)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3fb843cea4268e6a0f841d7b1f74488b5c8cf772","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2015-03-13 01:43:46 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Document websso setup"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"there are a few extra steps necessary for supporing horizon and"},{"line_number":10,"context_line":"a federated keystone, these need to be documented."},{"line_number":11,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9a80dd14_6b5a622b","line":8,"updated":"2015-03-13 07:13:14.000000000","message":"Are we missing some bp reference here?","commit_id":"0093a27b9eae51cf3e02e6c556ed20f9111409b7"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7906fefdbb1703ca35cddf38f724347ab56211f3","unresolved":false,"context_lines":[{"line_number":5,"context_line":"CommitDate: 2015-03-13 01:43:46 -0400"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Document websso setup"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"there are a few extra steps necessary for supporing horizon and"},{"line_number":10,"context_line":"a federated keystone, these need to be documented."},{"line_number":11,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"9a80dd14_4a72067d","line":8,"in_reply_to":"9a80dd14_6b5a622b","updated":"2015-03-19 05:44:34.000000000","message":"the BP is already marked complete, if you feel it\u0027s necessary to open a bug/bp for docs then let me know, but i don\u0027t want to have to open a bug for every change (unless it\u0027s actually a functional bug)","commit_id":"0093a27b9eae51cf3e02e6c556ed20f9111409b7"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"7ffb61149612e7c2e4488965a714a1b346413201","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Document websso setup"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"there are a few extra steps necessary for supporing horizon and"},{"line_number":10,"context_line":"a federated keystone, these need to be documented."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I468e5591de9b77b44de995d855dc9b133bf0e741"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"1a6ced46_d1828151","line":9,"updated":"2015-03-24 00:38:01.000000000","message":"supporting","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Document websso setup"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"there are a few extra steps necessary for supporing horizon and"},{"line_number":10,"context_line":"a federated keystone, these need to be documented."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I468e5591de9b77b44de995d855dc9b133bf0e741"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":8,"id":"1a6ced46_bb9689ee","line":9,"in_reply_to":"1a6ced46_d1828151","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"}],"doc/source/configure_federation.rst":[{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3fb843cea4268e6a0f841d7b1f74488b5c8cf772","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"9a80dd14_a8cc608a","updated":"2015-03-13 07:13:14.000000000","message":"OK","commit_id":"0093a27b9eae51cf3e02e6c556ed20f9111409b7"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":68,"context_line":"Configure Keystone and Horizon for Single Sign-On"},{"line_number":69,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"* To configure horizon to access a federated keystone,"},{"line_number":72,"context_line":"  follow the steps outlined at: `Keystone Federation and Horizon`_."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":".. _`Keystone Federation and Horizon`: extensions/websso.html"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_f9670d4b","line":71,"updated":"2015-03-25 18:35:30.000000000","message":"Should this be Horizon and Keystone?","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[{"line_number":68,"context_line":"Configure Keystone and Horizon for Single Sign-On"},{"line_number":69,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"* To configure horizon to access a federated keystone,"},{"line_number":72,"context_line":"  follow the steps outlined at: `Keystone Federation and Horizon`_."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":".. _`Keystone Federation and Horizon`: extensions/websso.html"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_632cdf4a","line":71,"in_reply_to":"1a6ced46_f9670d4b","updated":"2015-04-02 06:20:02.000000000","message":"refer to comment in other file","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":11387,"name":"Sam Leong","email":"chio-fai-sam.leong@hpe.com","username":"Chioleong"},"change_message_id":"ec24e0fe80d1f9abd4f5e8661315644dbb1cdf23","unresolved":false,"context_lines":[{"line_number":71,"context_line":"* To configure horizon to access a federated keystone,"},{"line_number":72,"context_line":"  follow the steps outlined at: `Keystone Federation and Horizon`_."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":".. _`Keystone Federation and Horizon`: extensions/websso.html"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Enable the ``OS-FEDERATION`` extension"},{"line_number":77,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_0cb0addc","line":74,"updated":"2015-04-01 23:09:45.000000000","message":"I think you meant extensions/websso.rst","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[{"line_number":71,"context_line":"* To configure horizon to access a federated keystone,"},{"line_number":72,"context_line":"  follow the steps outlined at: `Keystone Federation and Horizon`_."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":".. _`Keystone Federation and Horizon`: extensions/websso.html"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Enable the ``OS-FEDERATION`` extension"},{"line_number":77,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_e3f90fca","line":74,"in_reply_to":"baa041b7_0cb0addc","updated":"2015-04-02 06:20:02.000000000","message":"nope, i meant this :)","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"}],"doc/source/extensions/websso.rst":[{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c25d0e4c216d1c43e8e4cd03f756eaaf5d99fe02","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"  [federation]"},{"line_number":33,"context_line":"  trusted_dashboard \u003d http://acme.horizon.com"},{"line_number":34,"context_line":"  trusted_dashboard \u003d http://beta.horizon.com"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"2. Update Apache vhost file with websso information."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a80dd14_f8662b50","line":34,"updated":"2015-03-13 03:44:07.000000000","message":"to get this working with horizon, the value is http://\u003chost\u003e/auth/websso\n\nI wonder if we need to relax the keystone validation to just really check the host and not the full url.","commit_id":"c5a75a815d56b34782ba62d556c611d95fc63b07"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"09de18b8f5346a6663eb96d562762964c08e6785","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"  [federation]"},{"line_number":33,"context_line":"  trusted_dashboard \u003d http://acme.horizon.com"},{"line_number":34,"context_line":"  trusted_dashboard \u003d http://beta.horizon.com"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"2. Update Apache vhost file with websso information."},{"line_number":37,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a80dd14_725b37f6","line":34,"in_reply_to":"9a80dd14_f8662b50","updated":"2015-03-13 05:42:41.000000000","message":"good suggestion, we should change keystone to be a bit smarter, but for now i just added /auth/websso","commit_id":"c5a75a815d56b34782ba62d556c611d95fc63b07"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c25d0e4c216d1c43e8e4cd03f756eaaf5d99fe02","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"3. Update `remote_id_attribute` in keystone.conf."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"A remote id attribute indicated the the header to retrieve from the WSGI"},{"line_number":59,"context_line":"environment. This header should contain information about the identity"},{"line_number":60,"context_line":"provider. For `mod_shib` this would be `Shib-Identity-Provider`, for"},{"line_number":61,"context_line":"`mod_auth_openidc`, this could be `HTTP_OIDC_ISS`."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a80dd14_78d95bf2","line":58,"updated":"2015-03-13 03:44:07.000000000","message":"duplicate \"the\"\n\n\"indicates\"?","commit_id":"c5a75a815d56b34782ba62d556c611d95fc63b07"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"09de18b8f5346a6663eb96d562762964c08e6785","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"3. Update `remote_id_attribute` in keystone.conf."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"A remote id attribute indicated the the header to retrieve from the WSGI"},{"line_number":59,"context_line":"environment. This header should contain information about the identity"},{"line_number":60,"context_line":"provider. For `mod_shib` this would be `Shib-Identity-Provider`, for"},{"line_number":61,"context_line":"`mod_auth_openidc`, this could be `HTTP_OIDC_ISS`."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a80dd14_f26647ba","line":58,"in_reply_to":"9a80dd14_78d95bf2","updated":"2015-03-13 05:42:41.000000000","message":"Done","commit_id":"c5a75a815d56b34782ba62d556c611d95fc63b07"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c25d0e4c216d1c43e8e4cd03f756eaaf5d99fe02","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    The motivation for this approach was to have ensure there is some"},{"line_number":88,"context_line":"    identity provider data in an assertion. Thus removing the requirement for"},{"line_number":89,"context_line":"    horizon to list multiple (or all) identity providers from keystone."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a80dd14_7875dbc9","line":89,"updated":"2015-03-13 03:44:07.000000000","message":"Do we need to mention what settings are needed in Horizon?","commit_id":"c5a75a815d56b34782ba62d556c611d95fc63b07"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"09de18b8f5346a6663eb96d562762964c08e6785","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"    The motivation for this approach was to have ensure there is some"},{"line_number":88,"context_line":"    identity provider data in an assertion. Thus removing the requirement for"},{"line_number":89,"context_line":"    horizon to list multiple (or all) identity providers from keystone."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9a80dd14_437f4c66","line":89,"in_reply_to":"9a80dd14_7875dbc9","updated":"2015-03-13 05:42:41.000000000","message":"i wouldn\u0027t be opposed to doing that here, just wondering if it\u0027s the right spot, does horizon have a section that it would logically be added to? if not, i don\u0027t mind adding it here\n\n*edit*, i was initially going to write a draft, but ended up writing it all.","commit_id":"c5a75a815d56b34782ba62d556c611d95fc63b07"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3fb843cea4268e6a0f841d7b1f74488b5c8cf772","unresolved":false,"context_lines":[{"line_number":66,"context_line":".. code-block:: ini"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"  [federation]"},{"line_number":69,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"4. Set `remote_id` for a keystone identity provider."},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_886ebc2d","line":69,"updated":"2015-03-13 07:13:14.000000000","message":"Just a heads up: There is a now unblocked patch that brings multiple remote_ids per IdP and which changes the proper section of remote_id_attribute (see line ~150 https://review.openstack.org/#/c/152156/25/keystone/contrib/federation/utils.py ).\nI am confident it will get an FFE, so maybe we should hold off for a moment with merging this patch and simply update docs when the situation with the pending patch is clear.","commit_id":"0093a27b9eae51cf3e02e6c556ed20f9111409b7"},{"author":{"_account_id":10335,"name":"Marco Fargetta","email":"marco.fargetta@ct.infn.it","username":"fmarco76"},"change_message_id":"2c5ce3add32f27ce1f6dcbc9ae9a81b93762c549","unresolved":false,"context_lines":[{"line_number":66,"context_line":".. code-block:: ini"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"  [federation]"},{"line_number":69,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"4. Set `remote_id` for a keystone identity provider."},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_c532485d","line":69,"in_reply_to":"9a80dd14_886ebc2d","updated":"2015-03-13 15:30:41.000000000","message":"If the patch get merged you may assign a remote_id_attribute per protocol but the current one is still valid. However, to use the new one I think you have to patch the code first and then the documentation. So if this guideline has to reflect the current websso implementation I think this is OK and when/if the other patch is merged you have to change the code and the doc.","commit_id":"0093a27b9eae51cf3e02e6c556ed20f9111409b7"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7906fefdbb1703ca35cddf38f724347ab56211f3","unresolved":false,"context_lines":[{"line_number":66,"context_line":".. code-block:: ini"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"  [federation]"},{"line_number":69,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"4. Set `remote_id` for a keystone identity provider."