)]}'
{"doc/source/services.rst":[{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9934c256e41b58f011f14dcef58bf11cf2863f1b","unresolved":false,"context_lines":[{"line_number":5,"context_line":"This document provides a summary of some things that other services"},{"line_number":6,"context_line":"need to know about how keystone. Specifically, we were requested to"},{"line_number":7,"context_line":"describe what other services need to know about the v3 API. The v3 API"},{"line_number":8,"context_line":"was introduced in the Grizzly release, and it\u0027s use until recently has"},{"line_number":9,"context_line":"been hidden from other services since the auth_token middleware kept"},{"line_number":10,"context_line":"the differences hidden. Once the services need to make use of v3"},{"line_number":11,"context_line":"features they need to know about how it works."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_7a0e2ee6","line":8,"updated":"2015-07-23 04:28:04.000000000","message":"s/it\u0027s/its","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a868286a5a50db48bac6524685ec74f16a34713f","unresolved":false,"context_lines":[{"line_number":5,"context_line":"This document provides a summary of some things that other services"},{"line_number":6,"context_line":"need to know about how keystone. Specifically, we were requested to"},{"line_number":7,"context_line":"describe what other services need to know about the v3 API. The v3 API"},{"line_number":8,"context_line":"was introduced in the Grizzly release, and it\u0027s use until recently has"},{"line_number":9,"context_line":"been hidden from other services since the auth_token middleware kept"},{"line_number":10,"context_line":"the differences hidden. Once the services need to make use of v3"},{"line_number":11,"context_line":"features they need to know about how it works."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_0ec229e9","line":8,"in_reply_to":"3a50d1a3_7a0e2ee6","updated":"2015-07-23 16:00:58.000000000","message":"Done","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9934c256e41b58f011f14dcef58bf11cf2863f1b","unresolved":false,"context_lines":[{"line_number":7,"context_line":"describe what other services need to know about the v3 API. The v3 API"},{"line_number":8,"context_line":"was introduced in the Grizzly release, and it\u0027s use until recently has"},{"line_number":9,"context_line":"been hidden from other services since the auth_token middleware kept"},{"line_number":10,"context_line":"the differences hidden. Once the services need to make use of v3"},{"line_number":11,"context_line":"features they need to know about how it works."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_9a11ba06","line":10,"updated":"2015-07-23 04:28:04.000000000","message":"maybe replace hidden here with encapsulated.","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a868286a5a50db48bac6524685ec74f16a34713f","unresolved":false,"context_lines":[{"line_number":7,"context_line":"describe what other services need to know about the v3 API. The v3 API"},{"line_number":8,"context_line":"was introduced in the Grizzly release, and it\u0027s use until recently has"},{"line_number":9,"context_line":"been hidden from other services since the auth_token middleware kept"},{"line_number":10,"context_line":"the differences hidden. Once the services need to make use of v3"},{"line_number":11,"context_line":"features they need to know about how it works."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_aeb45581","line":10,"in_reply_to":"3a50d1a3_9a11ba06","updated":"2015-07-23 16:00:58.000000000","message":"Done","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9934c256e41b58f011f14dcef58bf11cf2863f1b","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    OpenStack servers like keystone, nova, glance, etc."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Project"},{"line_number":21,"context_line":"    Used to be called a tenant."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Token differences"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_ba2fd63d","line":21,"updated":"2015-07-23 04:28:04.000000000","message":"Formerly known as a tenant","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a868286a5a50db48bac6524685ec74f16a34713f","unresolved":false,"context_lines":[{"line_number":18,"context_line":"    OpenStack servers like keystone, nova, glance, etc."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Project"},{"line_number":21,"context_line":"    Used to be called a tenant."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"Token differences"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_ceb76183","line":21,"in_reply_to":"3a50d1a3_ba2fd63d","updated":"2015-07-23 16:00:58.000000000","message":"Done","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9934c256e41b58f011f14dcef58bf11cf2863f1b","unresolved":false,"context_lines":[{"line_number":38,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"A major change to v3 is domains. Every project, user, and group is in a"},{"line_number":41,"context_line":"domain. This means they have a domain_id. You can have 2 users with the"},{"line_number":42,"context_line":"same name but they must be in different domains, so user names are not"},{"line_number":43,"context_line":"unique. In case you\u0027re wondering, roles are not in domains."},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_3a24265c","line":41,"updated":"2015-07-23 04:28:04.000000000","message":"s/2/two","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a868286a5a50db48bac6524685ec74f16a34713f","unresolved":false,"context_lines":[{"line_number":38,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"A major change to v3 is domains. Every project, user, and group is in a"},{"line_number":41,"context_line":"domain. This means they have a domain_id. You can have 2 users with the"},{"line_number":42,"context_line":"same name but they must be in different domains, so user names are not"},{"line_number":43,"context_line":"unique. In case you\u0027re wondering, roles are not in domains."},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_6e996dc3","line":41,"in_reply_to":"3a50d1a3_3a24265c","updated":"2015-07-23 16:00:58.000000000","message":"Done","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9934c256e41b58f011f14dcef58bf11cf2863f1b","unresolved":false,"context_lines":[{"line_number":40,"context_line":"A major change to v3 is domains. Every project, user, and group is in a"},{"line_number":41,"context_line":"domain. This means they have a domain_id. You can have 2 users with the"},{"line_number":42,"context_line":"same name but they must be in different domains, so user names are not"},{"line_number":43,"context_line":"unique. In case you\u0027re wondering, roles are not in domains."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"One of the great things about domains is that you can have one domain"},{"line_number":46,"context_line":"backed by SQL (for service users) and another backed by LDAP (the cloud"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_1aeccaf1","line":43,"updated":"2015-07-23 04:28:04.000000000","message":"s/In case you\u0027re wondering, roles are not in domains./However roles are not in domains.","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a868286a5a50db48bac6524685ec74f16a34713f","unresolved":false,"context_lines":[{"line_number":40,"context_line":"A major change to v3 is domains. Every project, user, and group is in a"},{"line_number":41,"context_line":"domain. This means they have a domain_id. You can have 2 users with the"},{"line_number":42,"context_line":"same name but they must be in different domains, so user names are not"},{"line_number":43,"context_line":"unique. In case you\u0027re wondering, roles are not in domains."