)]}'
{"doc/source/configuration.rst":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"02defb626a6a99e38838f24f47da8e370f7561bb","unresolved":false,"context_lines":[{"line_number":147,"context_line":"configuration file."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"It is important to notice that with the creation of other domains (by enabling"},{"line_number":150,"context_line":"this configuration), regular admin operations like list users and groups will"},{"line_number":151,"context_line":"need that either a domain filter is specified in the call or a domain scoped"},{"line_number":152,"context_line":"token is being used."},{"line_number":153,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8c0949_01b138e1","line":150,"updated":"2014-10-31 09:26:10.000000000","message":"I\u0027d suggest a few things here:\n\n1) Let\u0027s make this a NOTE::\n\n2) It isn\u0027t really the \"creation of other domains\" that causes this restriction, it is the enabling of domain-specific drivers.\n\n3) First describe the actual  restriction...that we do not support the listing of all users or groups in a single API call\n\n4) Then get specific...it is indeed ONLY GET /users and GET/groups that have this requirement to add a domain filter or be issued via a domain scoped token.","commit_id":"ca8822284d049e28f3595a81f18fd1284f0d7d09"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"f0642972b9433a8442c011add2d143e8a07807f4","unresolved":false,"context_lines":[{"line_number":147,"context_line":"configuration file."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"It is important to notice that with the creation of other domains (by enabling"},{"line_number":150,"context_line":"this configuration), regular admin operations like list users and groups will"},{"line_number":151,"context_line":"need that either a domain filter is specified in the call or a domain scoped"},{"line_number":152,"context_line":"token is being used."},{"line_number":153,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8c0949_67868cbb","line":150,"in_reply_to":"7a8c0949_01b138e1","updated":"2014-10-31 11:33:59.000000000","message":"thanks for the suggestions.\n\n1) ++ (I was only concerned about a lot of notes in this topic)\n\n2) ++\n\n3) the restriction is more general, right? Not only related to the domain specific drivers?\n\n4) ++","commit_id":"ca8822284d049e28f3595a81f18fd1284f0d7d09"},{"author":{"_account_id":220,"name":"Haneef Ali","email":"haneef.ali@hp.com","username":"haneef"},"change_message_id":"1ae7a15bda2f20c22fd219369b90bbc05942a22f","unresolved":false,"context_lines":[{"line_number":153,"context_line":"    those calls will need that either a domain filter is specified or the usage"},{"line_number":154,"context_line":"    of a domain scoped token."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":".. NOTE::"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"    Keystone does not support moving the contents of a domain (i.e. \"it\u0027s\""},{"line_number":159,"context_line":"    users and groups) from one backend to another, nor group membership across"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_7ad7e923","line":156,"updated":"2014-11-03 18:54:58.000000000","message":"Documenting is really good.  But this review doesn\u0027t close the defect. We should throw  Not Supported or some  other error. We should not throw 401 which is misleading","commit_id":"9565fb100c328098991efedb8cd73ce7a4085282"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"142868171faa363e2e37b02be436e4c3e0783114","unresolved":false,"context_lines":[{"line_number":153,"context_line":"    those calls will need that either a domain filter is specified or the usage"},{"line_number":154,"context_line":"    of a domain scoped token."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":".. NOTE::"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"    Keystone does not support moving the contents of a domain (i.e. \"it\u0027s\""},{"line_number":159,"context_line":"    users and groups) from one backend to another, nor group membership across"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a890539_3de4960c","line":156,"in_reply_to":"7a8c0949_55891e25","updated":"2014-11-11 09:56:09.000000000","message":"So I think that Haneef is correct, we shouldn\u0027t be throwing a 401 for this specific problem.  What confuses this is that there are two situations:\n\n1) With domain specific backends when no domain is specified when listing users or groups.  I think this should throw a 403 (Forbidden).\n\n2) If you do specify a domain when listing users and groups, but you don\u0027t have a role that gives you access to that API, then we should (and do) throw a 401 (Unathorized).  This is irrespective of whether we are using domain specific backends or not.\n\nSo I think we should fix 1), along with this doc change, which would involve changing the exception thown at the end of _get_domain_id_for_list_request() in common/controller.py","commit_id":"9565fb100c328098991efedb8cd73ce7a4085282"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"2f3bc8b33d4d749dcc3455a92140956b65c3961a","unresolved":false,"context_lines":[{"line_number":153,"context_line":"    those calls will need that either a domain filter is specified or the usage"},{"line_number":154,"context_line":"    of a domain scoped token."