)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7b4fc2c32811124f980366042bd123e90e480d47","unresolved":false,"context_lines":[{"line_number":10,"context_line":"domain specific backends by enabling Keystone to generate"},{"line_number":11,"context_line":"truly installion-wide IDs, even if the underlying entities are"},{"line_number":12,"context_line":"held in a variety of external backends."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I1fdb83cca748e4107411f60f7567499c0a7915b5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"1ae5cdf2_7f8b0768","line":13,"updated":"2014-06-03 14:13:51.000000000","message":"Existing Launchpad blueprint?\n\nhttps://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c0deb5c33a752a0e10305cb716fa57f7d2732cfb","unresolved":false,"context_lines":[{"line_number":10,"context_line":"domain specific backends by enabling Keystone to generate"},{"line_number":11,"context_line":"truly installion-wide IDs, even if the underlying entities are"},{"line_number":12,"context_line":"held in a variety of external backends."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I1fdb83cca748e4107411f60f7567499c0a7915b5"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"1ae5cdf2_4d7b0028","line":13,"in_reply_to":"1ae5cdf2_7f8b0768","updated":"2014-06-03 17:23:48.000000000","message":"Done","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"1d0b6220e7f44aa18e3e4f389e710871ffb63322","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-06-05 11:15:27 +0100"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Cross Backend Unique Idenifiers for User and Group Entities"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This change fixes the currently experimental support for"},{"line_number":10,"context_line":"domain specific backends by enabling Keystone to generate"},{"line_number":11,"context_line":"truly installion-wide IDs, even if the underlying entities are"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"1ae5cdf2_362eaaa5","line":8,"updated":"2014-06-05 19:41:27.000000000","message":"Please fix the typo in the first line.  I\u0027ve fixed it for you before and you reverted. Idenifiers -\u003e Identifiers","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2014-06-05 11:15:27 +0100"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Cross Backend Unique Idenifiers for User and Group Entities"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This change fixes the currently experimental support for"},{"line_number":10,"context_line":"domain specific backends by enabling Keystone to generate"},{"line_number":11,"context_line":"truly installion-wide IDs, even if the underlying entities are"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"1ae5cdf2_827009a5","line":8,"in_reply_to":"1ae5cdf2_362eaaa5","updated":"2014-06-06 10:42:38.000000000","message":"Damn.  Guilty as charged, sir!","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"f54a0283a46af8d12d63070ab6e027ac8ee483f8","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This change fixes the currently experimental support for"},{"line_number":10,"context_line":"domain specific backends by enabling Keystone to generate"},{"line_number":11,"context_line":"truly installion-wide IDs, even if the underlying entities are"},{"line_number":12,"context_line":"held in a variety of external backends."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Blueprint: multi-backend-uuids"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"1ae5cdf2_3602fcb4","line":11,"updated":"2014-06-07 05:06:42.000000000","message":"typo: installion should be installation","commit_id":"fb062648883fbe0bca25eec23c13f2bdda4c0e4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a37a4a9b7f307123da085e0e755a950fc1b6343c","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This change fixes the currently experimental support for"},{"line_number":10,"context_line":"domain specific backends by enabling Keystone to generate"},{"line_number":11,"context_line":"truly installion-wide IDs, even if the underlying entities are"},{"line_number":12,"context_line":"held in a variety of external backends."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Blueprint: multi-backend-uuids"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":13,"id":"1ae5cdf2_dccc978d","line":11,"in_reply_to":"1ae5cdf2_3602fcb4","updated":"2014-06-07 10:13:26.000000000","message":"Done","commit_id":"fb062648883fbe0bca25eec23c13f2bdda4c0e4f"}],"specs/juno/multi-backend-uuids.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f71cc47dcda3aa3f45b81b6eee11779c1e04a29b","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"1ae5cdf2_34fb61c2","updated":"2014-06-03 17:25:38.000000000","message":"I\u0027d use a single space after .\u0027s, not double","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7b4fc2c32811124f980366042bd123e90e480d47","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Cross-backend IDs for User and Group Entities"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_1fdf636a","line":9,"updated":"2014-06-03 14:13:51.000000000","message":"\u003d\u003d should be the same length as title text. \n\n    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n    Cross-backend IDs for User and Group Entities\n    \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c0deb5c33a752a0e10305cb716fa57f7d2732cfb","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":8,"context_line":"Cross-backend IDs for User and Group Entities"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_cd3e308c","line":9,"in_reply_to":"1ae5cdf2_1fdf636a","updated":"2014-06-03 17:23:48.000000000","message":"Done","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f71cc47dcda3aa3f45b81b6eee11779c1e04a29b","unresolved":false,"context_lines":[{"line_number":24,"context_line":"federation, this is no longer the case.  However, the Keystone API still"},{"line_number":25,"context_line":"assumes it can uniquely identify a user and group from just the ID provided."},{"line_number":26,"context_line":"Further, Openstack installations that support multiple customers, where each"},{"line_number":27,"context_line":"customer is represented as a domain with its own LDAP, mean that it is simply"},{"line_number":28,"context_line":"impractical to just search for the entity in the various backends."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"What is required is for Keystone to continue to be able to provide an ID via"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_8d18a876","line":27,"updated":"2014-06-03 17:25:38.000000000","message":"s/mean/meaning ?","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c7430e4e88185828129108d015b17bd2db95eb47","unresolved":false,"context_lines":[{"line_number":24,"context_line":"federation, this is no longer the case.  However, the Keystone API still"},{"line_number":25,"context_line":"assumes it can uniquely identify a user and group from just the ID provided."},{"line_number":26,"context_line":"Further, Openstack installations that support multiple customers, where each"},{"line_number":27,"context_line":"customer is represented as a domain with its own LDAP, mean that it is simply"},{"line_number":28,"context_line":"impractical to just search for the entity in the various backends."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"What is required is for Keystone to continue to be able to provide an ID via"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_950b268d","line":27,"in_reply_to":"1ae5cdf2_8d18a876","updated":"2014-06-04 16:06:04.000000000","message":"Done","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f71cc47dcda3aa3f45b81b6eee11779c1e04a29b","unresolved":false,"context_lines":[{"line_number":31,"context_line":"its API for all entities it encounters (however they were created) and to be"},{"line_number":32,"context_line":"able to find that entity again efficiently when it receives an API call to"},{"line_number":33,"context_line":"manipulate that entity using the ID it provided.  Clients of Keystone should"},{"line_number":34,"context_line":"be impervious to any such changes below the API."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"A key requirement is that the introduction of any such support should not"},{"line_number":37,"context_line":"invalidate or change any IDs already issued by Keystone in existing"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_ed1e8c5e","line":34,"updated":"2014-06-03 17:25:38.000000000","message":"impervious sounds funny in this context, how about \u0027unaware\u0027 ?","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c7430e4e88185828129108d015b17bd2db95eb47","unresolved":false,"context_lines":[{"line_number":31,"context_line":"its API for all entities it encounters (however they were created) and to be"},{"line_number":32,"context_line":"able to find that entity again efficiently when it receives an API call to"},{"line_number":33,"context_line":"manipulate that entity using the ID it provided.  Clients of Keystone should"},{"line_number":34,"context_line":"be impervious to any such changes below the API."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"A key requirement is that the introduction of any such support should not"},{"line_number":37,"context_line":"invalidate or change any IDs already issued by Keystone in existing"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_b5fca273","line":34,"in_reply_to":"1ae5cdf2_ed1e8c5e","updated":"2014-06-04 16:06:04.000000000","message":"Done","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f71cc47dcda3aa3f45b81b6eee11779c1e04a29b","unresolved":false,"context_lines":[{"line_number":42,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The proposal is that Keystone will build a mapping of `Public IDs` to their"},{"line_number":45,"context_line":"underlying backend identifiers so that Keystone can route an API calls to the"},{"line_number":46,"context_line":"correct driver.  Clients of Keystone will only see the `Public ID` and the"},{"line_number":47,"context_line":"generation of the `Public ID` will happen on-the-fly within Keystone.  This"},{"line_number":48,"context_line":"change was originally proposed (and was close to being integrated) for"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_2d431443","line":45,"updated":"2014-06-03 17:25:38.000000000","message":"\u0027an\u0027 singular and \u0027calls\u0027 plural.","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c7430e4e88185828129108d015b17bd2db95eb47","unresolved":false,"context_lines":[{"line_number":42,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The proposal is that Keystone will build a mapping of `Public IDs` to their"},{"line_number":45,"context_line":"underlying backend identifiers so that Keystone can route an API calls to the"},{"line_number":46,"context_line":"correct driver.  Clients of Keystone will only see the `Public ID` and the"},{"line_number":47,"context_line":"generation of the `Public ID` will happen on-the-fly within Keystone.  This"},{"line_number":48,"context_line":"change was originally proposed (and was close to being integrated) for"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_752dbafd","line":45,"in_reply_to":"1ae5cdf2_2d431443","updated":"2014-06-04 16:06:04.000000000","message":"Done","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7b4fc2c32811124f980366042bd123e90e480d47","unresolved":false,"context_lines":[{"line_number":87,"context_line":"    to regenerate on-the-fly as user and group entities were encountered by"},{"line_number":88,"context_line":"    Keystone.  Although this appears attractive, its usefulness needs to be"},{"line_number":89,"context_line":"    tempered with the fact that if the assignments table was also lost, then"},{"line_number":90,"context_line":"    such a facility could only be part of recovery."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"  * Ease of purging mapping table"},{"line_number":93,"context_line":"    In the case where the identities are managed outside of Keystone (e.g. LDAP"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_ffe0f7fb","line":90,"updated":"2014-06-03 14:13:51.000000000","message":"Would there be some performance issues with regenerating the table in this case?","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c0deb5c33a752a0e10305cb716fa57f7d2732cfb","unresolved":false,"context_lines":[{"line_number":87,"context_line":"    to regenerate on-the-fly as user and group entities were encountered by"},{"line_number":88,"context_line":"    Keystone.  Although this appears attractive, its usefulness needs to be"},{"line_number":89,"context_line":"    tempered with the fact that if the assignments table was also lost, then"},{"line_number":90,"context_line":"    such a facility could only be part of recovery."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"  * Ease of purging mapping table"},{"line_number":93,"context_line":"    In the case where the identities are managed outside of Keystone (e.g. LDAP"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_cd6550b6","line":90,"in_reply_to":"1ae5cdf2_ffe0f7fb","updated":"2014-06-03 17:23:48.000000000","message":"It would be the same performance as the first time you connected Keystone to, say, the LDAP backends...the first time users \u0026 groups were listed would take a bit of a performance hit, but after that not much..See performance section.","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7b4fc2c32811124f980366042bd123e90e480d47","unresolved":false,"context_lines":[{"line_number":94,"context_line":"    or federation), then it is likely that stale entries representing users"},{"line_number":95,"context_line":"    and groups that have been deleted from the underlying identity store will"},{"line_number":96,"context_line":"    remain stored in the mapping table.  Whilst benign, there will be clearly"},{"line_number":97,"context_line":"    a need for some kind of periodic cleanup.  If the table was regeneratable"},{"line_number":98,"context_line":"    then simply purging the entire table (or all entries for a given domain)"},{"line_number":99,"context_line":"    using an option in keystone-manage would be a simple cure (albeit"},{"line_number":100,"context_line":"    incurring a slight performance degradation each time a given entity was"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_ff855707","line":97,"updated":"2014-06-03 14:13:51.000000000","message":"any ideas on how to do the periodic cleanup? Could we implement a periodic task or would that have issues running in Apache?","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c0deb5c33a752a0e10305cb716fa57f7d2732cfb","unresolved":false,"context_lines":[{"line_number":94,"context_line":"    or federation), then it is likely that stale entries representing users"},{"line_number":95,"context_line":"    and groups that have been deleted from the underlying identity store will"},{"line_number":96,"context_line":"    remain stored in the mapping table.  