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"One of the great things about domains is that you can have one domain"},{"line_number":46,"context_line":"backed by SQL (for service users) and another backed by LDAP (the cloud"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_cef441f2","line":43,"in_reply_to":"3a50d1a3_1aeccaf1","updated":"2015-07-23 16:00:58.000000000","message":"Done","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"5f713ecc0bdb0119319c32ffa1c31ae5bccfc361","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"One of the great things about domains is that you can have one domain"},{"line_number":46,"context_line":"backed by SQL (for service users) and another backed by LDAP (the cloud"},{"line_number":47,"context_line":"is deployed into existing infrastructure)."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"If you do v2 operations, there\u0027s no way to specify the domain, so v2"},{"line_number":50,"context_line":"operations all work against the \"default\" domain. So if you\u0027re stuck"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_3fead174","line":47,"updated":"2015-07-23 07:18:21.000000000","message":"Maybe add: \"Due to the fact that the keystone architecture allows a different backend for Identity (I.e. User and Groups) to that of Assignments (Projects, Roles etc.), this means that while you can source your users and groups from different LDAPs based on their domain, all Projects, Roles etc. can reside in a keystone SQL database.  This is a common operating model.\"","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a868286a5a50db48bac6524685ec74f16a34713f","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"One of the great things about domains is that you can have one domain"},{"line_number":46,"context_line":"backed by SQL (for service users) and another backed by LDAP (the cloud"},{"line_number":47,"context_line":"is deployed into existing infrastructure)."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"If you do v2 operations, there\u0027s no way to specify the domain, so v2"},{"line_number":50,"context_line":"operations all work against the \"default\" domain. So if you\u0027re stuck"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_0e954931","line":47,"in_reply_to":"3a50d1a3_3fead174","updated":"2015-07-23 16:00:58.000000000","message":"The audience for this isn\u0027t setting up keystone, they\u0027re just consuming tokens.","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9934c256e41b58f011f14dcef58bf11cf2863f1b","unresolved":false,"context_lines":[{"line_number":47,"context_line":"is deployed into existing infrastructure)."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"If you do v2 operations, there\u0027s no way to specify the domain, so v2"},{"line_number":50,"context_line":"operations all work against the \"default\" domain. So if you\u0027re stuck"},{"line_number":51,"context_line":"with v2 and need to get a token you can only get tokens for users in"},{"line_number":52,"context_line":"the default domain (i.e., not ldap)."},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_5acd7283","line":50,"updated":"2015-07-23 04:28:04.000000000","message":"Maybe better to state \"Default\" since that\u0027s the domain name, whereas \"default\" is the domain id.","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a868286a5a50db48bac6524685ec74f16a34713f","unresolved":false,"context_lines":[{"line_number":47,"context_line":"is deployed into existing infrastructure)."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"If you do v2 operations, there\u0027s no way to specify the domain, so v2"},{"line_number":50,"context_line":"operations all work against the \"default\" domain. So if you\u0027re stuck"},{"line_number":51,"context_line":"with v2 and need to get a token you can only get tokens for users in"},{"line_number":52,"context_line":"the default domain (i.e., not ldap)."},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_ee06dd84","line":50,"in_reply_to":"3a50d1a3_5acd7283","updated":"2015-07-23 16:00:58.000000000","message":"Removed the quotes. The default domain doesn\u0027t need to be called \"Default\".","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9934c256e41b58f011f14dcef58bf11cf2863f1b","unresolved":false,"context_lines":[{"line_number":49,"context_line":"If you do v2 operations, there\u0027s no way to specify the domain, so v2"},{"line_number":50,"context_line":"operations all work against the \"default\" domain. So if you\u0027re stuck"},{"line_number":51,"context_line":"with v2 and need to get a token you can only get tokens for users in"},{"line_number":52,"context_line":"the default domain (i.e., not ldap)."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Domain-scoped tokens"},{"line_number":55,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_baa4b6b9","line":52,"updated":"2015-07-23 04:28:04.000000000","message":"s/ldap/LDAP","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"5f713ecc0bdb0119319c32ffa1c31ae5bccfc361","unresolved":false,"context_lines":[{"line_number":49,"context_line":"If you do v2 operations, there\u0027s no way to specify the domain, so v2"},{"line_number":50,"context_line":"operations all work against the \"default\" domain. So if you\u0027re stuck"},{"line_number":51,"context_line":"with v2 and need to get a token you can only get tokens for users in"},{"line_number":52,"context_line":"the default domain (i.e., not ldap)."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Domain-scoped tokens"},{"line_number":55,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_7f0a998b","line":52,"in_reply_to":"3a50d1a3_baa4b6b9","updated":"2015-07-23 07:18:21.000000000","message":"and that\u0027s not true....we do allow the default domain to be LDAP.","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9934c256e41b58f011f14dcef58bf11cf2863f1b","unresolved":false,"context_lines":[{"line_number":68,"context_line":"the token and get info about the token (the user, project, and roles),"},{"line_number":69,"context_line":"and sets a bunch of environment variables with the user, project, and"},{"line_number":70,"context_line":"roles. The services typically take the results, put it in the"},{"line_number":71,"context_line":"\"context\", and use the context to do pass to the policy for"},{"line_number":72,"context_line":"authentication (e.g., ."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Service tokens are a new-ish feature where the auth_token middleware"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_1a712a44","line":71,"updated":"2015-07-23 04:28:04.000000000","message":"\"..to do pass\"... ?","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"c08b2c9f136c6def814706078dc3f64b37671384","unresolved":false,"context_lines":[{"line_number":69,"context_line":"and sets a bunch of environment variables with the user, project, and"},{"line_number":70,"context_line":"roles. The services typically take the results, put it in the"},{"line_number":71,"context_line":"\"context\", and use the context to do pass to the policy for"},{"line_number":72,"context_line":"authentication (e.g., ."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Service tokens are a new-ish feature where the auth_token middleware"},{"line_number":75,"context_line":"will also accept a service token in the \"X-Service-Token\" header. It"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_4bdcce72","line":72,"updated":"2015-07-23 01:28:37.000000000","message":"e.g., what?","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"5f713ecc0bdb0119319c32ffa1c31ae5bccfc361","unresolved":false,"context_lines":[{"line_number":88,"context_line":"used, auth_token will pick v3 if the server reports that v3 is"},{"line_number":89,"context_line":"available. If auth_token is configured to use v2 then if it receives a"},{"line_number":90,"context_line":"v3 token it will fail if the user is not in the default domain (e.g.,"},{"line_number":91,"context_line":"in LDAP or the domain that heat creates users in). So auth_token"},{"line_number":92,"context_line":"middleware needs to use v3!"