},{"line_number":72,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_2ab6b2f9","line":69,"in_reply_to":"9a80dd14_c532485d","updated":"2015-03-19 05:44:34.000000000","message":"i changed up this section to reflect the comments","commit_id":"0093a27b9eae51cf3e02e6c556ed20f9111409b7"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3fb843cea4268e6a0f841d7b1f74488b5c8cf772","unresolved":false,"context_lines":[{"line_number":68,"context_line":"  [federation]"},{"line_number":69,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"4. Set `remote_id` for a keystone identity provider."},{"line_number":72,"context_line":""},{"line_number":73,"context_line":"A keystone identity provider may have multiple `remote_ids` specified, this"},{"line_number":74,"context_line":"setting allows the same *keystone* identity provider resource to be used"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_8826bccc","line":71,"updated":"2015-03-13 07:13:14.000000000","message":"As of today (13 March 2015) the change that allows for multiple remote_ids is not merged. However I am glad to see that the docs are being prepared for that.\nHowever, it\u0027d be better to update section 3. and say that remote_id_attribute should be put in the sections whose names are equal to protocol\u0027s name (those added via OS-FEDERATION api) and the [federation] is the last resort.\n\nIf we have protocols like saml2 and oidc added via OS-FEDERATION api then I\u0027d expect configuration in keystone.conf:\n[saml2]\nremote_id_attribute \u003d Shib-Idntity-Provider\n\n[oidc]\nremote_id_attribute \u003d HTTP_OIDC_ISS\n\n\nLastly, if such sections are not added Keystone will try one last time and query config file looking for attribute in [federation] section.\n\nIt\u0027s unlikely to handle more than one federation protocol, but eventually Keystone is ready for that.","commit_id":"0093a27b9eae51cf3e02e6c556ed20f9111409b7"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3fb843cea4268e6a0f841d7b1f74488b5c8cf772","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    The motivation for this approach was to have ensure there is some"},{"line_number":91,"context_line":"    identity provider data in an assertion. Thus removing the requirement for"},{"line_number":92,"context_line":"    horizon to list multiple (or all) identity providers from keystone."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"horizon changes"},{"line_number":95,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":96,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_2b54eafd","line":93,"updated":"2015-03-13 07:13:14.000000000","message":"We could also add some section that since now we are using one entry point `/v3/auth/OS-FEDERATION/websso/` and one need to use multiple IdP it\u0027s standard WebSSO usecase and we recommend using external 3-rd party software for Discovery Service, e.g. https://wiki.shibboleth.net/confluence/display/SHIB2/DiscoveryService","commit_id":"0093a27b9eae51cf3e02e6c556ed20f9111409b7"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7906fefdbb1703ca35cddf38f724347ab56211f3","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    The motivation for this approach was to have ensure there is some"},{"line_number":91,"context_line":"    identity provider data in an assertion. Thus removing the requirement for"},{"line_number":92,"context_line":"    horizon to list multiple (or all) identity providers from keystone."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"horizon changes"},{"line_number":95,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":96,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_0aa80e8b","line":93,"in_reply_to":"9a80dd14_2b54eafd","updated":"2015-03-19 05:44:34.000000000","message":"i\u0027d have to talk to you about this one, i\u0027m a bit unclear, but if you want to add in some content please go ahead and do so (override this patch or attach a follow-on)","commit_id":"0093a27b9eae51cf3e02e6c556ed20f9111409b7"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"ab65e9d395cfcc8ba35b079dae6b67c867848537","unresolved":false,"context_lines":[{"line_number":102,"context_line":".. code-block:: ini"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"  OPENSTACK_KEYSTONE_URL \u003d \"http://localhost:5000/v3\""},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"2. Enable the WebSSO setting."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Ensure the `WEBSSO_ENABLED` is set to True in horizon\u0027s settings.py file, this"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_78505232","line":105,"updated":"2015-03-13 19:46:49.000000000","message":"this have to be set as well to tell horizon the keystone api version: https://github.com/openstack/horizon/blob/master/openstack_dashboard/local/local_settings.py.example#L50\n\nOPENSTACK_API_VERSIONS \u003d {\n    \"identity\": 3,\n}","commit_id":"0093a27b9eae51cf3e02e6c556ed20f9111409b7"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7906fefdbb1703ca35cddf38f724347ab56211f3","unresolved":false,"context_lines":[{"line_number":102,"context_line":".. code-block:: ini"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"  OPENSTACK_KEYSTONE_URL \u003d \"http://localhost:5000/v3\""},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"2. Enable the WebSSO setting."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Ensure the `WEBSSO_ENABLED` is set to True in horizon\u0027s settings.py file, this"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a80dd14_2a287232","line":105,"in_reply_to":"9a80dd14_78505232","updated":"2015-03-19 05:44:34.000000000","message":"done! thanks i knew i forgot something","commit_id":"0093a27b9eae51cf3e02e6c556ed20f9111409b7"},{"author":{"_account_id":13063,"name":"WEI CHEN","email":"dave.jungler@gmail.com","username":"wei.d.chen"},"change_message_id":"16cd6af8a389896e0baceed3b141569001df2493","unresolved":false,"context_lines":[{"line_number":1,"context_line":":orphan:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":".."},{"line_number":4,"context_line":"      Copyright 2011-2013 OpenStack, Foundation"},{"line_number":5,"context_line":"      All Rights Reserved."},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_c9c1a34f","line":4,"updated":"2015-03-19 07:06:54.000000000","message":"Need change the date and the company?","commit_id":"c2ef36c3313196cde46241efb5b7566934842159"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8feb78f023964d1dbfb8d0a271bcbdcc73574aaa","unresolved":false,"context_lines":[{"line_number":1,"context_line":":orphan:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":".."},{"line_number":4,"context_line":"      Copyright 2011-2013 OpenStack, Foundation"},{"line_number":5,"context_line":"      All Rights Reserved."},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_ee956488","line":4,"in_reply_to":"9a80dd14_c9c1a34f","updated":"2015-03-19 20:10:55.000000000","message":"Done","commit_id":"c2ef36c3313196cde46241efb5b7566934842159"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"394002269616350a8a5a761310f8246586224f9b","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  [saml2]"},{"line_number":78,"context_line":"  remote_id_attribute \u003d Shib-Identity-Provider"},{"line_number":79,"context_line":"  [oidc]"},{"line_number":80,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"4. Set `remote_ids` for a keystone identity provider."},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_c9b7e31f","line":80,"updated":"2015-03-19 07:00:43.000000000","message":"I personally think we should advise users to always choose per-protocol configuration, and keep configuring this parameter in the [federation] .\nAlso, some explanation why two possible sections in the config would be very useful.","commit_id":"c2ef36c3313196cde46241efb5b7566934842159"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8feb78f023964d1dbfb8d0a271bcbdcc73574aaa","unresolved":false,"context_lines":[{"line_number":77,"context_line":"  [saml2]"},{"line_number":78,"context_line":"  remote_id_attribute \u003d Shib-Identity-Provider"},{"line_number":79,"context_line":"  [oidc]"},{"line_number":80,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"4. Set `remote_ids` for a keystone identity provider."},{"line_number":83,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a80dd14_0e9398a3","line":80,"in_reply_to":"9a80dd14_c9b7e31f","updated":"2015-03-19 20:10:55.000000000","message":"Done, i reworded things a bit","commit_id":"c2ef36c3313196cde46241efb5b7566934842159"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c97f99abaadde257fd2c5a1fa52a6caf0da022c5","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"1. Set the Identity Service version to 3"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Ensure the `OPENSTACK_API_VERSIONS` option in horizon\u0027s settings.py has been"},{"line_number":110,"context_line":"updated to indicate that the `identity` version to use is `3`."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a80dd14_b9c5675d","line":109,"updated":"2015-03-20 04:45:55.000000000","message":"settings.py \u003d\u003e local_settings.py","commit_id":"5f87a377a504a0431180b1c944e0f5ad2bc53937"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"a3a725233e491c67c48605f03d120c5e638e8f63","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"1. Set the Identity Service version to 3"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Ensure the `OPENSTACK_API_VERSIONS` option in horizon\u0027s settings.py has been"},{"line_number":110,"context_line":"updated to indicate that the `identity` version to use is `3`."},{"line_number":111,"context_line":""},{"line_number":112,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a80dd14_d4df4264","line":109,"in_reply_to":"9a80dd14_b9c5675d","updated":"2015-03-20 05:35:50.000000000","message":"Done","commit_id":"5f87a377a504a0431180b1c944e0f5ad2bc53937"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c97f99abaadde257fd2c5a1fa52a6caf0da022c5","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"2. Authenticate against Identity Server v3."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Ensure the `OPENSTACK_KEYSTONE_URL` option in horizon\u0027s settings.py has been"},{"line_number":121,"context_line":"updated to point to a v3 URL."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a80dd14_d9c05b4c","line":120,"updated":"2015-03-20 04:45:55.000000000","message":"local_settings.py","commit_id":"5f87a377a504a0431180b1c944e0f5ad2bc53937"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"a3a725233e491c67c48605f03d120c5e638e8f63","unresolved":false,"context_lines":[{"line_number":117,"context_line":""},{"line_number":118,"context_line":"2. Authenticate against Identity Server v3."},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Ensure the `OPENSTACK_KEYSTONE_URL` option in horizon\u0027s settings.py has been"},{"line_number":121,"context_line":"updated to point to a v3 URL."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a80dd14_14d55a42","line":120,"in_reply_to":"9a80dd14_d9c05b4c","updated":"2015-03-20 05:35:50.000000000","message":"Done","commit_id":"5f87a377a504a0431180b1c944e0f5ad2bc53937"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"c97f99abaadde257fd2c5a1fa52a6caf0da022c5","unresolved":false,"context_lines":[{"line_number":126,"context_line":""},{"line_number":127,"context_line":"3. Enable the WebSSO setting."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Ensure the `WEBSSO_ENABLED` is set to True in horizon\u0027s settings.py file, this"},{"line_number":130,"context_line":"will provide users with an updated login screen for horizon."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a80dd14_b99c876b","line":129,"updated":"2015-03-20 04:45:55.000000000","message":"local_settings.py","commit_id":"5f87a377a504a0431180b1c944e0f5ad2bc53937"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"a3a725233e491c67c48605f03d120c5e638e8f63","unresolved":false,"context_lines":[{"line_number":126,"context_line":""},{"line_number":127,"context_line":"3. Enable the WebSSO setting."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Ensure the `WEBSSO_ENABLED` is set to True in horizon\u0027s settings.py file, this"},{"line_number":130,"context_line":"will provide users with an updated login screen for horizon."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a80dd14_34c89ea7","line":129,"in_reply_to":"9a80dd14_b99c876b","updated":"2015-03-20 05:35:50.000000000","message":"Done","commit_id":"5f87a377a504a0431180b1c944e0f5ad2bc53937"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"66ce3ec2d3be19bd08134894d0df74dfb6f8ffa6","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"1. Update `trusted_dashboard` in keystone.conf."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Specify hostnames of trusted horizon servers. This value may be repeated"},{"line_number":26,"context_line":"multiple times. This setting ensures that keystone only sends token data back"},{"line_number":27,"context_line":"to trusted servers only. This is performed as a precaution, specifically to"},{"line_number":28,"context_line":"prevent man-in-the-middle (MITM) attacks."