)]}'
{"doc/source/federation/configure_federation.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"988f3eadc5ee4ca7aa5b8fcc450662868c106df3","unresolved":false,"context_lines":[{"line_number":163,"context_line":"~~~~~~~~~~~~~~~~~"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Create an Identity Provider object in keystone, which represents the Identity"},{"line_number":166,"context_line":"Provider we will use to authenticate end users::"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"    $ openstack identity provider create --remote-id http://myidp.example.com/v3/OS-FEDERATION/saml2/idp myidp"},{"line_number":169,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8ec9b2_83970beb","line":166,"range":{"start_line":166,"start_character":46,"end_line":166,"end_character":48},"updated":"2016-09-16 02:46:10.000000000","message":"could use bash: but meh","commit_id":"f231e3c6d1d3cba265cb1d876fad90db22a4aefc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"988f3eadc5ee4ca7aa5b8fcc450662868c106df3","unresolved":false,"context_lines":[{"line_number":167,"context_line":""},{"line_number":168,"context_line":"    $ openstack identity provider create --remote-id http://myidp.example.com/v3/OS-FEDERATION/saml2/idp myidp"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":"The value for the remote-id option is the Entity ID provided by the IdP. If the"},{"line_number":171,"context_line":"IdP is a Keystone IdP, it is the value set in that Keystone\u0027s"},{"line_number":172,"context_line":"`[federation]/idp_entity_id` option. It will usually appear as a URI but there"},{"line_number":173,"context_line":"is no requirement for it to resolve to anything and may be arbitrarily decided"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8ec9b2_a39c0710","line":170,"range":{"start_line":170,"start_character":18,"end_line":170,"end_character":27},"updated":"2016-09-16 02:46:10.000000000","message":"``remote-id`` or ``--remote-id``","commit_id":"f231e3c6d1d3cba265cb1d876fad90db22a4aefc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"988f3eadc5ee4ca7aa5b8fcc450662868c106df3","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":"The value for the remote-id option is the Entity ID provided by the IdP. If the"},{"line_number":171,"context_line":"IdP is a Keystone IdP, it is the value set in that Keystone\u0027s"},{"line_number":172,"context_line":"`[federation]/idp_entity_id` option. It will usually appear as a URI but there"},{"line_number":173,"context_line":"is no requirement for it to resolve to anything and may be arbitrarily decided"},{"line_number":174,"context_line":"by the administrator of the IdP. The local name, here called \u0027myidp\u0027, is"},{"line_number":175,"context_line":"decided by you and will be used by the mapping, protocol, and later for"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8ec9b2_e3a28f4a","line":172,"range":{"start_line":172,"start_character":0,"end_line":172,"end_character":28},"updated":"2016-09-16 02:46:10.000000000","message":"moar backticks:  ``[federation]/idp_entity_id``","commit_id":"f231e3c6d1d3cba265cb1d876fad90db22a4aefc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"988f3eadc5ee4ca7aa5b8fcc450662868c106df3","unresolved":false,"context_lines":[{"line_number":201,"context_line":"        {"},{"line_number":202,"context_line":"            \"local\": ["},{"line_number":203,"context_line":"                {"},{"line_number":204,"context_line":"                    \"group\": {"},{"line_number":205,"context_line":"                        \"name\": \"federated_users\""},{"line_number":206,"context_line":"                    }"},{"line_number":207,"context_line":"                }"},{"line_number":208,"context_line":"            ],"},{"line_number":209,"context_line":"            \"remote\": ["}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8ec9b2_23b0f789","line":206,"range":{"start_line":204,"start_character":20,"end_line":206,"end_character":21},"updated":"2016-09-16 02:46:10.000000000","message":"doesn\u0027t this need a domain attribute if you\u0027re going to use the group\u0027s name","commit_id":"f231e3c6d1d3cba265cb1d876fad90db22a4aefc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"988f3eadc5ee4ca7aa5b8fcc450662868c106df3","unresolved":false,"context_lines":[{"line_number":364,"context_line":"    idp_entity_id\u003dhttps://keystone.example.com/v3/OS-FEDERATION/saml2/idp"},{"line_number":365,"context_line":"    idp_sso_endpoint\u003dhttps://keystone.example.com/v3/OS-FEDERATION/saml2/sso"},{"line_number":366,"context_line":""},{"line_number":367,"context_line":"Note the certfile, keyfile, and idp_metadata_path settings and adjust them if"},{"line_number":368,"context_line":"necessary:"},{"line_number":369,"context_line":""},{"line_number":370,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8ec9b2_e6cd3db8","line":367,"range":{"start_line":367,"start_character":9,"end_line":367,"end_character":49},"updated":"2016-09-16 02:46:10.000000000","message":"these should each be in double backticks","commit_id":"f231e3c6d1d3cba265cb1d876fad90db22a4aefc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"988f3eadc5ee4ca7aa5b8fcc450662868c106df3","unresolved":false,"context_lines":[{"line_number":391,"context_line":"    idp_contact_name\u003dJohn"},{"line_number":392,"context_line":"    idp_contact_surname\u003dSmith"},{"line_number":393,"context_line":"    idp_contact_email\u003djsmith@example.com"},{"line_number":394,"context_line":"    idp_contact_telephone\u003d555-555-5555"},{"line_number":395,"context_line":"    idp_contact_type\u003dtechnical"},{"line_number":396,"context_line":""},{"line_number":397,"context_line":"Generate Metadata"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a8ec9b2_06c78996","line":394,"range":{"start_line":394,"start_character":32,"end_line":394,"end_character":33},"updated":"2016-09-16 02:46:10.000000000","message":":)","commit_id":"f231e3c6d1d3cba265cb1d876fad90db22a4aefc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"42250f276ad6622aec35f192d76e50032fcaa0e1","unresolved":false,"context_lines":[{"line_number":227,"context_line":"        }"},{"line_number":228,"context_line":"    ]"},{"line_number":229,"context_line":"    EOF"},{"line_number":230,"context_line":"    $ openstack mapping create --rules rules.json myidp-mapping"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"Read more about `mapping"},{"line_number":233,"context_line":"\u003chttp://developer.openstack.org/api-ref/identity/v3-ext/#mappings\u003e`__."}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8ec9b2_c7173f43","line":230,"range":{"start_line":230,"start_character":50,"end_line":230,"end_character":63},"updated":"2016-09-22 03:24:56.000000000","message":"i vaguely remember a bug where mappings had hyphens in the name, i can\u0027t remember the outcome, but how about we remove the hyphen for safety, or use an underscore","commit_id":"b521629a534356d62f44026eb0a0b801aa850ebb"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6df5241d56ccdb98d896c7bcd7f8353a0fe3ea7f","unresolved":false,"context_lines":[{"line_number":227,"context_line":"        }"},{"line_number":228,"context_line":"    ]"},{"line_number":229,"context_line":"    EOF"},{"line_number":230,"context_line":"    $ openstack mapping create --rules rules.json myidp-mapping"},{"line_number":231,"context_line":""},{"line_number":232,"context_line":"Read more about `mapping"},{"line_number":233,"context_line":"\u003chttp://developer.openstack.org/api-ref/identity/v3-ext/#mappings\u003e`__."