)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d42be7f9b8b2d509e1e3f9594750bd33e3a7a800","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Instructions to install IETF ABFAB federation protocol on Keystone."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"bp abfab \u003chttps://blueprints.launchpad.net/keystone/+spec/abfab\u003e"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: I65f7d4fccc74757bb87b0757e1f084f2685a96f1"},{"line_number":12,"context_line":"Co-Authored-By: David Chadwick \u003cd.w.chadwick@kent.ac.uk\u003e"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"9a80dd14_e03763fd","line":9,"updated":"2015-03-12 21:42:41.000000000","message":"no need to include the link.","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"}],"doc/source/configure_federation.rst":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d42be7f9b8b2d509e1e3f9594750bd33e3a7a800","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"* To use Shibboleth, follow the steps outlined at: `Setup Shibboleth`_."},{"line_number":63,"context_line":"* To use OpenID Connect, follow the steps outlined at: `Setup OpenID Connect`_."},{"line_number":64,"context_line":"* To use Abfab, follow the steps outlined at: `Setup Abfab`_."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":".. _`Setup Shibboleth`: extensions/shibboleth.html"},{"line_number":67,"context_line":".. _`Setup OpenID Connect`: extensions/openidc.html"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_a0df2bd5","line":64,"updated":"2015-03-12 21:42:41.000000000","message":"Is it Abfab or ABFAB?","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d52af7ea137f21136d6555d3c96abbb6edda7364","unresolved":false,"context_lines":[{"line_number":61,"context_line":""},{"line_number":62,"context_line":"* To use Shibboleth, follow the steps outlined at: `Setup Shibboleth`_."},{"line_number":63,"context_line":"* To use OpenID Connect, follow the steps outlined at: `Setup OpenID Connect`_."},{"line_number":64,"context_line":"* To use Abfab, follow the steps outlined at: `Setup Abfab`_."},{"line_number":65,"context_line":""},{"line_number":66,"context_line":".. _`Setup Shibboleth`: extensions/shibboleth.html"},{"line_number":67,"context_line":".. _`Setup OpenID Connect`: extensions/openidc.html"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_af455444","line":64,"in_reply_to":"9a80dd14_a0df2bd5","updated":"2015-03-13 04:42:21.000000000","message":"the best my googling came up with is ABFAB: \nhttps://datatracker.ietf.org/doc/draft-ietf-abfab-aaa-saml/\n\ni\u0027ll change up the docs to be consistent","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"}],"doc/source/extensions/abfab.rst":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d42be7f9b8b2d509e1e3f9594750bd33e3a7a800","unresolved":false,"context_lines":[{"line_number":1,"context_line":":orphan:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":".."},{"line_number":4,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_6000d334","line":1,"updated":"2015-03-12 21:42:41.000000000","message":"Do we want warning suppressed?","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d52af7ea137f21136d6555d3c96abbb6edda7364","unresolved":false,"context_lines":[{"line_number":1,"context_line":":orphan:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":".."},{"line_number":4,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_2f7164a8","line":1,"in_reply_to":"9a80dd14_6000d334","updated":"2015-03-13 04:42:21.000000000","message":"i think it\u0027s fine, we do this for a bunch of other docs","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d42be7f9b8b2d509e1e3f9594750bd33e3a7a800","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":".. _`connect to an ABFAB IdP`: https://wiki.moonshot.ja.net/display/Moonshot/Configure+a+Linux+Server+to+Connect+to+an+RP+Proxy"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Mod_moonshot also needs Shibboleth service configuration files located at"},{"line_number":68,"context_line":"/etc/shibboleth."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"On RHEL, CentOS or SE Linux distributions, shibd is installed with moonshot"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_e0c203e8","line":67,"updated":"2015-03-12 21:42:41.000000000","message":"mod_moonshot and \"needs the\"","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d52af7ea137f21136d6555d3c96abbb6edda7364","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":".. _`connect to an ABFAB IdP`: https://wiki.moonshot.ja.net/display/Moonshot/Configure+a+Linux+Server+to+Connect+to+an+RP+Proxy"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Mod_moonshot also needs Shibboleth service configuration files located at"},{"line_number":68,"context_line":"/etc/shibboleth."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"On RHEL, CentOS or SE Linux distributions, shibd is installed with moonshot"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_63a450a6","line":67,"in_reply_to":"9a80dd14_e0c203e8","updated":"2015-03-13 04:42:21.000000000","message":"Done","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d52af7ea137f21136d6555d3c96abbb6edda7364","unresolved":false,"context_lines":[{"line_number":91,"context_line":"  \u003cVirtualHost *:5000\u003e"},{"line_number":92,"context_line":"      ..."