)]}'
{"doc/source/external-auth.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9a9ce02d479cdf4b23698e60d0f664b9bf49ffc3","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Using external authentication with Keystone"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"When Keystone is executed in :doc:`HTTPD \u003capache-httpd\u003e` it is possible to "},{"line_number":6,"context_line":"use additional authentication methods different from the authentication"},{"line_number":7,"context_line":"provided by the identity store backend. For example, this makes possible to"},{"line_number":8,"context_line":"use a SQL identity backend together with X.509 authentication, Kerberos, etc."}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2Fwzc%3D","line":5,"updated":"2012-11-26 21:10:15.000000000","message":"trailing whitespace throughout","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"de066c4b795eeee9d4e9926f5c46f2a460c67e63","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Using external authentication with Keystone"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"When Keystone is executed in :doc:`HTTPD \u003capache-httpd\u003e` it is possible to "},{"line_number":6,"context_line":"use additional authentication methods different from the authentication"},{"line_number":7,"context_line":"provided by the identity store backend. For example, this makes possible to"},{"line_number":8,"context_line":"use a SQL identity backend together with X.509 authentication, Kerberos, etc."}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwHA%3D","line":5,"in_reply_to":"AAAAMH%2F%2Fwzc%3D","updated":"2012-11-27 09:26:30.000000000","message":"Done","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9a9ce02d479cdf4b23698e60d0f664b9bf49ffc3","unresolved":false,"context_lines":[{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"When Keystone is executed in :doc:`HTTPD \u003capache-httpd\u003e` it is possible to "},{"line_number":6,"context_line":"use additional authentication methods different from the authentication"},{"line_number":7,"context_line":"provided by the identity store backend. For example, this makes possible to"},{"line_number":8,"context_line":"use a SQL identity backend together with X.509 authentication, Kerberos, etc."},{"line_number":9,"context_line":"instead of using the username/password combination."}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2Fw08%3D","line":6,"updated":"2012-11-26 21:10:15.000000000","message":"additional authentication methods different from -\u003e external authentication methods in addition to","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"de066c4b795eeee9d4e9926f5c46f2a460c67e63","unresolved":false,"context_lines":[{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"When Keystone is executed in :doc:`HTTPD \u003capache-httpd\u003e` it is possible to "},{"line_number":6,"context_line":"use additional authentication methods different from the authentication"},{"line_number":7,"context_line":"provided by the identity store backend. For example, this makes possible to"},{"line_number":8,"context_line":"use a SQL identity backend together with X.509 authentication, Kerberos, etc."},{"line_number":9,"context_line":"instead of using the username/password combination."}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwG8%3D","line":6,"in_reply_to":"AAAAMH%2F%2Fw08%3D","updated":"2012-11-27 09:26:30.000000000","message":"Done","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9a9ce02d479cdf4b23698e60d0f664b9bf49ffc3","unresolved":false,"context_lines":[{"line_number":8,"context_line":"use a SQL identity backend together with X.509 authentication, Kerberos, etc."},{"line_number":9,"context_line":"instead of using the username/password combination."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Given auth"},{"line_number":12,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Webservers like Apache HTTP support many ways of authentication. Keystone can"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2Fw0E%3D","line":11,"updated":"2012-11-26 21:10:15.000000000","message":"not clear on what this heading is referring to","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"de066c4b795eeee9d4e9926f5c46f2a460c67e63","unresolved":false,"context_lines":[{"line_number":8,"context_line":"use a SQL identity backend together with X.509 authentication, Kerberos, etc."},{"line_number":9,"context_line":"instead of using the username/password combination."