)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":17123,"name":"Tom Cocozzello (tjcocozz)","email":"tjcocozz@us.ibm.com","username":"tcocozzello"},"change_message_id":"d63fa803849509db654bb1c27e0c8a4e2847c751","unresolved":false,"context_lines":[{"line_number":11,"context_line":"documentation around configuring httpd modules for the newly added call."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: Id334e979c951387b1d70da70fc5d4939a6e7d6a6"},{"line_number":14,"context_line":"related: bp federation-idp-websso"},{"line_number":15,"context_line":"closes-bug: 1491910"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"da20952f_94080bdb","line":14,"updated":"2015-09-03 15:55:46.000000000","message":"It looks like your blueprint link is broken","commit_id":"a54296e83458ca389a3929480477abb092dd5cc7"}],"doc/source/federation/websso.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0fe0d1c52c5dacdeafa3818926ae70a88d83d98b","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":".. NOTE::"},{"line_number":45,"context_line":"    It is important to remember that misconfiguration of httpd modules may"},{"line_number":46,"context_line":"    expose security vulnerabilities in a Federated deployment."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"If `mod_shib` is used, then use the following as an example:"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da20952f_e0c2c633","line":46,"updated":"2015-08-29 02:45:42.000000000","message":"this is about as vague as vague can get :)\n\nThe reason why we want to warn the reader (maybe use WARNING instead of NOTE?) is that now keystone will accept any assertions from any identity provider at this endpoint. Before, the assertion had to have identifying information in the form of the remote-id. If by some chance, the assertion from Coke actually works on a Pepsi IdP, then that\u0027s pretty bad.\n\nhow about...\n\nBy using the IdP specific route, a user will no longer leverage the Remote ID of n Identity Provider, and will be unable to verify that the Identity Provider is trusted, the mapping will remain as the only source of controlling authorization.","commit_id":"3309ce986efac37f02b1cadff38be05e18418a87"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3b9a85ac912089dcc65923f017e9a2a22e1c4761","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":".. NOTE::"},{"line_number":45,"context_line":"    It is important to remember that misconfiguration of httpd modules may"},{"line_number":46,"context_line":"    expose security vulnerabilities in a Federated deployment."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"If `mod_shib` is used, then use the following as an example:"},{"line_number":49,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"da20952f_baefed1c","line":46,"in_reply_to":"da20952f_e0c2c633","updated":"2015-08-31 13:27:18.000000000","message":"++, good suggestions. I\u0027ll incorporate that into my patch.","commit_id":"3309ce986efac37f02b1cadff38be05e18418a87"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a506453ce057e1683358d3108b04f13c913709a","unresolved":false,"context_lines":[{"line_number":45,"context_line":"    By using the IdP specific route, a user will no longer leverage the Remote"},{"line_number":46,"context_line":"    ID of a specific Identity Provider, and will be unable to verify that the"},{"line_number":47,"context_line":"    Identity Provider is trusted, the mapping will remain as the only source of"},{"line_number":48,"context_line":"    controlling authorization."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"If `mod_shib` is used, then use the following as an example:"},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_a64d949b","line":48,"updated":"2015-08-31 17:00:15.000000000","message":"Well, this is not really true. if you did this warning based on my previos comments in the underlying patches then it is my fault :-)\n\nWe can still leverage on remote id is we configure keystone to do so.","commit_id":"9e9931a35dcbc62b788244150fe1adf653beb20d"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"5a506453ce057e1683358d3108b04f13c913709a","unresolved":false,"context_lines":[{"line_number":111,"context_line":"        AuthName \"Acme Corporation\""},{"line_number":112,"context_line":"        KrbMethodNegotiate on"},{"line_number":113,"context_line":"        KrbMethodK5Passwd off"},{"line_number":114,"context_line":"        Krb5Keytab /etc/apache2/http.keytab"},{"line_number":115,"context_line":"        ..."},{"line_number":116,"context_line":"      \u003c/Location\u003e"},{"line_number":117,"context_line":"  \u003c/VirtualHost\u003e"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da20952f_7a43906c","line":114,"updated":"2015-08-31 17:00:15.000000000","message":"let\u0027s not mix kerberos here.","commit_id":"9e9931a35dcbc62b788244150fe1adf653beb20d"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"621621fda2b561745cbabee3dd4e32e6c7cc4b61","unresolved":false,"context_lines":[{"line_number":44,"context_line":".. WARNING::"},{"line_number":45,"context_line":"    By using the IdP specific route, a user will no longer leverage the Remote"},{"line_number":46,"context_line":"    ID of a specific Identity Provider, and will be unable to verify that the"},{"line_number":47,"context_line":"    Identity Provider is trusted, the mapping will remain as the only source of"},{"line_number":48,"context_line":"    controlling authorization."