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_54b512eb","line":25,"updated":"2015-03-20 05:54:01.000000000","message":"They are URLs, not hostnames.","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f2b9b87cd1a901e9374bb5c1ea1526f8aecb8bac","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"1. Update `trusted_dashboard` in keystone.conf."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Specify hostnames of trusted horizon servers. This value may be repeated"},{"line_number":26,"context_line":"multiple times. This setting ensures that keystone only sends token data back"},{"line_number":27,"context_line":"to trusted servers only. This is performed as a precaution, specifically to"},{"line_number":28,"context_line":"prevent man-in-the-middle (MITM) attacks."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_a8c6f246","line":25,"in_reply_to":"9a80dd14_54b512eb","updated":"2015-03-20 06:51:57.000000000","message":"Done","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"66ce3ec2d3be19bd08134894d0df74dfb6f8ffa6","unresolved":false,"context_lines":[{"line_number":56,"context_line":"3. Update `remote_id_attribute` in keystone.conf."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"A remote id attribute indicates the header to retrieve from the WSGI"},{"line_number":59,"context_line":"environment. This header should contain information about the identity"},{"line_number":60,"context_line":"provider. For `mod_shib` this would be `Shib-Identity-Provider`, for"},{"line_number":61,"context_line":"`mod_auth_openidc`, this could be `HTTP_OIDC_ISS`."},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_7496964d","line":59,"updated":"2015-03-20 05:54:01.000000000","message":"Maybe say \"about the identity of the identity provider\"?","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f2b9b87cd1a901e9374bb5c1ea1526f8aecb8bac","unresolved":false,"context_lines":[{"line_number":56,"context_line":"3. Update `remote_id_attribute` in keystone.conf."},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"A remote id attribute indicates the header to retrieve from the WSGI"},{"line_number":59,"context_line":"environment. This header should contain information about the identity"},{"line_number":60,"context_line":"provider. For `mod_shib` this would be `Shib-Identity-Provider`, for"},{"line_number":61,"context_line":"`mod_auth_openidc`, this could be `HTTP_OIDC_ISS`."},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_08dffe0d","line":59,"in_reply_to":"9a80dd14_7496964d","updated":"2015-03-20 06:51:57.000000000","message":"Done","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"66ce3ec2d3be19bd08134894d0df74dfb6f8ffa6","unresolved":false,"context_lines":[{"line_number":69,"context_line":"  [oidc]"},{"line_number":70,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatively, a generic options may be set at the `[federation]` level."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":".. code-block:: ini"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_f4bb66e2","line":72,"updated":"2015-03-20 05:54:01.000000000","message":"(nit) s/generics/generic/","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f2b9b87cd1a901e9374bb5c1ea1526f8aecb8bac","unresolved":false,"context_lines":[{"line_number":69,"context_line":"  [oidc]"},{"line_number":70,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Alternatively, a generic options may be set at the `[federation]` level."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":".. code-block:: ini"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_c8d88620","line":72,"in_reply_to":"9a80dd14_f4bb66e2","updated":"2015-03-20 06:51:57.000000000","message":"reworded this to \u0027generic option\u0027 (singular)","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"66ce3ec2d3be19bd08134894d0df74dfb6f8ffa6","unresolved":false,"context_lines":[{"line_number":90,"context_line":".. NOTE::"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    It\u0027s important to know that in the case of using horizon and keystone"},{"line_number":93,"context_line":"    federation, it is necessary to set the keystone IdP entry ID to the"},{"line_number":94,"context_line":"    value that will be returned from the `remote_id_attribute` key."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    For instance, if `remote_id_attribute` is set as `HTTP_OIDC_ISS`,"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_94cdca5f","line":93,"updated":"2015-03-20 05:54:01.000000000","message":"To make this more clear, I would say \"it is necessary to set the keystone IdP entry\u0027s `remote_id` to the value that will be returned from the `remote_id_attribute` key.\n\nIf multiple remote IDs make it into Kilo, you will want to adjust the wording slightly.","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f2b9b87cd1a901e9374bb5c1ea1526f8aecb8bac","unresolved":false,"context_lines":[{"line_number":90,"context_line":".. NOTE::"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    It\u0027s important to know that in the case of using horizon and keystone"},{"line_number":93,"context_line":"    federation, it is necessary to set the keystone IdP entry ID to the"},{"line_number":94,"context_line":"    value that will be returned from the `remote_id_attribute` key."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    For instance, if `remote_id_attribute` is set as `HTTP_OIDC_ISS`,"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_6836ba52","line":93,"in_reply_to":"9a80dd14_94cdca5f","updated":"2015-03-20 06:51:57.000000000","message":"i wrote this as:\n\nIt is necessary that the value returned from the `remote_id_attribute` key should be included in the keystone IdP entry\u0027s `remote_ids`.","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"66ce3ec2d3be19bd08134894d0df74dfb6f8ffa6","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    For instance, if `remote_id_attribute` is set as `HTTP_OIDC_ISS`,"},{"line_number":97,"context_line":"    a typical value would be `accounts.example.com`. This should be the"},{"line_number":98,"context_line":"    ID for the Identity Providers in keystone."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    The motivation for this approach was to have ensure there is some"},{"line_number":101,"context_line":"    identity provider data in an assertion. Thus removing the requirement for"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_74f9367f","line":98,"updated":"2015-03-20 05:54:01.000000000","message":"The remote ID, not just ID.","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f2b9b87cd1a901e9374bb5c1ea1526f8aecb8bac","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    For instance, if `remote_id_attribute` is set as `HTTP_OIDC_ISS`,"},{"line_number":97,"context_line":"    a typical value would be `accounts.example.com`. This should be the"},{"line_number":98,"context_line":"    ID for the Identity Providers in keystone."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    The motivation for this approach was to have ensure there is some"},{"line_number":101,"context_line":"    identity provider data in an assertion. Thus removing the requirement for"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_a83b5236","line":98,"in_reply_to":"9a80dd14_74f9367f","updated":"2015-03-20 06:51:57.000000000","message":"Done","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"66ce3ec2d3be19bd08134894d0df74dfb6f8ffa6","unresolved":false,"context_lines":[{"line_number":98,"context_line":"    ID for the Identity Providers in keystone."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    The motivation for this approach was to have ensure there is some"},{"line_number":101,"context_line":"    identity provider data in an assertion. Thus removing the requirement for"},{"line_number":102,"context_line":"    horizon to list multiple (or all) identity providers from keystone."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"horizon changes"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_f42c4604","line":101,"updated":"2015-03-20 05:54:01.000000000","message":"(nit) ...or claim in the case of OpenID Connect.","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f2b9b87cd1a901e9374bb5c1ea1526f8aecb8bac","unresolved":false,"context_lines":[{"line_number":98,"context_line":"    ID for the Identity Providers in keystone."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    The motivation for this approach was to have ensure there is some"},{"line_number":101,"context_line":"    identity provider data in an assertion. Thus removing the requirement for"},{"line_number":102,"context_line":"    horizon to list multiple (or all) identity providers from keystone."},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"horizon changes"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_e841caa6","line":101,"in_reply_to":"9a80dd14_f42c4604","updated":"2015-03-20 06:51:57.000000000","message":"Done","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"66ce3ec2d3be19bd08134894d0df74dfb6f8ffa6","unresolved":false,"context_lines":[{"line_number":126,"context_line":""},{"line_number":127,"context_line":"3. Enable the WebSSO setting."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Ensure the `WEBSSO_ENABLED` is set to True in horizon\u0027s local_settings.py file,"},{"line_number":130,"context_line":"this will provide users with an updated login screen for horizon."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_b4464ebe","line":129,"updated":"2015-03-20 05:54:01.000000000","message":"Add \"option\" - \"Ensure the `WEBSSO_ENABLED` option is set...\"","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f2b9b87cd1a901e9374bb5c1ea1526f8aecb8bac","unresolved":false,"context_lines":[{"line_number":126,"context_line":""},{"line_number":127,"context_line":"3. Enable the WebSSO setting."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Ensure the `WEBSSO_ENABLED` is set to True in horizon\u0027s local_settings.py file,"},{"line_number":130,"context_line":"this will provide users with an updated login screen for horizon."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_680dda8e","line":129,"in_reply_to":"9a80dd14_b4464ebe","updated":"2015-03-20 06:51:57.000000000","message":"Done","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"66ce3ec2d3be19bd08134894d0df74dfb6f8ffa6","unresolved":false,"context_lines":[{"line_number":133,"context_line":""},{"line_number":134,"context_line":"  WEBSSO_ENABLED \u003d True"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"4. (Optional) Create a list of authentication methods with `WEBSSO_CHOICES`."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Within horizon\u0027s settings.py file, a list of supported authentication methods"},{"line_number":139,"context_line":"can be specified. The entries in the list map to keystone federation protocols,"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_74277612","line":136,"updated":"2015-03-20 05:54:01.000000000","message":"\"...with the `WEBSSO_CHOICES` option.\"","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f2b9b87cd1a901e9374bb5c1ea1526f8aecb8bac","unresolved":false,"context_lines":[{"line_number":133,"context_line":""},{"line_number":134,"context_line":"  WEBSSO_ENABLED \u003d True"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"4. (Optional) Create a list of authentication methods with `WEBSSO_CHOICES`."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"Within horizon\u0027s settings.py file, a list of supported authentication methods"},{"line_number":139,"context_line":"can be specified. The entries in the list map to keystone federation protocols,"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_480ad679","line":136,"in_reply_to":"9a80dd14_74277612","updated":"2015-03-20 06:51:57.000000000","message":"Done","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"66ce3ec2d3be19bd08134894d0df74dfb6f8ffa6","unresolved":false,"context_lines":[{"line_number":148,"context_line":"        (\"saml2\", _(\"Security Assertion Markup Language\"))"},{"line_number":149,"context_line":"      )"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"5. (Optional) Specify an initial choice with `WEBSSO_INITIAL_CHOICE`."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"The list set by `WEBSSO_CHOICES` will be generated in a drop-down menu in the"},{"line_number":154,"context_line":"login screen. The setting `WEBSSO_INITIAL_CHOICE` will automatically set that"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_147e3ae4","line":151,"updated":"2015-03-20 05:54:01.000000000","message":"\"...with the `WEBSSO_INITIAL_CHOICE` option.\"","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f2b9b87cd1a901e9374bb5c1ea1526f8aecb8bac","unresolved":false,"context_lines":[{"line_number":148,"context_line":"        (\"saml2\", _(\"Security Assertion Markup Language\"))"},{"line_number":149,"context_line":"      )"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"5. (Optional) Specify an initial choice with `WEBSSO_INITIAL_CHOICE`."