)]}'
{"doc/source/configuration.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":21,"context_line":".. toctree::"},{"line_number":22,"context_line":"   :maxdepth: 1"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"   man/keystone-manage"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"Once keystone is installed, it is configured via a primary configuration file"},{"line_number":27,"context_line":"(``etc/keystone.conf``), a PasteDeploy configuration file"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_953f02b3","side":"PARENT","line":24,"range":{"start_line":24,"start_character":3,"end_line":24,"end_character":22},"updated":"2016-11-18 19:29:37.000000000","message":"this was removed since it marked the 3rd time we referenced the manage command","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":28,"context_line":"(``etc/keystone-paste.ini``), possibly a separate logging configuration file,"},{"line_number":29,"context_line":"and initializing data into keystone using the command line client."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"By default, keystone starts a service on `IANA-assigned port 35357"},{"line_number":32,"context_line":"\u003chttp://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt\u003e`_."},{"line_number":33,"context_line":"This may overlap with your system\u0027s ephemeral port range, so another process"},{"line_number":34,"context_line":"may already be using this port without being explicitly configured to do so. To"},{"line_number":35,"context_line":"prevent this scenario from occurring, it\u0027s recommended that you explicitly"},{"line_number":36,"context_line":"exclude port 35357 from the available ephemeral port range. On a Linux system,"},{"line_number":37,"context_line":"this would be accomplished by:"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":".. code-block:: bash"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    $ sysctl -w \u0027net.ipv4.ip_local_reserved_ports\u003d35357\u0027"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"To make the above change persistent,"},{"line_number":44,"context_line":"``net.ipv4.ip_local_reserved_ports \u003d 35357`` should be added to"},{"line_number":45,"context_line":"``/etc/sysctl.conf`` or to ``/etc/sysctl.d/keystone.conf``."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Configuration Files"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_f54f5668","side":"PARENT","line":45,"range":{"start_line":31,"start_character":0,"end_line":45,"end_character":59},"updated":"2016-11-18 19:29:37.000000000","message":"this section was removed since i asked the room at the summit and no one knew what it was about","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e6ff6d6aac840235f4817e6fd13b0549e8a6ab52","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"To make the above change persistent,"},{"line_number":44,"context_line":"``net.ipv4.ip_local_reserved_ports \u003d 35357`` should be added to"},{"line_number":45,"context_line":"``/etc/sysctl.conf`` or to ``/etc/sysctl.d/keystone.conf``."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Configuration Files"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_6c0b7b24","side":"PARENT","line":45,"in_reply_to":"7a77a97e_e1b3144b","updated":"2016-11-18 22:19:05.000000000","message":"i\u0027ll let dolph weigh in","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b2863c3a31e5dae915c57995a05a613284b45a00","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"To make the above change persistent,"},{"line_number":44,"context_line":"``net.ipv4.ip_local_reserved_ports \u003d 35357`` should be added to"},{"line_number":45,"context_line":"``/etc/sysctl.conf`` or to ``/etc/sysctl.d/keystone.conf``."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Configuration Files"},{"line_number":48,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_e1b3144b","side":"PARENT","line":45,"in_reply_to":"7a77a97e_f54f5668","updated":"2016-11-18 21:42:18.000000000","message":"I think this was needed because 35357 is within the ephemeral port range. The instructions here are reserving that port for only keystone to run on.\n\nDolph would probably be able to keep me honest here.","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b2863c3a31e5dae915c57995a05a613284b45a00","unresolved":false,"context_lines":[{"line_number":439,"context_line":""},{"line_number":440,"context_line":"UUID or Fernet?"},{"line_number":441,"context_line":"^^^^^^^^^^^^^^^"},{"line_number":442,"context_line":"Each token format uses different technologies to achieve various performance,"},{"line_number":443,"context_line":"scaling and architectural requirements."