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Given auth"},{"line_number":12,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Webservers like Apache HTTP support many ways of authentication. Keystone can"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwG4%3D","line":11,"in_reply_to":"AAAAMH%2F%2Fw0E%3D","updated":"2012-11-27 09:26:30.000000000","message":"Done","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9a9ce02d479cdf4b23698e60d0f664b9bf49ffc3","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Given auth"},{"line_number":12,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Webservers like Apache HTTP support many ways of authentication. Keystone can"},{"line_number":15,"context_line":"profit from this feature and let the authentication be done in the webserver,"},{"line_number":16,"context_line":"that will pass down the authenticated user to Keystone using the ``REMOTE_USER``"},{"line_number":17,"context_line":"environment variable. This user must exist in advance in the identity backend"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2Fw1I%3D","line":14,"updated":"2012-11-26 21:10:15.000000000","message":"many ways -\u003e many methods","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"de066c4b795eeee9d4e9926f5c46f2a460c67e63","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Given auth"},{"line_number":12,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Webservers like Apache HTTP support many ways of authentication. Keystone can"},{"line_number":15,"context_line":"profit from this feature and let the authentication be done in the webserver,"},{"line_number":16,"context_line":"that will pass down the authenticated user to Keystone using the ``REMOTE_USER``"},{"line_number":17,"context_line":"environment variable. This user must exist in advance in the identity backend"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwG0%3D","line":14,"in_reply_to":"AAAAMH%2F%2Fw1I%3D","updated":"2012-11-27 09:26:30.000000000","message":"Done","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9a9ce02d479cdf4b23698e60d0f664b9bf49ffc3","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Developing a WSGI middleware for authentication"},{"line_number":44,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Apart from the **Given Authentication** it is possible to implement other"},{"line_number":47,"context_line":"custom authentication mechanisms based on the usage of the ``REMOTE_USER``"},{"line_number":48,"context_line":"variable. Please note that is preferred to leverage the authentication to"},{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2Fw0M%3D","line":46,"updated":"2012-11-26 21:10:15.000000000","message":"what is \"Given Authentication\"?","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"518d6d67838f64ed8bf191f12397e2074d5fc396","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Developing a WSGI middleware for authentication"},{"line_number":44,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Apart from the **Given Authentication** it is possible to implement other"},{"line_number":47,"context_line":"custom authentication mechanisms based on the usage of the ``REMOTE_USER``"},{"line_number":48,"context_line":"variable. Please note that is preferred to leverage the authentication to"},{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwPo%3D","line":46,"in_reply_to":"AAAAMH%2F%2Fw0M%3D","updated":"2012-11-27 03:33:18.000000000","message":"\"in addition to validating against the Identity backend....\"","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"de066c4b795eeee9d4e9926f5c46f2a460c67e63","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Developing a WSGI middleware for authentication"},{"line_number":44,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Apart from the **Given Authentication** it is possible to implement other"},{"line_number":47,"context_line":"custom authentication mechanisms based on the usage of the ``REMOTE_USER``"},{"line_number":48,"context_line":"variable. Please note that is preferred to leverage the authentication to"},{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwGw%3D","line":46,"in_reply_to":"AAAAMH%2F%2Fw0M%3D","updated":"2012-11-27 09:26:30.000000000","message":"Done","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9a9ce02d479cdf4b23698e60d0f664b9bf49ffc3","unresolved":false,"context_lines":[{"line_number":44,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Apart from the **Given Authentication** it is possible to implement other"},{"line_number":47,"context_line":"custom authentication mechanisms based on the usage of the ``REMOTE_USER``"},{"line_number":48,"context_line":"variable. Please note that is preferred to leverage the authentication to"},{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"},{"line_number":50,"context_line":"needed."}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2Fw0o%3D","line":47,"updated":"2012-11-26 21:10:15.000000000","message":"based on the usage of -\u003e using","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"de066c4b795eeee9d4e9926f5c46f2a460c67e63","unresolved":false,"context_lines":[{"line_number":44,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Apart from the **Given Authentication** it is possible to implement other"},{"line_number":47,"context_line":"custom authentication mechanisms based on the usage of the ``REMOTE_USER``"},{"line_number":48,"context_line":"variable. Please note that is preferred to leverage the authentication to"},{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"},{"line_number":50,"context_line":"needed."