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_7f1e1971","line":91,"updated":"2015-07-23 07:18:21.000000000","message":"probably remove LDAP from the example here","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a868286a5a50db48bac6524685ec74f16a34713f","unresolved":false,"context_lines":[{"line_number":88,"context_line":"used, auth_token will pick v3 if the server reports that v3 is"},{"line_number":89,"context_line":"available. If auth_token is configured to use v2 then if it receives a"},{"line_number":90,"context_line":"v3 token it will fail if the user is not in the default domain (e.g.,"},{"line_number":91,"context_line":"in LDAP or the domain that heat creates users in). So auth_token"},{"line_number":92,"context_line":"middleware needs to use v3!"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_0ecd4930","line":91,"in_reply_to":"3a50d1a3_7f1e1971","updated":"2015-07-23 16:00:58.000000000","message":"Done","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9934c256e41b58f011f14dcef58bf11cf2863f1b","unresolved":false,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":"If you need to get a token, don\u0027t define options for username and"},{"line_number":102,"context_line":"password and get a token using v2. We\u0027ve got an interface for using"},{"line_number":103,"context_line":"authentication plugins where there\u0027s an option for that supports v2 or"},{"line_number":104,"context_line":"v3 and potentially other authentication mechanisms (X.509 client"},{"line_number":105,"context_line":"certs!)."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_9ae9bab9","line":103,"updated":"2015-07-23 04:28:04.000000000","message":"\"... where there\u0027s an option for that supports...\" - sounds awkward","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"a868286a5a50db48bac6524685ec74f16a34713f","unresolved":false,"context_lines":[{"line_number":100,"context_line":""},{"line_number":101,"context_line":"If you need to get a token, don\u0027t define options for username and"},{"line_number":102,"context_line":"password and get a token using v2. We\u0027ve got an interface for using"},{"line_number":103,"context_line":"authentication plugins where there\u0027s an option for that supports v2 or"},{"line_number":104,"context_line":"v3 and potentially other authentication mechanisms (X.509 client"},{"line_number":105,"context_line":"certs!)."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_8e8719b4","line":103,"in_reply_to":"3a50d1a3_9ae9bab9","updated":"2015-07-23 16:00:58.000000000","message":"propose an alternative.","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9934c256e41b58f011f14dcef58bf11cf2863f1b","unresolved":false,"context_lines":[{"line_number":123,"context_line":""},{"line_number":124,"context_line":"While you can\u0027t use v2 to set up the hierarchy, you can get a v2 token"},{"line_number":125,"context_line":"scoped to a project that\u0027s part of a hierarchy."},{"line_number":126,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_5af7b28a","line":126,"updated":"2015-07-23 04:28:04.000000000","message":"remove blank line","commit_id":"8192a9ba4b4f094fecf951f884d70bbf23772748"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"7f2e5fd91f4b2c2f8456a542237f82d52e00c62e","unresolved":false,"context_lines":[{"line_number":27,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Keystone runs both v2 and v3, v2 requests go to /v2.0 and v3 requests"},{"line_number":30,"context_line":"go to /v3. You don\u0027t need to \"enable\" v3 api in keystone, it is always"},{"line_number":31,"context_line":"available. If you get a token using the v2 API you can use it to do v3"},{"line_number":32,"context_line":"operations (like list users and stuff). The reverse also works, get a"},{"line_number":33,"context_line":"v3 token and use it on v2 works fine."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a4dcd0f_d1568229","line":30,"updated":"2015-08-05 20:19:01.000000000","message":"It\u0027s available by default - not always. Some deployers switch it off and surprise their colleagues by non-operational v3 REST API, and they, in turn, blame keystone it doesn\u0027t work.\nI\u0027d suggest to say something like: \"available by default if not messed up by those who deployed the cloud you are working on\" :)","commit_id":"ae3034aa92565627453ca1afbbe8f79ba0b42abe"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"7f2e5fd91f4b2c2f8456a542237f82d52e00c62e","unresolved":false,"context_lines":[{"line_number":54,"context_line":"operations all work against the default domain. So if you\u0027re stuck with"},{"line_number":55,"context_line":"v2 and need to get a token you can only get tokens for users in the"},{"line_number":56,"context_line":"default domain. If your default domain is SQL and you have a domain for"},{"line_number":57,"context_line":"LDAP users called \"ldap\" you can\u0027t get to the users in LDAP using v2."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Domain-scoped tokens"},{"line_number":60,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a4dcd0f_ac2d9d96","line":57,"updated":"2015-08-05 20:19:01.000000000","message":"More to say: in the contrary case you\u0027ll not even be able to create your service users at all if your default domain is configured to use LDAP r/o backend.","commit_id":"ae3034aa92565627453ca1afbbe8f79ba0b42abe"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"7f2e5fd91f4b2c2f8456a542237f82d52e00c62e","unresolved":false,"context_lines":[{"line_number":62,"context_line":"Domain-scoped tokens are scoped to a domain rather than a project."},{"line_number":63,"context_line":"These are useful for operating against keystone but are useless in"},{"line_number":64,"context_line":"other services, so other services don\u0027t need to concern themselves with"},{"line_number":65,"context_line":"domain-scoped tokens."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Auth Token middleware"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a4dcd0f_2c68adb8","line":65,"updated":"2015-08-05 20:19:01.000000000","message":"It\u0027ll be good to have a link to domain scoped tokens doc here.","commit_id":"ae3034aa92565627453ca1afbbe8f79ba0b42abe"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"7f2e5fd91f4b2c2f8456a542237f82d52e00c62e","unresolved":false,"context_lines":[{"line_number":75,"context_line":"and sets a bunch of environment variables with the user, project, and"},{"line_number":76,"context_line":"roles. The services typically take the environment variables, put them"},{"line_number":77,"context_line":"in the service\u0027s \"context\", and use the context to for authorization"},{"line_number":78,"context_line":"via oslo.policy."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"Service Tokens"},{"line_number":81,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a4dcd0f_9728ea87","line":78,"updated":"2015-08-05 20:19:01.000000000","message":"I think, authorization is not the purpose of oslo.policy - can you explain here somehow, what is \"enforcement\"?","commit_id":"ae3034aa92565627453ca1afbbe8f79ba0b42abe"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"7f2e5fd91f4b2c2f8456a542237f82d52e00c62e","unresolved":false,"context_lines":[{"line_number":82,"context_line":""},{"line_number":83,"context_line":"Service tokens are a new-ish feature where the auth_token middleware"},{"line_number":84,"context_line":"will also accept a service token in the \"X-Service-Token\" header. It"},{"line_number":85,"context_line":"does the same thing with the service token as the user token, but the"},{"line_number":86,"context_line":"results of the token get stuck in environment variables for the service"},{"line_number":87,"context_line":"token (the service user, project, and roles). If the service knows"},{"line_number":88,"context_line":"about these then it can put this info in its \"context\" and use it for"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a4dcd0f_374b162c","line":85,"updated":"2015-08-05 20:19:01.000000000","message":"This reference to the user token is a bit confusing, maybe just provide here a short description of what exactly happens?","commit_id":"ae3034aa92565627453ca1afbbe8f79ba0b42abe"},{"author":{"_account_id":13055,"name":"Alexander Makarov","email":"ajiekcahdp.makapob@gmail.com","username":"amakarov"},"change_message_id":"7f2e5fd91f4b2c2f8456a542237f82d52e00c62e","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Hierarchical Multitenancy"},{"line_number":136,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":"The token format is the same (the token doesn\u0027t contain any info about"},{"line_number":139,"context_line":"the hierarchy). If the service needs to know the hierarchy it will have"},{"line_number":140,"context_line":"to use the v3 API to fetch the hierarchy."