)]}'
{"doc/source/security_compliance.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5dc7bb2e3abbe4ca49af373e85a6d99478f2c0b2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"5a8bc5a2_3eba256f","updated":"2016-09-23 05:03:39.000000000","message":"add this to the \"Advanced Topics\" section I suppose -- http://docs.openstack.org/developer/keystone/#advanced-topics","commit_id":"caa0f922ec16ed93ac233ea9d1a8369158006435"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c7efc3108c48766c92431358c79f1477db5deb33","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"5a8bc5a2_bb729eab","in_reply_to":"5a8bc5a2_3eba256f","updated":"2016-09-23 17:36:52.000000000","message":"Done","commit_id":"caa0f922ec16ed93ac233ea9d1a8369158006435"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5dc7bb2e3abbe4ca49af373e85a6d99478f2c0b2","unresolved":false,"context_lines":[{"line_number":19,"context_line":"compliance, specifically to satisfy Payment Card Industry - Data Security"},{"line_number":20,"context_line":"Standard (PCI-DSS) v3.1 requirements.  However, these features could be used to"},{"line_number":21,"context_line":"satisfy other security requirements as well.  See `Security Hardening: PCI-DSS"},{"line_number":22,"context_line":"\u003chttps://github.com/openstack/keystone-specs/blob/master/specs/keystone/newton/"},{"line_number":23,"context_line":"pci-dss.rst#security-hardening-pci-dss\u003e`_ for more information on PCI-DSS."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"These features can be enabled by changing the configuration settings under the"},{"line_number":26,"context_line":"``[security_compliance]`` section in keystone.conf"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8bc5a2_9eab391d","line":23,"range":{"start_line":22,"start_character":1,"end_line":23,"end_character":38},"updated":"2016-09-23 05:03:39.000000000","message":"use the rendered doc, it\u0027s purdier: http://specs.openstack.org/openstack/keystone-specs/specs/keystone/newton/pci-dss.html","commit_id":"caa0f922ec16ed93ac233ea9d1a8369158006435"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c7efc3108c48766c92431358c79f1477db5deb33","unresolved":false,"context_lines":[{"line_number":19,"context_line":"compliance, specifically to satisfy Payment Card Industry - Data Security"},{"line_number":20,"context_line":"Standard (PCI-DSS) v3.1 requirements.  However, these features could be used to"},{"line_number":21,"context_line":"satisfy other security requirements as well.  See `Security Hardening: PCI-DSS"},{"line_number":22,"context_line":"\u003chttps://github.com/openstack/keystone-specs/blob/master/specs/keystone/newton/"},{"line_number":23,"context_line":"pci-dss.rst#security-hardening-pci-dss\u003e`_ for more information on PCI-DSS."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"These features can be enabled by changing the configuration settings under the"},{"line_number":26,"context_line":"``[security_compliance]`` section in keystone.conf"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8bc5a2_05f6d1d6","line":23,"range":{"start_line":22,"start_character":1,"end_line":23,"end_character":38},"in_reply_to":"5a8bc5a2_9eab391d","updated":"2016-09-23 17:36:52.000000000","message":"Done","commit_id":"caa0f922ec16ed93ac233ea9d1a8369158006435"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5dc7bb2e3abbe4ca49af373e85a6d99478f2c0b2","unresolved":false,"context_lines":[{"line_number":25,"context_line":"These features can be enabled by changing the configuration settings under the"},{"line_number":26,"context_line":"``[security_compliance]`` section in keystone.conf"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":".. NOTE::"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"    Most of these features only apply to the SQL backend for the identity"},{"line_number":31,"context_line":"    driver."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Disabling Inactive Users"},{"line_number":34,"context_line":"------------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8bc5a2_de4a2183","line":31,"range":{"start_line":28,"start_character":0,"end_line":31,"end_character":11},"updated":"2016-09-23 05:03:39.000000000","message":"another NOTE saying that most of these are off by default and the settings need to be updated for the feature to be enabled ?","commit_id":"caa0f922ec16ed93ac233ea9d1a8369158006435"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c7efc3108c48766c92431358c79f1477db5deb33","unresolved":false,"context_lines":[{"line_number":25,"context_line":"These features can be enabled by changing the configuration settings under the"},{"line_number":26,"context_line":"``[security_compliance]`` section in keystone.conf"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":".. NOTE::"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"    Most of these features only apply to the SQL backend for the identity"},{"line_number":31,"context_line":"    driver."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Disabling Inactive Users"},{"line_number":34,"context_line":"------------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8bc5a2_251cad11","line":31,"range":{"start_line":28,"start_character":0,"end_line":31,"end_character":11},"in_reply_to":"5a8bc5a2_de4a2183","updated":"2016-09-23 17:36:52.000000000","message":"Done","commit_id":"caa0f922ec16ed93ac233ea9d1a8369158006435"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5dc7bb2e3abbe4ca49af373e85a6d99478f2c0b2","unresolved":false,"context_lines":[{"line_number":50,"context_line":"-------------------------"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The account lockout feature limits the number of times a user can attempt to"},{"line_number":53,"context_line":"login with an incorrect password.  