}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwGs%3D","line":47,"in_reply_to":"AAAAMH%2F%2Fw0o%3D","updated":"2012-11-27 09:26:30.000000000","message":"Done","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9a9ce02d479cdf4b23698e60d0f664b9bf49ffc3","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Apart from the **Given Authentication** it is possible to implement other"},{"line_number":47,"context_line":"custom authentication mechanisms based on the usage of the ``REMOTE_USER``"},{"line_number":48,"context_line":"variable. Please note that is preferred to leverage the authentication to"},{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"},{"line_number":50,"context_line":"needed."},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2Fw0k%3D","line":48,"updated":"2012-11-26 21:10:15.000000000","message":"variable -\u003e WSGI environment variable","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"de066c4b795eeee9d4e9926f5c46f2a460c67e63","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Apart from the **Given Authentication** it is possible to implement other"},{"line_number":47,"context_line":"custom authentication mechanisms based on the usage of the ``REMOTE_USER``"},{"line_number":48,"context_line":"variable. Please note that is preferred to leverage the authentication to"},{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"},{"line_number":50,"context_line":"needed."},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwGo%3D","line":48,"in_reply_to":"AAAAMH%2F%2Fw0k%3D","updated":"2012-11-27 09:26:30.000000000","message":"Done","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9a9ce02d479cdf4b23698e60d0f664b9bf49ffc3","unresolved":false,"context_lines":[{"line_number":47,"context_line":"custom authentication mechanisms based on the usage of the ``REMOTE_USER``"},{"line_number":48,"context_line":"variable. Please note that is preferred to leverage the authentication to"},{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"},{"line_number":50,"context_line":"needed."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This task is accomplished implementing a WSGI middleware. This middleware"},{"line_number":53,"context_line":"should set the ``REMOTE_USER`` variable in the environment and Keystone will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2Fw0Q%3D","line":50,"updated":"2012-11-26 21:10:15.000000000","message":"I\u0027m not clear on what this last sentence is suggesting","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"de066c4b795eeee9d4e9926f5c46f2a460c67e63","unresolved":false,"context_lines":[{"line_number":47,"context_line":"custom authentication mechanisms based on the usage of the ``REMOTE_USER``"},{"line_number":48,"context_line":"variable. Please note that is preferred to leverage the authentication to"},{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"},{"line_number":50,"context_line":"needed."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This task is accomplished implementing a WSGI middleware. This middleware"},{"line_number":53,"context_line":"should set the ``REMOTE_USER`` variable in the environment and Keystone will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwGk%3D","line":50,"in_reply_to":"AAAAMH%2F%2Fw0Q%3D","updated":"2012-11-27 09:26:30.000000000","message":"Done","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"518d6d67838f64ed8bf191f12397e2074d5fc396","unresolved":false,"context_lines":[{"line_number":47,"context_line":"custom authentication mechanisms based on the usage of the ``REMOTE_USER``"},{"line_number":48,"context_line":"variable. Please note that is preferred to leverage the authentication to"},{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"},{"line_number":50,"context_line":"needed."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This task is accomplished implementing a WSGI middleware. This middleware"},{"line_number":53,"context_line":"should set the ``REMOTE_USER`` variable in the environment and Keystone will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwPk%3D","line":50,"in_reply_to":"AAAAMH%2F%2Fw0Q%3D","updated":"2012-11-27 03:33:18.000000000","message":"I think the doc needs to state the robustness and review that the Apache modules have undergone over the years, and that implementing custom module has a higher risk of exploit that using a comparable Apache module.","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"de066c4b795eeee9d4e9926f5c46f2a460c67e63","unresolved":false,"context_lines":[{"line_number":47,"context_line":"custom authentication mechanisms based on the usage of the ``REMOTE_USER``"},{"line_number":48,"context_line":"variable. Please note that is preferred to leverage the authentication to"},{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"},{"line_number":50,"context_line":"needed."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This task is accomplished implementing a WSGI middleware. This middleware"},{"line_number":53,"context_line":"should set the ``REMOTE_USER`` variable in the environment and Keystone will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwFU%3D","line":50,"in_reply_to":"AAAAMH%2F%2FwPk%3D","updated":"2012-11-27 09:26:30.000000000","message":"Done","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"518d6d67838f64ed8bf191f12397e2074d5fc396","unresolved":false,"context_lines":[{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"},{"line_number":50,"context_line":"needed."