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1a4dcd0f_17b37a99","line":137,"updated":"2015-08-05 20:19:01.000000000","message":"Please add a row or two about what HMT is and what it is aiming to.","commit_id":"ae3034aa92565627453ca1afbbe8f79ba0b42abe"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8feb1a98476167c032062b61712c7ef6ef9ea768","unresolved":false,"context_lines":[{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"This document provides a summary of some things that other services"},{"line_number":6,"context_line":"need to know about how keystone works. Specifically, we were requested"},{"line_number":7,"context_line":"to describe what other services need to know about the v3 API. The v3"},{"line_number":8,"context_line":"API was introduced in the Grizzly release, and it\u0027s use until recently"},{"line_number":9,"context_line":"has been hidden from other services since the auth_token middleware"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_bb124708","line":6,"updated":"2015-08-07 17:37:17.000000000","message":"Are we going to stick with \u0027keystone\u0027 or \u0027Keystone\u0027?","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bd820a559b58fbd1a8bad55ced979d696d0f110f","unresolved":false,"context_lines":[{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"This document provides a summary of some things that other services"},{"line_number":6,"context_line":"need to know about how keystone works. Specifically, we were requested"},{"line_number":7,"context_line":"to describe what other services need to know about the v3 API. The v3"},{"line_number":8,"context_line":"API was introduced in the Grizzly release, and it\u0027s use until recently"},{"line_number":9,"context_line":"has been hidden from other services since the auth_token middleware"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_7ca55545","line":6,"in_reply_to":"1a4dcd0f_bb124708","updated":"2015-08-10 14:16:20.000000000","message":"Done","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"66753f30372d2d585a0e3b9e07f9d87eae307ad3","unresolved":false,"context_lines":[{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Service"},{"line_number":19,"context_line":"    OpenStack servers like keystone, nova, glance, etc."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Project"},{"line_number":22,"context_line":"    These are projects in keystone. They used to be called \"tenant\"s"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_4d078581","line":19,"updated":"2015-08-10 14:44:51.000000000","message":"services*","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8feb1a98476167c032062b61712c7ef6ef9ea768","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Project"},{"line_number":22,"context_line":"    These are projects in keystone. They used to be called \"tenant\"s"},{"line_number":23,"context_line":"    and that term is still used all over the place."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Token differences"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_fbbd2fd8","line":23,"updated":"2015-08-07 17:37:17.000000000","message":"We could elaborate saying \"they used to be called tenants in v2.0, but the naming was changed when the v3 api was introduced.\" or something to that effect.","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bd820a559b58fbd1a8bad55ced979d696d0f110f","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Project"},{"line_number":22,"context_line":"    These are projects in keystone. They used to be called \"tenant\"s"},{"line_number":23,"context_line":"    and that term is still used all over the place."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Token differences"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_dc6ca90a","line":23,"in_reply_to":"1a4dcd0f_fbbd2fd8","updated":"2015-08-10 14:16:20.000000000","message":"Done","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8feb1a98476167c032062b61712c7ef6ef9ea768","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Keystone runs both v2 and v3, v2 requests go to /v2.0 and v3 requests"},{"line_number":30,"context_line":"go to /v3. You don\u0027t need to \"enable\" the v3 API in keystone, it is"},{"line_number":31,"context_line":"available by default if not disabled intentionally. If you get a token"},{"line_number":32,"context_line":"using the v2 API you can use it to do v3 operations (like list users"},{"line_number":33,"context_line":"and stuff). The reverse also works, get a v3 token and use it on v2"},{"line_number":34,"context_line":"works fine."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_fb8bef1c","line":31,"updated":"2015-08-07 17:37:17.000000000","message":"nit: available via a separate pipeline from v2.0","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bd820a559b58fbd1a8bad55ced979d696d0f110f","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Keystone runs both v2 and v3, v2 requests go to /v2.0 and v3 requests"},{"line_number":30,"context_line":"go to /v3. You don\u0027t need to \"enable\" the v3 API in keystone, it is"},{"line_number":31,"context_line":"available by default if not disabled intentionally. If you get a token"},{"line_number":32,"context_line":"using the v2 API you can use it to do v3 operations (like list users"},{"line_number":33,"context_line":"and stuff). The reverse also works, get a v3 token and use it on v2"},{"line_number":34,"context_line":"works fine."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_bc075d1c","line":31,"in_reply_to":"1a4dcd0f_fb8bef1c","updated":"2015-08-10 14:16:20.000000000","message":"Done","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8feb1a98476167c032062b61712c7ef6ef9ea768","unresolved":false,"context_lines":[{"line_number":45,"context_line":"A major change to v3 is domains. Every project, user, and group is in a"},{"line_number":46,"context_line":"domain. This means they have a domain_id. You can have two users with"},{"line_number":47,"context_line":"the same name but they must be in different domains, so user names are"},{"line_number":48,"context_line":"not unique. However, roles are not in domains."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"One of the great things about domains is that you can have one domain"},{"line_number":51,"context_line":"backed by SQL (for service users) and another backed by LDAP (the cloud"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_db8dd32b","line":48,"updated":"2015-08-07 17:37:17.000000000","message":"Do we want to add that user IDs are assumed to be unique across domains?","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bd820a559b58fbd1a8bad55ced979d696d0f110f","unresolved":false,"context_lines":[{"line_number":45,"context_line":"A major change to v3 is domains. Every project, user, and group is in a"},{"line_number":46,"context_line":"domain. This means they have a domain_id. You can have two users with"},{"line_number":47,"context_line":"the same name but they must be in different domains, so user names are"},{"line_number":48,"context_line":"not unique. However, roles are not in domains."