},{"line_number":93,"context_line":"      \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/abfab/auth\u003e"},{"line_number":94,"context_line":"          AuthType Negotiate"},{"line_number":95,"context_line":"          Require valid-user"},{"line_number":96,"context_line":"      \u003c/LocationMatch\u003e"},{"line_number":97,"context_line":"  \u003c/VirtualHost\u003e"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_5e4c7f42","line":94,"updated":"2015-03-13 04:42:21.000000000","message":"i find it weird that this is the only changes necessary","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"},{"author":{"_account_id":9729,"name":"Ioram Schechtman Sette","email":"iss@cin.ufpe.br","username":"Ioram7"},"change_message_id":"a8814d291c6a5d63dc5b6c246e0ce849a0b0b724","unresolved":false,"context_lines":[{"line_number":91,"context_line":"  \u003cVirtualHost *:5000\u003e"},{"line_number":92,"context_line":"      ..."},{"line_number":93,"context_line":"      \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/abfab/auth\u003e"},{"line_number":94,"context_line":"          AuthType Negotiate"},{"line_number":95,"context_line":"          Require valid-user"},{"line_number":96,"context_line":"      \u003c/LocationMatch\u003e"},{"line_number":97,"context_line":"  \u003c/VirtualHost\u003e"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_8d4db840","line":94,"in_reply_to":"9a80dd14_5e4c7f42","updated":"2015-03-14 14:44:58.000000000","message":"This tells apache to protect the URL with auth_gssapi module.\nauth_gssapi needs the moonshot libraries to run.\nThis module will connect to the Abfab server from radsec.conf.\nThis module will also use the /etc/shibboleth files to decompose the SAML assertion.\n\nPlease tell me what do you think is weird.","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6344096066f187c3f514c30c19a714a06cfd32aa","unresolved":false,"context_lines":[{"line_number":91,"context_line":"  \u003cVirtualHost *:5000\u003e"},{"line_number":92,"context_line":"      ..."},{"line_number":93,"context_line":"      \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/abfab/auth\u003e"},{"line_number":94,"context_line":"          AuthType Negotiate"},{"line_number":95,"context_line":"          Require valid-user"},{"line_number":96,"context_line":"      \u003c/LocationMatch\u003e"},{"line_number":97,"context_line":"  \u003c/VirtualHost\u003e"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_9a988776","line":94,"in_reply_to":"9a80dd14_8d4db840","updated":"2015-03-14 22:32:46.000000000","message":"i was just expecting more sever info, but i guess that\u0027s all radsec.conf, i admit i didn\u0027t fully read the wiki install/config docs that are linked above.","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"d52af7ea137f21136d6555d3c96abbb6edda7364","unresolved":false,"context_lines":[{"line_number":96,"context_line":"      \u003c/LocationMatch\u003e"},{"line_number":97,"context_line":"  \u003c/VirtualHost\u003e"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"  \u003cVirtualHost *:35357\u003e"},{"line_number":100,"context_line":"      ..."},{"line_number":101,"context_line":"      \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/abfab/auth\u003e"},{"line_number":102,"context_line":"          AuthType Negotiate"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_833dc42d","line":99,"updated":"2015-03-13 04:42:21.000000000","message":"I don\u0027t think we want this section as it\u0027s for v2 admin requests only, and we don\u0027t support federation for v2 requests","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6344096066f187c3f514c30c19a714a06cfd32aa","unresolved":false,"context_lines":[{"line_number":96,"context_line":"      \u003c/LocationMatch\u003e"},{"line_number":97,"context_line":"  \u003c/VirtualHost\u003e"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"  \u003cVirtualHost *:35357\u003e"},{"line_number":100,"context_line":"      ..."},{"line_number":101,"context_line":"      \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/abfab/auth\u003e"},{"line_number":102,"context_line":"          AuthType Negotiate"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_7aabd374","line":99,"in_reply_to":"9a80dd14_0d08e8d8","updated":"2015-03-14 22:32:46.000000000","message":"back in the v2.0 only world (pre-grizzly), the ports specified admin (35357) vs non-admin (5000) actions. \n\nin the v3 world, everything should go through port 5000, and we just look at the roles in the token.\n\ni would have thought that if no locationMatch is set for that port, then the idp login shouldn\u0027t be brought up at all, it should just result in a 404 with resource not found... let me dig into this a bit","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"},{"author":{"_account_id":9729,"name":"Ioram Schechtman Sette","email":"iss@cin.ufpe.br","username":"Ioram7"},"change_message_id":"a8814d291c6a5d63dc5b6c246e0ce849a0b0b724","unresolved":false,"context_lines":[{"line_number":96,"context_line":"      \u003c/LocationMatch\u003e"},{"line_number":97,"context_line":"  \u003c/VirtualHost\u003e"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"  \u003cVirtualHost *:35357\u003e"},{"line_number":100,"context_line":"      ..."