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This task is accomplished implementing a WSGI middleware. This middleware"},{"line_number":53,"context_line":"should set the ``REMOTE_USER`` variable in the environment and Keystone will"},{"line_number":54,"context_line":"assume that the user has been already authenticated upstream and will not try to"},{"line_number":55,"context_line":"authenticate it. However, as in the given auth case, the user must exist in"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwPY%3D","line":52,"updated":"2012-11-27 03:33:18.000000000","message":"\"This task \" should be \"if you find you must implement a custom authentication mechanism, you will need to create a WSGI middleware pipeline component.","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"de066c4b795eeee9d4e9926f5c46f2a460c67e63","unresolved":false,"context_lines":[{"line_number":49,"context_line":"the http server and not develop a custom authentication module unless strongly"},{"line_number":50,"context_line":"needed."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"This task is accomplished implementing a WSGI middleware. This middleware"},{"line_number":53,"context_line":"should set the ``REMOTE_USER`` variable in the environment and Keystone will"},{"line_number":54,"context_line":"assume that the user has been already authenticated upstream and will not try to"},{"line_number":55,"context_line":"authenticate it. However, as in the given auth case, the user must exist in"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwFY%3D","line":52,"in_reply_to":"AAAAMH%2F%2FwPY%3D","updated":"2012-11-27 09:26:30.000000000","message":"Done","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9a9ce02d479cdf4b23698e60d0f664b9bf49ffc3","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    paste.filter_factory \u003d keystone.middleware.MyMiddlewareAuth.factory"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    [pipeline:public_api]"},{"line_number":93,"context_line":"    pipeline \u003d stats_monitoring url_normalize token_auth admin_token_auth xml_body json_body myauth debug ec2_extension user_crud_extension public_service"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2Fwzo%3D","line":93,"updated":"2012-11-26 21:10:15.000000000","message":"Instead of copy/pasting the entire current pipeline, you can explain where in the pipeline it should be placed, and why (and show a corresponding snippet of the pipeline, such as:\n\n     pipeline \u003d [...] something_required_upstream [...] my_auth [...] something_required_downstream [...]","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"de066c4b795eeee9d4e9926f5c46f2a460c67e63","unresolved":false,"context_lines":[{"line_number":90,"context_line":"    paste.filter_factory \u003d keystone.middleware.MyMiddlewareAuth.factory"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    [pipeline:public_api]"},{"line_number":93,"context_line":"    pipeline \u003d stats_monitoring url_normalize token_auth admin_token_auth xml_body json_body myauth debug ec2_extension user_crud_extension public_service"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAMH%2F%2FwFc%3D","line":93,"in_reply_to":"AAAAMH%2F%2Fwzo%3D","updated":"2012-11-27 09:26:30.000000000","message":"Done","commit_id":"45a06e7ceb4bc6eae717b38eb2db183e1c50e2d2"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d697306f5e0ee2e2faecb67e92466a15b27bb1e2","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        SSLEngine on"},{"line_number":30,"context_line":"        SSLCertificateFile    /etc/ssl/certs/ssl.cert"},{"line_number":31,"context_line":"        SSLCertificateKeyFile /etc/ssl/private/ssl.key"},{"line_number":32,"context_line":"        "},{"line_number":33,"context_line":"        "},{"line_number":34,"context_line":"        SSLCACertificatePath /etc/ssl/allowed_cas"},{"line_number":35,"context_line":"        SSLCARevocationPath  /etc/ssl/allowed_cas"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAMH%2F%2FvnE%3D","line":32,"updated":"2012-11-27 17:22:37.000000000","message":"one blank line instead of two (I think RST will choke on two without the trailing whitespace?)","commit_id":"6bf835fe6274115857262f696868112b4fdc6e1f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d697306f5e0ee2e2faecb67e92466a15b27bb1e2","unresolved":false,"context_lines":[{"line_number":36,"context_line":"        SSLUserName          SSL_CLIENT_S_DN_CN"},{"line_number":37,"context_line":"        SSLVerifyClient      require"},{"line_number":38,"context_line":"        SSLVerifyDepth       10"},{"line_number":39,"context_line":"        "},{"line_number":40,"context_line":"        (...)"},{"line_number":41,"context_line":"    \u003c/VirtualHost\u003e"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAMH%2F%2FvnI%3D","line":39,"updated":"2012-11-27 17:22:37.000000000","message":"remove trailing whitespace","commit_id":"6bf835fe6274115857262f696868112b4fdc6e1f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d697306f5e0ee2e2faecb67e92466a15b27bb1e2","unresolved":false,"context_lines":[{"line_number":59,"context_line":"to develop a custom WSGI middleware pipeline component. This middleware should"},{"line_number":60,"context_line":"set the environment variable ``REMOTE_USER`` to the authenticated username."