}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa6399be_2e762606","line":230,"range":{"start_line":230,"start_character":50,"end_line":230,"end_character":63},"in_reply_to":"7a8ec9b2_c7173f43","updated":"2016-10-13 19:25:33.000000000","message":"Done","commit_id":"b521629a534356d62f44026eb0a0b801aa850ebb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"42250f276ad6622aec35f192d76e50032fcaa0e1","unresolved":false,"context_lines":[{"line_number":243,"context_line":""},{"line_number":244,"context_line":".. code-block:: bash"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"    $ openstack federation protocol create mapped --mapping myidp-mapping --identity-provider myidp"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"The name you give the protocol is not arbitrary. It must match the method name"},{"line_number":249,"context_line":"you gave in the ``[auth]/methods`` config option. When authenticating it will be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8ec9b2_072cc797","line":246,"range":{"start_line":246,"start_character":60,"end_line":246,"end_character":73},"updated":"2016-09-22 03:24:56.000000000","message":"here too","commit_id":"b521629a534356d62f44026eb0a0b801aa850ebb"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6df5241d56ccdb98d896c7bcd7f8353a0fe3ea7f","unresolved":false,"context_lines":[{"line_number":243,"context_line":""},{"line_number":244,"context_line":".. code-block:: bash"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"    $ openstack federation protocol create mapped --mapping myidp-mapping --identity-provider myidp"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"The name you give the protocol is not arbitrary. It must match the method name"},{"line_number":249,"context_line":"you gave in the ``[auth]/methods`` config option. When authenticating it will be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa6399be_0e6de230","line":246,"range":{"start_line":246,"start_character":60,"end_line":246,"end_character":73},"in_reply_to":"7a8ec9b2_072cc797","updated":"2016-10-13 19:25:33.000000000","message":"Done","commit_id":"b521629a534356d62f44026eb0a0b801aa850ebb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"42250f276ad6622aec35f192d76e50032fcaa0e1","unresolved":false,"context_lines":[{"line_number":478,"context_line":"                       project_domain_name\u003dos.environ.get(\u0027OS_PROJECT_DOMAIN_NAME\u0027))"},{"line_number":479,"context_line":"    password_session \u003d session.Session(auth\u003dauth, verify\u003dFalse)"},{"line_number":480,"context_line":"    k2ksession \u003d k2k.Keystone2Keystone(password_session.auth, \u0027mysp\u0027,"},{"line_number":481,"context_line":"                       domain_name\u003d\u0027federated_domain\u0027)"},{"line_number":482,"context_line":"    auth_ref \u003d k2ksession.get_auth_ref(password_session)"},{"line_number":483,"context_line":"    scoped_token_id \u003d auth_ref._auth_token"},{"line_number":484,"context_line":"    print(\u0027Scoped token id: %s\u0027 % scoped_token_id)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8ec9b2_271d4362","line":481,"range":{"start_line":481,"start_character":23,"end_line":481,"end_character":54},"updated":"2016-09-22 03:24:56.000000000","message":"bump this over so it matches the previous indentation","commit_id":"b521629a534356d62f44026eb0a0b801aa850ebb"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6df5241d56ccdb98d896c7bcd7f8353a0fe3ea7f","unresolved":false,"context_lines":[{"line_number":478,"context_line":"                       project_domain_name\u003dos.environ.get(\u0027OS_PROJECT_DOMAIN_NAME\u0027))"},{"line_number":479,"context_line":"    password_session \u003d session.Session(auth\u003dauth, verify\u003dFalse)"},{"line_number":480,"context_line":"    k2ksession \u003d k2k.Keystone2Keystone(password_session.auth, \u0027mysp\u0027,"},{"line_number":481,"context_line":"                       domain_name\u003d\u0027federated_domain\u0027)"},{"line_number":482,"context_line":"    auth_ref \u003d k2ksession.get_auth_ref(password_session)"},{"line_number":483,"context_line":"    scoped_token_id \u003d auth_ref._auth_token"},{"line_number":484,"context_line":"    print(\u0027Scoped token id: %s\u0027 % scoped_token_id)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa6399be_8e8012c2","line":481,"range":{"start_line":481,"start_character":23,"end_line":481,"end_character":54},"in_reply_to":"7a8ec9b2_271d4362","updated":"2016-10-13 19:25:33.000000000","message":"Done","commit_id":"b521629a534356d62f44026eb0a0b801aa850ebb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"42250f276ad6622aec35f192d76e50032fcaa0e1","unresolved":false,"context_lines":[{"line_number":481,"context_line":"                       domain_name\u003d\u0027federated_domain\u0027)"},{"line_number":482,"context_line":"    auth_ref \u003d k2ksession.get_auth_ref(password_session)"},{"line_number":483,"context_line":"    scoped_token_id \u003d auth_ref._auth_token"},{"line_number":484,"context_line":"    print(\u0027Scoped token id: %s\u0027 % scoped_token_id)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8ec9b2_275463fc","line":484,"range":{"start_line":484,"start_character":4,"end_line":484,"end_character":50},"updated":"2016-09-22 03:24:56.000000000","message":"maybe mention that the scoped token is coming from the SP, and print the entire token body?","commit_id":"b521629a534356d62f44026eb0a0b801aa850ebb"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6df5241d56ccdb98d896c7bcd7f8353a0fe3ea7f","unresolved":false,"context_lines":[{"line_number":481,"context_line":"                       domain_name\u003d\u0027federated_domain\u0027)"},{"line_number":482,"context_line":"    auth_ref \u003d k2ksession.get_auth_ref(password_session)"},{"line_number":483,"context_line":"    scoped_token_id \u003d auth_ref._auth_token"},{"line_number":484,"context_line":"    print(\u0027Scoped token id: %s\u0027 % scoped_token_id)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa6399be_ae0a3677","line":484,"range":{"start_line":484,"start_character":4,"end_line":484,"end_character":50},"in_reply_to":"7a8ec9b2_275463fc","updated":"2016-10-13 19:25:33.000000000","message":"\u003e maybe mention that the scoped token is coming from the SP\n\nThis is already mentioned on line 459.\n\n\u003e print the entire token body\n\nThe auth_token/_auth_token properties of AccessInfo are just the string ID, are you wanting to do a lookup with that ID to get the entire token body?","commit_id":"b521629a534356d62f44026eb0a0b801aa850ebb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e6618134d77e729f40ad28b70756d9cae97b1ca1","unresolved":false,"context_lines":[{"line_number":481,"context_line":"                       domain_name\u003d\u0027federated_domain\u0027)"},{"line_number":482,"context_line":"    auth_ref \u003d k2ksession.get_auth_ref(password_session)"},{"line_number":483,"context_line":"    scoped_token_id \u003d auth_ref._auth_token"},{"line_number":484,"context_line":"    print(\u0027Scoped token id: %s\u0027 % scoped_token_id)"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa6399be_1c28aee1","line":484,"range":{"start_line":484,"start_character":4,"end_line":484,"end_character":50},"in_reply_to":"fa6399be_ae0a3677","updated":"2016-10-14 03:46:00.000000000","message":"no, i suppose not. i was just thinking that showing the whole token would make it easier to understand that it\u0027s coming from another keystone. not a big deal","commit_id":"b521629a534356d62f44026eb0a0b801aa850ebb"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2c879dc95ca346ed82bf93c1bbf9481ee363d127","unresolved":false,"context_lines":[{"line_number":204,"context_line":"    The motivation for this approach is that there will always be some data"},{"line_number":205,"context_line":"    sent by the identity provider (in the assertion or claim) that uniquely"},{"line_number":206,"context_line":"    identifies the identity provider. This removes the requirement for horizon"},{"line_number":207,"context_line":"    to list all the identity providers that are trusted by keystone."},{"line_number":208,"context_line":"Read more about `identity providers"},{"line_number":209,"context_line":"\u003chttp://developer.openstack.org/api-ref/identity/v3-ext/#identity-providers\u003e`__."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_3cf7328c","line":208,"range":{"start_line":207,"start_character":4,"end_line":208,"end_character":35},"updated":"2016-10-14 03:44:30.000000000","message":"surprised this didn\u0027t fail the doc, a new line here would be good","commit_id":"84f723a499928c1799eb3eca0307aa64633b8fd0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"fc924863c72b85d13c8c0f5a0cf7cdab5807e042","unresolved":false,"context_lines":[{"line_number":204,"context_line":"    The motivation for this approach is that there will always be some data"},{"line_number":205,"context_line":"    sent by the identity provider (in the assertion or claim) that uniquely"},{"line_number":206,"context_line":"    identifies the identity provider. This removes the requirement for horizon"},{"line_number":207,"context_line":"    to list all the identity providers that are trusted by keystone."