"},{"line_number":40,"context_line":"Keystone and the web applications which could be overkill for many web"},{"line_number":41,"context_line":"applications."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"The design in this blueprint has a positive impact when username and password"},{"line_number":44,"context_line":"authentication is used because it limits the visibility of the credentials only"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_667b7629","line":41,"in_reply_to":"1ae5cdf2_2a013a39","updated":"2014-06-26 10:07:59.000000000","message":"ECP is an extension to a SAML protocol which was designed for browsers. Marco\u0027s point was that it\u0027s inefficient and insecure to implement a website (which should be accessed with webbrowsers), and add some ECP client implementation in there. The proper way to use federation in this use-case is shibboleth configuration and later maybe some use of the assertion issued by a IdP. But not handling SAML requests/responses, timeouts, some security checks and things like that.\n\nPlus, we would witness an *impersonation* problem again - user (human being) must pass it\u0027s user/pass to a website, so it can try to authenticate on behalf of the user.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36e3f9866ff5650a2e3506047f3294668e90ee7c","unresolved":false,"context_lines":[{"line_number":107,"context_line":"     +---------+       (w/ Optional Refresh Token)"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"   Note: The lines illustrating steps (A), (B), and (C) are broken into two"},{"line_number":110,"context_line":"   parts as they pass through the user-agent."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"                     Figure 3: Authorization Code Flow"},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_8a796ec7","line":110,"updated":"2014-06-26 05:02:33.000000000","message":"It is not clear who the actors are in your diagram or description below. Please be specific about what ends up in keystone.\n\nYour specification seems to muddle authorization and authentication a little. It looks as if the server that provides authentication is also responsible for authorization. This would be contrary to any scenario except if Keystone was also the IDP.\n\nIn the case Keystone is not the IDP, is the external service responsible for authorization in your mind? Please clarify in the spec the intention.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36e3f9866ff5650a2e3506047f3294668e90ee7c","unresolved":false,"context_lines":[{"line_number":143,"context_line":"        authorization code, and ensures that the redirection URI"},{"line_number":144,"context_line":"        received matches the URI used to redirect the client in"},{"line_number":145,"context_line":"        step (C).  If valid, the authorization server responds back with"},{"line_number":146,"context_line":"        an access token and, optionally, a refresh token."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":""},{"line_number":149,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_aac62a14","line":146,"updated":"2014-06-26 05:02:33.000000000","message":"I apologize that I wasn\u0027t clear in my last comment, please elaborate in the spec about the refresh token and what it is used for. It is not clear based upon the information here what the refresh token is meant to do or how it is meant to be used. This is important if it is to be part of the spec.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"4034fd99403a82b32b75d8578915c88f936f47a3","unresolved":false,"context_lines":[{"line_number":152,"context_line":"for the login. In case of SAML federation, this page has to be protected with"},{"line_number":153,"context_line":"the federated login and never shown to the user, or shown to select the"},{"line_number":154,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"},{"line_number":155,"context_line":"for the Apache http server can implement the Discovery Protocol which allows"},{"line_number":156,"context_line":"the user to select the Identity Provider for the authentication. However, the"},{"line_number":157,"context_line":"use of an external Discovery Service is not mandatory and the login page could"},{"line_number":158,"context_line":"implement the Discovery for the user. This is useful in case the list of IdPs"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_92e0b898","line":155,"updated":"2014-06-26 13:41:01.000000000","message":"Any impact on the apache conf as documented here ? http://docs.openstack.org/developer/keystone/configure_federation.html#configure-apache-httpd-for-mod-shibboleth","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"10aba1aece2b4c13b2f2fd7d45bd5c1611ebe999","unresolved":false,"context_lines":[{"line_number":152,"context_line":"for the login. In case of SAML federation, this page has to be protected with"},{"line_number":153,"context_line":"the federated login and never shown to the user, or shown to select the"},{"line_number":154,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"},{"line_number":155,"context_line":"for the Apache http server can implement the Discovery Protocol which allows"},{"line_number":156,"context_line":"the user to select the Identity Provider for the authentication. However, the"},{"line_number":157,"context_line":"use of an external Discovery Service is not mandatory and the login page could"},{"line_number":158,"context_line":"implement the Discovery for the user. This is useful in case the list of IdPs"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_fa62ae14","line":155,"in_reply_to":"1ae5cdf2_92e0b898","updated":"2014-06-26 