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"One of the great things about domains is that you can have one domain"},{"line_number":51,"context_line":"backed by SQL (for service users) and another backed by LDAP (the cloud"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_4750c60a","line":48,"in_reply_to":"1a4dcd0f_db8dd32b","updated":"2015-08-10 14:16:20.000000000","message":"Done","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8feb1a98476167c032062b61712c7ef6ef9ea768","unresolved":false,"context_lines":[{"line_number":54,"context_line":"If you do v2 operations, there\u0027s no way to specify the domain, so v2"},{"line_number":55,"context_line":"operations all work against the default domain. So if you\u0027re stuck with"},{"line_number":56,"context_line":"v2 and need to get a token you can only get tokens for users in the"},{"line_number":57,"context_line":"default domain. If your default domain is SQL and you have a domain for"},{"line_number":58,"context_line":"LDAP users called \"ldap\" you can\u0027t get to the users in LDAP using v2."},{"line_number":59,"context_line":"Also, if your default domain is read-only LDAP then you won\u0027t be able"},{"line_number":60,"context_line":"to create the service users using v2 clients because any SQL-backed"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_3ba9577c","line":57,"updated":"2015-08-07 17:37:17.000000000","message":"Is it important to add how someone would figure out what their default domain is?","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8feb1a98476167c032062b61712c7ef6ef9ea768","unresolved":false,"context_lines":[{"line_number":75,"context_line":"The auth_token middleware handles token validation for the different"},{"line_number":76,"context_line":"services. Conceptually, what happens is that auth_token pulls the token"},{"line_number":77,"context_line":"out of the X-Auth-Token header, sends the token to keystone to validate"},{"line_number":78,"context_line":"the token and get info about the token (the user, project, and roles),"},{"line_number":79,"context_line":"and sets a bunch of environment variables with the user, project, and"},{"line_number":80,"context_line":"roles. The services typically take the environment variables, put them"},{"line_number":81,"context_line":"in the service\u0027s \"context\", and use the context for policy enforcement"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_9be50bde","line":78,"updated":"2015-08-07 17:37:17.000000000","message":"information*","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bd820a559b58fbd1a8bad55ced979d696d0f110f","unresolved":false,"context_lines":[{"line_number":75,"context_line":"The auth_token middleware handles token validation for the different"},{"line_number":76,"context_line":"services. Conceptually, what happens is that auth_token pulls the token"},{"line_number":77,"context_line":"out of the X-Auth-Token header, sends the token to keystone to validate"},{"line_number":78,"context_line":"the token and get info about the token (the user, project, and roles),"},{"line_number":79,"context_line":"and sets a bunch of environment variables with the user, project, and"},{"line_number":80,"context_line":"roles. The services typically take the environment variables, put them"},{"line_number":81,"context_line":"in the service\u0027s \"context\", and use the context for policy enforcement"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_87b48e35","line":78,"in_reply_to":"1a4dcd0f_9be50bde","updated":"2015-08-10 14:16:20.000000000","message":"Done","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8feb1a98476167c032062b61712c7ef6ef9ea768","unresolved":false,"context_lines":[{"line_number":84,"context_line":"Service Tokens"},{"line_number":85,"context_line":"--------------"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Service tokens are a new-ish feature where the auth_token middleware"},{"line_number":88,"context_line":"will also accept a service token in the \"X-Service-Token\" header. It"},{"line_number":89,"context_line":"does the same thing with the service token as the user token, but the"},{"line_number":90,"context_line":"results of the token get stuck in environment variables for the service"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_1bda5b18","line":87,"updated":"2015-08-07 17:37:17.000000000","message":"would we be able to give a release that they were introduced? it might make the doc a little more time-less.","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8feb1a98476167c032062b61712c7ef6ef9ea768","unresolved":false,"context_lines":[{"line_number":133,"context_line":"----------------------------------"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"keystone CLI is deprecated and will be removed soon. The openstack CLI"},{"line_number":136,"context_line":"has all the keystone commands and even supports V3."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Hierarchical Multitenancy"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_fb152f9b","line":136,"updated":"2015-08-07 17:37:17.000000000","message":"Maybe link to the OSC docs here? It would be useful for someone reading this if they have no clue what OSC is.","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bd820a559b58fbd1a8bad55ced979d696d0f110f","unresolved":false,"context_lines":[{"line_number":133,"context_line":"----------------------------------"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"keystone CLI is deprecated and will be removed soon. The openstack CLI"},{"line_number":136,"context_line":"has all the keystone commands and even supports V3."},{"line_number":137,"context_line":""},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Hierarchical Multitenancy"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a4dcd0f_e7aa3285","line":136,"in_reply_to":"1a4dcd0f_fb152f9b","updated":"2015-08-10 14:16:20.000000000","message":"Done","commit_id":"0d65a0b0f51cf4d775abfb1f8e7072ded11a7914"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b0e7ec95feb4a8ce93505bac6cc75055d7538062","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Project"},{"line_number":22,"context_line":"    These are projects in keystone. They used to be called \"tenant\"s"},{"line_number":23,"context_line":"    and that term is still used all over the place."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Token differences"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa1b9901_01e01e95","line":23,"updated":"2015-08-25 19:58:30.000000000","message":"... when referencing the v2 API.","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df090d51a9fcd5399108b37390809eb79575738a","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Project"},{"line_number":22,"context_line":"    These are projects in keystone. They used to be called \"tenant\"s"},{"line_number":23,"context_line":"    and that term is still used all over the place."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Token differences"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_0329bf9d","line":23,"in_reply_to":"fa1b9901_01e01e95","updated":"2015-09-30 16:23:21.000000000","message":"Done","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b0e7ec95feb4a8ce93505bac6cc75055d7538062","unresolved":false,"context_lines":[{"line_number":31,"context_line":"available by default if not disabled intentionally. If you get a token"},{"line_number":32,"context_line":"using the v2 API you can use it to do v3 operations (like list users"},{"line_number":33,"context_line":"and stuff). The reverse also works, get a v3 token and use it on v2"},{"line_number":34,"context_line":"works fine."