},{"line_number":208,"context_line":"Read more about `identity providers"},{"line_number":209,"context_line":"\u003chttp://developer.openstack.org/api-ref/identity/v3-ext/#identity-providers\u003e`__."},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_4a9886c0","line":208,"range":{"start_line":207,"start_character":4,"end_line":208,"end_character":35},"in_reply_to":"fa6399be_3cf7328c","updated":"2016-10-14 11:26:33.000000000","message":"Done","commit_id":"84f723a499928c1799eb3eca0307aa64633b8fd0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":80,"context_line":".. _`Keystone Federation and Horizon`: websso.html"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Configure Federation in Keystone"},{"line_number":83,"context_line":"----------------------------------"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Now that the Identity Provider and keystone are communicating we can start to"},{"line_number":86,"context_line":"configure ``federation``."}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_ed432611","line":83,"range":{"start_line":83,"start_character":32,"end_line":83,"end_character":34},"updated":"2016-10-14 17:39:51.000000000","message":"Extra 2 \"-\" now","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":80,"context_line":".. _`Keystone Federation and Horizon`: websso.html"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Configure Federation in Keystone"},{"line_number":83,"context_line":"----------------------------------"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Now that the Identity Provider and keystone are communicating we can start to"},{"line_number":86,"context_line":"configure ``federation``."}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_fec74e93","line":83,"range":{"start_line":83,"start_character":32,"end_line":83,"end_character":34},"in_reply_to":"fa6399be_ed432611","updated":"2016-10-14 18:38:23.000000000","message":"Done","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":195,"context_line":"    and mapping to use based on the protocol and the value returned from the"},{"line_number":196,"context_line":"    `remote_id_attribute` key."},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"    For example, if our identity provider is ``google``, the mapping used is"},{"line_number":199,"context_line":"    ``google_mapping`` and the protocol is ``oidc``. The identity provider\u0027s"},{"line_number":200,"context_line":"    remote IDs  would be: [``accounts.google.com``]."},{"line_number":201,"context_line":"    The `remote_id_attribute` value may be set to ``HTTP_OIDC_ISS``, since"},{"line_number":202,"context_line":"    this value will always be ``accounts.google.com``."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"    The motivation for this approach is that there will always be some data"},{"line_number":205,"context_line":"    sent by the identity provider (in the assertion or claim) that uniquely"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_8dd62a26","line":202,"range":{"start_line":198,"start_character":4,"end_line":202,"end_character":54},"updated":"2016-10-14 17:39:51.000000000","message":"Not sure we should be plugging google.","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":195,"context_line":"    and mapping to use based on the protocol and the value returned from the"},{"line_number":196,"context_line":"    `remote_id_attribute` key."},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"    For example, if our identity provider is ``google``, the mapping used is"},{"line_number":199,"context_line":"    ``google_mapping`` and the protocol is ``oidc``. The identity provider\u0027s"},{"line_number":200,"context_line":"    remote IDs  would be: [``accounts.google.com``]."},{"line_number":201,"context_line":"    The `remote_id_attribute` value may be set to ``HTTP_OIDC_ISS``, since"},{"line_number":202,"context_line":"    this value will always be ``accounts.google.com``."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"    The motivation for this approach is that there will always be some data"},{"line_number":205,"context_line":"    sent by the identity provider (in the assertion or claim) that uniquely"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_83b999ce","line":202,"range":{"start_line":198,"start_character":4,"end_line":202,"end_character":54},"in_reply_to":"fa6399be_8dd62a26","updated":"2016-10-14 18:38:23.000000000","message":"This is a copy and paste from websso.rst, not original material","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":222,"context_line":"An Identity Provider has exactly one mapping specified per protocol."},{"line_number":223,"context_line":"Mapping objects can be used multiple times by different combinations of Identity Provider and Protocol."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"As a simple example, if Keystone is your IdP, you can map a few known remote"},{"line_number":226,"context_line":"users to the group you already created:"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":".. code-block:: bash"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_4d2092f7","line":225,"range":{"start_line":225,"start_character":24,"end_line":225,"end_character":32},"updated":"2016-10-14 17:39:51.000000000","message":"keystone","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":222,"context_line":"An Identity Provider has exactly one mapping specified per protocol."},{"line_number":223,"context_line":"Mapping objects can be used multiple times by different combinations of Identity Provider and Protocol."},{"line_number":224,"context_line":""},{"line_number":225,"context_line":"As a simple example, if Keystone is your IdP, you can map a few known remote"},{"line_number":226,"context_line":"users to the group you already created:"},{"line_number":227,"context_line":""},{"line_number":228,"context_line":".. code-block:: bash"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_3ebe26ff","line":225,"range":{"start_line":225,"start_character":24,"end_line":225,"end_character":32},"in_reply_to":"fa6399be_4d2092f7","updated":"2016-10-14 18:38:23.000000000","message":"Done","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":315,"context_line":""},{"line_number":316,"context_line":".. NOTE::"},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"    Authentication with Keystone-to-keystone federation does not follow these steps."},{"line_number":319,"context_line":"    See `Testing it all out`_ to authenticate with Keystone-to-keystone."},{"line_number":320,"context_line":""},{"line_number":321,"context_line":"1. Authenticate externally and generate an unscoped token in keystone"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_4dc4123f","line":318,"range":{"start_line":318,"start_character":24,"end_line":318,"end_character":44},"updated":"2016-10-14 17:39:51.000000000","message":"keystone-to-keystone or Keystone-to-Keystone","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":315,"context_line":""},{"line_number":316,"context_line":".. NOTE::"},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"    Authentication with Keystone-to-keystone federation does not follow these steps."},{"line_number":319,"context_line":"    See `Testing it all out`_ to authenticate with Keystone-to-keystone."},{"line_number":320,"context_line":""},{"line_number":321,"context_line":"1. Authenticate externally and generate an unscoped token in keystone"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_5eb91a14","line":318,"range":{"start_line":318,"start_character":24,"end_line":318,"end_character":44},"in_reply_to":"fa6399be_4dc4123f","updated":"2016-10-14 18:38:23.000000000","message":"Done","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":316,"context_line":".. NOTE::"},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"    Authentication with Keystone-to-keystone federation does not follow these steps."},{"line_number":319,"context_line":"    See `Testing it all out`_ to authenticate with Keystone-to-keystone."