14:47:51.000000000","message":"Not at all. The discovery service need to be configure in shibboleth2.xml which is in /etc/shibboleth if you have a packaged version.This is requested if you want use more than one IdP","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"88ea044ec60592897c8f64d2e4dac1811d007258","unresolved":false,"context_lines":[{"line_number":152,"context_line":"for the login. In case of SAML federation, this page has to be protected with"},{"line_number":153,"context_line":"the federated login and never shown to the user, or shown to select the"},{"line_number":154,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"},{"line_number":155,"context_line":"for the Apache http server can implement the Discovery Protocol which allows"},{"line_number":156,"context_line":"the user to select the Identity Provider for the authentication. However, the"},{"line_number":157,"context_line":"use of an external Discovery Service is not mandatory and the login page could"},{"line_number":158,"context_line":"implement the Discovery for the user. This is useful in case the list of IdPs"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_8f99696f","line":155,"in_reply_to":"1ae5cdf2_b0d687f0","updated":"2014-06-26 15:55:44.000000000","message":"Actually, I do not know how this API was supposed to work with multiple IDPs but since SAML is managed by the module in apache I am using the future this provide.\n\nI think the decision to use the apache module came after the design of this API and they are misleading in some ways.\n\nIn any case I was thinking to authenticate the login page with shibboleth for all IdPs.\nAfter all, it is queste complicate to say to shibboleth which IdP to use in which location.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"fa1f28b4ca59cffd23ee2b603e357a54658f4a83","unresolved":false,"context_lines":[{"line_number":152,"context_line":"for the login. In case of SAML federation, this page has to be protected with"},{"line_number":153,"context_line":"the federated login and never shown to the user, or shown to select the"},{"line_number":154,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"},{"line_number":155,"context_line":"for the Apache http server can implement the Discovery Protocol which allows"},{"line_number":156,"context_line":"the user to select the Identity Provider for the authentication. However, the"},{"line_number":157,"context_line":"use of an external Discovery Service is not mandatory and the login page could"},{"line_number":158,"context_line":"implement the Discovery for the user. This is useful in case the list of IdPs"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_ef4f4d33","line":155,"in_reply_to":"1ae5cdf2_b0d687f0","updated":"2014-06-26 16:01:44.000000000","message":"Good point, it\u0027s not in the spec. Every IdP sends it\u0027s unique identificator in the saml assertion, for instance Shib-Identity-Provider. This could be use to distinguish between IdPs.\nAnd the decidion to leverage federated auth into Apache modules was AFAIR before we completed API secs. Keystone doesn\u0027t handle federated workflow, but must be aware who and how it can assign some roles.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"4eb6b4efd5e228461c87119ebb39455453d44f4c","unresolved":false,"context_lines":[{"line_number":152,"context_line":"for the login. In case of SAML federation, this page has to be protected with"},{"line_number":153,"context_line":"the federated login and never shown to the user, or shown to select the"},{"line_number":154,"context_line":"authentication provider(s) (like a SAML Discovery Service).  The SAML module"},{"line_number":155,"context_line":"for the Apache http server can implement the Discovery Protocol which allows"},{"line_number":156,"context_line":"the user to select the Identity Provider for the authentication. However, the"},{"line_number":157,"context_line":"use of an external Discovery Service is not mandatory and the login page could"},{"line_number":158,"context_line":"implement the Discovery for the user. This is useful in case the list of IdPs"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_b0d687f0","line":155,"in_reply_to":"1ae5cdf2_fa62ae14","updated":"2014-06-26 15:41:15.000000000","message":"In a multi-IdP setup, how do you specify the auth URL in keystone (in the form of identity_provider/XXX/protocol/YYY/auth ) if the IdP discovery is managed by shibboleth ?","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"4034fd99403a82b32b75d8578915c88f936f47a3","unresolved":false,"context_lines":[{"line_number":158,"context_line":"implement the Discovery for the user. This is useful in case the list of IdPs"},{"line_number":159,"context_line":"in the federation has to be limited to a subset and only this subset has to be"},{"line_number":160,"context_line":"shown to the user. Currently, the list of IdPs enabled is managed by Keystone"},{"line_number":161,"context_line":"so it is easier to manage the list inside Keystone, otherwise the list should"},{"line_number":162,"context_line":"be managed by Apache http server and Keystone making the configuration more"},{"line_number":163,"context_line":"complicated."