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":".. NOTE::"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"    Keystone does not support moving the contents of a domain (i.e. \"it\u0027s\""},{"line_number":159,"context_line":"    users and groups) from one backend to another, nor group membership across"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_55891e25","line":156,"in_reply_to":"7a8c0949_7ad7e923","updated":"2014-11-03 23:18:30.000000000","message":"Not sure if changing the return is approachable right now, if I understood correctly the issue is caused mainly because we don\u0027t have a domain scoped token and 401 is returned in each domain related operation if you pass a project token. Maybe for *this* issue, the documentation is enough...","commit_id":"9565fb100c328098991efedb8cd73ce7a4085282"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"ee271bc621d896e48c33dc266267739234fab59b","unresolved":false,"context_lines":[{"line_number":149,"context_line":".. NOTE::"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    It is important to notice that by enabling this configuration, the"},{"line_number":152,"context_line":"    operations of listing all users and listing all groups are not supported,"},{"line_number":153,"context_line":"    those calls will need that either a domain filter is specified or the usage"},{"line_number":154,"context_line":"    of a domain scoped token."},{"line_number":155,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_cc9bab70","line":152,"updated":"2014-11-13 00:21:54.000000000","message":"should this be \"not fully supported\"? It still works but just requires additioanl argument or scope.","commit_id":"552d05846b0c7befe8f604d57e9ad9775abf68b8"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"009bbd26b79f15bceb5f0d83d8e52e54da5a8736","unresolved":false,"context_lines":[{"line_number":149,"context_line":".. NOTE::"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    It is important to notice that by enabling this configuration, the"},{"line_number":152,"context_line":"    operations of listing all users and listing all groups are not supported,"},{"line_number":153,"context_line":"    those calls will need that either a domain filter is specified or the usage"},{"line_number":154,"context_line":"    of a domain scoped token."},{"line_number":155,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_6ca477a6","line":152,"in_reply_to":"5a890539_cc9bab70","updated":"2014-11-13 00:24:53.000000000","message":"the sentence is specifying \"all\" users and \"all\" groups, which is not supported.","commit_id":"552d05846b0c7befe8f604d57e9ad9775abf68b8"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"be00b8ba8882cefaaa4b6bb573ebd61341702d13","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    It is important to notice that by enabling this configuration, the"},{"line_number":152,"context_line":"    operations of listing all users and listing all groups are not supported,"},{"line_number":153,"context_line":"    those calls will need that either a domain filter is specified or the usage"},{"line_number":154,"context_line":"    of a domain scoped token."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":".. NOTE::"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_0cbf73d1","line":153,"updated":"2014-11-13 00:20:57.000000000","message":"\"will need that\" -\u003e \"must have\"?","commit_id":"552d05846b0c7befe8f604d57e9ad9775abf68b8"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"009bbd26b79f15bceb5f0d83d8e52e54da5a8736","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"    It is important to notice that by enabling this configuration, the"},{"line_number":152,"context_line":"    operations of listing all users and listing all groups are not supported,"},{"line_number":153,"context_line":"    those calls will need that either a domain filter is specified or the usage"},{"line_number":154,"context_line":"    of a domain scoped token."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":".. NOTE::"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_cca9eb7c","line":153,"in_reply_to":"5a890539_0cbf73d1","updated":"2014-11-13 00:24:53.000000000","message":"hm... good point, \"will need that\" sounds the same as \"must have\" to me...","commit_id":"552d05846b0c7befe8f604d57e9ad9775abf68b8"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"b4cfbc8520520c1622700b1821b265d09ec5ee02","unresolved":false,"context_lines":[{"line_number":151,"context_line":"    It is important to notice that by enabling this configuration, the"},{"line_number":152,"context_line":"    operations of listing all users and listing all groups are not supported,"},{"line_number":153,"context_line":"    those calls will need that either a domain filter is specified or the usage"},{"line_number":154,"context_line":"    of a domain scoped token."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":".. NOTE::"},{"line_number":157,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a890539_de49ba8f","line":154,"updated":"2014-11-20 00:46:29.000000000","message":"This should say what happens if you don\u0027t specify a domain filter... i.e., what error do you get back? That way this document might show up if someone googles for it.\n\nMaybe the error response can also be improved.","commit_id":"552d05846b0c7befe8f604d57e9ad9775abf68b8"}]}