},{"line_number":320,"context_line":""},{"line_number":321,"context_line":"1. Authenticate externally and generate an unscoped token in keystone"},{"line_number":322,"context_line":"2. Determine accessible resources"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_cdfd826f","line":319,"range":{"start_line":319,"start_character":51,"end_line":319,"end_character":71},"updated":"2016-10-14 17:39:51.000000000","message":"keystone-to-keystone or Keystone-to-Keystone","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":316,"context_line":".. NOTE::"},{"line_number":317,"context_line":""},{"line_number":318,"context_line":"    Authentication with Keystone-to-keystone federation does not follow these steps."},{"line_number":319,"context_line":"    See `Testing it all out`_ to authenticate with Keystone-to-keystone."},{"line_number":320,"context_line":""},{"line_number":321,"context_line":"1. Authenticate externally and generate an unscoped token in keystone"},{"line_number":322,"context_line":"2. Determine accessible resources"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_7e3a5e9a","line":319,"range":{"start_line":319,"start_character":51,"end_line":319,"end_character":71},"in_reply_to":"fa6399be_cdfd826f","updated":"2016-10-14 18:38:23.000000000","message":"Done","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":400,"context_line":""},{"line_number":401,"context_line":".. code-block:: bash"},{"line_number":402,"context_line":""},{"line_number":403,"context_line":"    $ curl -X POST -H \"Content-Type: application/json\" -d \u0027{\"auth\":{\"identity\":{\"methods\":[\"mapped\"],\"mapped\":{\"id\":\"\u003cunscoped_token_id\u003e\"}},\"scope\":{\"project\":{\"domain\": {\"name\": \"Default\"},\"name\":\"service\"}}}}\u0027 -D - http://localhost:5000/v3/auth/tokens"},{"line_number":404,"context_line":""},{"line_number":405,"context_line":"--------------------------------------"},{"line_number":406,"context_line":"Keystone as an Identity Provider (IdP)"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_2d251e08","line":403,"range":{"start_line":403,"start_character":161,"end_line":403,"end_character":188},"updated":"2016-10-14 17:39:51.000000000","message":"Should this be \"federated_domain\"?","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":400,"context_line":""},{"line_number":401,"context_line":".. code-block:: bash"},{"line_number":402,"context_line":""},{"line_number":403,"context_line":"    $ curl -X POST -H \"Content-Type: application/json\" -d \u0027{\"auth\":{\"identity\":{\"methods\":[\"mapped\"],\"mapped\":{\"id\":\"\u003cunscoped_token_id\u003e\"}},\"scope\":{\"project\":{\"domain\": {\"name\": \"Default\"},\"name\":\"service\"}}}}\u0027 -D - http://localhost:5000/v3/auth/tokens"},{"line_number":404,"context_line":""},{"line_number":405,"context_line":"--------------------------------------"},{"line_number":406,"context_line":"Keystone as an Identity Provider (IdP)"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_be407608","line":403,"range":{"start_line":403,"start_character":161,"end_line":403,"end_character":188},"in_reply_to":"fa6399be_2d251e08","updated":"2016-10-14 18:38:23.000000000","message":"yes, and federated_project too","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":441,"context_line":"``idp_entity_id`` is the unique identifier for the Identity Provider. It"},{"line_number":442,"context_line":"usually takes the form of a URI but it does not have to resolve to anything."},{"line_number":443,"context_line":"``idp_sso_endpoint`` is required to generate valid metadata but its value is"},{"line_number":444,"context_line":"not important, though it may be in the future."},{"line_number":445,"context_line":""},{"line_number":446,"context_line":"Note the ``certfile``, ``keyfile``, and ``idp_metadata_path`` settings and adjust them if"},{"line_number":447,"context_line":"necessary:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_2dcd1e85","line":444,"range":{"start_line":444,"start_character":0,"end_line":444,"end_character":13},"updated":"2016-10-14 17:39:51.000000000","message":"unimportant","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":441,"context_line":"``idp_entity_id`` is the unique identifier for the Identity Provider. It"},{"line_number":442,"context_line":"usually takes the form of a URI but it does not have to resolve to anything."},{"line_number":443,"context_line":"``idp_sso_endpoint`` is required to generate valid metadata but its value is"},{"line_number":444,"context_line":"not important, though it may be in the future."},{"line_number":445,"context_line":""},{"line_number":446,"context_line":"Note the ``certfile``, ``keyfile``, and ``idp_metadata_path`` settings and adjust them if"},{"line_number":447,"context_line":"necessary:"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_439301fa","line":444,"range":{"start_line":444,"start_character":0,"end_line":444,"end_character":13},"in_reply_to":"fa6399be_2dcd1e85","updated":"2016-10-14 18:38:23.000000000","message":"any particular reason? \"not important\" reads better to me","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":540,"context_line":"                       user_domain_name\u003dos.environ.get(\u0027OS_USER_DOMAIN_NAME\u0027),"},{"line_number":541,"context_line":"                       project_name\u003dos.environ.get(\u0027OS_PROJECT_NAME\u0027),"},{"line_number":542,"context_line":"                       project_domain_name\u003dos.environ.get(\u0027OS_PROJECT_DOMAIN_NAME\u0027))"},{"line_number":543,"context_line":"    password_session \u003d session.Session(auth\u003dauth, verify\u003dFalse)"},{"line_number":544,"context_line":"    k2ksession \u003d k2k.Keystone2Keystone(password_session.auth, \u0027mysp\u0027,"},{"line_number":545,"context_line":"                                       domain_name\u003d\u0027federated_domain\u0027)"},{"line_number":546,"context_line":"    auth_ref \u003d k2ksession.get_auth_ref(password_session)"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_8d92aa4a","line":543,"range":{"start_line":543,"start_character":50,"end_line":543,"end_character":62},"updated":"2016-10-14 17:39:51.000000000","message":"No certificate verification? I\u0027d rather examples show secure practices by default.","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":540,"context_line":"                       user_domain_name\u003dos.environ.get(\u0027OS_USER_DOMAIN_NAME\u0027),"},{"line_number":541,"context_line":"                       project_name\u003dos.environ.get(\u0027OS_PROJECT_NAME\u0027),"},{"line_number":542,"context_line":"                       project_domain_name\u003dos.environ.get(\u0027OS_PROJECT_DOMAIN_NAME\u0027))"},{"line_number":543,"context_line":"    password_session \u003d session.Session(auth\u003dauth, verify\u003dFalse)"},{"line_number":544,"context_line":"    k2ksession \u003d k2k.Keystone2Keystone(password_session.auth, \u0027mysp\u0027,"},{"line_number":545,"context_line":"                                       domain_name\u003d\u0027federated_domain\u0027)"},{"line_number":546,"context_line":"    auth_ref \u003d k2ksession.get_auth_ref(password_session)"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_c3b5517e","line":543,"range":{"start_line":543,"start_character":50,"end_line":543,"end_character":62},"in_reply_to":"fa6399be_8d92aa4a","updated":"2016-10-14 18:38:23.000000000","message":"good point","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"71b43c0396ce77b9d3bbfda40cdbaff51c1cedfc","unresolved":false,"context_lines":[{"line_number":138,"context_line":""},{"line_number":139,"context_line":"    $ openstack group create federated_users"},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"Add the group to the domain and project:"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":".. code-block:: bash"},{"line_number":144,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa6399be_56c01350","line":141,"updated":"2016-10-15 11:52:14.000000000","message":"nit: Add a role to the group in the domain and project","commit_id":"38f79a8edf624a12c06558d97602f54f8e4bd83a"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"71b43c0396ce77b9d3bbfda40cdbaff51c1cedfc","unresolved":false,"context_lines":[{"line_number":146,"context_line":"    $ openstack role add --group federated_users --project federated_project Member"},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"We\u0027ll later add a mapping that makes all federated users a part of this group"},{"line_number":149,"context_line":"and therefore members of the new domain."