},{"line_number":164,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_f2081c93","line":161,"updated":"2014-06-26 13:41:01.000000000","message":"it should be thought in terms of protocols, since many mappings can potentially be associated to an IdP","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"10aba1aece2b4c13b2f2fd7d45bd5c1611ebe999","unresolved":false,"context_lines":[{"line_number":158,"context_line":"implement the Discovery for the user. This is useful in case the list of IdPs"},{"line_number":159,"context_line":"in the federation has to be limited to a subset and only this subset has to be"},{"line_number":160,"context_line":"shown to the user. Currently, the list of IdPs enabled is managed by Keystone"},{"line_number":161,"context_line":"so it is easier to manage the list inside Keystone, otherwise the list should"},{"line_number":162,"context_line":"be managed by Apache http server and Keystone making the configuration more"},{"line_number":163,"context_line":"complicated."},{"line_number":164,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_d52ce595","line":161,"in_reply_to":"1ae5cdf2_f2081c93","updated":"2014-06-26 14:47:51.000000000","message":"But you in case of saml, can you obtain the list of IdPs?","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36e3f9866ff5650a2e3506047f3294668e90ee7c","unresolved":false,"context_lines":[{"line_number":160,"context_line":"shown to the user. Currently, the list of IdPs enabled is managed by Keystone"},{"line_number":161,"context_line":"so it is easier to manage the list inside Keystone, otherwise the list should"},{"line_number":162,"context_line":"be managed by Apache http server and Keystone making the configuration more"},{"line_number":163,"context_line":"complicated."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"After the login, whatever the method used for authentication, users are"},{"line_number":166,"context_line":"sent back to the web application which can retrieve the token from Keystone."}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_8a8b2ebf","line":163,"updated":"2014-06-26 05:02:33.000000000","message":"So in the case of the external discovery service, is it that Keystone would redirect the user to that service and never see the username/password combination (it will derive the username from the SAML or equivalent assertion)? Or does keystone still broker the username/password for the IDP.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"0d9b1f69c7b8852f65a38e78c3d562823103a3d5","unresolved":false,"context_lines":[{"line_number":160,"context_line":"shown to the user. Currently, the list of IdPs enabled is managed by Keystone"},{"line_number":161,"context_line":"so it is easier to manage the list inside Keystone, otherwise the list should"},{"line_number":162,"context_line":"be managed by Apache http server and Keystone making the configuration more"},{"line_number":163,"context_line":"complicated."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"After the login, whatever the method used for authentication, users are"},{"line_number":166,"context_line":"sent back to the web application which can retrieve the token from Keystone."}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_a62ade8e","line":163,"in_reply_to":"1ae5cdf2_8a8b2ebf","updated":"2014-06-26 10:07:59.000000000","message":"Morgan,\nThe idea is: \n- If we use classic authN way: Keystone exposes a webpage with login/password box. The login and password goes directly to Keystone, not via external Horizon. The token, or some protected data is returned after Keystone makes sure the credentials are valid (for instance by checking it in its backend). Its fine to pass the credentials here as the local user authenticates himself.\n\n- If the federation is used, this URL is protected by shibboleth. Only after successful authN against external IdP shibboleth will create a session and let user enter the URL, exactly how it is happening today in Federated-Keystone.\nKeystone will never get any credentials.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"81b632bb9c20a01b482357a57080d27b75106831","unresolved":false,"context_lines":[{"line_number":160,"context_line":"shown to the user. Currently, the list of IdPs enabled is managed by Keystone"},{"line_number":161,"context_line":"so it is easier to manage the list inside Keystone, otherwise the list should"},{"line_number":162,"context_line":"be managed by Apache http server and Keystone making the configuration more"},{"line_number":163,"context_line":"complicated."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"After the login, whatever the method used for authentication, users are"},{"line_number":166,"context_line":"sent back to the web application which can retrieve the token from Keystone."}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_71c6ce4a","line":163,"in_reply_to":"1ae5cdf2_8a8b2ebf","updated":"2014-06-26 14:38:52.000000000","message":"The DS is a SAML service aims at providing a list of IDPs to the user. The user have to select an IDP and return to the SP which will send the user to the selected IdP.\n\nActually, shibboleth allows you to develop an external service for the DS and many federations provide one the SPs can use or you can implement the protocol in the SP itself. Both solutions, external and on-board, have goodness and weakness.\n\nIn any case, during the discovery phase there are not credentials involved.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"4034fd99403a82b32b75d8578915c88f936f47a3","unresolved":false,"context_lines":[{"line_number":174,"context_line":"the attribute currently used by Keystone. This could slightly simplify the"},{"line_number":175,"context_line":"implementation. However, for the web application there are many libraries to"},{"line_number":176,"context_line":"implement the authentication using OAuth2.0 so it could be better supported."