First, you can set the maximum number of"},{"line_number":54,"context_line":"failed authentication attempts by setting the ``lockout_failure_attempts``:"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":".. code-block:: ini"},{"line_number":57,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8bc5a2_e9ff25ff","line":54,"range":{"start_line":53,"start_character":35,"end_line":54,"end_character":75},"updated":"2016-09-23 05:03:39.000000000","message":"round off the sentence with: \"if a user fails to authenticate after the maximum number of attempts, the user will be disabled. Users can be re-enabled by explicitly setting the enable user attribute via the API.\"","commit_id":"caa0f922ec16ed93ac233ea9d1a8369158006435"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c7efc3108c48766c92431358c79f1477db5deb33","unresolved":false,"context_lines":[{"line_number":50,"context_line":"-------------------------"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The account lockout feature limits the number of times a user can attempt to"},{"line_number":53,"context_line":"login with an incorrect password.  First, you can set the maximum number of"},{"line_number":54,"context_line":"failed authentication attempts by setting the ``lockout_failure_attempts``:"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":".. code-block:: ini"},{"line_number":57,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8bc5a2_a536fd4f","line":54,"range":{"start_line":53,"start_character":35,"end_line":54,"end_character":75},"in_reply_to":"5a8bc5a2_e9ff25ff","updated":"2016-09-23 17:36:52.000000000","message":"Perfect, thanks :)\n\nDone.","commit_id":"caa0f922ec16ed93ac233ea9d1a8369158006435"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5dc7bb2e3abbe4ca49af373e85a6d99478f2c0b2","unresolved":false,"context_lines":[{"line_number":64,"context_line":".. code-block:: ini"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"    [security_compliance]"},{"line_number":67,"context_line":"    lockout_duration \u003d 1800"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"If the ``lockout_duration`` is not set, then users may be locked out"},{"line_number":70,"context_line":"indefinitely until the user is explicitly enabled via the API."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8bc5a2_1e13a967","line":67,"range":{"start_line":67,"start_character":4,"end_line":67,"end_character":27},"updated":"2016-09-23 05:03:39.000000000","message":"mention what unit of time this is measured in","commit_id":"caa0f922ec16ed93ac233ea9d1a8369158006435"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c7efc3108c48766c92431358c79f1477db5deb33","unresolved":false,"context_lines":[{"line_number":64,"context_line":".. code-block:: ini"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"    [security_compliance]"},{"line_number":67,"context_line":"    lockout_duration \u003d 1800"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"If the ``lockout_duration`` is not set, then users may be locked out"},{"line_number":70,"context_line":"indefinitely until the user is explicitly enabled via the API."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a8bc5a2_85e101d3","line":67,"range":{"start_line":67,"start_character":4,"end_line":67,"end_character":27},"in_reply_to":"5a8bc5a2_1e13a967","updated":"2016-09-23 17:36:52.000000000","message":"This is a code block; the seconds is mentioned right above that.","commit_id":"caa0f922ec16ed93ac233ea9d1a8369158006435"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1ad29f11e524c0fc394616daad2f28e9f248bc3","unresolved":false,"context_lines":[{"line_number":33,"context_line":"-------------------------"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The account lockout feature limits the number of times a user can attempt to"},{"line_number":36,"context_line":"login with an incorrect password.  If a user fails to authenticate after the"},{"line_number":37,"context_line":"maximum number of attempts, the user will be disabled.  Users can be re-enabled"},{"line_number":38,"context_line":"by explicitly setting the enable user attribute via the API."},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_fbfee636","line":36,"range":{"start_line":36,"start_character":34,"end_line":36,"end_character":35},"updated":"2016-09-23 17:56:51.000000000","message":"extra space","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c0a47958e2cdc0787ad932e6de3d5e054dd94138","unresolved":false,"context_lines":[{"line_number":33,"context_line":"-------------------------"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The account lockout feature limits the number of times a user can attempt to"},{"line_number":36,"context_line":"login with an incorrect password.  If a user fails to authenticate after the"},{"line_number":37,"context_line":"maximum number of attempts, the user will be disabled.  Users can be re-enabled"},{"line_number":38,"context_line":"by explicitly setting the enable user attribute via the API."},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_f196074b","line":36,"range":{"start_line":36,"start_character":34,"end_line":36,"end_character":35},"in_reply_to":"5a8bc5a2_fbfee636","updated":"2016-09-23 18:22:37.000000000","message":"Done","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1ad29f11e524c0fc394616daad2f28e9f248bc3","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The account lockout feature limits the number of times a user can attempt to"},{"line_number":36,"context_line":"login with an incorrect password.  If a user fails to authenticate after the"},{"line_number":37,"context_line":"maximum number of attempts, the user will be disabled.  Users can be re-enabled"},{"line_number":38,"context_line":"by explicitly setting the enable user attribute via the API."