},{"line_number":444,"context_line":""},{"line_number":445,"context_line":"UUID tokens contain randomly generated UUID4 payloads that are issued and"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_c1bd3803","side":"PARENT","line":442,"updated":"2016-11-18 21:42:18.000000000","message":"s/Each/Both/","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e6ff6d6aac840235f4817e6fd13b0549e8a6ab52","unresolved":false,"context_lines":[{"line_number":439,"context_line":""},{"line_number":440,"context_line":"UUID or Fernet?"},{"line_number":441,"context_line":"^^^^^^^^^^^^^^^"},{"line_number":442,"context_line":"Each token format uses different technologies to achieve various performance,"},{"line_number":443,"context_line":"scaling and architectural requirements."},{"line_number":444,"context_line":""},{"line_number":445,"context_line":"UUID tokens contain randomly generated UUID4 payloads that are issued and"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_0c29278a","side":"PARENT","line":442,"in_reply_to":"7a77a97e_c1bd3803","updated":"2016-11-18 22:19:05.000000000","message":"Done","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b2863c3a31e5dae915c57995a05a613284b45a00","unresolved":false,"context_lines":[{"line_number":442,"context_line":"Each token format uses different technologies to achieve various performance,"},{"line_number":443,"context_line":"scaling and architectural requirements."},{"line_number":444,"context_line":""},{"line_number":445,"context_line":"UUID tokens contain randomly generated UUID4 payloads that are issued and"},{"line_number":446,"context_line":"validated by the identity service. They are encoded using their hex digest for"},{"line_number":447,"context_line":"transport and are thus URL-friendly. They must be persisted by the identity"},{"line_number":448,"context_line":"service in order to be later validated. Revoking them is simply a matter of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_213d0c8f","side":"PARENT","line":445,"updated":"2016-11-18 21:42:18.000000000","message":"s/payloads/IDs/","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e6ff6d6aac840235f4817e6fd13b0549e8a6ab52","unresolved":false,"context_lines":[{"line_number":442,"context_line":"Each token format uses different technologies to achieve various performance,"},{"line_number":443,"context_line":"scaling and architectural requirements."},{"line_number":444,"context_line":""},{"line_number":445,"context_line":"UUID tokens contain randomly generated UUID4 payloads that are issued and"},{"line_number":446,"context_line":"validated by the identity service. They are encoded using their hex digest for"},{"line_number":447,"context_line":"transport and are thus URL-friendly. They must be persisted by the identity"},{"line_number":448,"context_line":"service in order to be later validated. Revoking them is simply a matter of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_2c2c2398","side":"PARENT","line":445,"in_reply_to":"7a77a97e_213d0c8f","updated":"2016-11-18 22:19:05.000000000","message":"Done","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":882,"context_line":"   *Experimental* (Icehouse, Juno)"},{"line_number":883,"context_line":"   *Stable* (Kilo)"},{"line_number":884,"context_line":""},{"line_number":885,"context_line":"Logging"},{"line_number":886,"context_line":"-------"},{"line_number":887,"context_line":""},{"line_number":888,"context_line":"Logging is configured externally to the rest of keystone. Configure the path to"},{"line_number":889,"context_line":"your logging configuration file using the ``[DEFAULT] log_config_append``"},{"line_number":890,"context_line":"option of ``keystone.conf``. If you wish to route all your logging through"},{"line_number":891,"context_line":"syslog, set the ``[DEFAULT] use_syslog`` option."},{"line_number":892,"context_line":""},{"line_number":893,"context_line":"A sample ``log_config_append`` file is included with the project at"},{"line_number":894,"context_line":"``etc/logging.conf.sample``. Like other OpenStack projects, keystone uses the"},{"line_number":895,"context_line":"`Python logging module`_, which includes extensive configuration options for"},{"line_number":896,"context_line":"choosing the output levels and formats."},{"line_number":897,"context_line":""},{"line_number":898,"context_line":".. _Paste: http://pythonpaste.org/"},{"line_number":899,"context_line":".. _`Python logging module`: http://docs.python.org/library/logging.html"},{"line_number":900,"context_line":""},{"line_number":901,"context_line":"SSL"},{"line_number":902,"context_line":"---"},{"line_number":903,"context_line":""},{"line_number":904,"context_line":"A secure deployment should have keystone running in a web server (such as"},{"line_number":905,"context_line":"Apache httpd), or behind an SSL terminator."