)]}'
{"doc/source/services.rst":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2f3e417b4684d1bc26b0be35d8bf97b2558ea9d4","unresolved":false,"context_lines":[{"line_number":69,"context_line":"only capable of using v2.0 and you need to get a token, then you can only get"},{"line_number":70,"context_line":"tokens for users and tenants (projects) in the default domain. In the real"},{"line_number":71,"context_line":"world, this means that if your default domain is backed by SQL and you have a"},{"line_number":72,"context_line":"separate domain for LDAP users, then can\u0027t authenticate as an LDAP user using"},{"line_number":73,"context_line":"v2.0. Conversely, if your default domain is backed by a read-only LDAP driver,"},{"line_number":74,"context_line":"then you won\u0027t be able to create the service users using v2 clients because any"},{"line_number":75,"context_line":"SQL-backed domain is unreachable."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a2ca52d_fc726f10","line":72,"updated":"2015-10-15 22:27:48.000000000","message":"missing word: \"then can\u0027t\" -\u003e \"then you can\u0027t\"","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"326ffc8ac627b72e3b3ad4b8d4d7b7a71108a6d6","unresolved":false,"context_lines":[{"line_number":69,"context_line":"only capable of using v2.0 and you need to get a token, then you can only get"},{"line_number":70,"context_line":"tokens for users and tenants (projects) in the default domain. In the real"},{"line_number":71,"context_line":"world, this means that if your default domain is backed by SQL and you have a"},{"line_number":72,"context_line":"separate domain for LDAP users, then can\u0027t authenticate as an LDAP user using"},{"line_number":73,"context_line":"v2.0. Conversely, if your default domain is backed by a read-only LDAP driver,"},{"line_number":74,"context_line":"then you won\u0027t be able to create the service users using v2 clients because any"},{"line_number":75,"context_line":"SQL-backed domain is unreachable."}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a2ca52d_3053fe6c","line":72,"in_reply_to":"5a2ca52d_fc726f10","updated":"2015-10-16 19:12:59.000000000","message":"Done","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2f3e417b4684d1bc26b0be35d8bf97b2558ea9d4","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"From a v3 client\u0027s perspective, the default domain is not special, other than"},{"line_number":78,"context_line":"the fact that such a domain can generally be assumed to exist (assuming the"},{"line_number":79,"context_line":"deployment is also running the v2.0). It would be reasonable for a v3 client to"},{"line_number":80,"context_line":"assume a default user domain ID of ``default`` and a default project domain ID"},{"line_number":81,"context_line":"of ``default`` unless overridden by more specific configuration."},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a2ca52d_9cf01b69","line":79,"updated":"2015-10-15 22:27:48.000000000","message":"\"the v2.0\" -\u003e \"v2.0\" (remove the)","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"326ffc8ac627b72e3b3ad4b8d4d7b7a71108a6d6","unresolved":false,"context_lines":[{"line_number":76,"context_line":""},{"line_number":77,"context_line":"From a v3 client\u0027s perspective, the default domain is not special, other than"},{"line_number":78,"context_line":"the fact that such a domain can generally be assumed to exist (assuming the"},{"line_number":79,"context_line":"deployment is also running the v2.0). It would be reasonable for a v3 client to"},{"line_number":80,"context_line":"assume a default user domain ID of ``default`` and a default project domain ID"},{"line_number":81,"context_line":"of ``default`` unless overridden by more specific configuration."},{"line_number":82,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a2ca52d_d04deac4","line":79,"in_reply_to":"5a2ca52d_9cf01b69","updated":"2015-10-16 19:12:59.000000000","message":"I think I forgot to include \"API\"","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2f3e417b4684d1bc26b0be35d8bf97b2558ea9d4","unresolved":false,"context_lines":[{"line_number":81,"context_line":"of ``default`` unless overridden by more specific configuration."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"To summarize, avoiding namespace conflicts in the v2.0 API is achieved by"},{"line_number":84,"context_line":"limiting the v2.0 API and it\u0027s clients to working with users and projects which"},{"line_number":85,"context_line":"are namespaced by a single, arbitrary domain in v3."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Token differences"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a2ca52d_1c05eb44","line":84,"updated":"2015-10-15 22:27:48.000000000","message":"change \"it\u0027s\" to \"its\"","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"326ffc8ac627b72e3b3ad4b8d4d7b7a71108a6d6","unresolved":false,"context_lines":[{"line_number":81,"context_line":"of ``default`` unless overridden by more specific configuration."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"To summarize, avoiding namespace conflicts in the v2.0 API is achieved by"},{"line_number":84,"context_line":"limiting the v2.0 API and it\u0027s clients to working with users and projects which"},{"line_number":85,"context_line":"are namespaced by a single, arbitrary domain in v3."