Whilst benign, there will be clearly"},{"line_number":97,"context_line":"    a need for some kind of periodic cleanup.  If the table was regeneratable"},{"line_number":98,"context_line":"    then simply purging the entire table (or all entries for a given domain)"},{"line_number":99,"context_line":"    using an option in keystone-manage would be a simple cure (albeit"},{"line_number":100,"context_line":"    incurring a slight performance degradation each time a given entity was"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_adbc84dd","line":97,"in_reply_to":"1ae5cdf2_ff855707","updated":"2014-06-03 17:23:48.000000000","message":"So one idea would be to have a slow running background trawl that would read the check the mapping table entries against the remote backend.  Or if your backend could provide you with a \"delete log\", then you could parse it periodically and call keystone-mange to delete the entries.","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7b4fc2c32811124f980366042bd123e90e480d47","unresolved":false,"context_lines":[{"line_number":101,"context_line":"    next encountered).  An alternative would be to provide the ability to"},{"line_number":102,"context_line":"    delete individual entries based on the local entity information."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"  * Ensuring consistent `Public ID` generation when using multiple Keystones"},{"line_number":105,"context_line":"    For some large installations, multiple Keystones may be running, backed"},{"line_number":106,"context_line":"    by a replicated database. In such circumstances it is possible that two"},{"line_number":107,"context_line":"    different Keystones might encounter an entity for the first time and"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_5f748b35","line":104,"updated":"2014-06-03 14:13:51.000000000","message":"missing period after Keystones.","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c0deb5c33a752a0e10305cb716fa57f7d2732cfb","unresolved":false,"context_lines":[{"line_number":101,"context_line":"    next encountered).  An alternative would be to provide the ability to"},{"line_number":102,"context_line":"    delete individual entries based on the local entity information."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"  * Ensuring consistent `Public ID` generation when using multiple Keystones"},{"line_number":105,"context_line":"    For some large installations, multiple Keystones may be running, backed"},{"line_number":106,"context_line":"    by a replicated database. In such circumstances it is possible that two"},{"line_number":107,"context_line":"    different Keystones might encounter an entity for the first time and"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_cdc1d055","line":104,"in_reply_to":"1ae5cdf2_5f748b35","updated":"2014-06-03 17:23:48.000000000","message":"Done","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7b4fc2c32811124f980366042bd123e90e480d47","unresolved":false,"context_lines":[{"line_number":137,"context_line":"    backend), does it make sense to hash the uuid just because the algorithm"},{"line_number":138,"context_line":"    has been specified as hashing?  Today, this might seem overkill, although"},{"line_number":139,"context_line":"    perhaps in the future we might not wish to treat the identifiers of a"},{"line_number":140,"context_line":"    separate keystone IDP as a valid `Public ID`?  The current proposal is to"},{"line_number":141,"context_line":"    ignore the hashing algorithm if the underlying driver is uuid based (i.e."},{"line_number":142,"context_line":"    SQL)."},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_ff01d76a","line":140,"updated":"2014-06-03 14:13:51.000000000","message":"Keystone","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c0deb5c33a752a0e10305cb716fa57f7d2732cfb","unresolved":false,"context_lines":[{"line_number":137,"context_line":"    backend), does it make sense to hash the uuid just because the algorithm"},{"line_number":138,"context_line":"    has been specified as hashing?  Today, this might seem overkill, although"},{"line_number":139,"context_line":"    perhaps in the future we might not wish to treat the identifiers of a"},{"line_number":140,"context_line":"    separate keystone IDP as a valid `Public ID`?  The current proposal is to"},{"line_number":141,"context_line":"    ignore the hashing algorithm if the underlying driver is uuid based (i.e."},{"line_number":142,"context_line":"    SQL)."},{"line_number":143,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_4dcdc084","line":140,"in_reply_to":"1ae5cdf2_ff01d76a","updated":"2014-06-03 17:23:48.000000000","message":"Done","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f71cc47dcda3aa3f45b81b6eee11779c1e04a29b","unresolved":false,"context_lines":[{"line_number":198,"context_line":""},{"line_number":199,"context_line":"The data model changes invlove the creation of a new table that provides"},{"line_number":200,"context_line":"the mapping:"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"class IDMapping(sql.ModelBase, sql.ModelDictMixin):"},{"line_number":203,"context_line":"    __tablename__ \u003d \u0027id_mapping\u0027"},{"line_number":204,"context_line":"    public_id \u003d sql.Column(sql.String(64), primary_key\u003dTrue)"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_6dab5c75","line":201,"updated":"2014-06-03 17:25:38.000000000","message":"might want to add:\n\n.. code-block:: python\n\nand indent the code","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c7430e4e88185828129108d015b17bd2db95eb47","unresolved":false,"context_lines":[{"line_number":198,"context_line":""},{"line_number":199,"context_line":"The data model changes invlove the creation of a new table that provides"},{"line_number":200,"context_line":"the mapping:"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"class IDMapping(sql.ModelBase, sql.ModelDictMixin):"},{"line_number":203,"context_line":"    __tablename__ \u003d \u0027id_mapping\u0027"},{"line_number":204,"context_line":"    public_id \u003d sql.Column(sql.String(64), primary_key\u003dTrue)"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_153e3628","line":201,"in_reply_to":"1ae5cdf2_6dab5c75","updated":"2014-06-04 16:06:04.000000000","message":"Done","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7b4fc2c32811124f980366042bd123e90e480d47","unresolved":false,"context_lines":[{"line_number":211,"context_line":"        nullable\u003dFalse)"},{"line_number":212,"context_line":"    __table_args__ \u003d (sql.UniqueConstraint(\u0027domain_id\u0027, \u0027local_id\u0027, \u0027type\u0027),"},{"line_number":213,"context_line":"                      {})"},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"The unique constraint is defined to ensure two mappings to the same `public_id`"},{"line_number":216,"context_line":"cannot be stored in the table."},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_5f756bf8","line":214,"updated":"2014-06-03 14:13:51.000000000","message":"thanks for adding the schema","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c0deb5c33a752a0e10305cb716fa57f7d2732cfb","unresolved":false,"context_lines":[{"line_number":211,"context_line":"        nullable\u003dFalse)"},{"line_number":212,"context_line":"    __table_args__ \u003d (sql.UniqueConstraint(\u0027domain_id\u0027, \u0027local_id\u0027, \u0027type\u0027),"},{"line_number":213,"context_line":"                      {})"},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"The unique constraint is defined to ensure two mappings to the same `public_id`"},{"line_number":216,"context_line":"cannot be stored in the table."},{"line_number":217,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_eda92c91","line":214,"in_reply_to":"1ae5cdf2_5f756bf8","updated":"2014-06-03 17:23:48.000000000","message":"you\u0027re welcome!","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f71cc47dcda3aa3f45b81b6eee11779c1e04a29b","unresolved":false,"context_lines":[{"line_number":235,"context_line":"which remains unrestricted.  This error condition can only be returned from the"},{"line_number":236,"context_line":"`Add user to group` API call."},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"#### 500 Unsupported Mapping Generator"},{"line_number":239,"context_line":"An unsupported mapping generator algorithm has been specified in the Keystone"},{"line_number":240,"context_line":"configuration file.  Any identity API is likely to generate this return code if"},{"line_number":241,"context_line":"the configuration file value is incorrectly specified."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_0db498cf","line":238,"updated":"2014-06-03 17:25:38.000000000","message":"*Identity* Mapping","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c7430e4e88185828129108d015b17bd2db95eb47","unresolved":false,"context_lines":[{"line_number":235,"context_line":"which remains unrestricted.  This error condition can only be returned from the"},{"line_number":236,"context_line":"`Add user to group` API call."},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"#### 500 Unsupported Mapping Generator"},{"line_number":239,"context_line":"An unsupported mapping generator algorithm has been specified in the Keystone"},{"line_number":240,"context_line":"configuration file.  Any identity API is likely to generate this return code if"},{"line_number":241,"context_line":"the configuration file value is incorrectly specified."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_55499eb5","line":238,"in_reply_to":"1ae5cdf2_0db498cf","updated":"2014-06-04 16:06:04.000000000","message":"Done","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7b4fc2c32811124f980366042bd123e90e480d47","unresolved":false,"context_lines":[{"line_number":250,"context_line":"`Public ID` is exposed).  This is in contrast to the current single-domain LDAP"},{"line_number":251,"context_line":"implementation that exposes the local ID defined by the LDAP driver as the"},{"line_number":252,"context_line":"publicly visible entity ID."},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"Notifications Impact"},{"line_number":255,"context_line":"--------------------"},{"line_number":256,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_9f337313","line":253,"updated":"2014-06-03 14:13:51.000000000","message":"not sure on this but we *might* need two lines between sections? That\u0027s at least what I\u0027ve been seeing in other specs.","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c0deb5c33a752a0e10305cb716fa57f7d2732cfb","unresolved":false,"context_lines":[{"line_number":250,"context_line":"`Public ID` is exposed).  This is in contrast to the current single-domain LDAP"},{"line_number":251,"context_line":"implementation that exposes the local ID defined by the LDAP driver as the"},{"line_number":252,"context_line":"publicly visible entity ID."},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"Notifications Impact"},{"line_number":255,"context_line":"--------------------"},{"line_number":256,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_0d865813","line":253,"in_reply_to":"1ae5cdf2_9f337313","updated":"2014-06-03 17:23:48.000000000","message":"so the template has one line between minor sections and two lines between major sections...which I tried to follow here.","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"7b4fc2c32811124f980366042bd123e90e480d47","unresolved":false,"context_lines":[{"line_number":357,"context_line":"References"},{"line_number":358,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":359,"context_line":""},{"line_number":360,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_fa7f2564","line":360,"updated":"2014-06-03 14:13:51.000000000","message":"do we have an etherpad on this subject from the summit?","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c0deb5c33a752a0e10305cb716fa57f7d2732cfb","unresolved":false,"context_lines":[{"line_number":357,"context_line":"References"},{"line_number":358,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":359,"context_line":""},{"line_number":360,"context_line":"None"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1ae5cdf2_2d7eb419","line":360,"in_reply_to":"1ae5cdf2_fa7f2564","updated":"2014-06-03 17:23:48.000000000","message":"added","commit_id":"3448292811cdc731c573fa5c452b658acd88293c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Cross-backend IDs for User and Group Entities"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Enable Keystone to generate and maintain unique IDs for user and group entities"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_f9556afa","line":11,"updated":"2014-06-03 21:06:21.000000000","message":"Make this\n\n`bp multi-backend-uuids \u003chttps://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids\u003e`_","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Cross-backend IDs for User and Group Entities"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Enable Keystone to generate and maintain unique IDs for user and group entities"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_0eb8f2c6","line":11,"in_reply_to":"1ae5cdf2_f9556afa","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Enable Keystone to generate and maintain unique IDs for user and group entities"},{"line_number":15,"context_line":"that are keystone-installation-wide, irrespective of whether the entity is"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_b94f626a","line":12,"updated":"2014-06-03 21:06:21.000000000","message":"there\u0027s an extra blank line here","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"https://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Enable Keystone to generate and maintain unique IDs for user and group entities"},{"line_number":15,"context_line":"that are keystone-installation-wide, irrespective of whether the entity is"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_8ecb2252","line":12,"in_reply_to":"1ae5cdf2_b94f626a","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Originally Keystone was responsible for creating all its user and group"},{"line_number":23,"context_line":"entities, along with assigning them a unique ID.  With the advent LDAP and"},{"line_number":24,"context_line":"federation, this is no longer the case.  