},{"line_number":906,"context_line":""},{"line_number":907,"context_line":"User CRUD additions for the V2.0 API"},{"line_number":908,"context_line":"------------------------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_754ee63b","side":"PARENT","line":905,"range":{"start_line":885,"start_character":0,"end_line":905,"end_character":43},"updated":"2016-11-18 19:29:37.000000000","message":"these were moved to line 890 (since the filtering portion was moved up near catalog)","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":904,"context_line":"A secure deployment should have keystone running in a web server (such as"},{"line_number":905,"context_line":"Apache httpd), or behind an SSL terminator."},{"line_number":906,"context_line":""},{"line_number":907,"context_line":"User CRUD additions for the V2.0 API"},{"line_number":908,"context_line":"------------------------------------"},{"line_number":909,"context_line":""},{"line_number":910,"context_line":"For the V2.0 API, keystone provides an additional capability that allows users"},{"line_number":911,"context_line":"to use a HTTP PATCH to change their own password."},{"line_number":912,"context_line":""},{"line_number":913,"context_line":"Each user can then change their own password with a HTTP PATCH :"},{"line_number":914,"context_line":""},{"line_number":915,"context_line":".. code-block:: bash"},{"line_number":916,"context_line":""},{"line_number":917,"context_line":"    $ curl -X PATCH http://localhost:5000/v2.0/OS-KSCRUD/users/\u003cuserid\u003e -H \"Content-type: application/json\" \\"},{"line_number":918,"context_line":"    -H \"X_Auth_Token: \u003cauthtokenid\u003e\" -d \u0027{\"user\": {\"password\": \"ABCD\", \"original_password\": \"DCBA\"}}\u0027"},{"line_number":919,"context_line":""},{"line_number":920,"context_line":"In addition to changing their password all of the user\u0027s current tokens will be"},{"line_number":921,"context_line":"revoked."},{"line_number":922,"context_line":""},{"line_number":923,"context_line":""},{"line_number":924,"context_line":"Inherited Role Assignments"},{"line_number":925,"context_line":"--------------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_35570ecb","side":"PARENT","line":922,"range":{"start_line":907,"start_character":0,"end_line":922,"end_character":0},"updated":"2016-11-18 19:29:37.000000000","message":"this was removed, it\u0027s not config related, and there are plenty of API examples, like in our API docs","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":921,"context_line":"revoked."},{"line_number":922,"context_line":""},{"line_number":923,"context_line":""},{"line_number":924,"context_line":"Inherited Role Assignments"},{"line_number":925,"context_line":"--------------------------"},{"line_number":926,"context_line":""},{"line_number":927,"context_line":"Keystone provides an optional capability to assign roles on a project or domain"},{"line_number":928,"context_line":"that, rather than affect the project or domain itself, are instead inherited to"},{"line_number":929,"context_line":"the project subtree or to all projects owned by that domain. This capability is"},{"line_number":930,"context_line":"enabled by default, but can be disabled by including the following in"},{"line_number":931,"context_line":"``keystone.conf``:"},{"line_number":932,"context_line":""},{"line_number":933,"context_line":".. code-block:: ini"},{"line_number":934,"context_line":""},{"line_number":935,"context_line":"    [os_inherit]"},{"line_number":936,"context_line":"    enabled \u003d False"},{"line_number":937,"context_line":""},{"line_number":938,"context_line":""},{"line_number":939,"context_line":"Endpoint Policy"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_b56b1e84","side":"PARENT","line":936,"range":{"start_line":924,"start_character":0,"end_line":936,"end_character":19},"updated":"2016-11-18 19:29:37.000000000","message":"just moved down a section, so endpoint policy can be near the catalog","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":1151,"context_line":"For more information and configuration options for the middleware see"},{"line_number":1152,"context_line":"`oslo.middleware \u003chttp://docs.openstack.org/developer/oslo.middleware/api.html#oslo_middleware.Healthcheck\u003e`_."},{"line_number":1153,"context_line":""},{"line_number":1154,"context_line":"Sample Configuration Files"},{"line_number":1155,"context_line":"--------------------------"},{"line_number":1156,"context_line":""},{"line_number":1157,"context_line":"The ``etc/`` folder distributed with keystone contains example configuration"},{"line_number":1158,"context_line":"files for each Server application."