},{"line_number":61,"context_line":"Keystone then will assume that the user has been already authenticated upstream"},{"line_number":62,"context_line":"and will not try to authenticate it. However, as in the given auth case, the"},{"line_number":63,"context_line":"user must exist in advance in the identity backend so that a proper token can"},{"line_number":64,"context_line":"be issued."},{"line_number":65,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAMH%2F%2Fvng%3D","line":62,"updated":"2012-11-27 17:22:37.000000000","message":"However, as with HTTPD authentication,","commit_id":"6bf835fe6274115857262f696868112b4fdc6e1f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d697306f5e0ee2e2faecb67e92466a15b27bb1e2","unresolved":false,"context_lines":[{"line_number":85,"context_line":"                request.environ[\u0027REMOTE_USER\u0027] \u003d username"},{"line_number":86,"context_line":"            else:"},{"line_number":87,"context_line":"                # User is not authenticated"},{"line_number":88,"context_line":"                raise exception.Unauthorized(message\u003d\"Invalid user\")"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Pipeline config"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAMH%2F%2Fvnw%3D","line":88,"updated":"2012-11-27 17:22:37.000000000","message":"raise exception.Unauthorized(\u0027Invalid user\u0027) is preferred (no kwargs)","commit_id":"6bf835fe6274115857262f696868112b4fdc6e1f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d697306f5e0ee2e2faecb67e92466a15b27bb1e2","unresolved":false,"context_lines":[{"line_number":92,"context_line":"--------------"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Once you have your WSGI middelware component developed you have to add it to"},{"line_number":95,"context_line":"your pipeline. The first step is add the middleware to your  configuration file."},{"line_number":96,"context_line":"Assuming that your middleware module is ``keystone.middleware.MyMiddlewareAuth``"},{"line_number":97,"context_line":"you can configure it in your ``keystone.conf`` as::"},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAMH%2F%2FvnY%3D","line":95,"updated":"2012-11-27 17:22:37.000000000","message":"remove double space between \u0027your\u0027 and \u0027configuration\u0027","commit_id":"6bf835fe6274115857262f696868112b4fdc6e1f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d697306f5e0ee2e2faecb67e92466a15b27bb1e2","unresolved":false,"context_lines":[{"line_number":104,"context_line":"the request body is converted from JSON before perform the authentication you"},{"line_number":105,"context_line":"should place it after the ``json_body`` filter) but it should be set before the"},{"line_number":106,"context_line":"``public_service`` (for the ``public_api`` pipeline) or ``admin_service`` (for"},{"line_number":107,"context_line":"the ``admin_api`` pipeline), since they require authentication."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"For example, if the original pipeline looks like this::"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAAMH%2F%2FvnM%3D","line":107,"updated":"2012-11-27 17:22:37.000000000","message":"nice!","commit_id":"6bf835fe6274115857262f696868112b4fdc6e1f"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"5c1012fac316541af7d2374cab1a82feaf78f424","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        SSLEngine on"},{"line_number":30,"context_line":"        SSLCertificateFile    /etc/ssl/certs/ssl.cert"},{"line_number":31,"context_line":"        SSLCertificateKeyFile /etc/ssl/private/ssl.key"},{"line_number":32,"context_line":"        "},{"line_number":33,"context_line":"        SSLCACertificatePath /etc/ssl/allowed_cas"},{"line_number":34,"context_line":"        SSLCARevocationPath  /etc/ssl/allowed_cas"},{"line_number":35,"context_line":"        SSLUserName          SSL_CLIENT_S_DN_CN"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMH%2F%2Fr8Q%3D","line":32,"updated":"2012-11-30 15:31:24.000000000","message":"White space","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"2644fd54def9b6af477beb648a5abad2913b908b","unresolved":false,"context_lines":[{"line_number":29,"context_line":"        SSLEngine on"},{"line_number":30,"context_line":"        SSLCertificateFile    /etc/ssl/certs/ssl.cert"},{"line_number":31,"context_line":"        SSLCertificateKeyFile /etc/ssl/private/ssl.key"},{"line_number":32,"context_line":"        "},{"line_number":33,"context_line":"        SSLCACertificatePath /etc/ssl/allowed_cas"},{"line_number":34,"context_line":"        SSLCARevocationPath  /etc/ssl/allowed_cas"},{"line_number":35,"context_line":"        SSLUserName          SSL_CLIENT_S_DN_CN"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMX%2F%2F%2Fuo%3D","line":32,"in_reply_to":"AAAAMH%2F%2Fr8Q%3D","updated":"2012-12-03 09:22:58.000000000","message":"Done","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"5c1012fac316541af7d2374cab1a82feaf78f424","unresolved":false,"context_lines":[{"line_number":47,"context_line":"variable."