)]}'
{"doc/source/extensions/openidc.rst":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"859e40bdf9638b6ecbdbd5c08993d0a99881aa79","unresolved":false,"context_lines":[{"line_number":63,"context_line":"`OIDCProviderUserInfoEndpoint`, and `OIDCProviderJwksUri`"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Note, if using a mod_wsgi version less than 4.3.0, then the `OIDCClaimPrefix`"},{"line_number":68,"context_line":"must be specified to have only alphanumerics or a dash (\"-\"), this is because"},{"line_number":69,"context_line":"mod_wsgi blocks headers that do not fit this criteria. See http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.3.0.html#bugs-fixed"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_1dded111","line":66,"updated":"2014-11-05 08:39:31.000000000","message":"3 blank lines?","commit_id":"8a40e6ad85ca0303f4cc694dc885345cbf797b22"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"469b4491d591bdabe0eea2ba454fedf5c035ce87","unresolved":false,"context_lines":[{"line_number":63,"context_line":"`OIDCProviderUserInfoEndpoint`, and `OIDCProviderJwksUri`"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":""},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Note, if using a mod_wsgi version less than 4.3.0, then the `OIDCClaimPrefix`"},{"line_number":68,"context_line":"must be specified to have only alphanumerics or a dash (\"-\"), this is because"},{"line_number":69,"context_line":"mod_wsgi blocks headers that do not fit this criteria. See http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.3.0.html#bugs-fixed"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8c0949_6872b1ae","line":66,"in_reply_to":"7a8c0949_1dded111","updated":"2014-11-05 09:08:23.000000000","message":"oops! i\u0027ll remove this","commit_id":"8a40e6ad85ca0303f4cc694dc885345cbf797b22"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9c6828e2de503ae6ffde8c1a8855509c5622aaff","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Configuring mod_auth_openidc"},{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Federate Keystone (SP) and an external IdP using OpenID Connect (`mod_auth_openidc`_)"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":".. _`mod_auth_openidc`: https://github.com/pingidentity/mod_auth_openidc"},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a8c0949_e8a5c147","line":23,"updated":"2014-11-05 09:32:37.000000000","message":"should mention how to install the package:\n\napt-get install libapache2-mod-auth-openidc","commit_id":"04f44622b8bfe1b7b8df3da97a09563b901715db"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b43506fafdbb4406223314a9fa53d96d8596d008","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":".. _`mod_auth_openidc`: https://github.com/pingidentity/mod_auth_openidc"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"In the keystone.conf Apache site file, add the following to load the"},{"line_number":28,"context_line":"mod_auth_openidc module:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":".. code-block:: xml"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_f4bae9be","line":27,"updated":"2014-11-06 12:02:12.000000000","message":"add the following where? Maybe add a snippet of the file where this line was added.","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"632701b3d648f2e010e8c4bd18b6b4e28b641082","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":".. _`mod_auth_openidc`: https://github.com/pingidentity/mod_auth_openidc"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"In the keystone.conf Apache site file, add the following to load the"},{"line_number":28,"context_line":"mod_auth_openidc module:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":".. code-block:: xml"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_205c277e","line":27,"in_reply_to":"7a8c0949_60d2af01","updated":"2014-11-06 15:07:01.000000000","message":"i\u0027ll try to elaborate a bit more","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"fe55141b4047c7d34d6252cb01e1460f42ba5605","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":".. _`mod_auth_openidc`: https://github.com/pingidentity/mod_auth_openidc"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"In the keystone.conf Apache site file, add the following to load the"},{"line_number":28,"context_line":"mod_auth_openidc module:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":".. code-block:: xml"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_60d2af01","line":27,"in_reply_to":"7a8c0949_655f2142","updated":"2014-11-06 14:34:08.000000000","message":"thought that it always followed the same pattern \u003d)","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"2be8836c4464a374e7c7c8927895b79f3b13eb7f","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":".. _`mod_auth_openidc`: https://github.com/pingidentity/mod_auth_openidc"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"In the keystone.conf Apache site file, add the following to load the"},{"line_number":28,"context_line":"mod_auth_openidc module:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":".. code-block:: xml"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_655f2142","line":27,"in_reply_to":"7a8c0949_f4bae9be","updated":"2014-11-06 14:23:33.000000000","message":"The details on where you set this are going to vary from distro to distro.  