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Token differences"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a2ca52d_f04826b5","line":84,"in_reply_to":"5a2ca52d_1c05eb44","updated":"2015-10-16 19:12:59.000000000","message":"Done","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"9227ff6af9c19cfe02ea4cce69e7fa8d6519ab8f","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"If you get a token using the v2 API, then you can use it to do v3 operations"},{"line_number":96,"context_line":"(such as list users). The reverse, using a v3 token against v2.0, is only true"},{"line_number":97,"context_line":"if you\u0027re using a project-scoped token wherein the  user and project are both"},{"line_number":98,"context_line":"owned by the \"default\" domain."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"You can get a v2 token using ``POST /v2.0/tokens``. You can get a v3 token"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a2fa921_dff8e54b","line":97,"updated":"2015-10-07 18:13:01.000000000","message":"extra space here","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"326ffc8ac627b72e3b3ad4b8d4d7b7a71108a6d6","unresolved":false,"context_lines":[{"line_number":94,"context_line":""},{"line_number":95,"context_line":"If you get a token using the v2 API, then you can use it to do v3 operations"},{"line_number":96,"context_line":"(such as list users). The reverse, using a v3 token against v2.0, is only true"},{"line_number":97,"context_line":"if you\u0027re using a project-scoped token wherein the  user and project are both"},{"line_number":98,"context_line":"owned by the \"default\" domain."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"You can get a v2 token using ``POST /v2.0/tokens``. You can get a v3 token"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a2ca52d_7346607c","line":97,"in_reply_to":"7a2fa921_dff8e54b","updated":"2015-10-16 19:12:59.000000000","message":"Done","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2f3e417b4684d1bc26b0be35d8bf97b2558ea9d4","unresolved":false,"context_lines":[{"line_number":95,"context_line":"If you get a token using the v2 API, then you can use it to do v3 operations"},{"line_number":96,"context_line":"(such as list users). The reverse, using a v3 token against v2.0, is only true"},{"line_number":97,"context_line":"if you\u0027re using a project-scoped token wherein the  user and project are both"},{"line_number":98,"context_line":"owned by the \"default\" domain."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"You can get a v2 token using ``POST /v2.0/tokens``. You can get a v3 token"},{"line_number":101,"context_line":"using ``POST /v3/auth/tokens``. Note that the responses are significantly"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a2ca52d_47562ccf","line":98,"updated":"2015-10-15 22:27:48.000000000","message":"If this is the case then there\u0027s a bug in keystone, because I can get a v3 token with a user and project in the non-default domain and use it to list users using v2.0, see http://paste.openstack.org/show/476439/","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"326ffc8ac627b72e3b3ad4b8d4d7b7a71108a6d6","unresolved":false,"context_lines":[{"line_number":95,"context_line":"If you get a token using the v2 API, then you can use it to do v3 operations"},{"line_number":96,"context_line":"(such as list users). The reverse, using a v3 token against v2.0, is only true"},{"line_number":97,"context_line":"if you\u0027re using a project-scoped token wherein the  user and project are both"},{"line_number":98,"context_line":"owned by the \"default\" domain."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"You can get a v2 token using ``POST /v2.0/tokens``. You can get a v3 token"},{"line_number":101,"context_line":"using ``POST /v3/auth/tokens``. Note that the responses are significantly"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a2ca52d_134fec37","line":98,"in_reply_to":"5a2ca52d_47562ccf","updated":"2015-10-16 19:12:59.000000000","message":"I think I worded this poorly. In this case, the token simply can\u0027t be validated against the v2 API (keystone uses v3 internally, essentially). I\u0027ll clarify.\n\nAlthough, I wonder if there are other calls in v2 that it wouldn\u0027t make sense to call? GET :5000/v2.0/tenants for example. I have no idea what the response to that would be if some tenants are outside the default domain. Exclude them? Raise 401?","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"2f3e417b4684d1bc26b0be35d8bf97b2558ea9d4","unresolved":false,"context_lines":[{"line_number":148,"context_line":"v3 is available. If ``auth_token`` is configured to use v2.0, then it will fail"},{"line_number":149,"context_line":"when it receives a v3 token wherein the user is not in the default domain (for"},{"line_number":150,"context_line":"example, the domain that heat creates users in). So if at all possible, the"},{"line_number":151,"context_line":"``auth_token`` middleware should be allowed to use v3."