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"You can set the maximum number of failed authentication attempts by setting"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_7b99f61e","line":37,"range":{"start_line":37,"start_character":55,"end_line":37,"end_character":56},"updated":"2016-09-23 17:56:51.000000000","message":"extra space","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c0a47958e2cdc0787ad932e6de3d5e054dd94138","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"The account lockout feature limits the number of times a user can attempt to"},{"line_number":36,"context_line":"login with an incorrect password.  If a user fails to authenticate after the"},{"line_number":37,"context_line":"maximum number of attempts, the user will be disabled.  Users can be re-enabled"},{"line_number":38,"context_line":"by explicitly setting the enable user attribute via the API."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"You can set the maximum number of failed authentication attempts by setting"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_11929357","line":37,"range":{"start_line":37,"start_character":55,"end_line":37,"end_character":56},"in_reply_to":"5a8bc5a2_7b99f61e","updated":"2016-09-23 18:22:37.000000000","message":"Done","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1ad29f11e524c0fc394616daad2f28e9f248bc3","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    disable_user_account_days_inactive \u003d 90"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"This above setting means that users that have not authenticated (inactive) for"},{"line_number":72,"context_line":"the past 90 days will be automatically disabled.  Users can be re-enabled by"},{"line_number":73,"context_line":"explicitly setting the enable user attribute via the API."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Password Expiration"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_db784ac7","line":72,"range":{"start_line":72,"start_character":49,"end_line":72,"end_character":50},"updated":"2016-09-23 17:56:51.000000000","message":"extra space","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1ad29f11e524c0fc394616daad2f28e9f248bc3","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    disable_user_account_days_inactive \u003d 90"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"This above setting means that users that have not authenticated (inactive) for"},{"line_number":72,"context_line":"the past 90 days will be automatically disabled.  Users can be re-enabled by"},{"line_number":73,"context_line":"explicitly setting the enable user attribute via the API."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Password Expiration"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_5b643a21","line":72,"range":{"start_line":72,"start_character":9,"end_line":72,"end_character":11},"updated":"2016-09-23 17:56:51.000000000","message":"maybe say \"90\" is just an example here?","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c0a47958e2cdc0787ad932e6de3d5e054dd94138","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    disable_user_account_days_inactive \u003d 90"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"This above setting means that users that have not authenticated (inactive) for"},{"line_number":72,"context_line":"the past 90 days will be automatically disabled.  Users can be re-enabled by"},{"line_number":73,"context_line":"explicitly setting the enable user attribute via the API."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Password Expiration"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_31a14fa4","line":72,"range":{"start_line":72,"start_character":9,"end_line":72,"end_character":11},"in_reply_to":"5a8bc5a2_5b643a21","updated":"2016-09-23 18:22:37.000000000","message":"Done","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c0a47958e2cdc0787ad932e6de3d5e054dd94138","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    disable_user_account_days_inactive \u003d 90"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"This above setting means that users that have not authenticated (inactive) for"},{"line_number":72,"context_line":"the past 90 days will be automatically disabled.  Users can be re-enabled by"},{"line_number":73,"context_line":"explicitly setting the enable user attribute via the API."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Password Expiration"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_71891726","line":72,"range":{"start_line":72,"start_character":49,"end_line":72,"end_character":50},"in_reply_to":"5a8bc5a2_db784ac7","updated":"2016-09-23 18:22:37.000000000","message":"Done","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1ad29f11e524c0fc394616daad2f28e9f248bc3","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    password_expires_days \u003d 90"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Once set, any new password changes will have an expiration date based on the"},{"line_number":87,"context_line":"number of days.  Existing passwords will not be impacted.  If you want existing"},{"line_number":88,"context_line":"passwords to have an expiration date, you would need to run a SQL script"},{"line_number":89,"context_line":"against the password table in the database to update the expires_at column."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_3b7e8eae","line":87,"range":{"start_line":87,"start_character":16,"end_line":87,"end_character":17},"updated":"2016-09-23 17:56:51.000000000","message":"ditto","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1ad29f11e524c0fc394616daad2f28e9f248bc3","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    password_expires_days \u003d 90"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Once set, any new password changes will have an expiration date based on the"},{"line_number":87,"context_line":"number of days.  Existing passwords will not be impacted.  