However, the Keystone API still"},{"line_number":25,"context_line":"assumes it can uniquely identify a user and group from just the ID provided."},{"line_number":26,"context_line":"Further, Openstack installations that support multiple customers, where each"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_b97682a2","line":23,"updated":"2014-06-03 21:06:21.000000000","message":"change \"advent LDAP\" to \"advent of LDAP\" (add \"of\")","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":20,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"Originally Keystone was responsible for creating all its user and group"},{"line_number":23,"context_line":"entities, along with assigning them a unique ID.  With the advent LDAP and"},{"line_number":24,"context_line":"federation, this is no longer the case.  However, the Keystone API still"},{"line_number":25,"context_line":"assumes it can uniquely identify a user and group from just the ID provided."},{"line_number":26,"context_line":"Further, Openstack installations that support multiple customers, where each"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_aec8de55","line":23,"in_reply_to":"1ae5cdf2_b97682a2","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":30,"context_line":"What is required is for Keystone to continue to be able to provide an ID via"},{"line_number":31,"context_line":"its API for all entities it encounters (however they were created) and to be"},{"line_number":32,"context_line":"able to find that entity again efficiently when it receives an API call to"},{"line_number":33,"context_line":"manipulate that entity using the ID it provided.  Clients of Keystone should"},{"line_number":34,"context_line":"be impervious to any such changes below the API."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"A key requirement is that the introduction of any such support should not"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_197216ad","line":33,"updated":"2014-06-03 21:06:21.000000000","message":"what is \"it\" referring to here? I think the last use of \"it\" was referring to Keystone, but \"it\" is not referring to \"the API caller\", so suggest change \"it\" to \"the caller\" ?","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":30,"context_line":"What is required is for Keystone to continue to be able to provide an ID via"},{"line_number":31,"context_line":"its API for all entities it encounters (however they were created) and to be"},{"line_number":32,"context_line":"able to find that entity again efficiently when it receives an API call to"},{"line_number":33,"context_line":"manipulate that entity using the ID it provided.  Clients of Keystone should"},{"line_number":34,"context_line":"be impervious to any such changes below the API."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"A key requirement is that the introduction of any such support should not"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_eebe66ad","line":33,"in_reply_to":"1ae5cdf2_197216ad","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":41,"context_line":"Proposed Change"},{"line_number":42,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The proposal is that Keystone will build a mapping of `Public IDs` to their"},{"line_number":45,"context_line":"underlying backend identifiers so that Keystone can route an API calls to the"},{"line_number":46,"context_line":"correct driver.  Clients of Keystone will only see the `Public ID` and the"},{"line_number":47,"context_line":"generation of the `Public ID` will happen on-the-fly within Keystone.  This"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_79e5da36","line":44,"updated":"2014-06-03 21:06:21.000000000","message":"I\u0027d prefers \"s for `Public IDs` rather than `. Otherwise it just shows up as italics. This applies to all these uses of `","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":41,"context_line":"Proposed Change"},{"line_number":42,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The proposal is that Keystone will build a mapping of `Public IDs` to their"},{"line_number":45,"context_line":"underlying backend identifiers so that Keystone can route an API calls to the"},{"line_number":46,"context_line":"correct driver.  Clients of Keystone will only see the `Public ID` and the"},{"line_number":47,"context_line":"generation of the `Public ID` will happen on-the-fly within Keystone.  This"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_6eea56ad","line":44,"in_reply_to":"1ae5cdf2_79e5da36","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":42,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The proposal is that Keystone will build a mapping of `Public IDs` to their"},{"line_number":45,"context_line":"underlying backend identifiers so that Keystone can route an API calls to the"},{"line_number":46,"context_line":"correct driver.  Clients of Keystone will only see the `Public ID` and the"},{"line_number":47,"context_line":"generation of the `Public ID` will happen on-the-fly within Keystone.  This"},{"line_number":48,"context_line":"change was originally proposed (and was close to being integrated) for"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_39c6f29a","line":45,"updated":"2014-06-03 21:06:21.000000000","message":"change \"an API calls\" to \"API calls\" (remove \"an\")","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":42,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"The proposal is that Keystone will build a mapping of `Public IDs` to their"},{"line_number":45,"context_line":"underlying backend identifiers so that Keystone can route an API calls to the"},{"line_number":46,"context_line":"correct driver.  Clients of Keystone will only see the `Public ID` and the"},{"line_number":47,"context_line":"generation of the `Public ID` will happen on-the-fly within Keystone.  This"},{"line_number":48,"context_line":"change was originally proposed (and was close to being integrated) for"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_0e7b92f5","line":45,"in_reply_to":"1ae5cdf2_39c6f29a","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":72,"context_line":"codebase, but removes the \"domain deduction\" code in favor of ID mapping."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"There are a number of design items that need to be taken into account in"},{"line_number":75,"context_line":"implementing this change:"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"* `Public ID` Generator Algorithm"},{"line_number":78,"context_line":"  The default generator is proposed as simply a regular uuid4 hex string,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_79ef9ae9","line":75,"updated":"2014-06-03 21:06:21.000000000","message":"the following list only contains 1 item \"Public ID Generator Algorithm\", so I guess the number of design items is 1. Maybe \"Public ID Generator Algorithm\" should be a subsection rather than a list.","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":72,"context_line":"codebase, but removes the \"domain deduction\" code in favor of ID mapping."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"There are a number of design items that need to be taken into account in"},{"line_number":75,"context_line":"implementing this change:"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"* `Public ID` Generator Algorithm"},{"line_number":78,"context_line":"  The default generator is proposed as simply a regular uuid4 hex string,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_2e804ebf","line":75,"in_reply_to":"1ae5cdf2_79ef9ae9","updated":"2014-06-04 16:05:55.000000000","message":"...there are more now...","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":74,"context_line":"There are a number of design items that need to be taken into account in"},{"line_number":75,"context_line":"implementing this change:"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"* `Public ID` Generator Algorithm"},{"line_number":78,"context_line":"  The default generator is proposed as simply a regular uuid4 hex string,"},{"line_number":79,"context_line":"  similar to how entities are normally identified.  It has also been suggested"},{"line_number":80,"context_line":"  that an option should be provided for such a `Public ID` to be regeneratable"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_d9650eb6","line":77,"updated":"2014-06-03 21:06:21.000000000","message":"the newline at the end of this line doesn\u0027t do anything for the rendered doc. Add a -- or something.\n\nOr use a definition list if that\u0027s what this is supposed to be. http://docutils.sourceforge.net/docs/ref/rst/restructuredtext.html#definition-lists\n\nAlso, remove the `s","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":74,"context_line":"There are a number of design items that need to be taken into account in"},{"line_number":75,"context_line":"implementing this change:"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"* `Public ID` Generator Algorithm"},{"line_number":78,"context_line":"  The default generator is proposed as simply a regular uuid4 hex string,"},{"line_number":79,"context_line":"  similar to how entities are normally identified.  It has also been suggested"},{"line_number":80,"context_line":"  that an option should be provided for such a `Public ID` to be regeneratable"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_47fad843","line":77,"in_reply_to":"1ae5cdf2_d9650eb6","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":79,"context_line":"  similar to how entities are normally identified.  It has also been suggested"},{"line_number":80,"context_line":"  that an option should be provided for such a `Public ID` to be regeneratable"},{"line_number":81,"context_line":"  from the underlying local identifier components, using a hash algorithm."},{"line_number":82,"context_line":"  Three use cases where given for such support:"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  * Loss of entire mapping table"},{"line_number":85,"context_line":"    If the mapping table was ever lost, then an additional recovery mechanism"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_99fe26ad","line":82,"updated":"2014-06-03 21:06:21.000000000","message":"change \"where\" to \"were\"","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":79,"context_line":"  similar to how entities are normally identified.  It has also been suggested"},{"line_number":80,"context_line":"  that an option should be provided for such a `Public ID` to be regeneratable"},{"line_number":81,"context_line":"  from the underlying local identifier components, using a hash algorithm."},{"line_number":82,"context_line":"  Three use cases where given for such support:"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  * Loss of entire mapping table"},{"line_number":85,"context_line":"    If the mapping table was ever lost, then an additional recovery mechanism"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_07b29093","line":82,"in_reply_to":"1ae5cdf2_99fe26ad","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":81,"context_line":"  from the underlying local identifier components, using a hash algorithm."},{"line_number":82,"context_line":"  Three use cases where given for such support:"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  * Loss of entire mapping table"},{"line_number":85,"context_line":"    If the mapping table was ever lost, then an additional recovery mechanism"},{"line_number":86,"context_line":"    (as opposed to reverting to a backup) would be to simply allow the table"},{"line_number":87,"context_line":"    to regenerate on-the-fly as user and group entities were encountered by"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_f9564acd","line":84,"updated":"2014-06-03 21:06:21.000000000","message":"the newline at the end of this line doesn\u0027t do anything for the rendered doc. Add a -- or something.","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":81,"context_line":"  from the underlying local identifier components, using a hash algorithm."},{"line_number":82,"context_line":"  Three use cases where given for such support:"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"  * Loss of entire mapping table"},{"line_number":85,"context_line":"    If the mapping table was ever lost, then an additional recovery mechanism"},{"line_number":86,"context_line":"    (as opposed to reverting to a backup) would be to simply allow the table"},{"line_number":87,"context_line":"    to regenerate on-the-fly as user and group entities were encountered by"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_67a51446","line":84,"in_reply_to":"1ae5cdf2_f9564acd","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":89,"context_line":"    tempered with the fact that if the assignments table was also lost, then"},{"line_number":90,"context_line":"    such a facility could only be part of recovery."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"  * Ease of purging mapping table"},{"line_number":93,"context_line":"    In the case where the identities are managed outside of Keystone (e.g. LDAP"},{"line_number":94,"context_line":"    or federation), then it is likely that stale entries representing users"},{"line_number":95,"context_line":"    and groups that have been deleted from the underlying identity store will"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_195cd6ec","line":92,"updated":"2014-06-03 21:06:21.000000000","message":"the newline at the end of this line doesn\u0027t do anything for the rendered doc. Add a -- or something.","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":89,"context_line":"    tempered with the fact that if the assignments table was also lost, then"},{"line_number":90,"context_line":"    such a facility could only be part of recovery."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"  * Ease of purging mapping table"},{"line_number":93,"context_line":"    In the case where the identities are managed outside of Keystone (e.g. LDAP"},{"line_number":94,"context_line":"    or federation), then it is likely that stale entries representing users"},{"line_number":95,"context_line":"    and groups that have been deleted from the underlying identity store will"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_8765c01f","line":92,"in_reply_to":"1ae5cdf2_195cd6ec","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    In the case where the identities are managed outside of Keystone (e.g. LDAP"},{"line_number":94,"context_line":"    or federation), then it is likely that stale entries representing users"},{"line_number":95,"context_line":"    and groups that have been deleted from the underlying identity store will"},{"line_number":96,"context_line":"    remain stored in the mapping table.  