},{"line_number":1159,"context_line":""},{"line_number":1160,"context_line":"* ``etc/keystone.conf.sample``"},{"line_number":1161,"context_line":"* ``etc/keystone-paste.ini``"},{"line_number":1162,"context_line":"* ``etc/logging.conf.sample``"},{"line_number":1163,"context_line":"* ``etc/default_catalog.templates``"},{"line_number":1164,"context_line":"* ``etc/sso_callback_template.html``"},{"line_number":1165,"context_line":""},{"line_number":1166,"context_line":".. _`API protection with RBAC`:"},{"line_number":1167,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_5511ea02","side":"PARENT","line":1164,"range":{"start_line":1154,"start_character":0,"end_line":1164,"end_character":36},"updated":"2016-11-18 19:29:37.000000000","message":"moved up near config files","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":1338,"context_line":"    values, or deployed keystone to a different endpoint, you will need to"},{"line_number":1339,"context_line":"    change the provided command accordingly."},{"line_number":1340,"context_line":""},{"line_number":1341,"context_line":"Initializing Keystone"},{"line_number":1342,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":1343,"context_line":""},{"line_number":1344,"context_line":"``keystone-manage`` is designed to execute commands that cannot be administered"},{"line_number":1345,"context_line":"through the normal REST API. At the moment, the following calls are supported:"},{"line_number":1346,"context_line":""},{"line_number":1347,"context_line":"* ``bootstrap``: Perform the basic bootstrap process."},{"line_number":1348,"context_line":"* ``credential_migrate``: Encrypt credentials using a new primary key."},{"line_number":1349,"context_line":"* ``credential_rotate``: Rotate Fernet keys for credential encryption."},{"line_number":1350,"context_line":"* ``credential_setup``: Setup a Fernet key repository for credential encryption."},{"line_number":1351,"context_line":"* ``db_sync``: Sync the database."},{"line_number":1352,"context_line":"* ``db_version``: Print the current migration version of the database."},{"line_number":1353,"context_line":"* ``doctor``: Diagnose common problems with keystone deployments."},{"line_number":1354,"context_line":"* ``domain_config_upload``: Upload domain configuration file."},{"line_number":1355,"context_line":"* ``fernet_rotate``: Rotate keys in the Fernet key repository."},{"line_number":1356,"context_line":"* ``fernet_setup``: Setup a Fernet key repository."},{"line_number":1357,"context_line":"* ``mapping_engine``: Test your federation mapping rules."},{"line_number":1358,"context_line":"* ``mapping_populate``: Prepare domain-specific LDAP backend"},{"line_number":1359,"context_line":"* ``mapping_purge``: Purge the identity mapping table."},{"line_number":1360,"context_line":"* ``pki_setup``: Initialize the certificates used to sign revocation lists."},{"line_number":1361,"context_line":"* ``saml_idp_metadata``: Generate identity provider metadata."},{"line_number":1362,"context_line":"* ``token_flush``: Purge expired tokens"},{"line_number":1363,"context_line":""},{"line_number":1364,"context_line":"Invoking ``keystone-manage`` by itself will give you additional usage"},{"line_number":1365,"context_line":"information."},{"line_number":1366,"context_line":""},{"line_number":1367,"context_line":"The private key used for token signing can only be read by its owner. This"},{"line_number":1368,"context_line":"prevents unauthorized users from spuriously signing tokens."},{"line_number":1369,"context_line":"``keystone-manage pki_setup`` Should be run as the same system user that will"},{"line_number":1370,"context_line":"be running the keystone service to ensure proper ownership for the private key"},{"line_number":1371,"context_line":"file and the associated certificates."},{"line_number":1372,"context_line":""},{"line_number":1373,"context_line":"Adding Users, Projects, and Roles via Command Line Interfaces"},{"line_number":1374,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_75ea66dc","side":"PARENT","line":1371,"range":{"start_line":1341,"start_character":0,"end_line":1371,"end_character":37},"updated":"2016-11-18 19:29:37.000000000","message":"this entire section did not talk about \"initialize\u0027, it just referenced the various keystone-manage commands. I created a new file so we don\u0027t have to update it in two spots.","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":1370,"context_line":"be running the keystone service to ensure proper ownership for the private key"},{"line_number":1371,"context_line":"file and the associated certificates."},{"line_number":1372,"context_line":""},{"line_number":1373,"context_line":"Adding Users, Projects, and Roles via Command Line Interfaces"},{"line_number":1374,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":1375,"context_line":""},{"line_number":1376,"context_line":"Keystone APIs are protected by the rules in the policy file. The default policy"},{"line_number":1377,"context_line":"rules require admin credentials to administer ``users``, ``projects``, and"},{"line_number":1378,"context_line":"``roles``. See section"},{"line_number":1379,"context_line":"`Keystone API protection with Role Based Access Control (RBAC)`_ for more"},{"line_number":1380,"context_line":"details on policy files."