If you want existing"},{"line_number":88,"context_line":"passwords to have an expiration date, you would need to run a SQL script"},{"line_number":89,"context_line":"against the password table in the database to update the expires_at column."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_7b4e5697","line":87,"range":{"start_line":87,"start_character":58,"end_line":87,"end_character":59},"updated":"2016-09-23 17:56:51.000000000","message":"ditto","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c0a47958e2cdc0787ad932e6de3d5e054dd94138","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    password_expires_days \u003d 90"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Once set, any new password changes will have an expiration date based on the"},{"line_number":87,"context_line":"number of days.  Existing passwords will not be impacted.  If you want existing"},{"line_number":88,"context_line":"passwords to have an expiration date, you would need to run a SQL script"},{"line_number":89,"context_line":"against the password table in the database to update the expires_at column."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_d1866b12","line":87,"range":{"start_line":87,"start_character":16,"end_line":87,"end_character":17},"in_reply_to":"5a8bc5a2_3b7e8eae","updated":"2016-09-23 18:22:37.000000000","message":"Done","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c0a47958e2cdc0787ad932e6de3d5e054dd94138","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    password_expires_days \u003d 90"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Once set, any new password changes will have an expiration date based on the"},{"line_number":87,"context_line":"number of days.  Existing passwords will not be impacted.  If you want existing"},{"line_number":88,"context_line":"passwords to have an expiration date, you would need to run a SQL script"},{"line_number":89,"context_line":"against the password table in the database to update the expires_at column."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_1179b32f","line":87,"range":{"start_line":87,"start_character":58,"end_line":87,"end_character":59},"in_reply_to":"5a8bc5a2_7b4e5697","updated":"2016-09-23 18:22:37.000000000","message":"Done","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1ad29f11e524c0fc394616daad2f28e9f248bc3","unresolved":false,"context_lines":[{"line_number":115,"context_line":"digit, and a minimum length of 7 characters."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"If you do set the password_regex, you’ll also want to provide text that"},{"line_number":118,"context_line":"describes your password strength requirements.  You can do this by setting the"},{"line_number":119,"context_line":"``password_regex_description``:"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_db268acd","line":118,"range":{"start_line":118,"start_character":47,"end_line":118,"end_character":48},"updated":"2016-09-23 17:56:51.000000000","message":"ditto","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c0a47958e2cdc0787ad932e6de3d5e054dd94138","unresolved":false,"context_lines":[{"line_number":115,"context_line":"digit, and a minimum length of 7 characters."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"If you do set the password_regex, you’ll also want to provide text that"},{"line_number":118,"context_line":"describes your password strength requirements.  You can do this by setting the"},{"line_number":119,"context_line":"``password_regex_description``:"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_31786f2a","line":118,"range":{"start_line":118,"start_character":47,"end_line":118,"end_character":48},"in_reply_to":"5a8bc5a2_db268acd","updated":"2016-09-23 18:22:37.000000000","message":"Done","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1ad29f11e524c0fc394616daad2f28e9f248bc3","unresolved":false,"context_lines":[{"line_number":132,"context_line":"-----------------------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"The password history requirements controls the number of passwords for a user"},{"line_number":135,"context_line":"that must be unique before an old password can to be reused.  You can enforce"},{"line_number":136,"context_line":"this by setting the ``unique_last_password_count``:"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_7b1c9677","line":135,"range":{"start_line":135,"start_character":61,"end_line":135,"end_character":62},"updated":"2016-09-23 17:56:51.000000000","message":"ditto","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c0a47958e2cdc0787ad932e6de3d5e054dd94138","unresolved":false,"context_lines":[{"line_number":132,"context_line":"-----------------------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"The password history requirements controls the number of passwords for a user"},{"line_number":135,"context_line":"that must be unique before an old password can to be reused.  You can enforce"},{"line_number":136,"context_line":"this by setting the ``unique_last_password_count``:"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_51733b4d","line":135,"range":{"start_line":135,"start_character":61,"end_line":135,"end_character":62},"in_reply_to":"5a8bc5a2_7b1c9677","updated":"2016-09-23 18:22:37.000000000","message":"Done","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1ad29f11e524c0fc394616daad2f28e9f248bc3","unresolved":false,"context_lines":[{"line_number":152,"context_line":"    minimum_password_age \u003d 1"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"In the above example, once a user changes their password, they would not be"},{"line_number":155,"context_line":"able to change it again for 1 day.  This prevents users from changing their"},{"line_number":156,"context_line":"passwords immediately in order to wipe out their password history and reuse an"},{"line_number":157,"context_line":"old password."