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"Another alternative could be to move the user authentication in an external"},{"line_number":179,"context_line":"service (could be also Horizon) and then use this service as an authentication"},{"line_number":180,"context_line":"provider for Keystone and the web application. In this scenario Keystone and"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_b250542d","line":177,"updated":"2014-06-26 13:41:01.000000000","message":"Could the oauth contrib module in keystone be used for this ?","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"10aba1aece2b4c13b2f2fd7d45bd5c1611ebe999","unresolved":false,"context_lines":[{"line_number":174,"context_line":"the attribute currently used by Keystone. This could slightly simplify the"},{"line_number":175,"context_line":"implementation. However, for the web application there are many libraries to"},{"line_number":176,"context_line":"implement the authentication using OAuth2.0 so it could be better supported."},{"line_number":177,"context_line":""},{"line_number":178,"context_line":"Another alternative could be to move the user authentication in an external"},{"line_number":179,"context_line":"service (could be also Horizon) and then use this service as an authentication"},{"line_number":180,"context_line":"provider for Keystone and the web application. In this scenario Keystone and"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_15a00df3","line":177,"in_reply_to":"1ae5cdf2_b250542d","updated":"2014-06-26 14:47:51.000000000","message":"Maybe but I have to look more closely to it","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"4034fd99403a82b32b75d8578915c88f936f47a3","unresolved":false,"context_lines":[{"line_number":186,"context_line":"Data Model Impact"},{"line_number":187,"context_line":"-----------------"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"If the authorisation code is in cache and not stored made persistent in a DB"},{"line_number":190,"context_line":"then not impact in the data model is expected for the authentication."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"A table with the list of web application granted to use Keystone for the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_069b8dc9","line":189,"updated":"2014-06-26 13:41:01.000000000","message":"I assume the auth code has a limited lifetime, is it hard-coded ? Configurable ?","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"10aba1aece2b4c13b2f2fd7d45bd5c1611ebe999","unresolved":false,"context_lines":[{"line_number":186,"context_line":"Data Model Impact"},{"line_number":187,"context_line":"-----------------"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"If the authorisation code is in cache and not stored made persistent in a DB"},{"line_number":190,"context_line":"then not impact in the data model is expected for the authentication."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"A table with the list of web application granted to use Keystone for the"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_15872d62","line":189,"in_reply_to":"1ae5cdf2_069b8dc9","updated":"2014-06-26 14:47:51.000000000","message":"I was thinking hard-coded.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36e3f9866ff5650a2e3506047f3294668e90ee7c","unresolved":false,"context_lines":[{"line_number":187,"context_line":"-----------------"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":"If the authorisation code is in cache and not stored made persistent in a DB"},{"line_number":190,"context_line":"then not impact in the data model is expected for the authentication."},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"A table with the list of web application granted to use Keystone for the"},{"line_number":193,"context_line":"authentication has to be managed."}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_cd9f10b3","line":190,"updated":"2014-06-26 05:02:33.000000000","message":"Please rephrase this and be specific about the changes being made. You can omit what is not going to be changed.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36e3f9866ff5650a2e3506047f3294668e90ee7c","unresolved":false,"context_lines":[{"line_number":211,"context_line":"            }"},{"line_number":212,"context_line":"        }"},{"line_number":213,"context_line":"      }"},{"line_number":214,"context_line":"  }"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Error code and output of the request remain the same."},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_8a6fae27","line":214,"updated":"2014-06-26 05:02:33.000000000","message":"I don\u0027t think this mechanism as described in the response to my comment will work. This will require maintaining a mapping of the code to token, and maintaining the token in a persistent store.\n\nOne of my main goals in Juno (see the non-persistent token spec) is to eliminate storage of the token within keystone. This means that the token will need to stand alone to provide authorization to take actions.\n\nI am unsure (without storing the token) how it will be possible to allow this to work.\n\nI do not see how this really makes anything more secure. You\u0027re trading one form of token for another and adding in another layer of abstraction.\n\nWhat are you solving with this extra abstraction away from the token. What specifically does it solve that we aren\u0027t (and cannot solve) with the current tokens?","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"10aba1aece2b4c13b2f2fd7d45bd5c1611ebe999","unresolved":false,"context_lines":[{"line_number":211,"context_line":"            }"},{"line_number":212,"context_line":"        }"},{"line_number":213,"context_line":"      }"},{"line_number":214,"context_line":"  }"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Error code and output of the request remain the same."