},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"Add Identity Provider(s), Mapping(s), and Protocol(s)"},{"line_number":152,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa6399be_76b3570a","line":149,"updated":"2016-10-15 11:52:14.000000000","message":"nice!","commit_id":"38f79a8edf624a12c06558d97602f54f8e4bd83a"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"71b43c0396ce77b9d3bbfda40cdbaff51c1cedfc","unresolved":false,"context_lines":[{"line_number":189,"context_line":""},{"line_number":190,"context_line":".. NOTE::"},{"line_number":191,"context_line":""},{"line_number":192,"context_line":"    Remote IDs are globally unique. Two identity providers cannot be"},{"line_number":193,"context_line":"    associated with the same remote ID. Once authenticated with the external"},{"line_number":194,"context_line":"    identity provider, keystone will determine which identity provider"},{"line_number":195,"context_line":"    and mapping to use based on the protocol and the value returned from the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa6399be_d6cc238b","line":192,"range":{"start_line":192,"start_character":59,"end_line":192,"end_character":65},"updated":"2016-10-15 11:52:14.000000000","message":"nit: can not","commit_id":"38f79a8edf624a12c06558d97602f54f8e4bd83a"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"71b43c0396ce77b9d3bbfda40cdbaff51c1cedfc","unresolved":false,"context_lines":[{"line_number":257,"context_line":"    EOF"},{"line_number":258,"context_line":"    $ openstack mapping create --rules rules.json myidp_mapping"},{"line_number":259,"context_line":""},{"line_number":260,"context_line":"As another example, if Shibboleth is your IdP, the remote section should use REMOTE_USER as the remote type:"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":".. code-block:: bash"},{"line_number":263,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa6399be_b6988f79","line":260,"range":{"start_line":260,"start_character":66,"end_line":260,"end_character":107},"updated":"2016-10-15 11:52:14.000000000","message":"\"should\" is a bit mandatory, think you should say again that is for mapping the user name.","commit_id":"38f79a8edf624a12c06558d97602f54f8e4bd83a"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"71b43c0396ce77b9d3bbfda40cdbaff51c1cedfc","unresolved":false,"context_lines":[{"line_number":303,"context_line":""},{"line_number":304,"context_line":"    $ openstack federation protocol create mapped --mapping myidp_mapping --identity-provider myidp"},{"line_number":305,"context_line":""},{"line_number":306,"context_line":"The name you give the protocol is not arbitrary. It must match the method name"},{"line_number":307,"context_line":"you gave in the ``[auth]/methods`` config option. When authenticating it will be"},{"line_number":308,"context_line":"referred to as the ``protocol_id``."},{"line_number":309,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa6399be_56a733bc","line":306,"range":{"start_line":306,"start_character":0,"end_line":306,"end_character":47},"updated":"2016-10-15 11:52:14.000000000","message":"that\u0027s true! and ppl usually forget to detail this in tutorials (myself included)","commit_id":"38f79a8edf624a12c06558d97602f54f8e4bd83a"}],"doc/source/federation/shibboleth.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"42250f276ad6622aec35f192d76e50032fcaa0e1","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    \u003cLocation /v3/OS-FEDERATION/identity_providers/idp_1/protocols/saml2/auth\u003e"},{"line_number":46,"context_line":"        ShibRequestSetting requireSession 1"},{"line_number":47,"context_line":"        ShibRequestSetting applicationId idp_1"},{"line_number":48,"context_line":"        AuthType shibboleth"},{"line_number":49,"context_line":"        ShibExportAssertion Off"},{"line_number":50,"context_line":"        Require valid-user"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8ec9b2_876617eb","side":"PARENT","line":47,"range":{"start_line":47,"start_character":8,"end_line":47,"end_character":46},"updated":"2016-09-22 03:24:56.000000000","message":"why was this removed?","commit_id":"9640f509974fbc86c344437b6640b437cf2ab685"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6df5241d56ccdb98d896c7bcd7f8353a0fe3ea7f","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"    \u003cLocation /v3/OS-FEDERATION/identity_providers/idp_1/protocols/saml2/auth\u003e"},{"line_number":46,"context_line":"        ShibRequestSetting requireSession 1"},{"line_number":47,"context_line":"        ShibRequestSetting applicationId idp_1"},{"line_number":48,"context_line":"        AuthType shibboleth"},{"line_number":49,"context_line":"        ShibExportAssertion Off"},{"line_number":50,"context_line":"        Require valid-user"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa6399be_cea20a4b","side":"PARENT","line":47,"range":{"start_line":47,"start_character":8,"end_line":47,"end_character":46},"in_reply_to":"7a8ec9b2_876617eb","updated":"2016-10-13 19:25:33.000000000","message":"It not needed if there is only one IdP, and if it\u0027s included it requires extra configuration in shibboleth2.xml. If we included it here but don\u0027t fix shibboleth2.xml we get this error from shibboleth:\n\n Unable to map non-default applicationId to an ApplicationOverride, check configuration.\n\nwhen trying to authenticate.\n\nI don\u0027t think it\u0027s needed for a basic setup, so better to leave it out. Advanced users can read the shibboleth documentation and configure it if they need it.","commit_id":"9640f509974fbc86c344437b6640b437cf2ab685"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"42250f276ad6622aec35f192d76e50032fcaa0e1","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":".. code-block:: bash"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    $ a2ensite wsgi-keystone.conf"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Enable the ``ssl`` and ``shib2`` modules, for example:"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8ec9b2_276b83ba","side":"PARENT","line":74,"range":{"start_line":74,"start_character":6,"end_line":74,"end_character":33},"updated":"2016-09-22 03:24:56.000000000","message":"wow, we did this before we moved entirely to apache, i forgot that!","commit_id":"9640f509974fbc86c344437b6640b437cf2ab685"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6df5241d56ccdb98d896c7bcd7f8353a0fe3ea7f","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":".. code-block:: bash"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"    $ a2ensite wsgi-keystone.conf"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Enable the ``ssl`` and ``shib2`` modules, for example:"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa6399be_2e92a6f6","side":"PARENT","line":74,"range":{"start_line":74,"start_character":6,"end_line":74,"end_character":33},"in_reply_to":"7a8ec9b2_276b83ba","updated":"2016-10-13 19:25:33.000000000","message":":)","commit_id":"9640f509974fbc86c344437b6640b437cf2ab685"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"42250f276ad6622aec35f192d76e50032fcaa0e1","unresolved":false,"context_lines":[{"line_number":258,"context_line":""},{"line_number":259,"context_line":".. code-block:: xml"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"    \u003cAttribute name\u003d\"openstack_user\" id\u003d\"openstack_user\"/\u003e"},{"line_number":262,"context_line":"    \u003cAttribute name\u003d\"openstack_roles\" id\u003d\"openstack_roles\"/\u003e"},{"line_number":263,"context_line":"    \u003cAttribute name\u003d\"openstack_project\" id\u003d\"openstack_project\"/\u003e"},{"line_number":264,"context_line":"    \u003cAttribute name\u003d\"openstack_user_domain\" id\u003d\"openstack_user_domain\"/\u003e"},{"line_number":265,"context_line":"    \u003cAttribute name\u003d\"openstack_project_domain\" id\u003d\"openstack_project_domain\"/\u003e"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"For more information