Whilst benign, there will be clearly"},{"line_number":97,"context_line":"    a need for some kind of periodic cleanup.  If the table was regeneratable"},{"line_number":98,"context_line":"    then simply purging the entire table (or all entries for a given domain)"},{"line_number":99,"context_line":"    using an option in keystone-manage would be a simple cure (albeit"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_991546e7","line":96,"updated":"2014-06-03 21:06:21.000000000","message":"change \"will be clearly\" to \"will clearly be\"","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    In the case where the identities are managed outside of Keystone (e.g. LDAP"},{"line_number":94,"context_line":"    or federation), then it is likely that stale entries representing users"},{"line_number":95,"context_line":"    and groups that have been deleted from the underlying identity store will"},{"line_number":96,"context_line":"    remain stored in the mapping table.  Whilst benign, there will be clearly"},{"line_number":97,"context_line":"    a need for some kind of periodic cleanup.  If the table was regeneratable"},{"line_number":98,"context_line":"    then simply purging the entire table (or all entries for a given domain)"},{"line_number":99,"context_line":"    using an option in keystone-manage would be a simple cure (albeit"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_0779b0c7","line":96,"in_reply_to":"1ae5cdf2_991546e7","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":"  * In the codebase today the controllers generate the ID for an entity they"},{"line_number":122,"context_line":"    are creating, and pass this to the manager/driver layer. All our unit"},{"line_number":123,"context_line":"    testing of the manager/driver layer also assume that the caller specifies"},{"line_number":124,"context_line":"    the ID. It would seem inappropriate to expose the controller layer to"},{"line_number":125,"context_line":"    whatever generator algorithm was in use. While irrelevant for the usual"},{"line_number":126,"context_line":"    RO LDAP or federation case (since Keystone never gets to create entities),"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_799dda65","line":123,"updated":"2014-06-03 21:06:21.000000000","message":"change \"assume\" to \"assumes\"","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":"  * In the codebase today the controllers generate the ID for an entity they"},{"line_number":122,"context_line":"    are creating, and pass this to the manager/driver layer. All our unit"},{"line_number":123,"context_line":"    testing of the manager/driver layer also assume that the caller specifies"},{"line_number":124,"context_line":"    the ID. It would seem inappropriate to expose the controller layer to"},{"line_number":125,"context_line":"    whatever generator algorithm was in use. While irrelevant for the usual"},{"line_number":126,"context_line":"    RO LDAP or federation case (since Keystone never gets to create entities),"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_2724ecc3","line":123,"in_reply_to":"1ae5cdf2_799dda65","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":124,"context_line":"    the ID. It would seem inappropriate to expose the controller layer to"},{"line_number":125,"context_line":"    whatever generator algorithm was in use. While irrelevant for the usual"},{"line_number":126,"context_line":"    RO LDAP or federation case (since Keystone never gets to create entities),"},{"line_number":127,"context_line":"    for RW LDAP situations where there entities might be created by Keystone or"},{"line_number":128,"context_line":"    out-of-band via LDAP, one would want the use-cases listed above for hashing"},{"line_number":129,"context_line":"    to be valid for all entities, not just those that were not created by"},{"line_number":130,"context_line":"    Keystone.  The proposal is, therefore, to remove the ID generation from"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_b98a0219","line":127,"updated":"2014-06-03 21:06:21.000000000","message":"change \"there entities\" to \"the entities\"","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":124,"context_line":"    the ID. It would seem inappropriate to expose the controller layer to"},{"line_number":125,"context_line":"    whatever generator algorithm was in use. While irrelevant for the usual"},{"line_number":126,"context_line":"    RO LDAP or federation case (since Keystone never gets to create entities),"},{"line_number":127,"context_line":"    for RW LDAP situations where there entities might be created by Keystone or"},{"line_number":128,"context_line":"    out-of-band via LDAP, one would want the use-cases listed above for hashing"},{"line_number":129,"context_line":"    to be valid for all entities, not just those that were not created by"},{"line_number":130,"context_line":"    Keystone.  The proposal is, therefore, to remove the ID generation from"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_672a7491","line":127,"in_reply_to":"1ae5cdf2_b98a0219","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":129,"context_line":"    to be valid for all entities, not just those that were not created by"},{"line_number":130,"context_line":"    Keystone.  The proposal is, therefore, to remove the ID generation from"},{"line_number":131,"context_line":"    the User and Group controllers, and let the identity manager carry out"},{"line_number":132,"context_line":"    this role.  In order to not invalidate much of our unit testing, the"},{"line_number":133,"context_line":"    manager layer will still honor an ID if it is included in the entity"},{"line_number":134,"context_line":"    object being provided on a `Create` call."},{"line_number":135,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_d98fce28","line":132,"updated":"2014-06-03 21:06:21.000000000","message":"but it seems like our unit testing is invalid anyways, since in the real world the ID isn\u0027t passed in.","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":129,"context_line":"    to be valid for all entities, not just those that were not created by"},{"line_number":130,"context_line":"    Keystone.  The proposal is, therefore, to remove the ID generation from"},{"line_number":131,"context_line":"    the User and Group controllers, and let the identity manager carry out"},{"line_number":132,"context_line":"    this role.  In order to not invalidate much of our unit testing, the"},{"line_number":133,"context_line":"    manager layer will still honor an ID if it is included in the entity"},{"line_number":134,"context_line":"    object being provided on a `Create` call."},{"line_number":135,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_0ac6159a","line":132,"in_reply_to":"1ae5cdf2_d98fce28","updated":"2014-06-04 16:05:55.000000000","message":"changed wording to state that will provide additional testing to prove that the ID generation is working, but many tests that that are independent of ID generation will still run (I\u0027d be OK in updating all the tests if that was thought  appropriate)","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":142,"context_line":"    SQL)."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"  * One potential advantage of hashing is that it can be quicker to determine"},{"line_number":145,"context_line":"    if you have a mapping stored already -i.e. you create the `Public ID` by"},{"line_number":146,"context_line":"    hashing and do a PK lookup, as opposed to search the table for an entry"},{"line_number":147,"context_line":"    that matches the three pieces of local identity information.  However,"},{"line_number":148,"context_line":"    such a PK look up would only work if the generation algorithm setting"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_b9912249","line":145,"updated":"2014-06-03 21:06:21.000000000","message":"add a space after - , also could use ` ` around i.e. so that it\u0027s italicized since it\u0027s latin.","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":142,"context_line":"    SQL)."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"  * One potential advantage of hashing is that it can be quicker to determine"},{"line_number":145,"context_line":"    if you have a mapping stored already -i.e. you create the `Public ID` by"},{"line_number":146,"context_line":"    hashing and do a PK lookup, as opposed to search the table for an entry"},{"line_number":147,"context_line":"    that matches the three pieces of local identity information.  However,"},{"line_number":148,"context_line":"    such a PK look up would only work if the generation algorithm setting"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_0ae9b5e5","line":145,"in_reply_to":"1ae5cdf2_b9912249","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":146,"context_line":"    hashing and do a PK lookup, as opposed to search the table for an entry"},{"line_number":147,"context_line":"    that matches the three pieces of local identity information.  However,"},{"line_number":148,"context_line":"    such a PK look up would only work if the generation algorithm setting"},{"line_number":149,"context_line":"    is immutable (i.e. there aren\u0027\u0027t old entries in the mapping table that"},{"line_number":150,"context_line":"    using the standard uuid generator). Although this could be mitigated by"},{"line_number":151,"context_line":"    catching the attempt to create a second mapping to a different `Public ID`,"},{"line_number":152,"context_line":"    for now it is recommended that this option for PK lookup is left as a"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_199db659","line":149,"updated":"2014-06-03 21:06:21.000000000","message":"change \"aren\u0027\u0027t\" to \"aren\u0027t\"\n\nchange \"that using\" to \"that are using\"","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":146,"context_line":"    hashing and do a PK lookup, as opposed to search the table for an entry"},{"line_number":147,"context_line":"    that matches the three pieces of local identity information.  However,"},{"line_number":148,"context_line":"    such a PK look up would only work if the generation algorithm setting"},{"line_number":149,"context_line":"    is immutable (i.e. there aren\u0027\u0027t old entries in the mapping table that"},{"line_number":150,"context_line":"    using the standard uuid generator). Although this could be mitigated by"},{"line_number":151,"context_line":"    catching the attempt to create a second mapping to a different `Public ID`,"},{"line_number":152,"context_line":"    for now it is recommended that this option for PK lookup is left as a"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_eaae4997","line":149,"in_reply_to":"1ae5cdf2_199db659","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":196,"context_line":"Data Model Impact"},{"line_number":197,"context_line":"-----------------"},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"The data model changes invlove the creation of a new table that provides"},{"line_number":200,"context_line":"the mapping:"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"class IDMapping(sql.ModelBase, sql.ModelDictMixin):"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_79ab1a75","line":199,"updated":"2014-06-03 21:06:21.000000000","message":"change \"invlove\" to \"involve\"","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":196,"context_line":"Data Model Impact"},{"line_number":197,"context_line":"-----------------"},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"The data model changes invlove the creation of a new table that provides"},{"line_number":200,"context_line":"the mapping:"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"class IDMapping(sql.ModelBase, sql.ModelDictMixin):"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_ca80adf9","line":199,"in_reply_to":"1ae5cdf2_79ab1a75","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":197,"context_line":"-----------------"},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"The data model changes invlove the creation of a new table that provides"},{"line_number":200,"context_line":"the mapping:"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"class IDMapping(sql.ModelBase, sql.ModelDictMixin):"},{"line_number":203,"context_line":"    __tablename__ \u003d \u0027id_mapping\u0027"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_b984c25e","line":200,"updated":"2014-06-03 21:06:21.000000000","message":"Use ::\n\nand indent the following section.\n\notherwise this fails to build.","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":197,"context_line":"-----------------"},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"The data model changes invlove the creation of a new table that provides"},{"line_number":200,"context_line":"the mapping:"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"class IDMapping(sql.ModelBase, sql.ModelDictMixin):"},{"line_number":203,"context_line":"    __tablename__ \u003d \u0027id_mapping\u0027"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_8a8a2519","line":200,"in_reply_to":"1ae5cdf2_b984c25e","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":202,"context_line":"class IDMapping(sql.ModelBase, sql.ModelDictMixin):"},{"line_number":203,"context_line":"    __tablename__ \u003d \u0027id_mapping\u0027"},{"line_number":204,"context_line":"    public_id \u003d sql.Column(sql.String(64), primary_key\u003dTrue)"},{"line_number":205,"context_line":"    domain_id \u003d sql.Column(sql.String(64), sql.ForeignKey(\u0027domain.id\u0027),"},{"line_number":206,"context_line":"                           nullable\u003dFalse)"},{"line_number":207,"context_line":"    local_id \u003d sql.Column(sql.String(64), nullable\u003dFalse)"},{"line_number":208,"context_line":"    type \u003d sql.Column("}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_b97be2f3","line":205,"updated":"2014-06-03 21:06:21.000000000","message":"Domains are in assignment, so is this table in the assignment backend?","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":202,"context_line":"class IDMapping(sql.ModelBase, sql.ModelDictMixin):"},{"line_number":203,"context_line":"    __tablename__ \u003d \u0027id_mapping\u0027"},{"line_number":204,"context_line":"    public_id \u003d sql.Column(sql.String(64), primary_key\u003dTrue)"},{"line_number":205,"context_line":"    domain_id \u003d sql.Column(sql.String(64), sql.ForeignKey(\u0027domain.id\u0027),"},{"line_number":206,"context_line":"                           nullable\u003dFalse)"},{"line_number":207,"context_line":"    local_id \u003d sql.Column(sql.String(64), nullable\u003dFalse)"},{"line_number":208,"context_line":"    type \u003d sql.Column("}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_aa32815c","line":205,"in_reply_to":"1ae5cdf2_b97be2f3","updated":"2014-06-04 16:05:55.000000000","message":"oops, good catch...it\u0027s in the identity backend today...so the FK is a no-no...","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":212,"context_line":"    __table_args__ \u003d (sql.UniqueConstraint(\u0027domain_id\u0027, \u0027local_id\u0027, \u0027type\u0027),"},{"line_number":213,"context_line":"                      {})"},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"The unique constraint is defined to ensure two mappings to the same `public_id`"},{"line_number":216,"context_line":"cannot be stored in the table."