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":".. ATTENTION::"},{"line_number":50,"context_line":"    Please note that event if it is possible to develop a custom authentication"},{"line_number":51,"context_line":"    module, it is preferred to leverage this to the http server. Such authentication"},{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMH%2F%2Fr8I%3D","line":50,"updated":"2012-11-30 15:31:24.000000000","message":"event-\u003eeven","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"2644fd54def9b6af477beb648a5abad2913b908b","unresolved":false,"context_lines":[{"line_number":47,"context_line":"variable."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":".. ATTENTION::"},{"line_number":50,"context_line":"    Please note that event if it is possible to develop a custom authentication"},{"line_number":51,"context_line":"    module, it is preferred to leverage this to the http server. Such authentication"},{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMX%2F%2F%2Fuk%3D","line":50,"in_reply_to":"AAAAMH%2F%2Fr8I%3D","updated":"2012-12-03 09:22:58.000000000","message":"Done","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"edd8d1cacad03faabfca21679808822a14e9cc74","unresolved":false,"context_lines":[{"line_number":47,"context_line":"variable."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":".. ATTENTION::"},{"line_number":50,"context_line":"    Please note that event if it is possible to develop a custom authentication"},{"line_number":51,"context_line":"    module, it is preferred to leverage this to the http server. Such authentication"},{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMH%2F%2FrjU%3D","line":50,"in_reply_to":"AAAAMH%2F%2Fr8I%3D","updated":"2012-11-30 19:24:05.000000000","message":"nice catch","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"5c1012fac316541af7d2374cab1a82feaf78f424","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":".. ATTENTION::"},{"line_number":50,"context_line":"    Please note that event if it is possible to develop a custom authentication"},{"line_number":51,"context_line":"    module, it is preferred to leverage this to the http server. Such authentication"},{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"},{"line_number":54,"context_line":"    module that implements the same authentication as an existing Apache module is"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMH%2F%2Fr8E%3D","line":51,"updated":"2012-11-30 15:31:24.000000000","message":"\"it is preferable to use the modules from the HTTPD server.   Authentication modules in web servers...\"","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"edd8d1cacad03faabfca21679808822a14e9cc74","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":".. ATTENTION::"},{"line_number":50,"context_line":"    Please note that event if it is possible to develop a custom authentication"},{"line_number":51,"context_line":"    module, it is preferred to leverage this to the http server. Such authentication"},{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"},{"line_number":54,"context_line":"    module that implements the same authentication as an existing Apache module is"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMH%2F%2FrjQ%3D","line":51,"in_reply_to":"AAAAMH%2F%2Fr8E%3D","updated":"2012-11-30 19:24:05.000000000","message":"+1","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"2644fd54def9b6af477beb648a5abad2913b908b","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":".. ATTENTION::"},{"line_number":50,"context_line":"    Please note that event if it is possible to develop a custom authentication"},{"line_number":51,"context_line":"    module, it is preferred to leverage this to the http server. Such authentication"},{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"},{"line_number":54,"context_line":"    module that implements the same authentication as an existing Apache module is"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMX%2F%2F%2Fug%3D","line":51,"in_reply_to":"AAAAMH%2F%2Fr8E%3D","updated":"2012-12-03 09:22:58.000000000","message":"Done","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"5c1012fac316541af7d2374cab1a82feaf78f424","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    Please note that event if it is possible to develop a custom authentication"},{"line_number":51,"context_line":"    module, it is preferred to leverage this to the http server. Such authentication"},{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"},{"line_number":54,"context_line":"    module that implements the same authentication as an existing Apache module is"},{"line_number":55,"context_line":"    not advised, since it introduces a higher security risk."},{"line_number":56,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMH%2F%2Fr8A%3D","line":53,"updated":"2012-11-30 15:31:24.000000000","message":"usage -\u003e use in live systems,","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"edd8d1cacad03faabfca21679808822a14e9cc74","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    Please note that event if it is possible to develop a custom authentication"},{"line_number":51,"context_line":"    module, it is preferred to leverage this to the http server. Such authentication"},{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"},{"line_number":54,"context_line":"    module that implements the same authentication as an existing Apache module is"},{"line_number":55,"context_line":"    not advised, since it introduces a higher security risk."