see the"},{"line_number":268,"context_line":"`attributes documentation \u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute\u003e`_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a8ec9b2_67b02b44","line":265,"range":{"start_line":261,"start_character":0,"end_line":265,"end_character":78},"updated":"2016-09-22 03:24:56.000000000","message":"nice addition","commit_id":"b521629a534356d62f44026eb0a0b801aa850ebb"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6df5241d56ccdb98d896c7bcd7f8353a0fe3ea7f","unresolved":false,"context_lines":[{"line_number":258,"context_line":""},{"line_number":259,"context_line":".. code-block:: xml"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"    \u003cAttribute name\u003d\"openstack_user\" id\u003d\"openstack_user\"/\u003e"},{"line_number":262,"context_line":"    \u003cAttribute name\u003d\"openstack_roles\" id\u003d\"openstack_roles\"/\u003e"},{"line_number":263,"context_line":"    \u003cAttribute name\u003d\"openstack_project\" id\u003d\"openstack_project\"/\u003e"},{"line_number":264,"context_line":"    \u003cAttribute name\u003d\"openstack_user_domain\" id\u003d\"openstack_user_domain\"/\u003e"},{"line_number":265,"context_line":"    \u003cAttribute name\u003d\"openstack_project_domain\" id\u003d\"openstack_project_domain\"/\u003e"},{"line_number":266,"context_line":""},{"line_number":267,"context_line":"For more information see the"},{"line_number":268,"context_line":"`attributes documentation \u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute\u003e`_"}],"source_content_type":"text/x-rst","patch_set":2,"id":"fa6399be_4ea6fa53","line":265,"range":{"start_line":261,"start_character":0,"end_line":265,"end_character":78},"in_reply_to":"7a8ec9b2_67b02b44","updated":"2016-10-13 19:25:33.000000000","message":"It\u0027s actually only valid for k2k, making a note in the next patch.","commit_id":"b521629a534356d62f44026eb0a0b801aa850ebb"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":144,"context_line":"        clockSkew\u003d\"180\"\u003e"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"        \u003c!--"},{"line_number":147,"context_line":"        By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache"},{"line_number":148,"context_line":"        are used. See example-shibboleth2.xml for samples of explicitly configuring them."},{"line_number":149,"context_line":"        --\u003e"},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_0d8dbad5","line":147,"range":{"start_line":147,"start_character":73,"end_line":147,"end_character":88},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":144,"context_line":"        clockSkew\u003d\"180\"\u003e"},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"        \u003c!--"},{"line_number":147,"context_line":"        By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache"},{"line_number":148,"context_line":"        are used. See example-shibboleth2.xml for samples of explicitly configuring them."},{"line_number":149,"context_line":"        --\u003e"},{"line_number":150,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_de228aa2","line":147,"range":{"start_line":147,"start_character":73,"end_line":147,"end_character":88},"in_reply_to":"fa6399be_0d8dbad5","updated":"2016-10-14 18:38:23.000000000","message":"This is a preformatted code block copied from the configuration produced by the shibboleth package. Linewrapping here would result in the html output being linewrapped as well, which would make it hard to compare to the non-linewrapped version on the user\u0027s system.","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"        \u003c!--"},{"line_number":147,"context_line":"        By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache"},{"line_number":148,"context_line":"        are used. See example-shibboleth2.xml for samples of explicitly configuring them."},{"line_number":149,"context_line":"        --\u003e"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"        \u003c!--"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_8dbf0a60","line":148,"range":{"start_line":148,"start_character":72,"end_line":148,"end_character":89},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":149,"context_line":"        --\u003e"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"        \u003c!--"},{"line_number":152,"context_line":"        To customize behavior for specific resources on Apache, and to link vhosts or"},{"line_number":153,"context_line":"        resources to ApplicationOverride settings below, use web server options/commands."},{"line_number":154,"context_line":"        See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help."},{"line_number":155,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_cdb5827e","line":152,"range":{"start_line":152,"start_character":71,"end_line":152,"end_character":85},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":150,"context_line":""},{"line_number":151,"context_line":"        \u003c!--"},{"line_number":152,"context_line":"        To customize behavior for specific resources on Apache, and to link vhosts or"},{"line_number":153,"context_line":"        resources to ApplicationOverride settings below, use web server options/commands."},{"line_number":154,"context_line":"        See https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPConfigurationElements for help."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"        For examples with the RequestMap XML syntax instead, see the example-shibboleth2.xml"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_adc20ee7","line":153,"range":{"start_line":153,"start_character":72,"end_line":153,"end_character":89},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":161,"context_line":"        \u003cApplicationDefaults entityID\u003d\"https://mysp.example.com/shibboleth\"\u003e"},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"            \u003c!--"},{"line_number":164,"context_line":"            Controls session lifetimes, address checks, cookie handling, and the protocol handlers."},{"line_number":165,"context_line":"            You MUST supply an effectively unique handlerURL value for each of your applications."},{"line_number":166,"context_line":"            The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing"},{"line_number":167,"context_line":"            a relative value based on the virtual host. Using handlerSSL\u003d\"true\", the default, will force"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_edb88677","line":164,"range":{"start_line":164,"start_character":74,"end_line":164,"end_character":99},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":162,"context_line":""},{"line_number":163,"context_line":"            \u003c!--"},{"line_number":164,"context_line":"            Controls session lifetimes, address checks, cookie handling, and the protocol handlers."},{"line_number":165,"context_line":"            You MUST supply an effectively unique handlerURL value for each of your applications."},{"line_number":166,"context_line":"            The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing"},{"line_number":167,"context_line":"            a relative value based on the virtual host. Using handlerSSL\u003d\"true\", the default, will force"},{"line_number":168,"context_line":"            the protocol to be https. You should also set cookieProps to \"https\" for SSL-only sites."}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_0db4da7d","line":165,"range":{"start_line":165,"start_character":71,"end_line":165,"end_character":97},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":163,"context_line":"            \u003c!--"},{"line_number":164,"context_line":"            Controls session lifetimes, address checks, cookie handling, and the protocol handlers."},{"line_number":165,"context_line":"            You MUST supply an effectively unique handlerURL value for each of your applications."},{"line_number":166,"context_line":"            The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing"},{"line_number":167,"context_line":"            a relative value based on the virtual host. Using handlerSSL\u003d\"true\", the default, will force"},{"line_number":168,"context_line":"            the protocol to be https. You should also set cookieProps to \"https\" for SSL-only sites."