},{"line_number":158,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_d60d8138","line":155,"range":{"start_line":155,"start_character":35,"end_line":155,"end_character":36},"updated":"2016-09-23 17:56:51.000000000","message":"ditto","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"c0a47958e2cdc0787ad932e6de3d5e054dd94138","unresolved":false,"context_lines":[{"line_number":152,"context_line":"    minimum_password_age \u003d 1"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"In the above example, once a user changes their password, they would not be"},{"line_number":155,"context_line":"able to change it again for 1 day.  This prevents users from changing their"},{"line_number":156,"context_line":"passwords immediately in order to wipe out their password history and reuse an"},{"line_number":157,"context_line":"old password."},{"line_number":158,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"5a8bc5a2_9193034f","line":155,"range":{"start_line":155,"start_character":35,"end_line":155,"end_character":36},"in_reply_to":"5a8bc5a2_d60d8138","updated":"2016-09-23 18:22:37.000000000","message":"Done","commit_id":"77f70759984aee590a0a369b601462237df6f1d7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"fa80d0ec903c95b14184ab4c63de09c07509852f","unresolved":false,"context_lines":[{"line_number":132,"context_line":"-----------------------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"The password history requirements controls the number of passwords for a user"},{"line_number":135,"context_line":"that must be unique before an old password can to be reused. You can enforce"},{"line_number":136,"context_line":"this by setting the ``unique_last_password_count``:"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a8bc5a2_904e616d","line":135,"range":{"start_line":135,"start_character":47,"end_line":135,"end_character":53},"updated":"2016-09-26 13:27:12.000000000","message":"s/to be/be","commit_id":"5b50c28ee859080ba63aba81af284dabc3345506"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"d1d6cbee472bceae5523dfc4638bc5195c9d10f4","unresolved":false,"context_lines":[{"line_number":132,"context_line":"-----------------------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"The password history requirements controls the number of passwords for a user"},{"line_number":135,"context_line":"that must be unique before an old password can to be reused. You can enforce"},{"line_number":136,"context_line":"this by setting the ``unique_last_password_count``:"},{"line_number":137,"context_line":""},{"line_number":138,"context_line":".. code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":6,"id":"5a8bc5a2_08c13854","line":135,"range":{"start_line":135,"start_character":47,"end_line":135,"end_character":53},"in_reply_to":"5a8bc5a2_904e616d","updated":"2016-09-26 17:08:04.000000000","message":"Done","commit_id":"5b50c28ee859080ba63aba81af284dabc3345506"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"59b187880e64ea956b8bfcd2a95cd471e53d9d6c","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    under the License."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":"Security Compliance \u0026 PCI-DSS"},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"As of the Newton release, keystone added security compliance features,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_a16e2bc7","line":15,"updated":"2016-10-11 22:07:38.000000000","message":"Being nothing but keystone.conf configuration stuff, this could also slot into configuration.rst","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"3bbac43ffba2d889e57aedcc9363f5548b5e515d","unresolved":false,"context_lines":[{"line_number":12,"context_line":"    under the License."},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":15,"context_line":"Security Compliance \u0026 PCI-DSS"},{"line_number":16,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"As of the Newton release, keystone added security compliance features,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_dee82ee5","line":15,"in_reply_to":"fa6399be_a16e2bc7","updated":"2016-10-12 21:12:14.000000000","message":"Agree","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"59b187880e64ea956b8bfcd2a95cd471e53d9d6c","unresolved":false,"context_lines":[{"line_number":22,"context_line":"pci-dss.html\u003e`_ for more information on PCI-DSS."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"These features can be enabled by changing the configuration settings under the"},{"line_number":25,"context_line":"``[security_compliance]`` section in keystone.conf."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":".. NOTE::"},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_2135bbd9","line":25,"updated":"2016-10-11 22:07:38.000000000","message":"nit: ``keystone.conf``","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"3bbac43ffba2d889e57aedcc9363f5548b5e515d","unresolved":false,"context_lines":[{"line_number":22,"context_line":"pci-dss.html\u003e`_ for more information on PCI-DSS."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"These features can be enabled by changing the configuration settings under the"},{"line_number":25,"context_line":"``[security_compliance]`` section in keystone.conf."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":".. NOTE::"},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_9eb5d6ef","line":25,"in_reply_to":"fa6399be_2135bbd9","updated":"2016-10-12 21:12:14.000000000","message":"Done","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"59b187880e64ea956b8bfcd2a95cd471e53d9d6c","unresolved":false,"context_lines":[{"line_number":27,"context_line":".. NOTE::"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"    Security compliance features are disabled by default and most of the"},{"line_number":30,"context_line":"    features only apply to the SQL backend for the identity driver."