)]}'
{"doc/source/federation/configure_federation.rst":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c4421201c60acb1dba9706b90d91931bd21009cd","unresolved":false,"context_lines":[{"line_number":317,"context_line":"    idp_contact_type\u003dtechnical"},{"line_number":318,"context_line":""},{"line_number":319,"context_line":"The SSO endpoint is required in order to generate valid metadata but is"},{"line_number":320,"context_line":"otherwise not used at this time."},{"line_number":321,"context_line":""},{"line_number":322,"context_line":".. code-block:: ini"},{"line_number":323,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8ec9b2_5670b1dc","line":320,"updated":"2016-09-20 14:00:37.000000000","message":"Maybe explain why you\u0027d want to generate the metadata or mention the section below.","commit_id":"08c8a721379f5bb409e22aab5937a11825954d89"}],"keystone/conf/saml.py":[{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c4421201c60acb1dba9706b90d91931bd21009cd","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"idp_sso_endpoint \u003d cfg.URIOpt("},{"line_number":65,"context_line":"    \u0027idp_sso_endpoint\u0027,"},{"line_number":66,"context_line":"    default\u003d\u0027https://keystone.example.com/v3/OS-FEDERATION/saml2/sso\u0027,"},{"line_number":67,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":68,"context_line":"This is the single sign-on (SSO) service location of the identity provider"},{"line_number":69,"context_line":"which accepts HTTP POST requests. A value is required to generate identity"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a8ec9b2_76776dd4","line":66,"updated":"2016-09-20 14:00:37.000000000","message":"I don\u0027t like defaults that are actually broken. If we don\u0027t need this then we shouldn\u0027t make it required and leave the default None. If this is required (I think it is for federation) then it should be checked somewhere (maybe only in doctor) to make sure it has a value.","commit_id":"08c8a721379f5bb409e22aab5937a11825954d89"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"459e055299590c94dd51fec4b0f14b367e853d1f","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"idp_sso_endpoint \u003d cfg.URIOpt("},{"line_number":65,"context_line":"    \u0027idp_sso_endpoint\u0027,"},{"line_number":66,"context_line":"    default\u003d\u0027https://keystone.example.com/v3/OS-FEDERATION/saml2/sso\u0027,"},{"line_number":67,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":68,"context_line":"This is the single sign-on (SSO) service location of the identity provider"},{"line_number":69,"context_line":"which accepts HTTP POST requests. A value is required to generate identity"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a8ec9b2_c0a56547","line":66,"updated":"2016-09-16 15:40:00.000000000","message":"I think we should make this a check in `keystone-manage doctor`. If someone wants to use federation and they don\u0027t change this value - the metadata generated will be wrong, right? Are we providing a default only to have it fail something later if it\u0027s not changed?","commit_id":"08c8a721379f5bb409e22aab5937a11825954d89"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"e0b8f72152664cb405bce1945ef375fcd492daa4","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"idp_sso_endpoint \u003d cfg.URIOpt("},{"line_number":65,"context_line":"    \u0027idp_sso_endpoint\u0027,"},{"line_number":66,"context_line":"    default\u003d\u0027https://keystone.example.com/v3/OS-FEDERATION/saml2/sso\u0027,"},{"line_number":67,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":68,"context_line":"This is the single sign-on (SSO) service location of the identity provider"},{"line_number":69,"context_line":"which accepts HTTP POST requests. A value is required to generate identity"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a8ec9b2_d4dd8043","line":66,"in_reply_to":"7a8ec9b2_76776dd4","updated":"2016-09-21 00:06:44.000000000","message":"David, it is required because the pysaml2 library needs some value to generate the ns0:SingleSignOnService node of the metadata. But none of keystone consumes this value and a keystone IdP isn\u0027t able to act as a WebSSO yet (so I\u0027m told, see http://eavesdrop.openstack.org/irclogs/%23openstack-keystone/%23openstack-keystone.2016-09-14.log.html#t2016-09-14T19:32:13], so that part of the metadata doesn\u0027t really have meaning. So it\u0027s not a broken default.","commit_id":"08c8a721379f5bb409e22aab5937a11825954d89"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"86f0dcf4958cc1e4c59a15acd17b12d9f0a912f7","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"idp_sso_endpoint \u003d cfg.URIOpt("},{"line_number":65,"context_line":"    \u0027idp_sso_endpoint\u0027,"},{"line_number":66,"context_line":"    