},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"REST API Impact"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_f9ae4a80","line":215,"updated":"2014-06-03 21:06:21.000000000","message":"change \"`public_id`\" to \"Public ID\"","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":212,"context_line":"    __table_args__ \u003d (sql.UniqueConstraint(\u0027domain_id\u0027, \u0027local_id\u0027, \u0027type\u0027),"},{"line_number":213,"context_line":"                      {})"},{"line_number":214,"context_line":""},{"line_number":215,"context_line":"The unique constraint is defined to ensure two mappings to the same `public_id`"},{"line_number":216,"context_line":"cannot be stored in the table."},{"line_number":217,"context_line":""},{"line_number":218,"context_line":"REST API Impact"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_2a259108","line":215,"in_reply_to":"1ae5cdf2_f9ae4a80","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":219,"context_line":"---------------"},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"There are no new API calls for this proposal.  Two existing API calls have"},{"line_number":222,"context_line":"an added restriction places upon them.  In the case when Keystone is configured"},{"line_number":223,"context_line":"for domain-specific backends (via the configuration file) the API calls of"},{"line_number":224,"context_line":"`List users` and `List groups` require a domain scope to be specified. This can"},{"line_number":225,"context_line":"be done explicitly by using the already support domain_id filter or implicitly"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_596c9e35","line":222,"updated":"2014-06-03 21:06:21.000000000","message":"change \"places\" to \"placed\"","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":219,"context_line":"---------------"},{"line_number":220,"context_line":""},{"line_number":221,"context_line":"There are no new API calls for this proposal.  Two existing API calls have"},{"line_number":222,"context_line":"an added restriction places upon them.  In the case when Keystone is configured"},{"line_number":223,"context_line":"for domain-specific backends (via the configuration file) the API calls of"},{"line_number":224,"context_line":"`List users` and `List groups` require a domain scope to be specified. This can"},{"line_number":225,"context_line":"be done explicitly by using the already support domain_id filter or implicitly"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_ca818dc4","line":222,"in_reply_to":"1ae5cdf2_596c9e35","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":222,"context_line":"an added restriction places upon them.  In the case when Keystone is configured"},{"line_number":223,"context_line":"for domain-specific backends (via the configuration file) the API calls of"},{"line_number":224,"context_line":"`List users` and `List groups` require a domain scope to be specified. This can"},{"line_number":225,"context_line":"be done explicitly by using the already support domain_id filter or implicitly"},{"line_number":226,"context_line":"by using a domain scoped token. If neither of these are provided, the call will"},{"line_number":227,"context_line":"return a 401 (Unauthorized) error code."},{"line_number":228,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_b962023c","line":225,"updated":"2014-06-03 21:06:21.000000000","message":"change \"support\" to \"supported\"","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":222,"context_line":"an added restriction places upon them.  In the case when Keystone is configured"},{"line_number":223,"context_line":"for domain-specific backends (via the configuration file) the API calls of"},{"line_number":224,"context_line":"`List users` and `List groups` require a domain scope to be specified. This can"},{"line_number":225,"context_line":"be done explicitly by using the already support domain_id filter or implicitly"},{"line_number":226,"context_line":"by using a domain scoped token. If neither of these are provided, the call will"},{"line_number":227,"context_line":"return a 401 (Unauthorized) error code."},{"line_number":228,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_ea8649da","line":225,"in_reply_to":"1ae5cdf2_b962023c","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":228,"context_line":""},{"line_number":229,"context_line":"There are also two new HTTP response codes for error conditions:"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"#### 403 Cross Backend Not Allowed"},{"line_number":232,"context_line":"Since group membership is considered a function of identity and the underlying"},{"line_number":233,"context_line":"driver backend, membership across different domain-specific backends is not"},{"line_number":234,"context_line":"supported. This does not affect role assignment across domains and backends"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_5953be6a","line":231,"updated":"2014-06-03 21:06:21.000000000","message":"403 is Forbidden, not Cross Backend Not Allowed -- see http://tools.ietf.org/html/rfc2616#section-10.4.4","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":228,"context_line":""},{"line_number":229,"context_line":"There are also two new HTTP response codes for error conditions:"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"#### 403 Cross Backend Not Allowed"},{"line_number":232,"context_line":"Since group membership is considered a function of identity and the underlying"},{"line_number":233,"context_line":"driver backend, membership across different domain-specific backends is not"},{"line_number":234,"context_line":"supported. This does not affect role assignment across domains and backends"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_f5970a8e","line":231,"in_reply_to":"1ae5cdf2_5953be6a","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":235,"context_line":"which remains unrestricted.  This error condition can only be returned from the"},{"line_number":236,"context_line":"`Add user to group` API call."},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"#### 500 Unsupported Mapping Generator"},{"line_number":239,"context_line":"An unsupported mapping generator algorithm has been specified in the Keystone"},{"line_number":240,"context_line":"configuration file.  Any identity API is likely to generate this return code if"},{"line_number":241,"context_line":"the configuration file value is incorrectly specified."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_794cfac8","line":238,"updated":"2014-06-03 21:06:21.000000000","message":"500 is Internal Server Error, see http://tools.ietf.org/html/rfc2616#section-10.5.1","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":235,"context_line":"which remains unrestricted.  This error condition can only be returned from the"},{"line_number":236,"context_line":"`Add user to group` API call."},{"line_number":237,"context_line":""},{"line_number":238,"context_line":"#### 500 Unsupported Mapping Generator"},{"line_number":239,"context_line":"An unsupported mapping generator algorithm has been specified in the Keystone"},{"line_number":240,"context_line":"configuration file.  Any identity API is likely to generate this return code if"},{"line_number":241,"context_line":"the configuration file value is incorrectly specified."}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_15955686","line":238,"in_reply_to":"1ae5cdf2_794cfac8","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":273,"context_line":""},{"line_number":274,"context_line":"* A non-PK table lookup for each entity returned by a `List` call"},{"line_number":275,"context_line":"  for users and groups (in order to map to the `Public ID`)"},{"line_number":276,"context_line":"* A mapping entry table create the first time a user or group item is"},{"line_number":277,"context_line":"  encountered (to create the mapping)"},{"line_number":278,"context_line":"* A PK lookup for every user and group API used to manipulate an entity (to"},{"line_number":279,"context_line":"  lookup the mapping)"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_b99762eb","line":276,"updated":"2014-06-03 21:06:21.000000000","message":"change \"create\" to \"is created\"","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":273,"context_line":""},{"line_number":274,"context_line":"* A non-PK table lookup for each entity returned by a `List` call"},{"line_number":275,"context_line":"  for users and groups (in order to map to the `Public ID`)"},{"line_number":276,"context_line":"* A mapping entry table create the first time a user or group item is"},{"line_number":277,"context_line":"  encountered (to create the mapping)"},{"line_number":278,"context_line":"* A PK lookup for every user and group API used to manipulate an entity (to"},{"line_number":279,"context_line":"  lookup the mapping)"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_95d7a64a","line":276,"in_reply_to":"1ae5cdf2_b99762eb","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":288,"context_line":""},{"line_number":289,"context_line":"The two main impacts on a deployer will be:"},{"line_number":290,"context_line":""},{"line_number":291,"context_line":"* Choice of `Public ID` generator algorithm"},{"line_number":292,"context_line":"  This was discussed earlier in this specification"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"* Periodic purging of stale entries from the mapping table"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_398b52c4","line":291,"updated":"2014-06-03 21:06:21.000000000","message":"add a . at then end of the line.","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":288,"context_line":""},{"line_number":289,"context_line":"The two main impacts on a deployer will be:"},{"line_number":290,"context_line":""},{"line_number":291,"context_line":"* Choice of `Public ID` generator algorithm"},{"line_number":292,"context_line":"  This was discussed earlier in this specification"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"* Periodic purging of stale entries from the mapping table"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_b5dbc24d","line":291,"in_reply_to":"1ae5cdf2_398b52c4","updated":"2014-06-04 16:05:55.000000000","message":"I\u0027m still struggling to understand the right methods of doing paragraph with hanging indents in this language!","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":291,"context_line":"* Choice of `Public ID` generator algorithm"},{"line_number":292,"context_line":"  This was discussed earlier in this specification"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"* Periodic purging of stale entries from the mapping table"},{"line_number":295,"context_line":"  As also described earlier, for backend entity stores that are managed outside"},{"line_number":296,"context_line":"  of Keystone, in general there is no reliable notification mechanism that"},{"line_number":297,"context_line":"  Keystone could use to auto-purge stale entries from the mapping table. To"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_59881ec5","line":294,"updated":"2014-06-03 21:06:21.000000000","message":"add a . at the end of the line.","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":291,"context_line":"* Choice of `Public ID` generator algorithm"},{"line_number":292,"context_line":"  This was discussed earlier in this specification"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"* Periodic purging of stale entries from the mapping table"},{"line_number":295,"context_line":"  As also described earlier, for backend entity stores that are managed outside"},{"line_number":296,"context_line":"  of Keystone, in general there is no reliable notification mechanism that"},{"line_number":297,"context_line":"  Keystone could use to auto-purge stale entries from the mapping table. To"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_d5e04efc","line":294,"in_reply_to":"1ae5cdf2_59881ec5","updated":"2014-06-04 16:05:55.000000000","message":"ditto","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":299,"context_line":"  `mapping_purge` which will allow the operator to specify the following"},{"line_number":300,"context_line":"  options:"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"  * keystone-manage mapping_purge --all"},{"line_number":303,"context_line":"    This will purge all mappings"},{"line_number":304,"context_line":"  * keystone-manage mapping_purge --domain-name \u003cname\u003e"},{"line_number":305,"context_line":"    This will purge all mappings for the named domain"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_b9be8263","line":302,"updated":"2014-06-03 21:06:21.000000000","message":"surround this in `` and add a -- or something at the end of the line.\n\nThis applies to all these examples.","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":299,"context_line":"  `mapping_purge` which will allow the operator to specify the following"},{"line_number":300,"context_line":"  options:"},{"line_number":301,"context_line":""},{"line_number":302,"context_line":"  * keystone-manage mapping_purge --all"},{"line_number":303,"context_line":"    This will purge all mappings"},{"line_number":304,"context_line":"  * keystone-manage mapping_purge --domain-name \u003cname\u003e"},{"line_number":305,"context_line":"    This will purge all mappings for the named domain"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_d5ae8e97","line":302,"in_reply_to":"1ae5cdf2_b9be8263","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"f49d3c8a567b1c3e049beb03167e89eef2e505ff","unresolved":false,"context_lines":[{"line_number":343,"context_line":"Testing"},{"line_number":344,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":345,"context_line":""},{"line_number":346,"context_line":"The current Keystone controller, manager and driver testing will be enhanced"},{"line_number":347,"context_line":"to included testing of the mapping and multiple domain/backend sceanrios."