},{"line_number":101,"context_line":"      \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/abfab/auth\u003e"},{"line_number":102,"context_line":"          AuthType Negotiate"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_0d08e8d8","line":99,"in_reply_to":"9a80dd14_833dc42d","updated":"2015-03-14 14:44:58.000000000","message":"I was not aware that port 35357 was supposed to receive only v2 requests. Is this new on Juno or Kilo versions?\nIn my icehouse installation, port 35357 can receive calls using the v3 API. I have tested calling:\nhttp://icehouse.sec.cs.kent.ac.uk:35357/v3/OS-FEDERATION/identity_providers/JaNet/protocols/abfab/auth\nIf this URL is not protected, the user can log in without any authentication.\nIf this URL is still valid in juno/kilo, I suggest that we point out to protect it with the entries:\n        Order allow,deny\n        Deny from all","commit_id":"e35272dc51e436d7445f1e1187b03abd451cfa46"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"4ea65cb9e42208048f02713ab379a9b2f858730e","unresolved":false,"context_lines":[{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Federate Keystone (SP) and an external IdP using ABFAB (`mod_moonshot`_)"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":".. _`mod_moonshot`: http://www.project-moonshot.org"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The links below present instructions to install `mod_moonshot` (a.k.a."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_3eaa3885","line":24,"updated":"2015-03-14 03:17:36.000000000","message":"While it helps to have the link to moonshot it would really be helpful to have a link to the most stable description of abfab (either a published standard link or the most recent draft).  This would be helpful because I went and looked and there are lots of IETF abfab drafts out there and it was not clear what really defines this \"standard\". Other than that looks good","commit_id":"d39be8605212232e11f814b1b3b4e75fd98923ed"},{"author":{"_account_id":9729,"name":"Ioram Schechtman Sette","email":"iss@cin.ufpe.br","username":"Ioram7"},"change_message_id":"2e604cb7ad4ec8f54194947fd4a2b66d481b8015","unresolved":false,"context_lines":[{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"Federate Keystone (SP) and an external IdP using ABFAB (`mod_moonshot`_)"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":".. _`mod_moonshot`: http://www.project-moonshot.org"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The links below present instructions to install `mod_moonshot` (a.k.a."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_2de3ecd9","line":24,"in_reply_to":"9a80dd14_3eaa3885","updated":"2015-03-14 15:16:23.000000000","message":"done.","commit_id":"d39be8605212232e11f814b1b3b4e75fd98923ed"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"d20c1c24b9d7df59350dd5a5e5a778fe8eeaad12","unresolved":false,"context_lines":[{"line_number":73,"context_line":"On RHEL, CentOS or SE Linux distributions, shibd is installed with moonshot"},{"line_number":74,"context_line":"libraries, so the files just need to be configured."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"On Ubuntu 12.04 or 14.04, you should install mod_shib and then disable it."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":".. code-block:: bash"},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_abe53a0a","line":76,"updated":"2015-03-13 07:24:53.000000000","message":"why?","commit_id":"d39be8605212232e11f814b1b3b4e75fd98923ed"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c931f4864d192d3744cd8f251220def4c499f6be","unresolved":false,"context_lines":[{"line_number":73,"context_line":"On RHEL, CentOS or SE Linux distributions, shibd is installed with moonshot"},{"line_number":74,"context_line":"libraries, so the files just need to be configured."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"On Ubuntu 12.04 or 14.04, you should install mod_shib and then disable it."},{"line_number":77,"context_line":""},{"line_number":78,"context_line":".. code-block:: bash"},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_3accfb69","line":76,"in_reply_to":"9a80dd14_abe53a0a","updated":"2015-03-14 22:33:31.000000000","message":"i think it needs the libraries, but not the handling mechanisms","commit_id":"d39be8605212232e11f814b1b3b4e75fd98923ed"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"96c7fd353663d206870c9b4a1c559bc6519ba1f7","unresolved":false,"context_lines":[{"line_number":56,"context_line":"* `Install Moonshot Libraries on Ubuntu 14.04 LTS`_"},{"line_number":57,"context_line":"* `Install mod_moonshot on Ubuntu 14.04 LTS`_"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":".. _`Install Moonshot Libraries on Ubuntu 14.04 LTS`: https://wiki.moonshot.ja.net/display/Moonshot/Install+Moonshot+Libraries+on+Ubuntu+14.04+LTS"},{"line_number":60,"context_line":".. _`Install mod_moonshot on Ubuntu 14.04 LTS`: https://wiki.moonshot.ja.net/display/Moonshot/Apache+HTTPD+on+Debian+7"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"Debian 7:"}],"source_content_type":"text/x-rst","patch_set":10,"id":"1aca2d91_e21f5306","line":59,"updated":"2015-05-09 00:21:03.000000000","message":"I tried to follow the instructions from this link to install the Moonshot daily key like -\n$ apt-key adv --keyserver keyserver.ubuntu.com --recv-keys B18F7887\nIt failed me, and I looked up from the server, I did not see this key named B18F7887. \nI\u0027m not sure if that name is out-dated or this patch may need to have more instructions for the update for that?","commit_id":"e475f4d56f4e221a4f511e7c0bf12f2ef7ef7916"}]}