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Account Lockout Threshold"},{"line_number":33,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_c125dfab","line":30,"updated":"2016-10-11 22:07:38.000000000","message":"I\u0027d suggest adding something along the lines of \"Other identity backends, such as LDAP servers, should implement their own security controls.\" I also think this note could be a paragraph on it\u0027s own, prior to the note about configuration.","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"3bbac43ffba2d889e57aedcc9363f5548b5e515d","unresolved":false,"context_lines":[{"line_number":27,"context_line":".. NOTE::"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"    Security compliance features are disabled by default and most of the"},{"line_number":30,"context_line":"    features only apply to the SQL backend for the identity driver."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Account Lockout Threshold"},{"line_number":33,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_1eaf0682","line":30,"in_reply_to":"fa6399be_c125dfab","updated":"2016-10-12 21:12:14.000000000","message":"Done","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"501609879188790fcfdb9169d60d0b2bd29bad79","unresolved":false,"context_lines":[{"line_number":35,"context_line":"The account lockout feature limits the number of times a user can attempt to"},{"line_number":36,"context_line":"login with an incorrect password. If a user fails to authenticate after the"},{"line_number":37,"context_line":"maximum number of attempts, the user will be disabled. Users can be re-enabled"},{"line_number":38,"context_line":"by explicitly setting the enable user attribute via the API."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"You can set the maximum number of failed authentication attempts by setting"},{"line_number":41,"context_line":"the ``lockout_failure_attempts``:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_e4883cea","line":38,"updated":"2016-10-11 17:53:34.000000000","message":"I suppose the policy for re-enabling a user can change per deployment. Is that why we don\u0027t explicitly say this can be done by an administrator?","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"59b187880e64ea956b8bfcd2a95cd471e53d9d6c","unresolved":false,"context_lines":[{"line_number":35,"context_line":"The account lockout feature limits the number of times a user can attempt to"},{"line_number":36,"context_line":"login with an incorrect password. If a user fails to authenticate after the"},{"line_number":37,"context_line":"maximum number of attempts, the user will be disabled. Users can be re-enabled"},{"line_number":38,"context_line":"by explicitly setting the enable user attribute via the API."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"You can set the maximum number of failed authentication attempts by setting"},{"line_number":41,"context_line":"the ``lockout_failure_attempts``:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_619b33ca","line":38,"in_reply_to":"fa6399be_e4883cea","updated":"2016-10-11 22:07:38.000000000","message":"++","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"59b187880e64ea956b8bfcd2a95cd471e53d9d6c","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    password_expires_days \u003d 90"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Once set, any new password changes will have an expiration date based on the"},{"line_number":87,"context_line":"number of days. Existing passwords will not be impacted. If you want existing"},{"line_number":88,"context_line":"passwords to have an expiration date, you would need to run a SQL script"},{"line_number":89,"context_line":"against the password table in the database to update the expires_at column."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_a1a54b05","line":87,"updated":"2016-10-11 22:07:38.000000000","message":"\"an expiration date based on the number of days\" feels like an incomplete thought.","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"3bbac43ffba2d889e57aedcc9363f5548b5e515d","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    password_expires_days \u003d 90"},{"line_number":85,"context_line":""},{"line_number":86,"context_line":"Once set, any new password changes will have an expiration date based on the"},{"line_number":87,"context_line":"number of days. Existing passwords will not be impacted. If you want existing"},{"line_number":88,"context_line":"passwords to have an expiration date, you would need to run a SQL script"},{"line_number":89,"context_line":"against the password table in the database to update the expires_at column."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_fe7332e5","line":87,"in_reply_to":"fa6399be_a1a54b05","updated":"2016-10-12 21:12:14.000000000","message":"Reworded this to \"based on the\ndate/time of the password change plus the number of days defined here\"","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"501609879188790fcfdb9169d60d0b2bd29bad79","unresolved":false,"context_lines":[{"line_number":86,"context_line":"Once set, any new password changes will have an expiration date based on the"},{"line_number":87,"context_line":"number of days. Existing passwords will not be impacted. If you want existing"},{"line_number":88,"context_line":"passwords to have an expiration date, you would need to run a SQL script"},{"line_number":89,"context_line":"against the password table in the database to update the expires_at column."