},{"line_number":348,"context_line":""},{"line_number":349,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_79a87a20","line":346,"updated":"2014-06-03 21:06:21.000000000","message":"this section should describe external (Tempest) testing, not unit testing which is implied.","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a55acdaa1db5afcf09906268cfa3fd0de4617148","unresolved":false,"context_lines":[{"line_number":343,"context_line":"Testing"},{"line_number":344,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":345,"context_line":""},{"line_number":346,"context_line":"The current Keystone controller, manager and driver testing will be enhanced"},{"line_number":347,"context_line":"to included testing of the mapping and multiple domain/backend sceanrios."},{"line_number":348,"context_line":""},{"line_number":349,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"1ae5cdf2_f5962a4b","line":346,"in_reply_to":"1ae5cdf2_79a87a20","updated":"2014-06-04 16:05:55.000000000","message":"Done","commit_id":"2dac76beb0fa292d8217f0efdcd6c8d1e53ab3c6"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b1d6212bbc48a05cd58250c4516180e60d6d9933","unresolved":false,"context_lines":[{"line_number":149,"context_line":"    this role.  In order to not invalidate much of our unit testing, the"},{"line_number":150,"context_line":"    manager layer will still honor an ID if it is included in the entity"},{"line_number":151,"context_line":"    object being provided on a Create call.  Additional testing will be"},{"line_number":152,"context_line":"    provided that specifically tests that the ID generation."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"  - If the underlying driver supports uuids (for example the current SQL"},{"line_number":155,"context_line":"    backend), does it make sense to hash the uuid just because the algorithm"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_cd44421d","line":152,"updated":"2014-06-04 18:03:05.000000000","message":"that the ID generation -- what?","commit_id":"48078dd20ad3ad088ee15c6367efbf8be8c85808"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"254df71bb65e0b3d933ea424fe1d1251220a4640","unresolved":false,"context_lines":[{"line_number":149,"context_line":"    this role.  In order to not invalidate much of our unit testing, the"},{"line_number":150,"context_line":"    manager layer will still honor an ID if it is included in the entity"},{"line_number":151,"context_line":"    object being provided on a Create call.  Additional testing will be"},{"line_number":152,"context_line":"    provided that specifically tests that the ID generation."},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"  - If the underlying driver supports uuids (for example the current SQL"},{"line_number":155,"context_line":"    backend), does it make sense to hash the uuid just because the algorithm"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_43bf23aa","line":152,"in_reply_to":"1ae5cdf2_cd44421d","updated":"2014-06-04 19:16:25.000000000","message":"errrr...oops!","commit_id":"48078dd20ad3ad088ee15c6367efbf8be8c85808"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b1d6212bbc48a05cd58250c4516180e60d6d9933","unresolved":false,"context_lines":[{"line_number":221,"context_line":"    class IDMapping(sql.ModelBase, sql.ModelDictMixin):"},{"line_number":222,"context_line":"        __tablename__ \u003d \u0027id_mapping\u0027"},{"line_number":223,"context_line":"        public_id \u003d sql.Column(sql.String(64), primary_key\u003dTrue)"},{"line_number":224,"context_line":"        domain_id \u003d sql.Column(sql.String(64), ullable\u003dFalse)"},{"line_number":225,"context_line":"        local_id \u003d sql.Column(sql.String(64), nullable\u003dFalse)"},{"line_number":226,"context_line":"        type \u003d sql.Column("},{"line_number":227,"context_line":"            sql.Enum(map.EntityType.USER, map.EntityType.GROUP,"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_ed73be7d","line":224,"updated":"2014-06-04 18:03:05.000000000","message":"add an \"n\" to \"ullable\"","commit_id":"48078dd20ad3ad088ee15c6367efbf8be8c85808"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"254df71bb65e0b3d933ea424fe1d1251220a4640","unresolved":false,"context_lines":[{"line_number":221,"context_line":"    class IDMapping(sql.ModelBase, sql.ModelDictMixin):"},{"line_number":222,"context_line":"        __tablename__ \u003d \u0027id_mapping\u0027"},{"line_number":223,"context_line":"        public_id \u003d sql.Column(sql.String(64), primary_key\u003dTrue)"},{"line_number":224,"context_line":"        domain_id \u003d sql.Column(sql.String(64), ullable\u003dFalse)"},{"line_number":225,"context_line":"        local_id \u003d sql.Column(sql.String(64), nullable\u003dFalse)"},{"line_number":226,"context_line":"        type \u003d sql.Column("},{"line_number":227,"context_line":"            sql.Enum(map.EntityType.USER, map.EntityType.GROUP,"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_83e4cbe1","line":224,"in_reply_to":"1ae5cdf2_ed73be7d","updated":"2014-06-04 19:16:25.000000000","message":"Done","commit_id":"48078dd20ad3ad088ee15c6367efbf8be8c85808"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b1d6212bbc48a05cd58250c4516180e60d6d9933","unresolved":false,"context_lines":[{"line_number":360,"context_line":"Testing"},{"line_number":361,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":362,"context_line":""},{"line_number":363,"context_line":"No additional tempest testing is proposed."},{"line_number":364,"context_line":""},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_8d331aaa","line":363,"updated":"2014-06-04 18:03:05.000000000","message":"This should explain why Tempest testing is required. I assume it\u0027s because it\u0027s generally covered by the existing tests.","commit_id":"48078dd20ad3ad088ee15c6367efbf8be8c85808"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"254df71bb65e0b3d933ea424fe1d1251220a4640","unresolved":false,"context_lines":[{"line_number":360,"context_line":"Testing"},{"line_number":361,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":362,"context_line":""},{"line_number":363,"context_line":"No additional tempest testing is proposed."},{"line_number":364,"context_line":""},{"line_number":365,"context_line":""},{"line_number":366,"context_line":"Documentation Impact"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1ae5cdf2_a3e547dd","line":363,"in_reply_to":"1ae5cdf2_8d331aaa","updated":"2014-06-04 19:16:25.000000000","message":"Done","commit_id":"48078dd20ad3ad088ee15c6367efbf8be8c85808"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ba921cd49ea3f25a0a7db8e0b4b829bfdba4431a","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Cross-backend IDs for User and Group Entities"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp multi-backend-uuids \u003chttps://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Enable Keystone to generate and maintain unique IDs for user and group entities"},{"line_number":14,"context_line":"that are keystone-installation-wide, irrespective of whether the entity is"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_19490860","line":11,"updated":"2014-06-04 20:27:27.000000000","message":"(NIT): suggest linewrap here.","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"77e4f9981a291e6006383ce54bb5795e82ac0bd3","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Cross-backend IDs for User and Group Entities"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp multi-backend-uuids \u003chttps://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Enable Keystone to generate and maintain unique IDs for user and group entities"},{"line_number":14,"context_line":"that are keystone-installation-wide, irrespective of whether the entity is"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_713db3c3","line":11,"in_reply_to":"1ae5cdf2_19490860","updated":"2014-06-05 10:17:00.000000000","message":"..could you point me at the markup spec as to how to split lines?...everything I tried seemed to mean that it further confused the link syntax","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ba921cd49ea3f25a0a7db8e0b4b829bfdba4431a","unresolved":false,"context_lines":[{"line_number":24,"context_line":"assumes it can uniquely identify a user and group from just the ID provided."},{"line_number":25,"context_line":"Further, for Openstack installations that support multiple customers, where"},{"line_number":26,"context_line":"each customer is represented as a domain with its own LDAP, it is simply"},{"line_number":27,"context_line":"impractical to just search for the entity in the various backends."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"What is required is for Keystone to continue to be able to provide an ID via"},{"line_number":30,"context_line":"its API for all entities it encounters (however they were created) and to be"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_f9661cec","line":27,"updated":"2014-06-04 20:27:27.000000000","message":"(NIT): Suggest \"search for the entity across all backends\"","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"77e4f9981a291e6006383ce54bb5795e82ac0bd3","unresolved":false,"context_lines":[{"line_number":24,"context_line":"assumes it can uniquely identify a user and group from just the ID provided."},{"line_number":25,"context_line":"Further, for Openstack installations that support multiple customers, where"},{"line_number":26,"context_line":"each customer is represented as a domain with its own LDAP, it is simply"},{"line_number":27,"context_line":"impractical to just search for the entity in the various backends."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"What is required is for Keystone to continue to be able to provide an ID via"},{"line_number":30,"context_line":"its API for all entities it encounters (however they were created) and to be"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_b11c9b6b","line":27,"in_reply_to":"1ae5cdf2_f9661cec","updated":"2014-06-05 10:17:00.000000000","message":"Done","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ba921cd49ea3f25a0a7db8e0b4b829bfdba4431a","unresolved":false,"context_lines":[{"line_number":75,"context_line":""},{"line_number":76,"context_line":"- Ensuring compatibility with existing entity IDs"},{"line_number":77,"context_line":"  There are two kinds of user and group entity IDs in Keystone installations"},{"line_number":78,"context_line":"  today:"},{"line_number":79,"context_line":"  - uuid IDs for SQL backed identities, or for those entities created by"},{"line_number":80,"context_line":"    Keystone in a RW LDAP backend (the uuid is stored in an LDAP attribute)"},{"line_number":81,"context_line":"  - various LDAP attributes as selected by operators (e.g. email address) for"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_d9dc00e7","line":78,"updated":"2014-06-04 20:27:27.000000000","message":"should have new line between : and bullet (doc generation errors)","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"77e4f9981a291e6006383ce54bb5795e82ac0bd3","unresolved":false,"context_lines":[{"line_number":75,"context_line":""},{"line_number":76,"context_line":"- Ensuring compatibility with existing entity IDs"},{"line_number":77,"context_line":"  There are two kinds of user and group entity IDs in Keystone installations"},{"line_number":78,"context_line":"  today:"},{"line_number":79,"context_line":"  - uuid IDs for SQL backed identities, or for those entities created by"},{"line_number":80,"context_line":"    Keystone in a RW LDAP backend (the uuid is stored in an LDAP attribute)"},{"line_number":81,"context_line":"  - various LDAP attributes as selected by operators (e.g. email address) for"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_76612904","line":78,"in_reply_to":"1ae5cdf2_d9dc00e7","updated":"2014-06-05 10:17:00.000000000","message":"Done","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ba921cd49ea3f25a0a7db8e0b4b829bfdba4431a","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  There are two kinds of user and group entity IDs in Keystone installations"},{"line_number":78,"context_line":"  today:"},{"line_number":79,"context_line":"  - uuid IDs for SQL backed identities, or for those entities created by"},{"line_number":80,"context_line":"    Keystone in a RW LDAP backend (the uuid is stored in an LDAP attribute)"},{"line_number":81,"context_line":"  - various LDAP attributes as selected by operators (e.g. email address) for"},{"line_number":82,"context_line":"    LDAP backed identities created outside of Keystone"},{"line_number":83,"context_line":"  Since (ignoring the current experimental support for domain-specifc backends)"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_799ccc0f","line":80,"updated":"2014-06-04 20:27:27.000000000","message":"Should have new line between bullet points. (doc generation errors)","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"77e4f9981a291e6006383ce54bb5795e82ac0bd3","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  There are two kinds of user and group entity IDs in Keystone installations"},{"line_number":78,"context_line":"  today:"},{"line_number":79,"context_line":"  - uuid IDs for SQL backed identities, or for those entities created by"},{"line_number":80,"context_line":"    Keystone in a RW LDAP backend (the uuid is stored in an LDAP attribute)"},{"line_number":81,"context_line":"  - various LDAP attributes as selected by operators (e.g. email address) for"},{"line_number":82,"context_line":"    LDAP backed identities created outside of Keystone"},{"line_number":83,"context_line":"  Since (ignoring the current experimental support for domain-specifc backends)"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_965cf54c","line":80,"in_reply_to":"1ae5cdf2_799ccc0f","updated":"2014-06-05 10:17:00.000000000","message":"Done","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ba921cd49ea3f25a0a7db8e0b4b829bfdba4431a","unresolved":false,"context_lines":[{"line_number":79,"context_line":"  - uuid IDs for SQL backed identities, or for those entities created by"},{"line_number":80,"context_line":"    Keystone in a RW LDAP backend (the uuid is stored in an LDAP attribute)"},{"line_number":81,"context_line":"  - various LDAP attributes as selected by operators (e.g. email address) for"},{"line_number":82,"context_line":"    LDAP backed identities created outside