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"Do this, not that"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a2ca52d_a7daa04a","line":151,"updated":"2015-10-15 22:27:48.000000000","message":"we might want to note here that services like heat that create users in their own domain by default won\u0027t work if auth_token doesn\u0027t use v3.","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"326ffc8ac627b72e3b3ad4b8d4d7b7a71108a6d6","unresolved":false,"context_lines":[{"line_number":148,"context_line":"v3 is available. If ``auth_token`` is configured to use v2.0, then it will fail"},{"line_number":149,"context_line":"when it receives a v3 token wherein the user is not in the default domain (for"},{"line_number":150,"context_line":"example, the domain that heat creates users in). So if at all possible, the"},{"line_number":151,"context_line":"``auth_token`` middleware should be allowed to use v3."},{"line_number":152,"context_line":""},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"Do this, not that"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5a2ca52d_934d3c9c","line":151,"in_reply_to":"5a2ca52d_a7daa04a","updated":"2015-10-16 19:12:59.000000000","message":"Added as a new paragraph","commit_id":"973f9e41b20a7969e6518fe8c10d8aa05eb1d22b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0cbbf28f463b38309653239fe08e92b45a585ae2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":2,"context_line":"Keystone for other services"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"This document provides a summary of some things that other services need to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_41ff1a67","line":2,"updated":"2015-10-20 17:28:33.000000000","message":"Maybe we should change this title into something snappier...","commit_id":"43459d477be856d506014facbb68cbfe1b580562"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0cbbf28f463b38309653239fe08e92b45a585ae2","unresolved":false,"context_lines":[{"line_number":153,"context_line":"(for example, the domain that heat creates users in). So if at all possible,"},{"line_number":154,"context_line":"the ``auth_token`` middleware should be allowed to use v3."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Additionally, as other services begin to utilize features which only found in"},{"line_number":157,"context_line":"the v3 API, you\u0027ll need to use the v3 API in order to utilize those services."},{"line_number":158,"context_line":"For example, heat creates users in an isolated domain, and thus requires the v3"},{"line_number":159,"context_line":"API."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_81b772d7","line":156,"updated":"2015-10-20 17:28:33.000000000","message":"which are* only","commit_id":"43459d477be856d506014facbb68cbfe1b580562"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4e15341b83e1feebb93815da38391c96e94e038e","unresolved":false,"context_lines":[{"line_number":153,"context_line":"(for example, the domain that heat creates users in). So if at all possible,"},{"line_number":154,"context_line":"the ``auth_token`` middleware should be allowed to use v3."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"Additionally, as other services begin to utilize features which only found in"},{"line_number":157,"context_line":"the v3 API, you\u0027ll need to use the v3 API in order to utilize those services."},{"line_number":158,"context_line":"For example, heat creates users in an isolated domain, and thus requires the v3"},{"line_number":159,"context_line":"API."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_6da244b0","line":156,"in_reply_to":"3a29b11f_81b772d7","updated":"2015-10-20 20:06:59.000000000","message":"Done","commit_id":"43459d477be856d506014facbb68cbfe1b580562"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0cbbf28f463b38309653239fe08e92b45a585ae2","unresolved":false,"context_lines":[{"line_number":158,"context_line":"For example, heat creates users in an isolated domain, and thus requires the v3"},{"line_number":159,"context_line":"API."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Do this, not that"},{"line_number":162,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Config options for authentication"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_21ce9e5a","line":161,"updated":"2015-10-20 17:28:33.000000000","message":"As a follow up, we should add a section here about policy.json and whether or not it needs to be updated if you\u0027re using v3 (common mistake by folks is to assume they need to change it)","commit_id":"43459d477be856d506014facbb68cbfe1b580562"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"4e15341b83e1feebb93815da38391c96e94e038e","unresolved":false,"context_lines":[{"line_number":158,"context_line":"For example, heat creates users in an isolated domain, and thus requires the v3"},{"line_number":159,"context_line":"API."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"Do this, not that"},{"line_number":162,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":163,"context_line":""},{"line_number":164,"context_line":"Config options for authentication"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3a29b11f_cded98f0","line":161,"in_reply_to":"3a29b11f_21ce9e5a","updated":"2015-10-20 20:06:59.000000000","message":"this isn\u0027t a doc for how to set up keystone, it\u0027s for developers in other services to use keystone. docs for how to set up keystone don\u0027t belong in this doc.","commit_id":"43459d477be856d506014facbb68cbfe1b580562"}]}