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"The list set by `WEBSSO_CHOICES` will be generated in a drop-down menu in the"},{"line_number":154,"context_line":"login screen. The setting `WEBSSO_INITIAL_CHOICE` will automatically set that"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_6884fad2","line":151,"in_reply_to":"9a80dd14_147e3ae4","updated":"2015-03-20 06:51:57.000000000","message":"Done","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"66ce3ec2d3be19bd08134894d0df74dfb6f8ffa6","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"5. (Optional) Specify an initial choice with `WEBSSO_INITIAL_CHOICE`."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"The list set by `WEBSSO_CHOICES` will be generated in a drop-down menu in the"},{"line_number":154,"context_line":"login screen. The setting `WEBSSO_INITIAL_CHOICE` will automatically set that"},{"line_number":155,"context_line":"choice to be highlighted by default."},{"line_number":156,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_d46f4226","line":153,"updated":"2015-03-20 05:54:01.000000000","message":"Also add \"option\" in this paragraph for consistency.","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f2b9b87cd1a901e9374bb5c1ea1526f8aecb8bac","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"5. (Optional) Specify an initial choice with `WEBSSO_INITIAL_CHOICE`."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":"The list set by `WEBSSO_CHOICES` will be generated in a drop-down menu in the"},{"line_number":154,"context_line":"login screen. The setting `WEBSSO_INITIAL_CHOICE` will automatically set that"},{"line_number":155,"context_line":"choice to be highlighted by default."},{"line_number":156,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a80dd14_a8699226","line":153,"in_reply_to":"9a80dd14_d46f4226","updated":"2015-03-20 06:51:57.000000000","message":"Done","commit_id":"281619816490d7587a7991f9d6a9d5c1ca73ce7b"},{"author":{"_account_id":8533,"name":"Marcos Fermín Lobo","email":"lobo@lukos.org","username":"mlobo"},"change_message_id":"4072726de4add4e97f1fcd90f557041565e8eed4","unresolved":false,"context_lines":[{"line_number":14,"context_line":"      under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":"keystone federation and horizon"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"keystone changes"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a80dd14_17d5571b","line":17,"updated":"2015-03-20 09:17:42.000000000","message":"Keystone with capital letter. Check the same issue in the full document","commit_id":"447d41f5828bb173cf43da92186b4d21564c4245"},{"author":{"_account_id":8533,"name":"Marcos Fermín Lobo","email":"lobo@lukos.org","username":"mlobo"},"change_message_id":"bbbdc1090c207fddd7c6fcf330aa043a5eb35d7d","unresolved":false,"context_lines":[{"line_number":14,"context_line":"      under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":"keystone federation and horizon"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"keystone changes"}],"source_content_type":"text/x-rst","patch_set":7,"id":"1a6ced46_f8feab37","line":17,"in_reply_to":"7a75e904_6f404157","updated":"2015-03-26 07:55:17.000000000","message":"Thanks for the info ;)","commit_id":"447d41f5828bb173cf43da92186b4d21564c4245"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9b8d083b3d74dde95b9f4c418d02f0c734554452","unresolved":false,"context_lines":[{"line_number":14,"context_line":"      under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":"keystone federation and horizon"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"keystone changes"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a75e904_6f404157","line":17,"in_reply_to":"9a80dd14_17d5571b","updated":"2015-03-21 06:09:11.000000000","message":"actually, the code names should be lower cased, this has been brought up a few times now, we\u0027re trying to make all the docs have `keystone` as lower cased.","commit_id":"447d41f5828bb173cf43da92186b4d21564c4245"},{"author":{"_account_id":8533,"name":"Marcos Fermín Lobo","email":"lobo@lukos.org","username":"mlobo"},"change_message_id":"4072726de4add4e97f1fcd90f557041565e8eed4","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"A remote id attribute indicates the header to retrieve from the WSGI"},{"line_number":59,"context_line":"environment. This header should contain information about the identity"},{"line_number":60,"context_line":"of the identity provider provider. For `mod_shib` this would be"},{"line_number":61,"context_line":"`Shib-Identity-Provider`, for `mod_auth_openidc`, this could be"},{"line_number":62,"context_line":"`HTTP_OIDC_ISS`."},{"line_number":63,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a80dd14_d7bbbf0c","line":60,"updated":"2015-03-20 09:17:42.000000000","message":"\"provider\" 2 times?","commit_id":"447d41f5828bb173cf43da92186b4d21564c4245"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9b8d083b3d74dde95b9f4c418d02f0c734554452","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"A remote id attribute indicates the header to retrieve from the WSGI"},{"line_number":59,"context_line":"environment. This header should contain information about the identity"},{"line_number":60,"context_line":"of the identity provider provider. For `mod_shib` this would be"},{"line_number":61,"context_line":"`Shib-Identity-Provider`, for `mod_auth_openidc`, this could be"},{"line_number":62,"context_line":"`HTTP_OIDC_ISS`."},{"line_number":63,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a75e904_af2159b6","line":60,"in_reply_to":"9a80dd14_d7bbbf0c","updated":"2015-03-21 06:09:11.000000000","message":"Done","commit_id":"447d41f5828bb173cf43da92186b4d21564c4245"},{"author":{"_account_id":8533,"name":"Marcos Fermín Lobo","email":"lobo@lukos.org","username":"mlobo"},"change_message_id":"4072726de4add4e97f1fcd90f557041565e8eed4","unresolved":false,"context_lines":[{"line_number":102,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":103,"context_line":"    identity providers from keystone."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"horizon changes"},{"line_number":106,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"1. Set the Identity Service version to 3"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a80dd14_37a6dbc1","line":105,"updated":"2015-03-20 09:17:42.000000000","message":"Horizon capital letter","commit_id":"447d41f5828bb173cf43da92186b4d21564c4245"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9b8d083b3d74dde95b9f4c418d02f0c734554452","unresolved":false,"context_lines":[{"line_number":102,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":103,"context_line":"    identity providers from keystone."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"horizon changes"},{"line_number":106,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"1. Set the Identity Service version to 3"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a75e904_8f249dc7","line":105,"in_reply_to":"9a80dd14_37a6dbc1","updated":"2015-03-21 06:09:11.000000000","message":"same reason as above","commit_id":"447d41f5828bb173cf43da92186b4d21564c4245"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":1,"context_line":":orphan:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":".."},{"line_number":4,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_96c47f41","line":1,"updated":"2015-03-24 00:32:59.000000000","message":"it would be better to have this in the a toc so that it\u0027s easier to find.","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":1,"context_line":":orphan:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":".."},{"line_number":4,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_d69f9cb2","line":1,"in_reply_to":"1a6ced46_96c47f41","updated":"2015-03-25 05:36:57.000000000","message":"i didn\u0027t address this for now since i don\u0027t know where to put it in the toc, i would like to rearrange things in the federation section to make the protocol specific bits easier to find anyway","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":14,"context_line":"      under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":"keystone federation and horizon"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"keystone changes"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_b646dbbd","line":17,"updated":"2015-03-24 00:32:59.000000000","message":"You can capitalize keystone in a title.","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":14,"context_line":"      under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":"keystone federation and horizon"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"keystone changes"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_5b8595ab","line":17,"in_reply_to":"1a6ced46_b646dbbd","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Specify URLs of trusted horizon servers. This value may be repeated"},{"line_number":26,"context_line":"multiple times. This setting ensures that keystone only sends token data back"},{"line_number":27,"context_line":"to trusted servers only. This is performed as a precaution, specifically to"},{"line_number":28,"context_line":"prevent man-in-the-middle (MITM) attacks."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_b6741bfe","line":27,"updated":"2015-03-24 00:32:59.000000000","message":"remove \"only\"","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Specify URLs of trusted horizon servers. This value may be repeated"},{"line_number":26,"context_line":"multiple times. This setting ensures that keystone only sends token data back"},{"line_number":27,"context_line":"to trusted servers only. This is performed as a precaution, specifically to"},{"line_number":28,"context_line":"prevent man-in-the-middle (MITM) attacks."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_bbbda96a","line":27,"in_reply_to":"1a6ced46_b6741bfe","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"7ffb61149612e7c2e4488965a714a1b346413201","unresolved":false,"context_lines":[{"line_number":30,"context_line":".. code-block:: ini"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"  [federation]"},{"line_number":33,"context_line":"  trusted_dashboard \u003d http://acme.horizon.com/auth/websso"},{"line_number":34,"context_line":"  trusted_dashboard \u003d http://beta.horizon.com/auth/websso"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"2. Update Apache vhost file with websso information."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_37306056","line":33,"updated":"2015-03-24 00:38:01.000000000","message":"trailing \"/\" is needed after websso","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":30,"context_line":".. code-block:: ini"},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"  [federation]"},{"line_number":33,"context_line":"  trusted_dashboard \u003d http://acme.horizon.com/auth/websso"},{"line_number":34,"context_line":"  trusted_dashboard \u003d http://beta.horizon.com/auth/websso"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"2. Update Apache vhost file with websso information."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_dbc0a5e2","line":33,"in_reply_to":"1a6ced46_37306056","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":33,"context_line":"  trusted_dashboard \u003d http://acme.horizon.com/auth/websso"},{"line_number":34,"context_line":"  trusted_dashboard \u003d http://beta.horizon.com/auth/websso"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"2. Update Apache vhost file with websso information."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The route `/v3/auth/OS-FEDERATION/websso/` must be protected by the chosen"},{"line_number":39,"context_line":"Apache module. This is performed so the request that originates from horizon"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_36ee6b89","line":36,"updated":"2015-03-24 00:32:59.000000000","message":"Apache is the organization, httpd is their HTTP server: http://httpd.apache.org/","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"2. Update Apache vhost file with websso information."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The route `/v3/auth/OS-FEDERATION/websso/` must be protected by the chosen"},{"line_number":39,"context_line":"Apache module. This is performed so the request that originates from horizon"},{"line_number":40,"context_line":"will use the same identity provider that keystone configured. Below is an"},{"line_number":41,"context_line":"example if `mod_auth_openidc` is selected. If `mod_shib` was used, then"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_76ff0335","line":38,"updated":"2015-03-24 00:32:59.000000000","message":"move route after which route it is.","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"2. Update Apache vhost file with websso information."