default\u003d\u0027https://keystone.example.com/v3/OS-FEDERATION/saml2/sso\u0027,"},{"line_number":67,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":68,"context_line":"This is the single sign-on (SSO) service location of the identity provider"},{"line_number":69,"context_line":"which accepts HTTP POST requests. A value is required to generate identity"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a8ec9b2_4f297d89","line":66,"in_reply_to":"7a8ec9b2_b6fee3ab","updated":"2016-09-16 17:58:51.000000000","message":"The point of this change is that, as far as I can tell, the value of this option is really inconsequential, at least until k2k websso is really supported. So not changing it shouldn\u0027t really hurt anything. The Location field of the ns0:SingleSignOnService node of the metadata will be wrong, but as far as I can tell there\u0027s nothing that uses that.","commit_id":"08c8a721379f5bb409e22aab5937a11825954d89"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"b40cf7349e1f897e5f2edfbb28332670be9725ea","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"idp_sso_endpoint \u003d cfg.URIOpt("},{"line_number":65,"context_line":"    \u0027idp_sso_endpoint\u0027,"},{"line_number":66,"context_line":"    default\u003d\u0027https://keystone.example.com/v3/OS-FEDERATION/saml2/sso\u0027,"},{"line_number":67,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":68,"context_line":"This is the single sign-on (SSO) service location of the identity provider"},{"line_number":69,"context_line":"which accepts HTTP POST requests. A value is required to generate identity"}],"source_content_type":"text/x-python","patch_set":1,"id":"7a8ec9b2_b6fee3ab","line":66,"in_reply_to":"7a8ec9b2_c0a56547","updated":"2016-09-16 16:00:55.000000000","message":"++","commit_id":"08c8a721379f5bb409e22aab5937a11825954d89"},{"author":{"_account_id":8116,"name":"John Dennis","email":"jdennis@redhat.com","username":"jdennis"},"change_message_id":"8b03b1ec551002a36b76e9593779584d6e037e1f","unresolved":false,"context_lines":[{"line_number":63,"context_line":""},{"line_number":64,"context_line":"idp_sso_endpoint \u003d cfg.URIOpt("},{"line_number":65,"context_line":"    \u0027idp_sso_endpoint\u0027,"},{"line_number":66,"context_line":"    default\u003d\u0027https://keystone.example.com/v3/OS-FEDERATION/saml2/sso\u0027,"},{"line_number":67,"context_line":"    help\u003dutils.fmt(\"\"\""},{"line_number":68,"context_line":"This is the single sign-on (SSO) service location of the identity provider"},{"line_number":69,"context_line":"which accepts HTTP POST requests. A value is required to generate identity"}],"source_content_type":"text/x-python","patch_set":1,"id":"5a8bc5a2_ac01f906","line":66,"in_reply_to":"7a8ec9b2_d4dd8043","updated":"2016-09-27 16:12:21.000000000","message":"I agree with David, broken defaults are a bad thing.\n\nIf I understand Colleen\u0027s argument correctly she wants a default value so that keystone-manage saml_idp_metadata can be run without generating an exception which requires some non-empty bogus value from a default, but that\u0027s OK because the bogus value isn\u0027t currently used.\n\nI don\u0027t buy that argument because the bogus value will get embedded in a file that few understand and will be forgotten. Worse folks will think they did something correct and will be miffed later when things fail in some cryptic way once the value starts being referenced.\n\nI\u0027ve done a lot of work with SAML in the last few years and I\u0027m regularly called upon to debug failed SAML deployments. My observation has been 95% of the problems are due to bad metadata and most folks are not SAML savvy enough to know what a SAML metadata file is and locate the file never mind actually being able to read it\u0027s contents and comprehend it. Or more importantly to correlate an obtuse failure to the contents of a metadata file.\n\nMy suggestion would be it\u0027s best to force people to be aware of what they are doing. You shouldn\u0027t be generating a metadata file unless you know it\u0027s needed and what it\u0027s for and what it\u0027s contents should be. Raising an exception for an undefined but mandatory value is a great way to force awareness and stop the process while the admin figures out what the value should be (as opposed to blinding accepting a non-working default that will have to be debugged later anyway).\n\nAlso, don\u0027t forget there is an excellent chance the metadata file will have been generated in the distant past, possibly by someone else. At the point the problem is detected that process may have been forgotten/lost. But there is another facet which is more pernicious, the metadata file by definition is meant to be distributed, it\u0027s not used locally. Then you have to track down where the file was distributed and make sure it gets updated. Best to avoid these headaches in the first place :-)","commit_id":"08c8a721379f5bb409e22aab5937a11825954d89"}]}