of Keystone"},{"line_number":83,"context_line":"  Since (ignoring the current experimental support for domain-specifc backends)"},{"line_number":84,"context_line":"  all IDs can only be related to the single chosen SQL or LDAP identity driver,"},{"line_number":85,"context_line":"  upgrading to Juno with multi-backend uuids should not affect these IDs that"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_398ec4d0","line":82,"updated":"2014-06-04 20:27:27.000000000","message":"Should have a newline before back-dent (doc generation errorS)","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"77e4f9981a291e6006383ce54bb5795e82ac0bd3","unresolved":false,"context_lines":[{"line_number":79,"context_line":"  - uuid IDs for SQL backed identities, or for those entities created by"},{"line_number":80,"context_line":"    Keystone in a RW LDAP backend (the uuid is stored in an LDAP attribute)"},{"line_number":81,"context_line":"  - various LDAP attributes as selected by operators (e.g. email address) for"},{"line_number":82,"context_line":"    LDAP backed identities created outside of Keystone"},{"line_number":83,"context_line":"  Since (ignoring the current experimental support for domain-specifc backends)"},{"line_number":84,"context_line":"  all IDs can only be related to the single chosen SQL or LDAP identity driver,"},{"line_number":85,"context_line":"  upgrading to Juno with multi-backend uuids should not affect these IDs that"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_b6573125","line":82,"in_reply_to":"1ae5cdf2_398ec4d0","updated":"2014-06-05 10:17:00.000000000","message":"Done","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ba921cd49ea3f25a0a7db8e0b4b829bfdba4431a","unresolved":false,"context_lines":[{"line_number":218,"context_line":"The data model changes involve the creation of a new table that provides"},{"line_number":219,"context_line":"the mapping:"},{"line_number":220,"context_line":""},{"line_number":221,"context_line":".. code-block:: python"},{"line_number":222,"context_line":"    class IDMapping(sql.ModelBase, sql.ModelDictMixin):"},{"line_number":223,"context_line":"        __tablename__ \u003d \u0027id_mapping\u0027"},{"line_number":224,"context_line":"        public_id \u003d sql.Column(sql.String(64), primary_key\u003dTrue)"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_19a8281f","line":221,"updated":"2014-06-04 20:27:27.000000000","message":"Need a newline after code-block:: python for doc generation","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"77e4f9981a291e6006383ce54bb5795e82ac0bd3","unresolved":false,"context_lines":[{"line_number":218,"context_line":"The data model changes involve the creation of a new table that provides"},{"line_number":219,"context_line":"the mapping:"},{"line_number":220,"context_line":""},{"line_number":221,"context_line":".. code-block:: python"},{"line_number":222,"context_line":"    class IDMapping(sql.ModelBase, sql.ModelDictMixin):"},{"line_number":223,"context_line":"        __tablename__ \u003d \u0027id_mapping\u0027"},{"line_number":224,"context_line":"        public_id \u003d sql.Column(sql.String(64), primary_key\u003dTrue)"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_363b21ec","line":221,"in_reply_to":"1ae5cdf2_19a8281f","updated":"2014-06-05 10:17:00.000000000","message":"Done","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"ba921cd49ea3f25a0a7db8e0b4b829bfdba4431a","unresolved":false,"context_lines":[{"line_number":226,"context_line":"        local_id \u003d sql.Column(sql.String(64), nullable\u003dFalse)"},{"line_number":227,"context_line":"        type \u003d sql.Column("},{"line_number":228,"context_line":"            sql.Enum(map.EntityType.USER, map.EntityType.GROUP,"},{"line_number":229,"context_line":"                     name\u003d\u0027type\u0027),"},{"line_number":230,"context_line":"            nullable\u003dFalse)"},{"line_number":231,"context_line":"        __table_args__ \u003d (sql.UniqueConstraint(\u0027domain_id\u0027, \u0027local_id\u0027, \u0027type\u0027),"},{"line_number":232,"context_line":"                          {})"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_19ef48ea","line":229,"updated":"2014-06-04 20:27:27.000000000","message":"Do we want an explicit index on type? \u0027get me all of type X\u0027?\n\nIt is likely we want an index on type/domain since you\u0027ve indicated that we have a desire to force a domain scope for listing user information (in multi-domain-backend config)\n\nBased on the keystone-manage command examples below, an index on the local_id is might be useful as well.\n\nSuggest:\n    Index (domain, type)\n    Index (local_id)","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"77e4f9981a291e6006383ce54bb5795e82ac0bd3","unresolved":false,"context_lines":[{"line_number":226,"context_line":"        local_id \u003d sql.Column(sql.String(64), nullable\u003dFalse)"},{"line_number":227,"context_line":"        type \u003d sql.Column("},{"line_number":228,"context_line":"            sql.Enum(map.EntityType.USER, map.EntityType.GROUP,"},{"line_number":229,"context_line":"                     name\u003d\u0027type\u0027),"},{"line_number":230,"context_line":"            nullable\u003dFalse)"},{"line_number":231,"context_line":"        __table_args__ \u003d (sql.UniqueConstraint(\u0027domain_id\u0027, \u0027local_id\u0027, \u0027type\u0027),"},{"line_number":232,"context_line":"                          {})"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1ae5cdf2_559262f6","line":229,"in_reply_to":"1ae5cdf2_19ef48ea","updated":"2014-06-05 10:17:00.000000000","message":"Except for the keystone-manage, there are only two real access patterns to the mapping table: by public ID (which is the PK) or by specifying all 3 local identifiers (which as it has a unique constraint will also have an index, I think).  So given the likely non-time-critical nature of keystone-manage, I don\u0027t think further indexes would be a good trade-off.  I\u0027ll add this text to the blueprint, since I think it is valuable info.","commit_id":"c5bfc2c1c5bd1a722a1b59f3419eb8f1ea4011eb"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Cross-backend IDs for User and Group Entities"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp multi-backend-uuids \u003chttps://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Enable Keystone to generate and maintain unique IDs for user and group entities"},{"line_number":14,"context_line":"that are keystone-installation-wide, irrespective of whether the entity is"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_7be01bcd","line":11,"updated":"2014-06-05 19:08:44.000000000","message":"you can break it after \"multi-backend-uuids\"","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":8,"context_line":"Cross-backend IDs for User and Group Entities"},{"line_number":9,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"`bp multi-backend-uuids \u003chttps://blueprints.launchpad.net/keystone/+spec/multi-backend-uuids\u003e`_"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Enable Keystone to generate and maintain unique IDs for user and group entities"},{"line_number":14,"context_line":"that are keystone-installation-wide, irrespective of whether the entity is"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_05996378","line":11,"in_reply_to":"1ae5cdf2_7be01bcd","updated":"2014-06-06 10:42:38.000000000","message":"Done","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":47,"context_line":"change was originally proposed (and was close to being integrated) for"},{"line_number":48,"context_line":"the IceHouse release, but by mutual agreement was deferred to allow discussion"},{"line_number":49,"context_line":"of this topic at the Juno summit, which endorsed the general direction"},{"line_number":50,"context_line":"outlined in this proposal,"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This mapping is only relevant to the identity component of Keystone (i.e."},{"line_number":53,"context_line":"users and groups) and so will be implemented as a plugable mapping backend"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_db0e8f8b","line":50,"updated":"2014-06-05 19:08:44.000000000","message":"change , to .","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":47,"context_line":"change was originally proposed (and was close to being integrated) for"},{"line_number":48,"context_line":"the IceHouse release, but by mutual agreement was deferred to allow discussion"},{"line_number":49,"context_line":"of this topic at the Juno summit, which endorsed the general direction"},{"line_number":50,"context_line":"outlined in this proposal,"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This mapping is only relevant to the identity component of Keystone (i.e."},{"line_number":53,"context_line":"users and groups) and so will be implemented as a plugable mapping backend"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_a2e985e7","line":50,"in_reply_to":"1ae5cdf2_db0e8f8b","updated":"2014-06-06 10:42:38.000000000","message":"Done","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This mapping is only relevant to the identity component of Keystone (i.e."},{"line_number":53,"context_line":"users and groups) and so will be implemented as a plugable mapping backend"},{"line_number":54,"context_line":"within identity, with the only storage backend initially provided as SQL."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"As was stated in the summary, one of the main drivers for this requirement is"},{"line_number":57,"context_line":"the support of domain specific backends (e.g. LDAP) for Openstack installations"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_fb56eb5a","line":54,"updated":"2014-06-05 19:08:44.000000000","message":"what does \"within identity\" mean? it\u0027s going to be like\n\n [identity]\n mapping_driver\u003didentity.id_mapping.sql.SqlIdMappingDriver\n\n?","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This mapping is only relevant to the identity component of Keystone (i.e."},{"line_number":53,"context_line":"users and groups) and so will be implemented as a plugable mapping backend"},{"line_number":54,"context_line":"within identity, with the only storage backend initially provided as SQL."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"As was stated in the summary, one of the main drivers for this requirement is"},{"line_number":57,"context_line":"the support of domain specific backends (e.g. LDAP) for Openstack installations"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_82280934","line":54,"in_reply_to":"1ae5cdf2_fb56eb5a","updated":"2014-06-06 10:42:38.000000000","message":"yep confusing, so no, it is a separate drive in its own right...I\u0027ll re-word","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":68,"context_line":"- Cross-domain role assignment"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"This change therefore builds on the multi-domain framework in the current"},{"line_number":71,"context_line":"codebase, but removes the \"domain deduction\" code in favor of ID mapping."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"There are a number of design items that need to be taken into account in"},{"line_number":74,"context_line":"implementing this change:"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_3b9213f6","line":71,"updated":"2014-06-05 19:08:44.000000000","message":"Removal of the domain deduction code should be one of the work items in that section.","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":68,"context_line":"- Cross-domain role assignment"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"This change therefore builds on the multi-domain framework in the current"},{"line_number":71,"context_line":"codebase, but removes the \"domain deduction\" code in favor of ID mapping."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"There are a number of design items that need to be taken into account in"},{"line_number":74,"context_line":"implementing this change:"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_42a7e1bc","line":71,"in_reply_to":"1ae5cdf2_3b9213f6","updated":"2014-06-06 10:42:38.000000000","message":"Done","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":73,"context_line":"There are a number of design items that need to be taken into account in"},{"line_number":74,"context_line":"implementing this change:"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"- Ensuring compatibility with existing entity IDs"},{"line_number":77,"context_line":"  There are two kinds of user and group entity IDs in Keystone installations"},{"line_number":78,"context_line":"  today:"},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_7bbf3b61","line":76,"updated":"2014-06-05 19:08:44.000000000","message":"Add a . at the end of the sentence.","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":73,"context_line":"There are a number of design items that need to be taken into account in"},{"line_number":74,"context_line":"implementing this change:"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"- Ensuring compatibility with existing entity IDs"},{"line_number":77,"context_line":"  There are two kinds of user and group entity IDs in Keystone installations"},{"line_number":78,"context_line":"  today:"},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_a28b45c1","line":76,"in_reply_to":"1ae5cdf2_7bbf3b61","updated":"2014-06-06 10:42:38.000000000","message":"Done","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  There are two kinds of user and group entity IDs in Keystone installations"},{"line_number":78,"context_line":"  today:"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  - uuid IDs for SQL backed identities, or for those entities created by"},{"line_number":81,"context_line":"    Keystone in a RW LDAP backend (the uuid is stored in an LDAP attribute)"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"  - various LDAP attributes as selected by operators (e.g. email address) for"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_db468f7a","line":80,"updated":"2014-06-05 19:08:44.000000000","message":"capitalize UUID","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  There are two kinds of user and group entity IDs in Keystone installations"},{"line_number":78,"context_line":"  today:"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"  - uuid IDs for SQL backed identities, or for those entities created by"},{"line_number":81,"context_line":"    Keystone in a RW LDAP backend (the uuid is stored in an LDAP attribute)"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"  - various LDAP attributes as selected by operators (e.g. email address) for"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_82a1e947","line":80,"in_reply_to":"1ae5cdf2_db468f7a","updated":"2014-06-06 10:42:38.000000000","message":"Done","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":94,"context_line":"  Public ID.  