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The route `/v3/auth/OS-FEDERATION/websso/` must be protected by the chosen"},{"line_number":39,"context_line":"Apache module. This is performed so the request that originates from horizon"},{"line_number":40,"context_line":"will use the same identity provider that keystone configured. Below is an"},{"line_number":41,"context_line":"example if `mod_auth_openidc` is selected. If `mod_shib` was used, then"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_7bab311d","line":38,"in_reply_to":"1a6ced46_76ff0335","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":36,"context_line":"2. Update Apache vhost file with websso information."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The route `/v3/auth/OS-FEDERATION/websso/` must be protected by the chosen"},{"line_number":39,"context_line":"Apache module. This is performed so the request that originates from horizon"},{"line_number":40,"context_line":"will use the same identity provider that keystone configured. Below is an"},{"line_number":41,"context_line":"example if `mod_auth_openidc` is selected. If `mod_shib` was used, then"},{"line_number":42,"context_line":"`AuthType` would be `shibboleth`."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_b6f97b4f","line":39,"updated":"2015-03-24 00:32:59.000000000","message":"Apache -\u003e httpd","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":36,"context_line":"2. Update Apache vhost file with websso information."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The route `/v3/auth/OS-FEDERATION/websso/` must be protected by the chosen"},{"line_number":39,"context_line":"Apache module. This is performed so the request that originates from horizon"},{"line_number":40,"context_line":"will use the same identity provider that keystone configured. Below is an"},{"line_number":41,"context_line":"example if `mod_auth_openidc` is selected. If `mod_shib` was used, then"},{"line_number":42,"context_line":"`AuthType` would be `shibboleth`."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_1bbb1d73","line":39,"in_reply_to":"1a6ced46_b6f97b4f","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The route `/v3/auth/OS-FEDERATION/websso/` must be protected by the chosen"},{"line_number":39,"context_line":"Apache module. This is performed so the request that originates from horizon"},{"line_number":40,"context_line":"will use the same identity provider that keystone configured. Below is an"},{"line_number":41,"context_line":"example if `mod_auth_openidc` is selected. If `mod_shib` was used, then"},{"line_number":42,"context_line":"`AuthType` would be `shibboleth`."},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_16a08f42","line":40,"updated":"2015-03-24 00:32:59.000000000","message":"that is configured in keystone","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The route `/v3/auth/OS-FEDERATION/websso/` must be protected by the chosen"},{"line_number":39,"context_line":"Apache module. This is performed so the request that originates from horizon"},{"line_number":40,"context_line":"will use the same identity provider that keystone configured. Below is an"},{"line_number":41,"context_line":"example if `mod_auth_openidc` is selected. If `mod_shib` was used, then"},{"line_number":42,"context_line":"`AuthType` would be `shibboleth`."},{"line_number":43,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_db67c523","line":40,"in_reply_to":"1a6ced46_16a08f42","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":38,"context_line":"The route `/v3/auth/OS-FEDERATION/websso/` must be protected by the chosen"},{"line_number":39,"context_line":"Apache module. This is performed so the request that originates from horizon"},{"line_number":40,"context_line":"will use the same identity provider that keystone configured. Below is an"},{"line_number":41,"context_line":"example if `mod_auth_openidc` is selected. If `mod_shib` was used, then"},{"line_number":42,"context_line":"`AuthType` would be `shibboleth`."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":".. code-block:: xml"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_b6909bed","line":41,"updated":"2015-03-24 00:32:59.000000000","message":"change \"if `mod_auth_openidc` is selected\" to \"for when `mod_auth_openidc` is used\"","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":38,"context_line":"The route `/v3/auth/OS-FEDERATION/websso/` must be protected by the chosen"},{"line_number":39,"context_line":"Apache module. This is performed so the request that originates from horizon"},{"line_number":40,"context_line":"will use the same identity provider that keystone configured. Below is an"},{"line_number":41,"context_line":"example if `mod_auth_openidc` is selected. If `mod_shib` was used, then"},{"line_number":42,"context_line":"`AuthType` would be `shibboleth`."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":".. code-block:: xml"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_5b73d5e6","line":41,"in_reply_to":"1a6ced46_b6909bed","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"7ffb61149612e7c2e4488965a714a1b346413201","unresolved":false,"context_lines":[{"line_number":44,"context_line":".. code-block:: xml"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"  \u003cVirtualHost *:5000\u003e"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"      ..."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"      \u003cLocationMatch /v3/auth/OS-FEDERATION/websso/.*\u003e"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_d1e9a11b","line":47,"updated":"2015-03-24 00:38:01.000000000","message":"Do we need to add the RedirectURI too?\n\nOIDCRedirectURI http://localhost:5000/v3/auth/OS-FEDERATION/websso/redirect","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":44,"context_line":".. code-block:: xml"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"  \u003cVirtualHost *:5000\u003e"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"      ..."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"      \u003cLocationMatch /v3/auth/OS-FEDERATION/websso/.*\u003e"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_bb4be985","line":47,"in_reply_to":"1a6ced46_d1e9a11b","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":58,"context_line":"A remote id attribute indicates the header to retrieve from the WSGI"},{"line_number":59,"context_line":"environment. This header should contain information about the identity"},{"line_number":60,"context_line":"of the identity provider. For `mod_shib` this would be"},{"line_number":61,"context_line":"`Shib-Identity-Provider`, for `mod_auth_openidc`, this could be"},{"line_number":62,"context_line":"`HTTP_OIDC_ISS`."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"It is recommended that this option be set on a per-protocol basis."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_f12bfd7f","line":61,"updated":"2015-03-24 00:32:59.000000000","message":"use `` for Shib-Identity-Provider","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":58,"context_line":"A remote id attribute indicates the header to retrieve from the WSGI"},{"line_number":59,"context_line":"environment. This header should contain information about the identity"},{"line_number":60,"context_line":"of the identity provider. For `mod_shib` this would be"},{"line_number":61,"context_line":"`Shib-Identity-Provider`, for `mod_auth_openidc`, this could be"},{"line_number":62,"context_line":"`HTTP_OIDC_ISS`."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"It is recommended that this option be set on a per-protocol basis."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_7b309101","line":61,"in_reply_to":"1a6ced46_f12bfd7f","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":59,"context_line":"environment. This header should contain information about the identity"},{"line_number":60,"context_line":"of the identity provider. For `mod_shib` this would be"},{"line_number":61,"context_line":"`Shib-Identity-Provider`, for `mod_auth_openidc`, this could be"},{"line_number":62,"context_line":"`HTTP_OIDC_ISS`."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"It is recommended that this option be set on a per-protocol basis."},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_1121799f","line":62,"updated":"2015-03-24 00:32:59.000000000","message":"use `` for HTTP_OIDC_ISS","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":59,"context_line":"environment. This header should contain information about the identity"},{"line_number":60,"context_line":"of the identity provider. For `mod_shib` this would be"},{"line_number":61,"context_line":"`Shib-Identity-Provider`, for `mod_auth_openidc`, this could be"},{"line_number":62,"context_line":"`HTTP_OIDC_ISS`."},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"It is recommended that this option be set on a per-protocol basis."},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_bb19298a","line":62,"in_reply_to":"1a6ced46_1121799f","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":84,"context_line":"A keystone identity provider may have multiple `remote_ids` specified, this"},{"line_number":85,"context_line":"setting allows the same *keystone* identity provider resource to be used"},{"line_number":86,"context_line":"with multiple external identity providers. For example, an identity"},{"line_number":87,"context_line":"provider resource may be called `university-idp`, and it\u0027s `remote_ids`"},{"line_number":88,"context_line":"could be [\u0027university-x\u0027, \u0027university-y\u0027, \u0027university-z\u0027]. Removing the"},{"line_number":89,"context_line":"need to configure N identity provider resources in keystone."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_560cc742","line":87,"updated":"2015-03-24 00:32:59.000000000","message":"use `` for university-idp\n\nchange \"it\u0027s\" to \"its\"","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":84,"context_line":"A keystone identity provider may have multiple `remote_ids` specified, this"},{"line_number":85,"context_line":"setting allows the same *keystone* identity provider resource to be used"},{"line_number":86,"context_line":"with multiple external identity providers. For example, an identity"},{"line_number":87,"context_line":"provider resource may be called `university-idp`, and it\u0027s `remote_ids`"},{"line_number":88,"context_line":"could be [\u0027university-x\u0027, \u0027university-y\u0027, \u0027university-z\u0027]. Removing the"},{"line_number":89,"context_line":"need to configure N identity provider resources in keystone."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_3642b03e","line":87,"in_reply_to":"1a6ced46_560cc742","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":85,"context_line":"setting allows the same *keystone* identity provider resource to be used"},{"line_number":86,"context_line":"with multiple external identity providers. For example, an identity"},{"line_number":87,"context_line":"provider resource may be called `university-idp`, and it\u0027s `remote_ids`"},{"line_number":88,"context_line":"could be [\u0027university-x\u0027, \u0027university-y\u0027, \u0027university-z\u0027]. Removing the"},{"line_number":89,"context_line":"need to configure N identity provider resources in keystone."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":".. NOTE::"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_310f5532","line":88,"updated":"2015-03-24 00:32:59.000000000","message":"use `` for the list","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":85,"context_line":"setting allows the same *keystone* identity provider resource to be used"},{"line_number":86,"context_line":"with multiple external identity providers. For example, an identity"},{"line_number":87,"context_line":"provider resource may be called `university-idp`, and it\u0027s `remote_ids`"},{"line_number":88,"context_line":"could be [\u0027university-x\u0027, \u0027university-y\u0027, \u0027university-z\u0027]. Removing the"},{"line_number":89,"context_line":"need to configure N identity provider resources in keystone."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":".. NOTE::"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_db1c257a","line":88,"in_reply_to":"1a6ced46_310f5532","updated":"2015-03-25 05:36:57.000000000","message":"Done... i think","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    It is necessary that the value returned from the `remote_id_attribute` key"},{"line_number":94,"context_line":"    should be included in the keystone IdP entry\u0027s `remote_ids`."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    For instance, if `remote_id_attribute` is set as `HTTP_OIDC_ISS`,"},{"line_number":97,"context_line":"    a typical value would be `accounts.example.com`. This should be the"},{"line_number":98,"context_line":"    remote ID for the Identity Providers in keystone."},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_9658ff57","line":96,"updated":"2015-03-24 00:32:59.000000000","message":"use `` for HTTP_OIDC_ISS","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":93,"context_line":"    It is necessary that the value returned from the `remote_id_attribute` key"},{"line_number":94,"context_line":"    should be included in the keystone IdP entry\u0027s `remote_ids`."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    For instance, if `remote_id_attribute` is set as `HTTP_OIDC_ISS`,"},{"line_number":97,"context_line":"    a typical value would be `accounts.example.com`. This should be the"},{"line_number":98,"context_line":"    remote ID for the Identity Providers in keystone."