I think it\u0027s best to leave this portion of the instructions generic.","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b43506fafdbb4406223314a9fa53d96d8596d008","unresolved":false,"context_lines":[{"line_number":25,"context_line":".. _`mod_auth_openidc`: https://github.com/pingidentity/mod_auth_openidc"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"In the keystone.conf Apache site file, add the following to load the"},{"line_number":28,"context_line":"mod_auth_openidc module:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":".. code-block:: xml"},{"line_number":31,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_94f3659d","line":28,"updated":"2014-11-06 12:02:12.000000000","message":"is this mod already installed in most distros?","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"632701b3d648f2e010e8c4bd18b6b4e28b641082","unresolved":false,"context_lines":[{"line_number":25,"context_line":".. _`mod_auth_openidc`: https://github.com/pingidentity/mod_auth_openidc"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"In the keystone.conf Apache site file, add the following to load the"},{"line_number":28,"context_line":"mod_auth_openidc module:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":".. code-block:: xml"},{"line_number":31,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_c02b6392","line":28,"in_reply_to":"7a8c0949_400e9335","updated":"2014-11-06 15:07:01.000000000","message":"i\u0027ll mention this.","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"2be8836c4464a374e7c7c8927895b79f3b13eb7f","unresolved":false,"context_lines":[{"line_number":25,"context_line":".. _`mod_auth_openidc`: https://github.com/pingidentity/mod_auth_openidc"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"In the keystone.conf Apache site file, add the following to load the"},{"line_number":28,"context_line":"mod_auth_openidc module:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":".. code-block:: xml"},{"line_number":31,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_400e9335","line":28,"in_reply_to":"7a8c0949_94f3659d","updated":"2014-11-06 14:23:33.000000000","message":"It\u0027s not on Fedora/CentOS/Red Hat.  I do think that we should mention that the module needs to be installed.","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"43d057e80f22ee3d8129206cb2b3125e28d64a9e","unresolved":false,"context_lines":[{"line_number":47,"context_line":"      OIDCClientID \u003copenid_client_id\u003e"},{"line_number":48,"context_line":"      OIDCClientSecret \u003copenid_client_secret\u003e"},{"line_number":49,"context_line":"      OIDCCryptoPassphrase openstack"},{"line_number":50,"context_line":"      OIDCRedirectURI http://localhost:5000/v3/OS-FEDERATION/identity_providers/goog/protocols/oidc/auth/redirect"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"      \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/oidc/auth\u003e"},{"line_number":53,"context_line":"        AuthType openid-connect"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_e4c4fa60","line":50,"updated":"2014-11-06 10:17:47.000000000","message":"You should probably replace \u0027goog\u0027 with a placeholder here, such as \u0027\u003cidp_name\u003e\u0027.","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"fe55141b4047c7d34d6252cb01e1460f42ba5605","unresolved":false,"context_lines":[{"line_number":47,"context_line":"      OIDCClientID \u003copenid_client_id\u003e"},{"line_number":48,"context_line":"      OIDCClientSecret \u003copenid_client_secret\u003e"},{"line_number":49,"context_line":"      OIDCCryptoPassphrase openstack"},{"line_number":50,"context_line":"      OIDCRedirectURI http://localhost:5000/v3/OS-FEDERATION/identity_providers/goog/protocols/oidc/auth/redirect"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"      \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/oidc/auth\u003e"},{"line_number":53,"context_line":"        AuthType openid-connect"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_c0728348","line":50,"in_reply_to":"7a8c0949_25b8b975","updated":"2014-11-06 14:34:08.000000000","message":"Didn\u0027t know that it needs to be the same as in the conf file, since there is no checking in here: https://github.com/openstack/keystone/blob/master/keystone/contrib/federation/controllers.py#L170","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"2be8836c4464a374e7c7c8927895b79f3b13eb7f","unresolved":false,"context_lines":[{"line_number":47,"context_line":"      