},{"line_number":56,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMH%2F%2FrjM%3D","line":53,"in_reply_to":"AAAAMH%2F%2Fr8A%3D","updated":"2012-11-30 19:24:05.000000000","message":"+1; \"production systems\" maybe?","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"2644fd54def9b6af477beb648a5abad2913b908b","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    Please note that event if it is possible to develop a custom authentication"},{"line_number":51,"context_line":"    module, it is preferred to leverage this to the http server. Such authentication"},{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"},{"line_number":54,"context_line":"    module that implements the same authentication as an existing Apache module is"},{"line_number":55,"context_line":"    not advised, since it introduces a higher security risk."},{"line_number":56,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMX%2F%2F%2Fuc%3D","line":53,"in_reply_to":"AAAAMH%2F%2Fr8A%3D","updated":"2012-12-03 09:22:58.000000000","message":"Done","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"5c1012fac316541af7d2374cab1a82feaf78f424","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"},{"line_number":54,"context_line":"    module that implements the same authentication as an existing Apache module is"},{"line_number":55,"context_line":"    not advised, since it introduces a higher security risk."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"If you find you must implement a custom authentication mechanism, you will need"},{"line_number":58,"context_line":"to develop a custom WSGI middleware pipeline component. This middleware should"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMH%2F%2Fr78%3D","line":55,"updated":"2012-11-30 15:31:24.000000000","message":"\"the same authentication as an existing Apache module introduces a security risk.\"","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"edd8d1cacad03faabfca21679808822a14e9cc74","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"},{"line_number":54,"context_line":"    module that implements the same authentication as an existing Apache module is"},{"line_number":55,"context_line":"    not advised, since it introduces a higher security risk."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"If you find you must implement a custom authentication mechanism, you will need"},{"line_number":58,"context_line":"to develop a custom WSGI middleware pipeline component. This middleware should"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMH%2F%2FrjI%3D","line":55,"in_reply_to":"AAAAMH%2F%2Fr78%3D","updated":"2012-11-30 19:24:05.000000000","message":"+1; introduces -\u003e likely introduces","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"2644fd54def9b6af477beb648a5abad2913b908b","unresolved":false,"context_lines":[{"line_number":52,"context_line":"    modules in webservers like Apache have normally undergone years of development"},{"line_number":53,"context_line":"    and usage and are maintained upstream. Developing a custom authentication"},{"line_number":54,"context_line":"    module that implements the same authentication as an existing Apache module is"},{"line_number":55,"context_line":"    not advised, since it introduces a higher security risk."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"If you find you must implement a custom authentication mechanism, you will need"},{"line_number":58,"context_line":"to develop a custom WSGI middleware pipeline component. This middleware should"}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMX%2F%2F%2FuY%3D","line":55,"in_reply_to":"AAAAMH%2F%2Fr78%3D","updated":"2012-12-03 09:22:58.000000000","message":"Done","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"5c1012fac316541af7d2374cab1a82feaf78f424","unresolved":false,"context_lines":[{"line_number":65,"context_line":"Your code should set the ``REMOTE_USER`` if the user is properly authenticated,"},{"line_number":66,"context_line":"following the semantics below::"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"    class MyMiddlewareAuth(wsgi.Middleware):"},{"line_number":69,"context_line":"        def __init__(self, *args, **kwargs):"},{"line_number":70,"context_line":"            super(MyMiddlewareAuth, self).__init__(*args, **kwargs)"},{"line_number":71,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMH%2F%2Fr7k%3D","line":68,"updated":"2012-11-30 15:31:24.000000000","message":"Leave this in for now, but after this commit,  add your sample Middleware Auth into keystone/contrib, and then update the documentation to refer to this.  We could potentially use the middleware in contrib for testing purposes inside of eventlet.","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"edd8d1cacad03faabfca21679808822a14e9cc74","unresolved":false,"context_lines":[{"line_number":65,"context_line":"Your code should set the ``REMOTE_USER`` if the user is properly authenticated,"},{"line_number":66,"context_line":"following the semantics below::"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"    class MyMiddlewareAuth(wsgi.Middleware):"},{"line_number":69,"context_line":"        def __init__(self, *args, **kwargs):"},{"line_number":70,"context_line":"            super(MyMiddlewareAuth, self).