},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_9b02ad09","line":96,"in_reply_to":"1a6ced46_9658ff57","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":94,"context_line":"    should be included in the keystone IdP entry\u0027s `remote_ids`."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    For instance, if `remote_id_attribute` is set as `HTTP_OIDC_ISS`,"},{"line_number":97,"context_line":"    a typical value would be `accounts.example.com`. This should be the"},{"line_number":98,"context_line":"    remote ID for the Identity Providers in keystone."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    The motivation for this approach was to have ensure there is some"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_565e8746","line":97,"updated":"2015-03-24 00:32:59.000000000","message":"use ``","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":94,"context_line":"    should be included in the keystone IdP entry\u0027s `remote_ids`."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    For instance, if `remote_id_attribute` is set as `HTTP_OIDC_ISS`,"},{"line_number":97,"context_line":"    a typical value would be `accounts.example.com`. This should be the"},{"line_number":98,"context_line":"    remote ID for the Identity Providers in keystone."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    The motivation for this approach was to have ensure there is some"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_b6006002","line":97,"in_reply_to":"1a6ced46_565e8746","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    a typical value would be `accounts.example.com`. This should be the"},{"line_number":98,"context_line":"    remote ID for the Identity Providers in keystone."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    The motivation for this approach was to have ensure there is some"},{"line_number":101,"context_line":"    identity provider data in a SAML assertion or OpenID Connect claim."},{"line_number":102,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":103,"context_line":"    identity providers from keystone."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_516851ba","line":100,"updated":"2015-03-24 00:32:59.000000000","message":"change \"have ensure\" to \"ensure\"","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    a typical value would be `accounts.example.com`. This should be the"},{"line_number":98,"context_line":"    remote ID for the Identity Providers in keystone."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"    The motivation for this approach was to have ensure there is some"},{"line_number":101,"context_line":"    identity provider data in a SAML assertion or OpenID Connect claim."},{"line_number":102,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":103,"context_line":"    identity providers from keystone."}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_f60ad81f","line":100,"in_reply_to":"1a6ced46_516851ba","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":110,"context_line":"Ensure the `OPENSTACK_API_VERSIONS` option in horizon\u0027s local_settings.py has"},{"line_number":111,"context_line":"been updated to indicate that the `identity` version to use is `3`."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":".. code-block:: ini"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  OPENSTACK_API_VERSIONS \u003d {"},{"line_number":116,"context_line":"    \"identity\": 3,"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_312675b8","line":113,"updated":"2015-03-24 00:32:59.000000000","message":"this is python","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":110,"context_line":"Ensure the `OPENSTACK_API_VERSIONS` option in horizon\u0027s local_settings.py has"},{"line_number":111,"context_line":"been updated to indicate that the `identity` version to use is `3`."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":".. code-block:: ini"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"  OPENSTACK_API_VERSIONS \u003d {"},{"line_number":116,"context_line":"    \"identity\": 3,"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_36147043","line":113,"in_reply_to":"1a6ced46_312675b8","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":121,"context_line":"Ensure the `OPENSTACK_KEYSTONE_URL` option in horizon\u0027s local_settings.py has"},{"line_number":122,"context_line":"been updated to point to a v3 URL."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":".. code-block:: ini"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"  OPENSTACK_KEYSTONE_URL \u003d \"http://localhost:5000/v3\""},{"line_number":127,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_71370de4","line":124,"updated":"2015-03-24 00:32:59.000000000","message":"python","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":121,"context_line":"Ensure the `OPENSTACK_KEYSTONE_URL` option in horizon\u0027s local_settings.py has"},{"line_number":122,"context_line":"been updated to point to a v3 URL."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":".. code-block:: ini"},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"  OPENSTACK_KEYSTONE_URL \u003d \"http://localhost:5000/v3\""},{"line_number":127,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_56364ce8","line":124,"in_reply_to":"1a6ced46_71370de4","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":130,"context_line":"Ensure the `WEBSSO_ENABLED` option is set to True in horizon\u0027s local_settings.py file,"},{"line_number":131,"context_line":"this will provide users with an updated login screen for horizon."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":".. code-block:: ini"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"  WEBSSO_ENABLED \u003d True"},{"line_number":136,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_913489df","line":133,"updated":"2015-03-24 00:32:59.000000000","message":"python","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":130,"context_line":"Ensure the `WEBSSO_ENABLED` option is set to True in horizon\u0027s local_settings.py file,"},{"line_number":131,"context_line":"this will provide users with an updated login screen for horizon."},{"line_number":132,"context_line":""},{"line_number":133,"context_line":".. code-block:: ini"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"  WEBSSO_ENABLED \u003d True"},{"line_number":136,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_763508d9","line":133,"in_reply_to":"1a6ced46_913489df","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Within horizon\u0027s settings.py file, a list of supported authentication methods"},{"line_number":141,"context_line":"can be specified. The entries in the list map to keystone federation protocols,"},{"line_number":142,"context_line":"with the exception of `credentials` which is reserved by horizon, and maps to"},{"line_number":143,"context_line":"the user name and password used by keystone\u0027s identity backend."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_d174419e","line":142,"updated":"2015-03-24 00:32:59.000000000","message":"use `` around credentials.","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Within horizon\u0027s settings.py file, a list of supported authentication methods"},{"line_number":141,"context_line":"can be specified. The entries in the list map to keystone federation protocols,"},{"line_number":142,"context_line":"with the exception of `credentials` which is reserved by horizon, and maps to"},{"line_number":143,"context_line":"the user name and password used by keystone\u0027s identity backend."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_f6581834","line":142,"in_reply_to":"1a6ced46_d174419e","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":142,"context_line":"with the exception of `credentials` which is reserved by horizon, and maps to"},{"line_number":143,"context_line":"the user name and password used by keystone\u0027s identity backend."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":".. code-block:: ini"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"  WEBSSO_CHOICES \u003d ("},{"line_number":148,"context_line":"        (\"credentials\", _(\"Keystone Credentials\")),"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_11589931","line":145,"updated":"2015-03-24 00:32:59.000000000","message":"python","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":142,"context_line":"with the exception of `credentials` which is reserved by horizon, and maps to"},{"line_number":143,"context_line":"the user name and password used by keystone\u0027s identity backend."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":".. code-block:: ini"},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"  WEBSSO_CHOICES \u003d ("},{"line_number":148,"context_line":"        (\"credentials\", _(\"Keystone Credentials\")),"}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_9630c4e9","line":145,"in_reply_to":"1a6ced46_11589931","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"298ef9adab7b83dce5c8490be62df7460ab9742a","unresolved":false,"context_lines":[{"line_number":157,"context_line":"menu in the login screen. The setting `WEBSSO_INITIAL_CHOICE` will"},{"line_number":158,"context_line":"automatically set that choice to be highlighted by default."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":".. code-block:: ini"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"  WEBSSO_CHOICES \u003d \"credentials\""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_713e2dba","line":160,"updated":"2015-03-24 00:32:59.000000000","message":"python","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"715f057ebc819dac7657a4855e83977c88686c38","unresolved":false,"context_lines":[{"line_number":157,"context_line":"menu in the login screen. The setting `WEBSSO_INITIAL_CHOICE` will"},{"line_number":158,"context_line":"automatically set that choice to be highlighted by default."},{"line_number":159,"context_line":""},{"line_number":160,"context_line":".. code-block:: ini"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"  WEBSSO_CHOICES \u003d \"credentials\""}],"source_content_type":"text/x-rst","patch_set":8,"id":"1a6ced46_b64ea06d","line":160,"in_reply_to":"1a6ced46_713e2dba","updated":"2015-03-25 05:36:57.000000000","message":"Done","commit_id":"a92e29ef31e91f52f921e3ea9baed5f4b26bce40"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":9,"id":"baa041b7_23ca57a2","updated":"2015-04-02 06:20:02.000000000","message":"@dstanek, overall comment for caps: i\u0027ll change the ones in the title. But i thought going forward we wanted to avoid using the \u0027code names\u0027 in capital letters.","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":14,"context_line":"      under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":"Keystone federation and Horizon"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Keystone changes"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_592741ca","line":17,"updated":"2015-03-25 18:35:30.000000000","message":"Since this is a title I think Federation should be in caps.","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[{"line_number":14,"context_line":"      under the License."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":"Keystone federation and Horizon"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Keystone changes"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_230ff7e2","line":17,"in_reply_to":"1a6ced46_592741ca","updated":"2015-04-02 06:20:02.000000000","message":"Done","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Keystone federation and Horizon"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Keystone changes"},{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"1. Update `trusted_dashboard` in keystone.conf."}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_992d39ab","line":20,"updated":"2015-03-25 18:35:30.000000000","message":"Same title thing here too","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Keystone federation and Horizon"},{"line_number":18,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Keystone changes"},{"line_number":21,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"1. Update `trusted_dashboard` in keystone.conf."}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_0314f3f2","line":20,"in_reply_to":"1a6ced46_992d39ab","updated":"2015-04-02 06:20:02.000000000","message":"Done","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"1. Update `trusted_dashboard` in keystone.conf."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Specify URLs of trusted horizon servers. This value may be repeated"},{"line_number":26,"context_line":"multiple times. This setting ensures that keystone only sends token data back"},{"line_number":27,"context_line":"to trusted servers. This is performed as a precaution, specifically to"},{"line_number":28,"context_line":"prevent man-in-the-middle (MITM) attacks."