},{"line_number":169,"context_line":"            Note that while we default checkAddress to \"false\", this has a negative impact on the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_2dafde2a","line":166,"range":{"start_line":166,"start_character":77,"end_line":166,"end_character":103},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":164,"context_line":"            Controls session lifetimes, address checks, cookie handling, and the protocol handlers."},{"line_number":165,"context_line":"            You MUST supply an effectively unique handlerURL value for each of your applications."},{"line_number":166,"context_line":"            The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing"},{"line_number":167,"context_line":"            a relative value based on the virtual host. Using handlerSSL\u003d\"true\", the default, will force"},{"line_number":168,"context_line":"            the protocol to be https. You should also set cookieProps to \"https\" for SSL-only sites."},{"line_number":169,"context_line":"            Note that while we default checkAddress to \"false\", this has a negative impact on the"},{"line_number":170,"context_line":"            security of your site. Stealing sessions via cookie theft is much easier with this disabled."}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_4daa521a","line":167,"range":{"start_line":167,"start_character":81,"end_line":167,"end_character":104},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":165,"context_line":"            You MUST supply an effectively unique handlerURL value for each of your applications."},{"line_number":166,"context_line":"            The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing"},{"line_number":167,"context_line":"            a relative value based on the virtual host. Using handlerSSL\u003d\"true\", the default, will force"},{"line_number":168,"context_line":"            the protocol to be https. You should also set cookieProps to \"https\" for SSL-only sites."},{"line_number":169,"context_line":"            Note that while we default checkAddress to \"false\", this has a negative impact on the"},{"line_number":170,"context_line":"            security of your site. Stealing sessions via cookie theft is much easier with this disabled."},{"line_number":171,"context_line":"            --\u003e"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_8d662a28","line":168,"range":{"start_line":168,"start_character":82,"end_line":168,"end_character":100},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":166,"context_line":"            The value defaults to /Shibboleth.sso, and should be a relative path, with the SP computing"},{"line_number":167,"context_line":"            a relative value based on the virtual host. Using handlerSSL\u003d\"true\", the default, will force"},{"line_number":168,"context_line":"            the protocol to be https. You should also set cookieProps to \"https\" for SSL-only sites."},{"line_number":169,"context_line":"            Note that while we default checkAddress to \"false\", this has a negative impact on the"},{"line_number":170,"context_line":"            security of your site. Stealing sessions via cookie theft is much easier with this disabled."},{"line_number":171,"context_line":"            --\u003e"},{"line_number":172,"context_line":"            \u003cSessions lifetime\u003d\"28800\" timeout\u003d\"3600\" relayState\u003d\"ss:mem\""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_ad692efb","line":169,"range":{"start_line":169,"start_character":75,"end_line":169,"end_character":97},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":167,"context_line":"            a relative value based on the virtual host. Using handlerSSL\u003d\"true\", the default, will force"},{"line_number":168,"context_line":"            the protocol to be https. You should also set cookieProps to \"https\" for SSL-only sites."},{"line_number":169,"context_line":"            Note that while we default checkAddress to \"false\", this has a negative impact on the"},{"line_number":170,"context_line":"            security of your site. Stealing sessions via cookie theft is much easier with this disabled."},{"line_number":171,"context_line":"            --\u003e"},{"line_number":172,"context_line":"            \u003cSessions lifetime\u003d\"28800\" timeout\u003d\"3600\" relayState\u003d\"ss:mem\""},{"line_number":173,"context_line":"                      checkAddress\u003d\"false\" handlerSSL\u003d\"false\" cookieProps\u003d\"http\"\u003e"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_cd6ca20a","line":170,"range":{"start_line":170,"start_character":78,"end_line":170,"end_character":104},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":233,"context_line":"            \u003cCredentialResolver type\u003d\"File\" key\u003d\"sp-key.pem\" certificate\u003d\"sp-cert.pem\"/\u003e"},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"            \u003c!--"},{"line_number":236,"context_line":"            The default settings can be overridden by creating ApplicationOverride elements (see"},{"line_number":237,"context_line":"            the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic)."},{"line_number":238,"context_line":"            Resource requests are mapped by web server commands, or the RequestMapper, to an"},{"line_number":239,"context_line":"            applicationId setting."}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_4d81728e","line":236,"range":{"start_line":236,"start_character":63,"end_line":236,"end_character":96},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":237,"context_line":"            the https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride topic)."},{"line_number":238,"context_line":"            Resource requests are mapped by web server commands, or the RequestMapper, to an"},{"line_number":239,"context_line":"            applicationId setting."},{"line_number":240,"context_line":"            Example of a second application (for a second vhost) that has a different entityID."},{"line_number":241,"context_line":"            Resources on the vhost would map to an applicationId of \"admin\":"},{"line_number":242,"context_line":"            --\u003e"},{"line_number":243,"context_line":"            \u003c!--"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_0d7bfac1","line":240,"range":{"start_line":240,"start_character":75,"end_line":240,"end_character":95},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":253,"context_line":""},{"line_number":254,"context_line":"    \u003c/SPConfig\u003e"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"If Keystone is your IdP, you will need to examine your attributes map file"},{"line_number":257,"context_line":"``/etc/shibboleth/attribute-map.xml`` and add the following attributes:"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":".. code-block:: xml"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_8df1ca6d","line":256,"range":{"start_line":256,"start_character":3,"end_line":256,"end_character":11},"updated":"2016-10-14 17:39:51.000000000","message":"keystone","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":253,"context_line":""},{"line_number":254,"context_line":"    \u003c/SPConfig\u003e"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"If Keystone is your IdP, you will need to examine your attributes map file"},{"line_number":257,"context_line":"``/etc/shibboleth/attribute-map.xml`` and add the following attributes:"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":".. code-block:: xml"}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_7eec1e2a","line":256,"range":{"start_line":256,"start_character":3,"end_line":256,"end_character":11},"in_reply_to":"fa6399be_8df1ca6d","updated":"2016-10-14 18:38:23.000000000","message":"Done","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":276,"context_line":"    $ service shibd restart"},{"line_number":277,"context_line":"    $ service apache2 restart"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Check ``/var/log/shibboleth/shibd_warn.log`` for any ERROR or CRIT notices and correct them."