__init__(*args, **kwargs)"},{"line_number":71,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMH%2F%2FrjE%3D","line":68,"in_reply_to":"AAAAMH%2F%2Fr7k%3D","updated":"2012-11-30 19:24:05.000000000","message":"if it goes into a new location, it needs to be removed here as well","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"2644fd54def9b6af477beb648a5abad2913b908b","unresolved":false,"context_lines":[{"line_number":65,"context_line":"Your code should set the ``REMOTE_USER`` if the user is properly authenticated,"},{"line_number":66,"context_line":"following the semantics below::"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"    class MyMiddlewareAuth(wsgi.Middleware):"},{"line_number":69,"context_line":"        def __init__(self, *args, **kwargs):"},{"line_number":70,"context_line":"            super(MyMiddlewareAuth, self).__init__(*args, **kwargs)"},{"line_number":71,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"AAAAMX%2F%2F%2FuU%3D","line":68,"in_reply_to":"AAAAMH%2F%2FrjE%3D","updated":"2012-12-03 09:22:58.000000000","message":"Good idea. I\u0027ll try to submit something in the next few days.","commit_id":"c0c87e117f8b94180994cf3f9e3a0d258ff82bf5"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"92c19b99d4f5999df36e9038ac94f827180307e9","unresolved":false,"context_lines":[{"line_number":92,"context_line":"----------------------"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Once you have your WSGI middleware component developed you have to add it to"},{"line_number":95,"context_line":"your pipeline. The first step is add the middleware to your configuration file."},{"line_number":96,"context_line":"Assuming that your middleware module is ``keystone.middleware.MyMiddlewareAuth``"},{"line_number":97,"context_line":"you can configure it in your ``keystone.conf`` as::"},{"line_number":98,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAMX%2F%2F%2Fro%3D","line":95,"updated":"2012-12-03 10:13:15.000000000","message":"is add -\u003e is to add","commit_id":"51011b28786ae8963a87080c9545c382c073ed2f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"92c19b99d4f5999df36e9038ac94f827180307e9","unresolved":false,"context_lines":[{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Once you have your WSGI middleware component developed you have to add it to"},{"line_number":95,"context_line":"your pipeline. The first step is add the middleware to your configuration file."},{"line_number":96,"context_line":"Assuming that your middleware module is ``keystone.middleware.MyMiddlewareAuth``"},{"line_number":97,"context_line":"you can configure it in your ``keystone.conf`` as::"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"    [filter:my_auth]"}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAMX%2F%2F%2Frk%3D","line":96,"updated":"2012-12-03 10:13:15.000000000","message":"comma after ``keystone.middleware.MyMiddlewareAuth``","commit_id":"51011b28786ae8963a87080c9545c382c073ed2f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"92c19b99d4f5999df36e9038ac94f827180307e9","unresolved":false,"context_lines":[{"line_number":104,"context_line":"the request body is converted from JSON before perform the authentication you"},{"line_number":105,"context_line":"should place it after the ``json_body`` filter) but it should be set before the"},{"line_number":106,"context_line":"``public_service`` (for the ``public_api`` pipeline) or ``admin_service`` (for"},{"line_number":107,"context_line":"the ``admin_api`` pipeline), since they require authentication."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"For example, if the original pipeline looks like this::"},{"line_number":110,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAMX%2F%2F%2Frg%3D","line":107,"updated":"2012-12-03 10:13:15.000000000","message":"require -\u003e consume (maybe?)","commit_id":"51011b28786ae8963a87080c9545c382c073ed2f"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"92c19b99d4f5999df36e9038ac94f827180307e9","unresolved":false,"context_lines":[{"line_number":111,"context_line":"    [pipeline:public_api]"},{"line_number":112,"context_line":"    pipeline \u003d stats_monitoring url_normalize token_auth admin_token_auth xml_body json_body debug ec2_extension user_crud_extension public_service"},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"You can modify it like this::"},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"    [pipeline:public_api]"},{"line_number":117,"context_line":"    pipeline \u003d stats_monitoring url_normalize token_auth admin_token_auth xml_body json_body my_auth debug ec2_extension user_crud_extension public_service"}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAMX%2F%2F%2Frc%3D","line":114,"updated":"2012-12-03 10:13:15.000000000","message":"Your modified pipeline might look like this::","commit_id":"51011b28786ae8963a87080c9545c382c073ed2f"}]}