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"You can get a v2 token using POST /v2.0/tokens. You can get a v3 token"},{"line_number":37,"context_line":"using POST /v3/auth/tokens. The response is different: the service"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa1b9901_218be2c4","line":34,"updated":"2015-08-25 19:58:30.000000000","message":"There are exceptions, specifically in the v3 -\u003e v2 case. The v2 API is limited to the \"default\" domain (perhaps domains should be introduced first?), so any reference to an entity outside the default domain would result in namespace collisions in v2, and thus result in 401\u0027s.","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"9b14c2cb37d76d1fb7855e3bae81e50deb073814","unresolved":false,"context_lines":[{"line_number":31,"context_line":"available by default if not disabled intentionally. If you get a token"},{"line_number":32,"context_line":"using the v2 API you can use it to do v3 operations (like list users"},{"line_number":33,"context_line":"and stuff). The reverse also works, get a v3 token and use it on v2"},{"line_number":34,"context_line":"works fine."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"You can get a v2 token using POST /v2.0/tokens. You can get a v3 token"},{"line_number":37,"context_line":"using POST /v3/auth/tokens. The response is different: the service"}],"source_content_type":"text/x-rst","patch_set":6,"id":"7a2fa921_380eda3b","line":34,"in_reply_to":"9a1a9d01_4dfda66c","updated":"2015-10-07 15:50:53.000000000","message":"That\u0027s blatantly not true. I\u0027m just submitting a follow-up patch.","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df090d51a9fcd5399108b37390809eb79575738a","unresolved":false,"context_lines":[{"line_number":31,"context_line":"available by default if not disabled intentionally. If you get a token"},{"line_number":32,"context_line":"using the v2 API you can use it to do v3 operations (like list users"},{"line_number":33,"context_line":"and stuff). The reverse also works, get a v3 token and use it on v2"},{"line_number":34,"context_line":"works fine."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"You can get a v2 token using POST /v2.0/tokens. You can get a v3 token"},{"line_number":37,"context_line":"using POST /v3/auth/tokens. The response is different: the service"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_4dfda66c","line":34,"in_reply_to":"fa1b9901_218be2c4","updated":"2015-09-30 16:23:21.000000000","message":"You can use token that you get through the v3 API to do anything on /v2.0/. I don\u0027t think there\u0027s anything that would result in a 401 if you did this. I can\u0027t figure out what you want me to change here, so I\u0027ll just leave it as is.","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b0e7ec95feb4a8ce93505bac6cc75055d7538062","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Domains"},{"line_number":43,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"A major change to v3 is domains. Every project, user, and group is in a"},{"line_number":46,"context_line":"domain. This means they have a domain_id. You can have two users with"},{"line_number":47,"context_line":"the same name but they must be in different domains, so user names are"},{"line_number":48,"context_line":"not unique. However, roles are not in domains."}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa1b9901_2179a2c8","line":45,"updated":"2015-08-25 19:58:30.000000000","message":"domains aren\u0027t a \"change to v3\", they\u0027re a change *introduced in* v3 -- something never available in v2 but always available in v3.","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df090d51a9fcd5399108b37390809eb79575738a","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Domains"},{"line_number":43,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"A major change to v3 is domains. Every project, user, and group is in a"},{"line_number":46,"context_line":"domain. This means they have a domain_id. You can have two users with"},{"line_number":47,"context_line":"the same name but they must be in different domains, so user names are"},{"line_number":48,"context_line":"not unique. However, roles are not in domains."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_0d2a4edb","line":45,"in_reply_to":"fa1b9901_2179a2c8","updated":"2015-09-30 16:23:21.000000000","message":"Done","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b0e7ec95feb4a8ce93505bac6cc75055d7538062","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"A major change to v3 is domains. Every project, user, and group is in a"},{"line_number":46,"context_line":"domain. This means they have a domain_id. You can have two users with"},{"line_number":47,"context_line":"the same name but they must be in different domains, so user names are"},{"line_number":48,"context_line":"not unique. However, roles are not in domains."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"One of the great things about domains is that you can have one domain"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa1b9901_81466e79","line":47,"updated":"2015-08-25 19:58:30.000000000","message":"can you slip the word namespacing in there to describe this behavior?","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df090d51a9fcd5399108b37390809eb79575738a","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"A major change to v3 is domains. Every project, user, and group is in a"},{"line_number":46,"context_line":"domain. This means they have a domain_id. You can have two users with"},{"line_number":47,"context_line":"the same name but they must be in different domains, so user names are"},{"line_number":48,"context_line":"not unique. However, roles are not in domains."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"One of the great things about domains is that you can have one domain"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_0d06ce51","line":47,"in_reply_to":"fa1b9901_81466e79","updated":"2015-09-30 16:23:21.000000000","message":"Done","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b0e7ec95feb4a8ce93505bac6cc75055d7538062","unresolved":false,"context_lines":[{"line_number":52,"context_line":"is deployed into existing infrastructure)."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"If you do v2 operations, there\u0027s no way to specify the domain, so v2"},{"line_number":55,"context_line":"operations all work against the default domain. So if you\u0027re stuck with"},{"line_number":56,"context_line":"v2 and need to get a token you can only get tokens for users in the"},{"line_number":57,"context_line":"default domain. If your default domain is SQL and you have a domain for"},{"line_number":58,"context_line":"LDAP users called \"ldap\" you can\u0027t get to the users in LDAP using v2."}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa1b9901_c13786fd","line":55,"updated":"2015-08-25 19:58:30.000000000","message":"I\u0027d put default in quotes, and then explain that it\u0027s not special from v3\u0027s perspective, but provide a single scope for the entirety of v2.0.","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df090d51a9fcd5399108b37390809eb79575738a","unresolved":false,"context_lines":[{"line_number":52,"context_line":"is deployed into existing infrastructure)."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"If you do v2 operations, there\u0027s no way to specify the domain, so v2"},{"line_number":55,"context_line":"operations all work against the default domain. So if you\u0027re stuck with"},{"line_number":56,"context_line":"v2 and need to get a token you can only get tokens for users in the"},{"line_number":57,"context_line":"default domain. If your default domain is SQL and you have a domain for"},{"line_number":58,"context_line":"LDAP users called \"ldap\" you can\u0027t get to the users in LDAP using v2."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_83614fab","line":55,"in_reply_to":"fa1b9901_c13786fd","updated":"2015-09-30 16:23:21.000000000","message":"Done","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b0e7ec95feb4a8ce93505bac6cc75055d7538062","unresolved":false,"context_lines":[{"line_number":58,"context_line":"LDAP users called \"ldap\" you can\u0027t get to the users in LDAP using v2."},{"line_number":59,"context_line":"Also, if your default domain is read-only LDAP then you won\u0027t be able"},{"line_number":60,"context_line":"to create the service users using v2 clients because any SQL-backed"},{"line_number":61,"context_line":"domain is unreachable."