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"In addition, you can set it so that passwords never expire for some users by"},{"line_number":92,"context_line":"adding their user ID to ``password_expires_ignore_user_ids`` list:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_84c78011","line":89,"updated":"2016-10-11 17:53:34.000000000","message":"We don\u0027t provide this script do we? I feel like there is a check here we can build into `keystone-manage doctor`.","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"59b187880e64ea956b8bfcd2a95cd471e53d9d6c","unresolved":false,"context_lines":[{"line_number":86,"context_line":"Once set, any new password changes will have an expiration date based on the"},{"line_number":87,"context_line":"number of days. Existing passwords will not be impacted. If you want existing"},{"line_number":88,"context_line":"passwords to have an expiration date, you would need to run a SQL script"},{"line_number":89,"context_line":"against the password table in the database to update the expires_at column."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"In addition, you can set it so that passwords never expire for some users by"},{"line_number":92,"context_line":"adding their user ID to ``password_expires_ignore_user_ids`` list:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_61825354","line":89,"updated":"2016-10-11 22:07:38.000000000","message":"``expires_at``\n\n++ That\u0027s be a good doctor check -- \"you have this config option set, but there are X users in the database that don\u0027t have a password expiration set. This implies Y. Run sql command Z directly to resolve.\"","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"3bbac43ffba2d889e57aedcc9363f5548b5e515d","unresolved":false,"context_lines":[{"line_number":86,"context_line":"Once set, any new password changes will have an expiration date based on the"},{"line_number":87,"context_line":"number of days. Existing passwords will not be impacted. If you want existing"},{"line_number":88,"context_line":"passwords to have an expiration date, you would need to run a SQL script"},{"line_number":89,"context_line":"against the password table in the database to update the expires_at column."},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"In addition, you can set it so that passwords never expire for some users by"},{"line_number":92,"context_line":"adding their user ID to ``password_expires_ignore_user_ids`` list:"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_de266ecd","line":89,"in_reply_to":"fa6399be_61825354","updated":"2016-10-12 21:12:14.000000000","message":"Yeah, we don\u0027t provide a script. ++ on adding a doctor check","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"501609879188790fcfdb9169d60d0b2bd29bad79","unresolved":false,"context_lines":[{"line_number":94,"context_line":".. code-block:: ini"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    [security_compliance]"},{"line_number":97,"context_line":"    Password_expires_ignore_user_ids \u003d [3a54353c9dcc44f690975ea768512f6a]"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"In this example, the password for user ID ``3a54353c9dcc44f690975ea768512f6a``"},{"line_number":100,"context_line":"would never expire."}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_04037043","line":97,"updated":"2016-10-11 17:53:34.000000000","message":"nit: use lowercase on configuration variables. \n\n  password_expires_ignore_user_ids \u003d ...","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"59b187880e64ea956b8bfcd2a95cd471e53d9d6c","unresolved":false,"context_lines":[{"line_number":94,"context_line":".. code-block:: ini"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    [security_compliance]"},{"line_number":97,"context_line":"    Password_expires_ignore_user_ids \u003d [3a54353c9dcc44f690975ea768512f6a]"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"In this example, the password for user ID ``3a54353c9dcc44f690975ea768512f6a``"},{"line_number":100,"context_line":"would never expire."}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_21e85b10","line":97,"in_reply_to":"fa6399be_04037043","updated":"2016-10-11 22:07:38.000000000","message":"++","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"3bbac43ffba2d889e57aedcc9363f5548b5e515d","unresolved":false,"context_lines":[{"line_number":94,"context_line":".. code-block:: ini"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"    [security_compliance]"},{"line_number":97,"context_line":"    Password_expires_ignore_user_ids \u003d [3a54353c9dcc44f690975ea768512f6a]"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"In this example, the password for user ID ``3a54353c9dcc44f690975ea768512f6a``"},{"line_number":100,"context_line":"would never expire."}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_9e131666","line":97,"in_reply_to":"fa6399be_04037043","updated":"2016-10-12 21:12:14.000000000","message":"Done","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"59b187880e64ea956b8bfcd2a95cd471e53d9d6c","unresolved":false,"context_lines":[{"line_number":114,"context_line":"The above is an example of a regular expression that requires 1 letter, 1"},{"line_number":115,"context_line":"digit, and a minimum length of 7 characters."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"If you do set the password_regex, you will also want to provide text that"},{"line_number":118,"context_line":"describes your password strength requirements. You can do this by setting the"},{"line_number":119,"context_line":"``password_regex_description``:"},{"line_number":120,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_6137b3b0","line":117,"updated":"2016-10-11 22:07:38.000000000","message":"nit: ``password_regex``","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"3bbac43ffba2d889e57aedcc9363f5548b5e515d","unresolved":false,"context_lines":[{"line_number":114,"context_line":"The above is an example of a regular expression that requires 1 letter, 1"},{"line_number":115,"context_line":"digit, and a minimum length of 7 characters."