}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_941b4072","line":25,"updated":"2015-03-25 18:35:30.000000000","message":"Horizon","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":23,"context_line":"1. Update `trusted_dashboard` in keystone.conf."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Specify URLs of trusted horizon servers. This value may be repeated"},{"line_number":26,"context_line":"multiple times. This setting ensures that keystone only sends token data back"},{"line_number":27,"context_line":"to trusted servers. This is performed as a precaution, specifically to"},{"line_number":28,"context_line":"prevent man-in-the-middle (MITM) attacks."},{"line_number":29,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_b4183c76","line":26,"updated":"2015-03-25 18:35:30.000000000","message":"Keystone","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":36,"context_line":"2. Update httpd vhost file with websso information."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The `/v3/auth/OS-FEDERATION/websso/` route must be protected by the chosen"},{"line_number":39,"context_line":"httpd module. This is performed so the request that originates from horizon"},{"line_number":40,"context_line":"will use the same identity provider that is configured in keystone. Below is"},{"line_number":41,"context_line":"an example for when `mod_auth_openidc` is used. If `mod_shib` was used, then"},{"line_number":42,"context_line":"`AuthType` would be `shibboleth`. In the case of `mod_auth_openidc` the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_543c68c8","line":39,"updated":"2015-03-25 18:35:30.000000000","message":"Horizon","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The `/v3/auth/OS-FEDERATION/websso/` route must be protected by the chosen"},{"line_number":39,"context_line":"httpd module. This is performed so the request that originates from horizon"},{"line_number":40,"context_line":"will use the same identity provider that is configured in keystone. Below is"},{"line_number":41,"context_line":"an example for when `mod_auth_openidc` is used. If `mod_shib` was used, then"},{"line_number":42,"context_line":"`AuthType` would be `shibboleth`. In the case of `mod_auth_openidc` the"},{"line_number":43,"context_line":"redirect must also be updated."}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_943260f0","line":40,"updated":"2015-03-25 18:35:30.000000000","message":"Keystone","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":82,"context_line":""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"4. Set `remote_ids` for a keystone identity provider."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"A keystone identity provider may have multiple `remote_ids` specified, this"},{"line_number":88,"context_line":"setting allows the same *keystone* identity provider resource to be used"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_74c32489","line":85,"updated":"2015-03-25 18:35:30.000000000","message":"Keystone","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"4. Set `remote_ids` for a keystone identity provider."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"A keystone identity provider may have multiple `remote_ids` specified, this"},{"line_number":88,"context_line":"setting allows the same *keystone* identity provider resource to be used"},{"line_number":89,"context_line":"with multiple external identity providers. For example, an identity"},{"line_number":90,"context_line":"provider resource may be called ``university-idp``, and its `remote_ids`"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_b4b91c17","line":87,"updated":"2015-03-25 18:35:30.000000000","message":"Keystone","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":85,"context_line":"4. Set `remote_ids` for a keystone identity provider."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"A keystone identity provider may have multiple `remote_ids` specified, this"},{"line_number":88,"context_line":"setting allows the same *keystone* identity provider resource to be used"},{"line_number":89,"context_line":"with multiple external identity providers. For example, an identity"},{"line_number":90,"context_line":"provider resource may be called ``university-idp``, and its `remote_ids`"},{"line_number":91,"context_line":"could be ``[\u0027university-x\u0027, \u0027university-y\u0027, \u0027university-z\u0027]``. Removing the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_34452c17","line":88,"updated":"2015-03-25 18:35:30.000000000","message":"Keystone","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[{"line_number":91,"context_line":"could be ``[\u0027university-x\u0027, \u0027university-y\u0027, \u0027university-z\u0027]``. Removing the"},{"line_number":92,"context_line":"need to configure N identity provider resources in keystone."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":".. NOTE::"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    It is necessary that the value returned from the `remote_id_attribute` key"},{"line_number":97,"context_line":"    should be included in the keystone IdP entry\u0027s `remote_ids`."}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_c31deb10","line":94,"updated":"2015-04-02 06:20:02.000000000","message":"this whole section should be reworked now that marco\u0027s and nathan\u0027s patches have landed.","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":".. NOTE::"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    It is necessary that the value returned from the `remote_id_attribute` key"},{"line_number":97,"context_line":"    should be included in the keystone IdP entry\u0027s `remote_ids`."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"    For instance, if `remote_id_attribute` is set as ``HTTP_OIDC_ISS``,"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_3487ecd8","line":96,"updated":"2015-03-25 18:35:30.000000000","message":"Is there something that enforces this?","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":94,"context_line":".. NOTE::"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    It is necessary that the value returned from the `remote_id_attribute` key"},{"line_number":97,"context_line":"    should be included in the keystone IdP entry\u0027s `remote_ids`."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"    For instance, if `remote_id_attribute` is set as ``HTTP_OIDC_ISS``,"},{"line_number":100,"context_line":"    a typical value would be ``accounts.example.com``. This should be the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_34b8cce4","line":97,"updated":"2015-03-25 18:35:30.000000000","message":"s/should//","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[{"line_number":94,"context_line":".. NOTE::"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    It is necessary that the value returned from the `remote_id_attribute` key"},{"line_number":97,"context_line":"    should be included in the keystone IdP entry\u0027s `remote_ids`."},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"    For instance, if `remote_id_attribute` is set as ``HTTP_OIDC_ISS``,"},{"line_number":100,"context_line":"    a typical value would be ``accounts.example.com``. This should be the"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_7e1a3470","line":97,"in_reply_to":"1a6ced46_34b8cce4","updated":"2015-04-02 06:20:02.000000000","message":"Done","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"    For instance, if `remote_id_attribute` is set as ``HTTP_OIDC_ISS``,"},{"line_number":100,"context_line":"    a typical value would be ``accounts.example.com``. This should be the"},{"line_number":101,"context_line":"    remote ID for the Identity Providers in keystone."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    The motivation for this approach was to ensure there is some"},{"line_number":104,"context_line":"    identity provider data in a SAML assertion or OpenID Connect claim."}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_34860c14","line":101,"updated":"2015-03-25 18:35:30.000000000","message":"Keystone and should \"Identity Providers\" be in caps? It\u0027s not like that anywhere else in the doc.","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[{"line_number":98,"context_line":""},{"line_number":99,"context_line":"    For instance, if `remote_id_attribute` is set as ``HTTP_OIDC_ISS``,"},{"line_number":100,"context_line":"    a typical value would be ``accounts.example.com``. This should be the"},{"line_number":101,"context_line":"    remote ID for the Identity Providers in keystone."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    The motivation for this approach was to ensure there is some"},{"line_number":104,"context_line":"    identity provider data in a SAML assertion or OpenID Connect claim."}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_5eff7001","line":101,"in_reply_to":"1a6ced46_34860c14","updated":"2015-04-02 06:20:02.000000000","message":"Done","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"60178a4dfee076fd7ffd246de4e166148cd189b2","unresolved":false,"context_lines":[{"line_number":100,"context_line":"    a typical value would be ``accounts.example.com``. This should be the"},{"line_number":101,"context_line":"    remote ID for the Identity Providers in keystone."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    The motivation for this approach was to ensure there is some"},{"line_number":104,"context_line":"    identity provider data in a SAML assertion or OpenID Connect claim."},{"line_number":105,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":106,"context_line":"    identity providers from keystone."}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_6e97d548","line":103,"updated":"2015-03-25 17:45:49.000000000","message":"(nit): s/was/is/  assuming this motivation is still valid...","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[{"line_number":100,"context_line":"    a typical value would be ``accounts.example.com``. This should be the"},{"line_number":101,"context_line":"    remote ID for the Identity Providers in keystone."},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    The motivation for this approach was to ensure there is some"},{"line_number":104,"context_line":"    identity provider data in a SAML assertion or OpenID Connect claim."},{"line_number":105,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":106,"context_line":"    identity providers from keystone."}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_8303630f","line":103,"in_reply_to":"1a6ced46_6e97d548","updated":"2015-04-02 06:20:02.000000000","message":"Done","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"c59c88383d4c63a277c5a1fc4479916f68f8d3d3","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    The motivation for this approach was to ensure there is some"},{"line_number":104,"context_line":"    identity provider data in a SAML assertion or OpenID Connect claim."},{"line_number":105,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":106,"context_line":"    identity providers from keystone."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Horizon changes"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_ee6025a7","line":105,"updated":"2015-03-25 17:45:11.000000000","message":"(nit): Sounds odd starting sentence with \"Thus\". Suggest either previous line should end in a comma, or start this sentence with \"This removes the...\"","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    The motivation for this approach was to ensure there is some"},{"line_number":104,"context_line":"    identity provider data in a SAML assertion or OpenID Connect claim."},{"line_number":105,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":106,"context_line":"    identity providers from keystone."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Horizon changes"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_74d084f6","line":105,"updated":"2015-03-25 18:35:30.000000000","message":"Horizon","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"    The motivation for this approach was to ensure there is some"},{"line_number":104,"context_line":"    identity provider data in a SAML assertion or OpenID Connect claim."},{"line_number":105,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":106,"context_line":"    identity providers from keystone."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Horizon changes"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_c3096b33","line":105,"in_reply_to":"1a6ced46_ee6025a7","updated":"2015-04-02 06:20:02.000000000","message":"Done","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":103,"context_line":"    The motivation for this approach was to ensure there is some"},{"line_number":104,"context_line":"    identity provider data in a SAML assertion or OpenID Connect claim."},{"line_number":105,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":106,"context_line":"    identity providers from keystone."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Horizon changes"},{"line_number":109,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_14fd906e","line":106,"updated":"2015-03-25 18:35:30.000000000","message":"Keystone","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":106,"context_line":"    identity providers from keystone."