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Domain-scoped tokens"},{"line_number":64,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa1b9901_0c3cd5c6","line":61,"updated":"2015-08-25 19:58:30.000000000","message":"++","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b0e7ec95feb4a8ce93505bac6cc75055d7538062","unresolved":false,"context_lines":[{"line_number":79,"context_line":"and sets a bunch of environment variables with the user, project, and"},{"line_number":80,"context_line":"roles. The services typically take the environment variables, put them"},{"line_number":81,"context_line":"in the service\u0027s \"context\", and use the context for policy enforcement"},{"line_number":82,"context_line":"via oslo.policy."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Service Tokens"},{"line_number":85,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa1b9901_8c9c65c1","line":82,"updated":"2015-08-25 19:58:30.000000000","message":"and to provide multi-tenancy constraints","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df090d51a9fcd5399108b37390809eb79575738a","unresolved":false,"context_lines":[{"line_number":79,"context_line":"and sets a bunch of environment variables with the user, project, and"},{"line_number":80,"context_line":"roles. The services typically take the environment variables, put them"},{"line_number":81,"context_line":"in the service\u0027s \"context\", and use the context for policy enforcement"},{"line_number":82,"context_line":"via oslo.policy."},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Service Tokens"},{"line_number":85,"context_line":"--------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_a36493b8","line":82,"in_reply_to":"fa1b9901_8c9c65c1","updated":"2015-09-30 16:23:21.000000000","message":"Done","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b0e7ec95feb4a8ce93505bac6cc75055d7538062","unresolved":false,"context_lines":[{"line_number":105,"context_line":"available. If auth_token is configured to use v2 then if it receives a"},{"line_number":106,"context_line":"v3 token it will fail if the user is not in the default domain (e.g.,"},{"line_number":107,"context_line":"the domain that heat creates users in). So auth_token middleware needs"},{"line_number":108,"context_line":"to use v3!"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"Do this, not that"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa1b9901_ac884972","line":108,"updated":"2015-08-25 19:58:30.000000000","message":"++","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b0e7ec95feb4a8ce93505bac6cc75055d7538062","unresolved":false,"context_lines":[{"line_number":116,"context_line":""},{"line_number":117,"context_line":"If you need to get a token, don\u0027t define options for username and"},{"line_number":118,"context_line":"password and get a token using v2. We\u0027ve got an interface for using"},{"line_number":119,"context_line":"authentication plugins where there\u0027s an option for that supports v2 or"},{"line_number":120,"context_line":"v3 and potentially other authentication mechanisms (X.509 client"},{"line_number":121,"context_line":"certs!)."},{"line_number":122,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa1b9901_acefe91c","line":119,"updated":"2015-08-25 19:58:30.000000000","message":"grammar","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df090d51a9fcd5399108b37390809eb79575738a","unresolved":false,"context_lines":[{"line_number":116,"context_line":""},{"line_number":117,"context_line":"If you need to get a token, don\u0027t define options for username and"},{"line_number":118,"context_line":"password and get a token using v2. We\u0027ve got an interface for using"},{"line_number":119,"context_line":"authentication plugins where there\u0027s an option for that supports v2 or"},{"line_number":120,"context_line":"v3 and potentially other authentication mechanisms (X.509 client"},{"line_number":121,"context_line":"certs!)."},{"line_number":122,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_4357b7c9","line":119,"in_reply_to":"fa1b9901_acefe91c","updated":"2015-09-30 16:23:21.000000000","message":"I reworded this since it didn\u0027t make sense to me.","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b0e7ec95feb4a8ce93505bac6cc75055d7538062","unresolved":false,"context_lines":[{"line_number":121,"context_line":"certs!)."},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"If your config file doesn\u0027t have the domain for the user, it\u0027s not"},{"line_number":124,"context_line":"going to be able to use v3 for authentication."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"Picking the version"},{"line_number":127,"context_line":"-------------------"}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa1b9901_8c38e5a1","line":124,"updated":"2015-08-25 19:58:30.000000000","message":"aside: although it would be reasonable for all v3 clients everywhere to assume a domain ID of \"default\" when no domain is otherwise specified...","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":8866,"name":"Raildo Mascena de Sousa Filho","email":"rmascena@redhat.com","username":"raildo"},"change_message_id":"378e1eb021a0f5e215d6e8003ad9c0a523f06dc9","unresolved":false,"context_lines":[{"line_number":140,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"This feature allows maintenance of a hierarchy of projects with"},{"line_number":143,"context_line":"\"parent\" projects operating as domains."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"The token format is the same (the token doesn\u0027t contain any info about"},{"line_number":146,"context_line":"the hierarchy). If the service needs to know the hierarchy it will have"}],"source_content_type":"text/x-rst","patch_set":6,"id":"1a4dcd0f_f663efdb","line":143,"updated":"2015-08-14 01:51:27.000000000","message":"With Hierarchical Multitenancy, we only have a project hierarchy inside a domain, so in fact, we don\u0027t have parent projects operating as domains, this will only be true after reseller.","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df090d51a9fcd5399108b37390809eb79575738a","unresolved":false,"context_lines":[{"line_number":140,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":141,"context_line":""},{"line_number":142,"context_line":"This feature allows maintenance of a hierarchy of projects with"},{"line_number":143,"context_line":"\"parent\" projects operating as domains."},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"The token format is the same (the token doesn\u0027t contain any info about"},{"line_number":146,"context_line":"the hierarchy). If the service needs to know the hierarchy it will have"}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_23f7238c","line":143,"in_reply_to":"1a4dcd0f_f663efdb","updated":"2015-09-30 16:23:21.000000000","message":"Raildo - I don\u0027t know what you want this to say, so just update the etherpad with the suggested text: https://etherpad.openstack.org/p/keystone-info","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"b0e7ec95feb4a8ce93505bac6cc75055d7538062","unresolved":false,"context_lines":[{"line_number":147,"context_line":"to use the v3 API to fetch the hierarchy."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"While you can\u0027t use v2 to set up the hierarchy, you can get a v2 token"},{"line_number":150,"context_line":"scoped to a project that\u0027s part of a hierarchy."}],"source_content_type":"text/x-rst","patch_set":6,"id":"fa1b9901_ec1401ea","line":150,"updated":"2015-08-25 19:58:30.000000000","message":"any part of the hierarchy?","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"df090d51a9fcd5399108b37390809eb79575738a","unresolved":false,"context_lines":[{"line_number":147,"context_line":"to use the v3 API to fetch the hierarchy."},{"line_number":148,"context_line":""},{"line_number":149,"context_line":"While you can\u0027t use v2 to set up the hierarchy, you can get a v2 token"},{"line_number":150,"context_line":"scoped to a project that\u0027s part of a hierarchy."