OIDCClientID \u003copenid_client_id\u003e"},{"line_number":48,"context_line":"      OIDCClientSecret \u003copenid_client_secret\u003e"},{"line_number":49,"context_line":"      OIDCCryptoPassphrase openstack"},{"line_number":50,"context_line":"      OIDCRedirectURI http://localhost:5000/v3/OS-FEDERATION/identity_providers/goog/protocols/oidc/auth/redirect"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"      \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/oidc/auth\u003e"},{"line_number":53,"context_line":"        AuthType openid-connect"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_25b8b975","line":50,"in_reply_to":"7a8c0949_34ec71c7","updated":"2014-11-06 14:23:33.000000000","message":"\u0027oidc\u0027 is not defined by the user as proposed in this patch.  It\u0027s a hard-coded mechanism, so you would have to create your protocol as \u0027oidc\u0027.  Of course this wouldn\u0027t be hardcoded if we follow my recommendation of making this configurable.","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"632701b3d648f2e010e8c4bd18b6b4e28b641082","unresolved":false,"context_lines":[{"line_number":47,"context_line":"      OIDCClientID \u003copenid_client_id\u003e"},{"line_number":48,"context_line":"      OIDCClientSecret \u003copenid_client_secret\u003e"},{"line_number":49,"context_line":"      OIDCCryptoPassphrase openstack"},{"line_number":50,"context_line":"      OIDCRedirectURI http://localhost:5000/v3/OS-FEDERATION/identity_providers/goog/protocols/oidc/auth/redirect"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"      \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/oidc/auth\u003e"},{"line_number":53,"context_line":"        AuthType openid-connect"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_1b0ec08d","line":50,"in_reply_to":"7a8c0949_c0728348","updated":"2014-11-06 15:07:01.000000000","message":"@rodrigods - the check is somewhere else, it\u0027s silly. \n\n@nkinder - what was your suggestion? i\u0027m not following?","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b43506fafdbb4406223314a9fa53d96d8596d008","unresolved":false,"context_lines":[{"line_number":47,"context_line":"      OIDCClientID \u003copenid_client_id\u003e"},{"line_number":48,"context_line":"      OIDCClientSecret \u003copenid_client_secret\u003e"},{"line_number":49,"context_line":"      OIDCCryptoPassphrase openstack"},{"line_number":50,"context_line":"      OIDCRedirectURI http://localhost:5000/v3/OS-FEDERATION/identity_providers/goog/protocols/oidc/auth/redirect"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"      \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/oidc/auth\u003e"},{"line_number":53,"context_line":"        AuthType openid-connect"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_34ec71c7","line":50,"in_reply_to":"7a8c0949_e4c4fa60","updated":"2014-11-06 12:02:12.000000000","message":"also, \"oidc\" since the protocol_id is defined by the user.","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"43d057e80f22ee3d8129206cb2b3125e28d64a9e","unresolved":false,"context_lines":[{"line_number":63,"context_line":"`OIDCProviderUserInfoEndpoint`, and `OIDCProviderJwksUri`"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Note, if using a mod_wsgi version less than 4.3.0, then the `OIDCClaimPrefix`"},{"line_number":66,"context_line":"must be specified to have only alphanumerics or a dash (\"-\"), this is because"},{"line_number":67,"context_line":"mod_wsgi blocks headers that do not fit this criteria. See http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.3.0.html#bugs-fixed"},{"line_number":68,"context_line":"for more details"},{"line_number":69,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_64400a57","line":66,"updated":"2014-11-06 10:17:47.000000000","message":"(nit)  I would split this into two sentences starting with \u0027this\u0027.","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"632701b3d648f2e010e8c4bd18b6b4e28b641082","unresolved":false,"context_lines":[{"line_number":63,"context_line":"`OIDCProviderUserInfoEndpoint`, and `OIDCProviderJwksUri`"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Note, if using a mod_wsgi version less than 4.3.0, then the `OIDCClaimPrefix`"},{"line_number":66,"context_line":"must be specified to have only alphanumerics or a dash (\"-\"), this is because"},{"line_number":67,"context_line":"mod_wsgi blocks headers that do not fit this criteria. See http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.3.0.html#bugs-fixed"},{"line_number":68,"context_line":"for more details"},{"line_number":69,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a8c0949_1b6fa0fe","line":66,"in_reply_to":"7a8c0949_64400a57","updated":"2014-11-06 15:07:01.000000000","message":"Done","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"1ae08e36d865f48bacbf65a528553bdf60e81bae","unresolved":false,"context_lines":[{"line_number":47,"context_line":"  \u003cVirtualHost *:5000\u003e"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"      ..."