This is achieved by setting the ``backward_compatible_ids``"},{"line_number":95,"context_line":"  configuration option to ``False``."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"- Public ID generator algorithm"},{"line_number":98,"context_line":"  The default generator is proposed as simply a regular uuid4 hex string,"},{"line_number":99,"context_line":"  similar to how entities are normally identified.  It has also been suggested"},{"line_number":100,"context_line":"  that an option should be provided for such a Public ID to be regeneratable"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_fbb26b92","line":97,"updated":"2014-06-05 19:08:44.000000000","message":"Add a . at the end of the sentence.","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":94,"context_line":"  Public ID.  This is achieved by setting the ``backward_compatible_ids``"},{"line_number":95,"context_line":"  configuration option to ``False``."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"- Public ID generator algorithm"},{"line_number":98,"context_line":"  The default generator is proposed as simply a regular uuid4 hex string,"},{"line_number":99,"context_line":"  similar to how entities are normally identified.  It has also been suggested"},{"line_number":100,"context_line":"  that an option should be provided for such a Public ID to be regeneratable"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_028dd9d2","line":97,"in_reply_to":"1ae5cdf2_fbb26b92","updated":"2014-06-06 10:42:38.000000000","message":"Done","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":101,"context_line":"  from the underlying local identifier components, using a hash algorithm."},{"line_number":102,"context_line":"  Three use cases were given for such support:"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"  - Loss of entire mapping table"},{"line_number":105,"context_line":"    If the mapping table was ever lost, then an additional recovery mechanism"},{"line_number":106,"context_line":"    (as opposed to reverting to a backup) would be to simply allow the table"},{"line_number":107,"context_line":"    to regenerate on-the-fly as user and group entities were encountered by"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_1bae372e","line":104,"updated":"2014-06-05 19:08:44.000000000","message":"Add a . at the end of the sentence.","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":101,"context_line":"  from the underlying local identifier components, using a hash algorithm."},{"line_number":102,"context_line":"  Three use cases were given for such support:"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"  - Loss of entire mapping table"},{"line_number":105,"context_line":"    If the mapping table was ever lost, then an additional recovery mechanism"},{"line_number":106,"context_line":"    (as opposed to reverting to a backup) would be to simply allow the table"},{"line_number":107,"context_line":"    to regenerate on-the-fly as user and group entities were encountered by"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_22bf3562","line":104,"in_reply_to":"1ae5cdf2_1bae372e","updated":"2014-06-06 10:42:38.000000000","message":"Done","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":109,"context_line":"    tempered with the fact that if the assignments table was also lost, then"},{"line_number":110,"context_line":"    such a facility could only be part of recovery."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"  - Ease of purging mapping table"},{"line_number":113,"context_line":"    In the case where the identities are managed outside of Keystone (e.g. LDAP"},{"line_number":114,"context_line":"    or federation), then it is likely that stale entries representing users"},{"line_number":115,"context_line":"    and groups that have been deleted from the underlying identity store will"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_3ba93324","line":112,"updated":"2014-06-05 19:08:44.000000000","message":"Add a . at the end of the sentence.","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":109,"context_line":"    tempered with the fact that if the assignments table was also lost, then"},{"line_number":110,"context_line":"    such a facility could only be part of recovery."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"  - Ease of purging mapping table"},{"line_number":113,"context_line":"    In the case where the identities are managed outside of Keystone (e.g. LDAP"},{"line_number":114,"context_line":"    or federation), then it is likely that stale entries representing users"},{"line_number":115,"context_line":"    and groups that have been deleted from the underlying identity store will"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_42c281e9","line":112,"in_reply_to":"1ae5cdf2_3ba93324","updated":"2014-06-06 10:42:38.000000000","message":"Done","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":172,"context_line":"    use the standard uuid generator). Although this could be mitigated by"},{"line_number":173,"context_line":"    catching the attempt to create a second mapping to a different Public ID,"},{"line_number":174,"context_line":"    for now it is recommended that this option for PK lookup is left as a"},{"line_number":175,"context_line":"    future performance improvement."},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"Alternatives"},{"line_number":178,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_76291289","line":175,"updated":"2014-06-05 19:08:44.000000000","message":"the doc mentions use cases and complexities -- what\u0027s going to be implemented?","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":172,"context_line":"    use the standard uuid generator). Although this could be mitigated by"},{"line_number":173,"context_line":"    catching the attempt to create a second mapping to a different Public ID,"},{"line_number":174,"context_line":"    for now it is recommended that this option for PK lookup is left as a"},{"line_number":175,"context_line":"    future performance improvement."},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"Alternatives"},{"line_number":178,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_e27f0da9","line":175,"in_reply_to":"1ae5cdf2_76291289","updated":"2014-06-06 10:42:38.000000000","message":"I\u0027ve clarified the above to make it clearer what is being implemented.","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":327,"context_line":"  ``mapping_purge`` which will allow the operator to specify the following"},{"line_number":328,"context_line":"  options:"},{"line_number":329,"context_line":""},{"line_number":330,"context_line":"  - ``keystone-manage mapping_purge --all``"},{"line_number":331,"context_line":"    This will purge all mappings"},{"line_number":332,"context_line":"  - ``keystone-manage mapping_purge --domain-name \u003cname\u003e``"},{"line_number":333,"context_line":"    This will purge all mappings for the named domain"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_f643623f","line":330,"updated":"2014-06-05 19:08:44.000000000","message":"add a -- at the end of these lines to separate the command from the description","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":327,"context_line":"  ``mapping_purge`` which will allow the operator to specify the following"},{"line_number":328,"context_line":"  options:"},{"line_number":329,"context_line":""},{"line_number":330,"context_line":"  - ``keystone-manage mapping_purge --all``"},{"line_number":331,"context_line":"    This will purge all mappings"},{"line_number":332,"context_line":"  - ``keystone-manage mapping_purge --domain-name \u003cname\u003e``"},{"line_number":333,"context_line":"    This will purge all mappings for the named domain"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_8584930b","line":330,"in_reply_to":"1ae5cdf2_f643623f","updated":"2014-06-06 10:42:38.000000000","message":"Done","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"9e5894d2d974e74b78552c49121e5f6e2e4825ce","unresolved":false,"context_lines":[{"line_number":359,"context_line":""},{"line_number":360,"context_line":"A full implementation that matches the above spec is already available at:"},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"https://review.openstack.org/#/c/74214/"},{"line_number":363,"context_line":""},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_b6563a04","line":362,"updated":"2014-06-05 19:08:44.000000000","message":"this section should describe how the work is going to be split up into reviewable chunks.","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"b6ba3367efb8dbc73b91c179d577af05fd9c63fd","unresolved":false,"context_lines":[{"line_number":359,"context_line":""},{"line_number":360,"context_line":"A full implementation that matches the above spec is already available at:"},{"line_number":361,"context_line":""},{"line_number":362,"context_line":"https://review.openstack.org/#/c/74214/"},{"line_number":363,"context_line":""},{"line_number":364,"context_line":""},{"line_number":365,"context_line":"Dependencies"}],"source_content_type":"text/x-rst","patch_set":11,"id":"1ae5cdf2_224d759a","line":362,"in_reply_to":"1ae5cdf2_b6563a04","updated":"2014-06-06 10:42:38.000000000","message":"Done","commit_id":"82d12e61e268e9e7be5f72de5e349fd71e24f3b2"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"f54a0283a46af8d12d63070ab6e027ac8ee483f8","unresolved":false,"context_lines":[{"line_number":51,"context_line":"outlined in this proposal."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"This mapping is only relevant to the identity component of Keystone (i.e."},{"line_number":54,"context_line":"users and groups) and  will be implemented as a plugable mapping backend,"},{"line_number":55,"context_line":"with the only storage backend initially provided as SQL."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"As was stated in the summary, one of the main drivers for this requirement is"}],"source_content_type":"text/x-rst","patch_set":13,"id":"1ae5cdf2_f6e5f40a","line":54,"updated":"2014-06-07 05:06:42.000000000","message":"typo plugable should be pluggable","commit_id":"fb062648883fbe0bca25eec23c13f2bdda4c0e4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a37a4a9b7f307123da085e0e755a950fc1b6343c","unresolved":false,"context_lines":[{"line_number":51,"context_line":"outlined in this proposal."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"This mapping is only relevant to the identity component of Keystone (i.e."},{"line_number":54,"context_line":"users and groups) and  will be implemented as a plugable mapping backend,"},{"line_number":55,"context_line":"with the only storage backend initially provided as SQL."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"As was stated in the summary, one of the main drivers for this requirement is"}],"source_content_type":"text/x-rst","patch_set":13,"id":"1ae5cdf2_7ca543b4","line":54,"in_reply_to":"1ae5cdf2_f6e5f40a","updated":"2014-06-07 10:13:26.000000000","message":"so there are slightly more hits via google for plugable than pluggable...but I\u0027ll believe wiki, so go with your suggestion :-)","commit_id":"fb062648883fbe0bca25eec23c13f2bdda4c0e4f"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"f54a0283a46af8d12d63070ab6e027ac8ee483f8","unresolved":false,"context_lines":[{"line_number":280,"context_line":"--------------------"},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"The existing identity notification will continue to function, although this"},{"line_number":283,"context_line":"reference the Public ID rather than any local identifier information."},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"Other End User Impact"},{"line_number":286,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"1ae5cdf2_b6252c5e","line":283,"updated":"2014-06-07 05:06:42.000000000","message":"typo: reference should be references","commit_id":"fb062648883fbe0bca25eec23c13f2bdda4c0e4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a37a4a9b7f307123da085e0e755a950fc1b6343c","unresolved":false,"context_lines":[{"line_number":280,"context_line":"--------------------"},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"The existing identity notification will continue to function, although this"},{"line_number":283,"context_line":"reference the Public ID rather than any local identifier information."},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"Other End User Impact"},{"line_number":286,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":13,"id":"1ae5cdf2_dc93b75a","line":283,"in_reply_to":"1ae5cdf2_b6252c5e","updated":"2014-06-07 10:13:26.000000000","message":"Done","commit_id":"fb062648883fbe0bca25eec23c13f2bdda4c0e4f"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"f54a0283a46af8d12d63070ab6e027ac8ee483f8","unresolved":false,"context_lines":[{"line_number":361,"context_line":""},{"line_number":362,"context_line":"The set of items required are:"},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"- Removal of the \"domain deduction\" paramater from the identity controller-"},{"line_number":365,"context_line":"  manager interface."},{"line_number":366,"context_line":""},{"line_number":367,"context_line":"- Ensure a domain is either explicitely or implicitely defined for the List"}],"source_content_type":"text/x-rst","patch_set":13,"id":"1ae5cdf2_56ff88aa","line":364,"updated":"2014-06-07 05:06:42.000000000","message":"typo: paramater should be parameter","commit_id":"fb062648883fbe0bca25eec23c13f2bdda4c0e4f"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"a37a4a9b7f307123da085e0e755a950fc1b6343c","unresolved":false,"context_lines":[{"line_number":361,"context_line":""},{"line_number":362,"context_line":"The set of items required are:"},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"- Removal of the \"domain deduction\" paramater from the identity controller-"},{"line_number":365,"context_line":"  manager interface."},{"line_number":366,"context_line":""},{"line_number":367,"context_line":"- Ensure a domain is either explicitely or implicitely defined for the List"}],"source_content_type":"text/x-rst","patch_set":13,"id":"1ae5cdf2_9caa0f84","line":364,"in_reply_to":"1ae5cdf2_56ff88aa","updated":"2014-06-07 10:13:26.000000000","message":"Done","commit_id":"fb062648883fbe0bca25eec23c13f2bdda4c0e4f"}]}