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Horizon changes"},{"line_number":109,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"1. Set the Identity Service version to 3"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_f419d4d7","line":108,"updated":"2015-03-25 18:35:30.000000000","message":"Changes","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[{"line_number":105,"context_line":"    Thus removing the requirement for horizon to list multiple (or all)"},{"line_number":106,"context_line":"    identity providers from keystone."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"Horizon changes"},{"line_number":109,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"1. Set the Identity Service version to 3"}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_a306671e","line":108,"in_reply_to":"1a6ced46_f419d4d7","updated":"2015-04-02 06:20:02.000000000","message":"Done","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"811ed2a8db9f50eea8c59f8bc2869641e76c608a","unresolved":false,"context_lines":[{"line_number":110,"context_line":""},{"line_number":111,"context_line":"1. Set the Identity Service version to 3"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"Ensure the `OPENSTACK_API_VERSIONS` option in horizon\u0027s local_settings.py has"},{"line_number":114,"context_line":"been updated to indicate that the `identity` version to use is `3`."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":".. code-block:: python"}],"source_content_type":"text/x-rst","patch_set":9,"id":"1a6ced46_140bd07d","line":113,"updated":"2015-03-25 18:35:30.000000000","message":"Horizon","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"470484df3b52ae0ef6d71009acf383bf8e8349ca","unresolved":false,"context_lines":[{"line_number":160,"context_line":"menu in the login screen. The setting `WEBSSO_INITIAL_CHOICE` will"},{"line_number":161,"context_line":"automatically set that choice to be highlighted by default."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":".. code-block:: python"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"  WEBSSO_CHOICES \u003d \"credentials\""}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_a8c88675","line":163,"updated":"2015-04-02 05:03:06.000000000","message":"should we mention somewhere here that it requires DOA 1.2.0 or later  (since DOA might get into kilo)","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c441bbfe57cab2035a4f4d19de2cf3022a997c81","unresolved":false,"context_lines":[{"line_number":160,"context_line":"menu in the login screen. The setting `WEBSSO_INITIAL_CHOICE` will"},{"line_number":161,"context_line":"automatically set that choice to be highlighted by default."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":".. code-block:: python"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"  WEBSSO_CHOICES \u003d \"credentials\""}],"source_content_type":"text/x-rst","patch_set":9,"id":"baa041b7_0381934a","line":163,"in_reply_to":"baa041b7_a8c88675","updated":"2015-04-02 06:20:02.000000000","message":"yes we should. I\u0027ll make a note of that in the beginning.","commit_id":"bdc7c714e9d1ef3dde6da6291090a5ba157559fb"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"49770263e6aebbd50d28f86dd99d109b8313ef6f","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"      ..."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"      \u003cLocationMatch /v3/auth/OS-FEDERATION/websso/.*\u003e"},{"line_number":54,"context_line":"        AuthType openid-connect"},{"line_number":55,"context_line":"        Require valid-user"},{"line_number":56,"context_line":"      \u003c/LocationMatch\u003e"}],"source_content_type":"text/x-rst","patch_set":10,"id":"baa041b7_001ff75f","line":53,"updated":"2015-04-05 01:09:38.000000000","message":"THis is actually too broad.  I did a match like this for kerberos:\n\n\u003clocation ~ \"kerberos\"\u003e\n\n\nI\u0027d recommend we put the protocol in there.","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"af8db5c731314dcc549401349a965687742481d0","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"      ..."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"      \u003cLocationMatch /v3/auth/OS-FEDERATION/websso/.*\u003e"},{"line_number":54,"context_line":"        AuthType openid-connect"},{"line_number":55,"context_line":"        Require valid-user"},{"line_number":56,"context_line":"      \u003c/LocationMatch\u003e"}],"source_content_type":"text/x-rst","patch_set":10,"id":"baa041b7_06da7078","line":53,"in_reply_to":"baa041b7_001ff75f","updated":"2015-04-05 06:24:50.000000000","message":"now I think your suggestion is too broad. anytime \"kerberos\" is in the path it\u0027ll go there, what if i want to delete the protocol kerberos ... \"DELETE ... /kerberos\".\n\nhow about we just say to enumerate them:\n\n  \u003cLocation ~ \"/v3/auth/OS-FEDERATION/websso/kerberos\"\u003e\n      kerb params\n\n  ...\n  \u003cLocation ~ \"/v3/auth/OS-FEDERATION/websso/oidc\"\u003e\n      oidc params","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"3b750aa853858b569688a8aab15ad82ab654ef54","unresolved":false,"context_lines":[{"line_number":50,"context_line":""},{"line_number":51,"context_line":"      ..."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"      \u003cLocationMatch /v3/auth/OS-FEDERATION/websso/.*\u003e"},{"line_number":54,"context_line":"        AuthType openid-connect"},{"line_number":55,"context_line":"        Require valid-user"},{"line_number":56,"context_line":"      \u003c/LocationMatch\u003e"}],"source_content_type":"text/x-rst","patch_set":10,"id":"9aa53dc9_85f8267e","line":53,"in_reply_to":"baa041b7_06da7078","updated":"2015-04-06 13:14:38.000000000","message":"That will be fine for this doc.","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"dbacf901fe28ef3c44d50ceb7ec22c6f70da60a3","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  [federation]"},{"line_number":81,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"4. Set `remote_ids` for a keystone identity provider."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"A keystone identity provider may have multiple `remote_ids` specified, this"},{"line_number":86,"context_line":"allows the same *keystone* identity provider resource to be used with multiple"}],"source_content_type":"text/x-rst","patch_set":10,"id":"baa041b7_d3b0e4df","line":83,"updated":"2015-04-03 12:43:29.000000000","message":"how? Using API or in keystone.conf? This wouldn\u0027t make sense for me if I didn\u0027t follow federation/websso development","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"af8db5c731314dcc549401349a965687742481d0","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  [federation]"},{"line_number":81,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"4. Set `remote_ids` for a keystone identity provider."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"A keystone identity provider may have multiple `remote_ids` specified, this"},{"line_number":86,"context_line":"allows the same *keystone* identity provider resource to be used with multiple"}],"source_content_type":"text/x-rst","patch_set":10,"id":"baa041b7_264d743e","line":83,"in_reply_to":"baa041b7_2010bb4d","updated":"2015-04-05 06:24:50.000000000","message":"Done","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"49770263e6aebbd50d28f86dd99d109b8313ef6f","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  [federation]"},{"line_number":81,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"4. Set `remote_ids` for a keystone identity provider."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"A keystone identity provider may have multiple `remote_ids` specified, this"},{"line_number":86,"context_line":"allows the same *keystone* identity provider resource to be used with multiple"}],"source_content_type":"text/x-rst","patch_set":10,"id":"baa041b7_2010bb4d","line":83,"in_reply_to":"baa041b7_7e42ff3f","updated":"2015-04-05 01:09:38.000000000","message":"Using the CLI:\n openstack identity provider set --remote-id \u003crid\u003e  \u003cprovider\u003e","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"af8db5c731314dcc549401349a965687742481d0","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  [federation]"},{"line_number":81,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"4. Set `remote_ids` for a keystone identity provider."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"A keystone identity provider may have multiple `remote_ids` specified, this"},{"line_number":86,"context_line":"allows the same *keystone* identity provider resource to be used with multiple"}],"source_content_type":"text/x-rst","patch_set":10,"id":"baa041b7_e6566cd1","line":83,"in_reply_to":"baa041b7_d3b0e4df","updated":"2015-04-05 06:24:50.000000000","message":"Done","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"a82508df0face8d55f947a471d2618de3ca0dc08","unresolved":false,"context_lines":[{"line_number":80,"context_line":"  [federation]"},{"line_number":81,"context_line":"  remote_id_attribute \u003d HTTP_OIDC_ISS"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"4. Set `remote_ids` for a keystone identity provider."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"A keystone identity provider may have multiple `remote_ids` specified, this"},{"line_number":86,"context_line":"allows the same *keystone* identity provider resource to be used with multiple"}],"source_content_type":"text/x-rst","patch_set":10,"id":"baa041b7_7e42ff3f","line":83,"in_reply_to":"baa041b7_d3b0e4df","updated":"2015-04-03 12:49:01.000000000","message":"s/This/This section/","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"dbacf901fe28ef3c44d50ceb7ec22c6f70da60a3","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    Remote IDs are globally unique. Two identity providers cannot be"},{"line_number":95,"context_line":"    associated with the same remote ID. Once authenticated with the external"},{"line_number":96,"context_line":"    identity provider, keystone will use determine which identity provider"},{"line_number":97,"context_line":"    and mapping to use based on the protocol and the value returned from the"},{"line_number":98,"context_line":"    `remote_id_attribute` key."},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"baa041b7_73691825","line":96,"updated":"2015-04-03 12:43:29.000000000","message":"\"use determine\"","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"af8db5c731314dcc549401349a965687742481d0","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"    Remote IDs are globally unique. Two identity providers cannot be"},{"line_number":95,"context_line":"    associated with the same remote ID. Once authenticated with the external"},{"line_number":96,"context_line":"    identity provider, keystone will use determine which identity provider"},{"line_number":97,"context_line":"    and mapping to use based on the protocol and the value returned from the"},{"line_number":98,"context_line":"    `remote_id_attribute` key."},{"line_number":99,"context_line":""}],"source_content_type":"text/x-rst","patch_set":10,"id":"baa041b7_c65128da","line":96,"in_reply_to":"baa041b7_73691825","updated":"2015-04-05 06:24:50.000000000","message":"Done","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"49770263e6aebbd50d28f86dd99d109b8313ef6f","unresolved":false,"context_lines":[{"line_number":157,"context_line":"  WEBSSO_CHOICES \u003d ("},{"line_number":158,"context_line":"        (\"credentials\", _(\"Keystone Credentials\")),"},{"line_number":159,"context_line":"        (\"oidc\", _(\"OpenID Connect\")),"},{"line_number":160,"context_line":"        (\"saml2\", _(\"Security Assertion Markup Language\"))"},{"line_number":161,"context_line":"      )"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"5. (Optional) Specify an initial choice with the `WEBSSO_INITIAL_CHOICE`"}],"source_content_type":"text/x-rst","patch_set":10,"id":"baa041b7_a02a8b7c","line":160,"updated":"2015-04-05 01:09:38.000000000","message":"If we are going to put two SSO values in here, we need to make sure the document is written to allow the two mechanisms to live side by side.  Most of the doc is OK, but the Locations in HTTPD need to be protocol specific.  See Above.","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"af8db5c731314dcc549401349a965687742481d0","unresolved":false,"context_lines":[{"line_number":157,"context_line":"  WEBSSO_CHOICES \u003d ("},{"line_number":158,"context_line":"        (\"credentials\", _(\"Keystone Credentials\")),"},{"line_number":159,"context_line":"        (\"oidc\", _(\"OpenID Connect\")),"},{"line_number":160,"context_line":"        (\"saml2\", _(\"Security Assertion Markup Language\"))"},{"line_number":161,"context_line":"      )"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"5. (Optional) Specify an initial choice with the `WEBSSO_INITIAL_CHOICE`"}],"source_content_type":"text/x-rst","patch_set":10,"id":"baa041b7_a65f44e4","line":160,"in_reply_to":"baa041b7_a02a8b7c","updated":"2015-04-05 06:24:50.000000000","message":"hopefully i did enough up-top to satisfy this concern.","commit_id":"bf0a0caf09409728bf7152ab423ea28c61752d89"}]}