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"If `mod_shib` is used, then use the following as an example:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba15a1d1_5b6bc11e","line":47,"updated":"2015-09-14 22:15:13.000000000","message":"\u003e the only source of\n\n\"the only means to\" ?","commit_id":"c0c7f2c4b1ff13beb32ab6e20db3256beacc5326"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"537a551cf7d2fd0f8db1b005b5e8c8acfd4163dc","unresolved":false,"context_lines":[{"line_number":44,"context_line":".. WARNING::"},{"line_number":45,"context_line":"    By using the IdP specific route, a user will no longer leverage the Remote"},{"line_number":46,"context_line":"    ID of a specific Identity Provider, and will be unable to verify that the"},{"line_number":47,"context_line":"    Identity Provider is trusted, the mapping will remain as the only source of"},{"line_number":48,"context_line":"    controlling authorization."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"If `mod_shib` is used, then use the following as an example:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"ba15a1d1_9b785d2d","line":47,"in_reply_to":"ba15a1d1_5b6bc11e","updated":"2015-09-15 13:03:46.000000000","message":"Done","commit_id":"c0c7f2c4b1ff13beb32ab6e20db3256beacc5326"},{"author":{"_account_id":12606,"name":"Miguel Grinberg","email":"miguel.grinberg@gmail.com","username":"miguelgrinberg"},"change_message_id":"36269b0075523144075869444a75a6350bae1bd8","unresolved":false,"context_lines":[{"line_number":60,"context_line":"        Require valid-user"},{"line_number":61,"context_line":"        ..."},{"line_number":62,"context_line":"      \u003c/Location\u003e"},{"line_number":63,"context_line":"      \u003cLocation ~ \"/v3/auth/OS-FEDERATION/identity_providers/idp_1/protocols/saml2/websso\"\u003e"},{"line_number":64,"context_line":"        AuthType shibboleth"},{"line_number":65,"context_line":"        Require valid-user"},{"line_number":66,"context_line":"        ..."}],"source_content_type":"text/x-rst","patch_set":5,"id":"da20952f_2d41ae0b","line":63,"updated":"2015-09-03 16:46:41.000000000","message":"Suggestion: replace the id of the IdP in all these examples with a pattern. That\u0027s what we use in OSAD. Example:\n\n    \u003cLocation ~ \"/v3/auth/OS-FEDERATION/identity_providers/.*?/protocols/saml2/websso\"\u003e","commit_id":"c0c7f2c4b1ff13beb32ab6e20db3256beacc5326"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"561b8334b63858b7dda5bb088a00ae2ee8c4f253","unresolved":false,"context_lines":[{"line_number":60,"context_line":"        Require valid-user"},{"line_number":61,"context_line":"        ..."},{"line_number":62,"context_line":"      \u003c/Location\u003e"},{"line_number":63,"context_line":"      \u003cLocation ~ \"/v3/auth/OS-FEDERATION/identity_providers/idp_1/protocols/saml2/websso\"\u003e"},{"line_number":64,"context_line":"        AuthType shibboleth"},{"line_number":65,"context_line":"        Require valid-user"},{"line_number":66,"context_line":"        ..."}],"source_content_type":"text/x-rst","patch_set":5,"id":"da20952f_28b67c8a","line":63,"in_reply_to":"da20952f_2d41ae0b","updated":"2015-09-03 17:14:37.000000000","message":"We previously did this, but for WebSSO pointing to specific Identity Providers, it can be a security vulnerability if you use wild cards. I believe using wild cards is less of a security risk if you only have one Identity Provider to route to. But in the case where you have multiple Identity Providers, by using a wild card, you could end up at Coke\u0027s IdP when you really meant to go to Pepsi\u0027s.","commit_id":"c0c7f2c4b1ff13beb32ab6e20db3256beacc5326"},{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"94ca6fe11fdef74350ff0df180b83799fde75466","unresolved":false,"context_lines":[{"line_number":257,"context_line":"  WEBSSO_CHOICES \u003d ("},{"line_number":258,"context_line":"        (\"credentials\", _(\"Keystone Credentials\")),"},{"line_number":259,"context_line":"        (\"oidc\", _(\"OpenID Connect\")),"},{"line_number":260,"context_line":"        (\"saml2\", _(\"Security Assertion Markup Language\"))"},{"line_number":261,"context_line":"      )"},{"line_number":262,"context_line":""},{"line_number":263,"context_line":"5. (Optional) Specify an initial choice with the `WEBSSO_INITIAL_CHOICE`"}],"source_content_type":"text/x-rst","patch_set":6,"id":"ba15a1d1_a9d7db49","line":260,"updated":"2015-09-16 17:25:44.000000000","message":"Horizon added a new config WEBSSO_IDP_MAPPING for mapping the dropdown value to the IdP/Protocol values.\n\nHorizon doc update is on the way:\nhttps://review.openstack.org/#/c/220012/4/doc/source/topics/settings.rst","commit_id":"bd0d23fe5bb2b28e3a193f9c64c0bca41de09260"}]}