}],"source_content_type":"text/x-rst","patch_set":6,"id":"9a1a9d01_0343ffb2","line":150,"in_reply_to":"fa1b9901_ec1401ea","updated":"2015-09-30 16:23:21.000000000","message":"I assume so if you use the ID.","commit_id":"19ab645632a2314f4cfd735f3cdf9299ebc22edd"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"605e3b9c5f56640dea26316998db154e4ddcc1f4","unresolved":false,"context_lines":[{"line_number":5,"context_line":"This document provides a summary of some things that other services"},{"line_number":6,"context_line":"need to know about how keystone works. Specifically, we were requested"},{"line_number":7,"context_line":"to describe what other services need to know about the v3 API. The v3"},{"line_number":8,"context_line":"API was introduced in the Grizzly release, and it\u0027s use until recently"},{"line_number":9,"context_line":"has been hidden from other services since the auth_token middleware"},{"line_number":10,"context_line":"translated the token format so that both versions look the same. Once"},{"line_number":11,"context_line":"the services need to make use of v3 features they need to know about"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_a9c99f5c","line":8,"updated":"2015-10-01 17:18:11.000000000","message":"s/it\u0027s/its","commit_id":"08a4de5544dc311577f6ac626b4d18e35a2b8e50"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d552d5e13622c1b7e2a036883defed470120f40f","unresolved":false,"context_lines":[{"line_number":5,"context_line":"This document provides a summary of some things that other services"},{"line_number":6,"context_line":"need to know about how keystone works. Specifically, we were requested"},{"line_number":7,"context_line":"to describe what other services need to know about the v3 API. The v3"},{"line_number":8,"context_line":"API was introduced in the Grizzly release, and it\u0027s use until recently"},{"line_number":9,"context_line":"has been hidden from other services since the auth_token middleware"},{"line_number":10,"context_line":"translated the token format so that both versions look the same. Once"},{"line_number":11,"context_line":"the services need to make use of v3 features they need to know about"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_4878e1c4","line":8,"in_reply_to":"9a1a9d01_a9c99f5c","updated":"2015-10-06 13:30:36.000000000","message":"Done","commit_id":"08a4de5544dc311577f6ac626b4d18e35a2b8e50"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"605e3b9c5f56640dea26316998db154e4ddcc1f4","unresolved":false,"context_lines":[{"line_number":64,"context_line":"you won\u0027t be able to create the service users using v2 clients because"},{"line_number":65,"context_line":"any SQL-backed domain is unreachable."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Domain-scoped tokens"},{"line_number":68,"context_line":"--------------------"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Domain-scoped tokens are scoped to a domain rather than a project."}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_c92173b6","line":67,"updated":"2015-10-01 17:18:11.000000000","message":"here tokens is lowercase, but below in Service Tokens it\u0027s upper","commit_id":"08a4de5544dc311577f6ac626b4d18e35a2b8e50"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d552d5e13622c1b7e2a036883defed470120f40f","unresolved":false,"context_lines":[{"line_number":64,"context_line":"you won\u0027t be able to create the service users using v2 clients because"},{"line_number":65,"context_line":"any SQL-backed domain is unreachable."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Domain-scoped tokens"},{"line_number":68,"context_line":"--------------------"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Domain-scoped tokens are scoped to a domain rather than a project."}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_0882e994","line":67,"in_reply_to":"9a1a9d01_c92173b6","updated":"2015-10-06 13:30:36.000000000","message":"Done","commit_id":"08a4de5544dc311577f6ac626b4d18e35a2b8e50"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"605e3b9c5f56640dea26316998db154e4ddcc1f4","unresolved":false,"context_lines":[{"line_number":86,"context_line":"multi-tenancy constraints (keep each customer in their own project) and"},{"line_number":87,"context_line":"for API authorization policy enforcement via oslo.policy."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Service Tokens"},{"line_number":90,"context_line":"--------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Service tokens are a new-ish feature where the auth_token middleware"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_2917cf55","line":89,"updated":"2015-10-01 17:18:11.000000000","message":"upper or lower case Tokens for this title?","commit_id":"08a4de5544dc311577f6ac626b4d18e35a2b8e50"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d552d5e13622c1b7e2a036883defed470120f40f","unresolved":false,"context_lines":[{"line_number":86,"context_line":"multi-tenancy constraints (keep each customer in their own project) and"},{"line_number":87,"context_line":"for API authorization policy enforcement via oslo.policy."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Service Tokens"},{"line_number":90,"context_line":"--------------"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"Service tokens are a new-ish feature where the auth_token middleware"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_e84f6d90","line":89,"in_reply_to":"9a1a9d01_2917cf55","updated":"2015-10-06 13:30:36.000000000","message":"Done","commit_id":"08a4de5544dc311577f6ac626b4d18e35a2b8e50"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"605e3b9c5f56640dea26316998db154e4ddcc1f4","unresolved":false,"context_lines":[{"line_number":139,"context_line":"----------------------------------"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"keystone CLI is deprecated and will be removed soon. The openstack CLI"},{"line_number":142,"context_line":"has all the keystone commands and even supports V3."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"Hierarchical Multitenancy"}],"source_content_type":"text/x-rst","patch_set":7,"id":"9a1a9d01_6980678c","line":142,"updated":"2015-10-01 17:18:11.000000000","message":"s/V3/v3","commit_id":"08a4de5544dc311577f6ac626b4d18e35a2b8e50"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"d552d5e13622c1b7e2a036883defed470120f40f","unresolved":false,"context_lines":[{"line_number":139,"context_line":"----------------------------------"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"keystone CLI is deprecated and will be removed soon. The openstack CLI"},{"line_number":142,"context_line":"has all the keystone commands and even supports V3."},{"line_number":143,"context_line":""},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"Hierarchical Multitenancy"}],"source_content_type":"text/x-rst","patch_set":7,"id":"7a2fa921_a849758d","line":142,"in_reply_to":"9a1a9d01_6980678c","updated":"2015-10-06 13:30:36.000000000","message":"Done","commit_id":"08a4de5544dc311577f6ac626b4d18e35a2b8e50"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"7ba0d0574a470145523d03896c0302788be39109","unresolved":false,"context_lines":[{"line_number":48,"context_line":"not unique. However, roles are not in domains."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"One of the great things about domains is that you can have one domain"},{"line_number":51,"context_line":"backed by SQL (for service users) and another backed by LDAP (the cloud"},{"line_number":52,"context_line":"is deployed into existing infrastructure)."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"If you do v2 operations, there\u0027s no way to specify the domain, so v2"}],"source_content_type":"text/x-rst","patch_set":9,"id":"7a2fa921_6b24b70c","line":51,"updated":"2015-10-06 13:54:39.000000000","message":"nit: maybe say:\n\n(for when the cloud is deployed....","commit_id":"54ce50887812cee1835564327cafea1c36d06988"}]}