},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_35c6e99c","line":214,"in_reply_to":"1ae5cdf2_1cd59a42","updated":"2014-06-26 14:47:51.000000000","message":"+1 for POST request.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"0d9b1f69c7b8852f65a38e78c3d562823103a3d5","unresolved":false,"context_lines":[{"line_number":211,"context_line":"            }"},{"line_number":212,"context_line":"        }"},{"line_number":213,"context_line":"      }"},{"line_number":214,"context_line":"  }"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Error code and output of the request remain the same."},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_a6e01e98","line":214,"in_reply_to":"1ae5cdf2_8a6fae27","updated":"2014-06-26 10:07:59.000000000","message":"++. I left similar comment few patches ago.\n\nI am fine (unless somebody points a real security related problem with that) with returning unscoped tokens. I think Horizon would not complain about that token.\n\nOne thing that needs to be considered is the fact that tokens are returned in the HTTP header\u0027s request. Since we want to make use of the browsers, we must all keep in mind that browsers don\u0027t keep headers between the calls. So If Keystone returns something like HTTP 302 with a \u0027location\u0027 header set to our Horizon/web portal, and return token in the header, the browser will get redirected, but it will lose the token. We might need something that would be more intelligent, some JS code? Or just Keystone that issues a POST request to the aforementioned Horizon.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"4034fd99403a82b32b75d8578915c88f936f47a3","unresolved":false,"context_lines":[{"line_number":211,"context_line":"            }"},{"line_number":212,"context_line":"        }"},{"line_number":213,"context_line":"      }"},{"line_number":214,"context_line":"  }"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Error code and output of the request remain the same."},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_1cd59a42","line":214,"in_reply_to":"1ae5cdf2_8a6fae27","updated":"2014-06-26 13:41:01.000000000","message":"@Morgan: I think the point is to make sure that Horizon is allowed by the user to use this token. I agree the proposed mechanism goes against non stored tokens ... How about simply having a catalog of accepted redirection addresses maintained in Keystone ? If the Horizon URL doesn\u0027t belong in the catalog, then the query is dropped. This might be enough to provide some form of control.\n\n@Marek: I\u0027d rather see a POST request than JS.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"81b632bb9c20a01b482357a57080d27b75106831","unresolved":false,"context_lines":[{"line_number":211,"context_line":"            }"},{"line_number":212,"context_line":"        }"},{"line_number":213,"context_line":"      }"},{"line_number":214,"context_line":"  }"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Error code and output of the request remain the same."},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_b14136a8","line":214,"in_reply_to":"1ae5cdf2_a6e01e98","updated":"2014-06-26 14:38:52.000000000","message":"This call is not performed by the browser but the Horizon or the any other web application. The browser is used by the user to get the authorisation code and then it is possible to get the token. However, looking again to this call I think it need some additional parameter. I will include in a new patch very soon.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36e3f9866ff5650a2e3506047f3294668e90ee7c","unresolved":false,"context_lines":[{"line_number":224,"context_line":""},{"line_number":225,"context_line":"Normal Response Codes 201"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"Error Response Codes identityFault (400, 500, …), badRequest (400),"},{"line_number":228,"context_line":"unauthorized (401), forbidden (403), badMethod (405)"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"Request parameters"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_6a2a6292","line":227,"updated":"2014-06-26 05:02:33.000000000","message":"What is IdentityFault? Is that a 400? a 500? another error?\n\nIf this is a 500 error, please update to be Internal Server Error (keep with HTTP status code names).","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"81b632bb9c20a01b482357a57080d27b75106831","unresolved":false,"context_lines":[{"line_number":224,"context_line":""},{"line_number":225,"context_line":"Normal Response Codes 201"},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"Error Response Codes identityFault (400, 500, …), badRequest (400),"},{"line_number":228,"context_line":"unauthorized (401), forbidden (403), badMethod (405)"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"Request parameters"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_516c7236","line":227,"in_reply_to":"1ae5cdf2_6a2a6292","updated":"2014-06-26 14:38:52.000000000","message":"Actually, I use the same error code of other identity api (see http://developer.openstack.org/api-ref-identity-v3.html) but I will fix this","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"4034fd99403a82b32b75d8578915c88f936f47a3","unresolved":false,"context_lines":[{"line_number":251,"context_line":"| secret          | plain   | xsd:string    | Secret code to authenticate    |"},{"line_number":252,"context_line":"| (Optional)      |         |               | the application                |"},{"line_number":253,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"Return parameters"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"+-----------------+---------+---------------+--------------------------------+"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_9c91aa54","line":254,"updated":"2014-06-26 13:41:01.000000000","message":"I don\u0027t see when this secret is used in the workflow you discussed on lines #57-107, it\u0027s different from the authorization-code right ?","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"10aba1aece2b4c13b2f2fd7d45bd5c1611ebe999","unresolved":false,"context_lines":[{"line_number":251,"context_line":"| secret          | plain   | xsd:string    | Secret code to authenticate    |"},{"line_number":252,"context_line":"| (Optional)      |         |               | the application                |"},{"line_number":253,"context_line":"+-----------------+---------+---------------+--------------------------------+"},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"Return parameters"},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"+-----------------+---------+---------------+--------------------------------+"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_153c8d92","line":254,"in_reply_to":"1ae5cdf2_9c91aa54","updated":"2014-06-26 14:47:51.000000000","message":"It is used to get the token. See the new patch.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36e3f9866ff5650a2e3506047f3294668e90ee7c","unresolved":false,"context_lines":[{"line_number":317,"context_line":"Normal Response Codes 200"},{"line_number":318,"context_line":""},{"line_number":319,"context_line":"Error Response Codes identityFault (400, 500, …), badRequest (400),"},{"line_number":320,"context_line":"unauthorized (401), forbidden (403), badMethod (405)"},{"line_number":321,"context_line":""},{"line_number":322,"context_line":"Request parameters"},{"line_number":323,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_8a27aec6","line":320,"updated":"2014-06-26 05:02:33.000000000","message":"Same as above","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36e3f9866ff5650a2e3506047f3294668e90ee7c","unresolved":false,"context_lines":[{"line_number":485,"context_line":"The mechanism has no impact on the token generation and management except for"},{"line_number":486,"context_line":"the way it is provided to third applications. The OAuth2.0 protocol proposed is"},{"line_number":487,"context_line":"standard and adopted by many organisation (like DropBox, Facebook, Google,"},{"line_number":488,"context_line":"Microsoft, etc...) so it has proven to be robust and secure as well."},{"line_number":489,"context_line":""},{"line_number":490,"context_line":"A vulnerability was recently discovered in OAuth 2.0 but it is more related to"},{"line_number":491,"context_line":"a problem with the applications missing to verify the return URL. A correct"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_cd03900b","line":488,"updated":"2014-06-26 05:02:33.000000000","message":"Please remove the \"This mechanism has no impact ... except\", you have said there is an impact. It would be best to keep the information here specific to the changes and not outline what we are not changing. (Makes it harder to understand).","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36e3f9866ff5650a2e3506047f3294668e90ee7c","unresolved":false,"context_lines":[{"line_number":493,"context_line":"page: `Covert Redirect Vulnerability Related to OAuth 2.0 and OpenID"},{"line_number":494,"context_line":"\u003chttp://tetraph.com/covert_redirect/oauth2_openid_covert_redirect.html\u003e`_"},{"line_number":495,"context_line":""},{"line_number":496,"context_line":"Nevertheless, when a web application is disabled or deleted, tokens released to"},{"line_number":497,"context_line":"this application for its users should be revoked."},{"line_number":498,"context_line":""},{"line_number":499,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_ed04cc15","line":496,"updated":"2014-06-26 05:02:33.000000000","message":"Suggest remove \"Nevertheless\"","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"36e3f9866ff5650a2e3506047f3294668e90ee7c","unresolved":false,"context_lines":[{"line_number":562,"context_line":"Testing"},{"line_number":563,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":564,"context_line":""},{"line_number":565,"context_line":"None"},{"line_number":566,"context_line":""},{"line_number":567,"context_line":""},{"line_number":568,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_0d21f89d","line":565,"updated":"2014-06-26 05:02:33.000000000","message":"Please outline what your plan for adding testing will be. Testing will need to be implemented to ensure this all works.","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"fa1f28b4ca59cffd23ee2b603e357a54658f4a83","unresolved":false,"context_lines":[{"line_number":562,"context_line":"Testing"},{"line_number":563,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":564,"context_line":""},{"line_number":565,"context_line":"None"},{"line_number":566,"context_line":""},{"line_number":567,"context_line":""},{"line_number":568,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_5fcb94a3","line":565,"in_reply_to":"1ae5cdf2_0d21f89d","updated":"2014-06-26 16:01:44.000000000","message":"added some proposals","commit_id":"5d793afd98b02c7e0c850980aed0a003d7a963a9"}]}