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"      OIDCClaimPrefix \"OIDC-\""},{"line_number":52,"context_line":"      OIDCResponseType \"id_token\""},{"line_number":53,"context_line":"      OIDCScope \"openid email profile\""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_e9d09af9","line":50,"updated":"2014-11-10 20:56:10.000000000","message":"Was there any documentation you can refer the user to that describes what these values are in more detail and how to configure them?","commit_id":"4e12e19c87d3e0c66ca1aab238398be23b6c1553"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7bbdbd5dee58e7a12880a1b3ccf6c1c8fde1b378","unresolved":false,"context_lines":[{"line_number":47,"context_line":"  \u003cVirtualHost *:5000\u003e"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"      ..."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"      OIDCClaimPrefix \"OIDC-\""},{"line_number":52,"context_line":"      OIDCResponseType \"id_token\""},{"line_number":53,"context_line":"      OIDCScope \"openid email profile\""}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a890539_e9533a6a","line":50,"in_reply_to":"5a890539_e9d09af9","updated":"2014-11-10 21:05:36.000000000","message":"the link of line 25 has more info about the different config options.\nI can submit a follow on patch to go into more detail, i\u0027ll probably do that once I\u0027ve tinkered around to get this to work different identity managers.","commit_id":"4e12e19c87d3e0c66ca1aab238398be23b6c1553"}],"keystone/contrib/federation/utils.py":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"859e40bdf9638b6ecbdbd5c08993d0a99881aa79","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"def get_assertion_params_from_env(context):"},{"line_number":138,"context_line":"    LOG.debug(context[\u0027environment\u0027])"},{"line_number":139,"context_line":"    prefix \u003d CONF.federation.assertion_prefix"},{"line_number":140,"context_line":"    for k, v in context[\u0027environment\u0027].items():"},{"line_number":141,"context_line":"        if k.startswith(prefix):"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a8c0949_bdccdd62","line":138,"updated":"2014-11-05 08:39:31.000000000","message":"did you mean to leave this in?","commit_id":"8a40e6ad85ca0303f4cc694dc885345cbf797b22"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"469b4491d591bdabe0eea2ba454fedf5c035ce87","unresolved":false,"context_lines":[{"line_number":135,"context_line":""},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"def get_assertion_params_from_env(context):"},{"line_number":138,"context_line":"    LOG.debug(context[\u0027environment\u0027])"},{"line_number":139,"context_line":"    prefix \u003d CONF.federation.assertion_prefix"},{"line_number":140,"context_line":"    for k, v in context[\u0027environment\u0027].items():"},{"line_number":141,"context_line":"        if k.startswith(prefix):"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a8c0949_48a6d511","line":138,"in_reply_to":"7a8c0949_bdccdd62","updated":"2014-11-05 09:08:23.000000000","message":"so i did mean to, but i think i\u0027ll post another patch for this, I was talking to nkinder about this and there is a lack of debug logging in the federation flows. So maybe i\u0027ll post all this in another patch.","commit_id":"8a40e6ad85ca0303f4cc694dc885345cbf797b22"}],"keystone/token/providers/common.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"1e50995c46d70aab11ec69a7725d68b4fb8399b0","unresolved":false,"context_lines":[{"line_number":430,"context_line":""},{"line_number":431,"context_line":"        token_ref \u003d None"},{"line_number":432,"context_line":"        if \u0027saml2\u0027 in method_names or \u0027oidc\u0027 in method_names:"},{"line_number":433,"context_line":"            token_ref \u003d self._handle_saml2_tokens(auth_context, project_id,"},{"line_number":434,"context_line":"                                                  domain_id)"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"        access_token \u003d None"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a8c0949_b7ccfc62","line":433,"updated":"2014-11-05 02:05:58.000000000","message":"this should be renamed to _handle_mapped_tokens(...) instead","commit_id":"8a40e6ad85ca0303f4cc694dc885345cbf797b22"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"469b4491d591bdabe0eea2ba454fedf5c035ce87","unresolved":false,"context_lines":[{"line_number":430,"context_line":""},{"line_number":431,"context_line":"        token_ref \u003d None"},{"line_number":432,"context_line":"        if \u0027saml2\u0027 in method_names or \u0027oidc\u0027 