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"If you do set the password_regex, you will also want to provide text that"},{"line_number":118,"context_line":"describes your password strength requirements. You can do this by setting the"},{"line_number":119,"context_line":"``password_regex_description``:"},{"line_number":120,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_79001c02","line":117,"in_reply_to":"fa6399be_6137b3b0","updated":"2016-10-12 21:12:14.000000000","message":"Done","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"501609879188790fcfdb9169d60d0b2bd29bad79","unresolved":false,"context_lines":[{"line_number":126,"context_line":"                                 characters."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"The description will be returned to users to explain why their requested"},{"line_number":129,"context_line":"password was insufficient."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Unique Password History"},{"line_number":132,"context_line":"-----------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_e4175c4f","line":129,"updated":"2016-10-11 17:53:34.000000000","message":"We could add a NOTE or WARNING here to double check that the help text  completely describes the regular expression for the sake of user-experience.\n\n  .. NOTE::\n\n    It is imperative to ensure the ``password_regex_description`` fully and \n    completely describes the ``password_regex``. If the two options are out\n    of sync, the help text may inaccurately describe the password \n    requirements being applied to the password. This leads to very poor\n    user experience.","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"3bbac43ffba2d889e57aedcc9363f5548b5e515d","unresolved":false,"context_lines":[{"line_number":126,"context_line":"                                 characters."},{"line_number":127,"context_line":""},{"line_number":128,"context_line":"The description will be returned to users to explain why their requested"},{"line_number":129,"context_line":"password was insufficient."},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"Unique Password History"},{"line_number":132,"context_line":"-----------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_d97208ad","line":129,"in_reply_to":"fa6399be_e4175c4f","updated":"2016-10-12 21:12:14.000000000","message":"Nice, thanks for writing this up. Done.","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"501609879188790fcfdb9169d60d0b2bd29bad79","unresolved":false,"context_lines":[{"line_number":140,"context_line":"    [security_compliance]"},{"line_number":141,"context_line":"    unique_last_password_count\u003d 5"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"The above example won’t allow a user to create a new password that is the same"},{"line_number":144,"context_line":"as any of their last 4 previous passwords."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Similarly, you can set the number of days that a password must be used before"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_471e4a64","line":143,"updated":"2016-10-11 17:53:34.000000000","message":"nit: won\u0027t or will not","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"3bbac43ffba2d889e57aedcc9363f5548b5e515d","unresolved":false,"context_lines":[{"line_number":140,"context_line":"    [security_compliance]"},{"line_number":141,"context_line":"    unique_last_password_count\u003d 5"},{"line_number":142,"context_line":""},{"line_number":143,"context_line":"The above example won’t allow a user to create a new password that is the same"},{"line_number":144,"context_line":"as any of their last 4 previous passwords."},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"Similarly, you can set the number of days that a password must be used before"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa6399be_3964e4e2","line":143,"in_reply_to":"fa6399be_471e4a64","updated":"2016-10-12 21:12:14.000000000","message":"Done","commit_id":"d993439385dd6b2440deba667e923bbd4d4825f7"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"34ecbef66987f5cbca2cb2dc83b57f796401af9d","unresolved":false,"context_lines":[{"line_number":28,"context_line":"These features can be enabled by changing the configuration settings under the"},{"line_number":29,"context_line":"``[security_compliance]`` section in ``keystone.conf``."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":".. NOTE::"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"    Security compliance features are disabled by default and most of the"},{"line_number":34,"context_line":"    features only apply to the SQL backend for the identity driver."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Account Lockout Threshold"},{"line_number":37,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa6399be_e621dcb5","line":34,"range":{"start_line":31,"start_character":0,"end_line":34,"end_character":67},"updated":"2016-10-13 04:18:33.000000000","message":"this is a repeat of lines 24-26","commit_id":"493750f3294335b7b048f228b04476d95f01696b"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"34ecbef66987f5cbca2cb2dc83b57f796401af9d","unresolved":false,"context_lines":[{"line_number":101,"context_line":"    [security_compliance]"},{"line_number":102,"context_line":"    password_expires_ignore_user_ids \u003d [3a54353c9dcc44f690975ea768512f6a]"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"In this example, the password for user ID ``3a54353c9dcc44f690975ea768512f6a``"},{"line_number":105,"context_line":"would never expire."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"Password Strength Requirements"},{"line_number":108,"context_line":"------------------------------"}],"source_content_type":"text/x-rst","patch_set":9,"id":"fa6399be_2603d410","line":105,"range":{"start_line":104,"start_character":0,"end_line":105,"end_character":19},"updated":"2016-10-13 04:18:33.000000000","message":"you may want to indicate that this is handy for service accounts that are configured for service to service communication","commit_id":"493750f3294335b7b048f228b04476d95f01696b"}]}