},{"line_number":280,"context_line":""},{"line_number":281,"context_line":"Upload your Service Provider\u0027s Metadata file to your Identity Provider. You can fetch it with:"},{"line_number":282,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_6df71659","line":279,"range":{"start_line":279,"start_character":79,"end_line":279,"end_character":92},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":276,"context_line":"    $ service shibd restart"},{"line_number":277,"context_line":"    $ service apache2 restart"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Check ``/var/log/shibboleth/shibd_warn.log`` for any ERROR or CRIT notices and correct them."},{"line_number":280,"context_line":""},{"line_number":281,"context_line":"Upload your Service Provider\u0027s Metadata file to your Identity Provider. You can fetch it with:"},{"line_number":282,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_9eef321d","line":279,"range":{"start_line":279,"start_character":79,"end_line":279,"end_character":92},"in_reply_to":"fa6399be_6df71659","updated":"2016-10-14 18:38:23.000000000","message":"Done","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Check ``/var/log/shibboleth/shibd_warn.log`` for any ERROR or CRIT notices and correct them."},{"line_number":280,"context_line":""},{"line_number":281,"context_line":"Upload your Service Provider\u0027s Metadata file to your Identity Provider. You can fetch it with:"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":".. code-block:: bash"},{"line_number":284,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_8d98ea1d","line":281,"range":{"start_line":281,"start_character":79,"end_line":281,"end_character":94},"updated":"2016-10-14 17:39:51.000000000","message":"line wrap","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Check ``/var/log/shibboleth/shibd_warn.log`` for any ERROR or CRIT notices and correct them."},{"line_number":280,"context_line":""},{"line_number":281,"context_line":"Upload your Service Provider\u0027s Metadata file to your Identity Provider. You can fetch it with:"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":".. code-block:: bash"},{"line_number":284,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_2d019e38","line":281,"range":{"start_line":281,"start_character":31,"end_line":281,"end_character":39},"updated":"2016-10-14 17:39:51.000000000","message":"metadata","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Check ``/var/log/shibboleth/shibd_warn.log`` for any ERROR or CRIT notices and correct them."},{"line_number":280,"context_line":""},{"line_number":281,"context_line":"Upload your Service Provider\u0027s Metadata file to your Identity Provider. You can fetch it with:"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":".. code-block:: bash"},{"line_number":284,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_fee02e2b","line":281,"range":{"start_line":281,"start_character":31,"end_line":281,"end_character":39},"in_reply_to":"fa6399be_2d019e38","updated":"2016-10-14 18:38:23.000000000","message":"Done","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Check ``/var/log/shibboleth/shibd_warn.log`` for any ERROR or CRIT notices and correct them."},{"line_number":280,"context_line":""},{"line_number":281,"context_line":"Upload your Service Provider\u0027s Metadata file to your Identity Provider. You can fetch it with:"},{"line_number":282,"context_line":""},{"line_number":283,"context_line":".. code-block:: bash"},{"line_number":284,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_1edc0272","line":281,"range":{"start_line":281,"start_character":79,"end_line":281,"end_character":94},"in_reply_to":"fa6399be_8d98ea1d","updated":"2016-10-14 18:38:23.000000000","message":"Done","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":285,"context_line":"    $ wget http://mysp.example.com/Shibboleth.sso/Metadata"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"This step depends on your Identity Provider choice and is not covered here."},{"line_number":288,"context_line":"If Keystone is your Identity Provider you do not need to upload this file."},{"line_number":289,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_0d621a0a","line":288,"range":{"start_line":288,"start_character":3,"end_line":288,"end_character":11},"updated":"2016-10-14 17:39:51.000000000","message":"keystone","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":285,"context_line":"    $ wget http://mysp.example.com/Shibboleth.sso/Metadata"},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"This step depends on your Identity Provider choice and is not covered here."},{"line_number":288,"context_line":"If Keystone is your Identity Provider you do not need to upload this file."},{"line_number":289,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_3ee70641","line":288,"range":{"start_line":288,"start_character":3,"end_line":288,"end_character":11},"in_reply_to":"fa6399be_0d621a0a","updated":"2016-10-14 18:38:23.000000000","message":"Done","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"6b4e49d03a1441addf4e69d6d3b07b546471d0e3","unresolved":false,"context_lines":[{"line_number":286,"context_line":""},{"line_number":287,"context_line":"This step depends on your Identity Provider choice and is not covered here."},{"line_number":288,"context_line":"If Keystone is your Identity Provider you do not need to upload this file."},{"line_number":289,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_8d4d4a9c","line":289,"updated":"2016-10-14 17:39:51.000000000","message":"Extra line","commit_id":"4635b9976367055e85d5104351278763db89a7b0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"9984c599b89471c737488d61831162cbc3c2f6a5","unresolved":false,"context_lines":[{"line_number":286,"context_line":""},{"line_number":287,"context_line":"This step depends on your Identity Provider choice and is not covered here."},{"line_number":288,"context_line":"If Keystone is your Identity Provider you do not need to upload this file."},{"line_number":289,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"fa6399be_7ed33e60","line":289,"in_reply_to":"fa6399be_8d4d4a9c","updated":"2016-10-14 18:38:23.000000000","message":"Done","commit_id":"4635b9976367055e85d5104351278763db89a7b0"}],"doc/source/federation/websso.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"2c879dc95ca346ed82bf93c1bbf9481ee363d127","unresolved":false,"context_lines":[{"line_number":73,"context_line":"  \u003cVirtualHost *:5000\u003e"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"      OIDCRedirectURI http://localhost:5000/v3/auth/OS-FEDERATION/websso/redirect"},{"line_number":76,"context_line":"      OIDCRedirectURI http://localhost:5000/v3/auth/OS-FEDERATION/identity_providers/myidp/protocol/oidc/websso/redirect"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"      ..."},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_bc66e24e","line":76,"range":{"start_line":76,"start_character":100,"end_line":76,"end_character":104},"updated":"2016-10-14 03:44:30.000000000","message":"replace oidc with mapped as well?","commit_id":"84f723a499928c1799eb3eca0307aa64633b8fd0"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"fc924863c72b85d13c8c0f5a0cf7cdab5807e042","unresolved":false,"context_lines":[{"line_number":73,"context_line":"  \u003cVirtualHost *:5000\u003e"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"      OIDCRedirectURI http://localhost:5000/v3/auth/OS-FEDERATION/websso/redirect"},{"line_number":76,"context_line":"      OIDCRedirectURI http://localhost:5000/v3/auth/OS-FEDERATION/identity_providers/myidp/protocol/oidc/websso/redirect"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":"      ..."},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa6399be_ea887a73","line":76,"range":{"start_line":76,"start_character":100,"end_line":76,"end_character":104},"in_reply_to":"fa6399be_bc66e24e","updated":"2016-10-14 11:26:33.000000000","message":"I would have to change it across all the docs and I haven\u0027t dived far enough into OpenID to understand those changes (for instance does this \u003chttp://git.openstack.org/cgit/openstack/keystone/tree/doc/source/federation/configure_federation.rst#n104\u003e need to drop \u0027openid\u0027 as an auth method? I don\u0027t know yet)","commit_id":"84f723a499928c1799eb3eca0307aa64633b8fd0"}]}