in method_names:"},{"line_number":433,"context_line":"            token_ref \u003d self._handle_saml2_tokens(auth_context, project_id,"},{"line_number":434,"context_line":"                                                  domain_id)"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"        access_token \u003d None"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a8c0949_a891f99b","line":433,"in_reply_to":"7a8c0949_9d72c17a","updated":"2014-11-05 09:08:23.000000000","message":"i\u0027ll open a bug for this, it should have been fixed when we did bp generic-mapping-federation\n\nhttp://specs.openstack.org/openstack/keystone-specs/specs/juno/generic-mapping-federation.html\n\nso i think it\u0027s a legitimate bug.","commit_id":"8a40e6ad85ca0303f4cc694dc885345cbf797b22"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"859e40bdf9638b6ecbdbd5c08993d0a99881aa79","unresolved":false,"context_lines":[{"line_number":430,"context_line":""},{"line_number":431,"context_line":"        token_ref \u003d None"},{"line_number":432,"context_line":"        if \u0027saml2\u0027 in method_names or \u0027oidc\u0027 in method_names:"},{"line_number":433,"context_line":"            token_ref \u003d self._handle_saml2_tokens(auth_context, project_id,"},{"line_number":434,"context_line":"                                                  domain_id)"},{"line_number":435,"context_line":""},{"line_number":436,"context_line":"        access_token \u003d None"}],"source_content_type":"text/x-python","patch_set":2,"id":"7a8c0949_9d72c17a","line":433,"in_reply_to":"7a8c0949_b7ccfc62","updated":"2014-11-05 08:39:31.000000000","message":"is there a defect/wish list /bp for that?  I\u0027m sure we planned to fix that last time around!  Maybe we even do that in this patch?","commit_id":"8a40e6ad85ca0303f4cc694dc885345cbf797b22"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"43d057e80f22ee3d8129206cb2b3125e28d64a9e","unresolved":false,"context_lines":[{"line_number":429,"context_line":"            trust \u003d self.trust_api.get_trust(metadata_ref[\u0027trust_id\u0027])"},{"line_number":430,"context_line":""},{"line_number":431,"context_line":"        token_ref \u003d None"},{"line_number":432,"context_line":"        if \u0027saml2\u0027 in method_names or \u0027oidc\u0027 in method_names:"},{"line_number":433,"context_line":"            token_ref \u003d self._handle_federation_tokens("},{"line_number":434,"context_line":"                auth_context, project_id, domain_id)"},{"line_number":435,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"7a8c0949_a4fe7236","line":432,"updated":"2014-11-06 10:17:47.000000000","message":"It would be nice if the federated methods could be specified as configuration to allow one to add new federation methods without touching code.","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"632701b3d648f2e010e8c4bd18b6b4e28b641082","unresolved":false,"context_lines":[{"line_number":429,"context_line":"            trust \u003d self.trust_api.get_trust(metadata_ref[\u0027trust_id\u0027])"},{"line_number":430,"context_line":""},{"line_number":431,"context_line":"        token_ref \u003d None"},{"line_number":432,"context_line":"        if \u0027saml2\u0027 in method_names or \u0027oidc\u0027 in method_names:"},{"line_number":433,"context_line":"            token_ref \u003d self._handle_federation_tokens("},{"line_number":434,"context_line":"                auth_context, project_id, domain_id)"},{"line_number":435,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"7a8c0949_60270f13","line":432,"in_reply_to":"7a8c0949_7478b92b","updated":"2014-11-06 15:07:01.000000000","message":"I filed this under https://bugs.launchpad.net/keystone/+bug/1390100 since there are a few different fixes we can do, i\u0027m not resolving it in this patch set.","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b43506fafdbb4406223314a9fa53d96d8596d008","unresolved":false,"context_lines":[{"line_number":429,"context_line":"            trust \u003d self.trust_api.get_trust(metadata_ref[\u0027trust_id\u0027])"},{"line_number":430,"context_line":""},{"line_number":431,"context_line":"        token_ref \u003d None"},{"line_number":432,"context_line":"        if \u0027saml2\u0027 in method_names or \u0027oidc\u0027 in method_names:"},{"line_number":433,"context_line":"            token_ref \u003d self._handle_federation_tokens("},{"line_number":434,"context_line":"                auth_context, project_id, domain_id)"},{"line_number":435,"context_line":""}],"source_content_type":"text/x-python","patch_set":4,"id":"7a8c0949_7478b92b","line":432,"in_reply_to":"7a8c0949_a4fe7236","updated":"2014-11-06 12:02:12.000000000","message":"++ and a private method to check if the token is a federation one, something like _is_federation_token(self, token_method_names)","commit_id":"5ac670079f72c4d2e29a972b4c614ada0b40c5b9"}]}