},{"line_number":1381,"context_line":""},{"line_number":1382,"context_line":"The keystone command line interface packaged in `python-keystoneclient`_ only"},{"line_number":1383,"context_line":"supports the Identity v2.0 API. The OpenStack common command line interface"},{"line_number":1384,"context_line":"packaged in `python-openstackclient`_ supports both v2.0 and v3 APIs."},{"line_number":1385,"context_line":""},{"line_number":1386,"context_line":"With both command line interfaces there are two ways to configure the client to"},{"line_number":1387,"context_line":"use admin credentials, using either an existing token or password credentials."},{"line_number":1388,"context_line":""},{"line_number":1389,"context_line":".. NOTE::"},{"line_number":1390,"context_line":""},{"line_number":1391,"context_line":"    As of the Juno release, it is recommended to use"},{"line_number":1392,"context_line":"    ``python-openstackclient``, as it supports both v2.0 and v3 APIs. For the"},{"line_number":1393,"context_line":"    purpose of backwards compatibility, the CLI packaged in"},{"line_number":1394,"context_line":"    ``python-keystoneclient`` is not being removed."},{"line_number":1395,"context_line":""},{"line_number":1396,"context_line":".. _`python-openstackclient`: http://docs.openstack.org/developer/python-openstackclient/"},{"line_number":1397,"context_line":".. _`python-keystoneclient`: http://docs.openstack.org/developer/python-keystoneclient/"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_f5bcb6dd","side":"PARENT","line":1394,"range":{"start_line":1373,"start_character":0,"end_line":1394,"end_character":51},"updated":"2016-11-18 19:29:37.000000000","message":"I renamed this to \"supported clients\" as I don\u0027t want to go into deep examples about creating and deleteing resources.","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":1396,"context_line":".. _`python-openstackclient`: http://docs.openstack.org/developer/python-openstackclient/"},{"line_number":1397,"context_line":".. _`python-keystoneclient`: http://docs.openstack.org/developer/python-keystoneclient/"},{"line_number":1398,"context_line":""},{"line_number":1399,"context_line":"Authenticating with a Token"},{"line_number":1400,"context_line":"---------------------------"},{"line_number":1401,"context_line":""},{"line_number":1402,"context_line":".. NOTE::"},{"line_number":1403,"context_line":""},{"line_number":1404,"context_line":"    If your keystone deployment is brand new, you will need to use this"},{"line_number":1405,"context_line":"    authentication method, along with your ``[DEFAULT] admin_token``."},{"line_number":1406,"context_line":""},{"line_number":1407,"context_line":"To authenticate with keystone using a token and ``python-openstackclient``, set"},{"line_number":1408,"context_line":"the following flags."},{"line_number":1409,"context_line":""},{"line_number":1410,"context_line":"* ``--os-url OS_URL``: Keystone endpoint the user communicates with"},{"line_number":1411,"context_line":"* ``--os-token OS_TOKEN``: User\u0027s service token"},{"line_number":1412,"context_line":""},{"line_number":1413,"context_line":"To administer a keystone endpoint, your token should be either belong to a user"},{"line_number":1414,"context_line":"with the ``admin`` role, or, if you haven\u0027t created one yet, should be equal to"},{"line_number":1415,"context_line":"the value defined by ``[DEFAULT] admin_token`` in your ``keystone.conf``."},{"line_number":1416,"context_line":""},{"line_number":1417,"context_line":"You can also set these variables in your environment so that they do not need"},{"line_number":1418,"context_line":"to be passed as arguments each time:"},{"line_number":1419,"context_line":""},{"line_number":1420,"context_line":".. code-block:: bash"},{"line_number":1421,"context_line":""},{"line_number":1422,"context_line":"    $ export OS_URL\u003dhttp://localhost:35357/v2.0"},{"line_number":1423,"context_line":"    $ export OS_TOKEN\u003dADMIN"},{"line_number":1424,"context_line":""},{"line_number":1425,"context_line":"Instead of ``python-openstackclient``, if using ``python-keystoneclient``, set"},{"line_number":1426,"context_line":"the following:"},{"line_number":1427,"context_line":""},{"line_number":1428,"context_line":"* ``--os-endpoint OS_SERVICE_ENDPOINT``: equivalent to ``--os-url OS_URL``"},{"line_number":1429,"context_line":"* ``--os-service-token OS_SERVICE_TOKEN``: equivalent to"},{"line_number":1430,"context_line":"  ``--os-token OS_TOKEN``"},{"line_number":1431,"context_line":""},{"line_number":1432,"context_line":""},{"line_number":1433,"context_line":"Authenticating with a Password"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_b5c79e62","side":"PARENT","line":1430,"range":{"start_line":1399,"start_character":0,"end_line":1430,"end_character":25},"updated":"2016-11-18 19:29:37.000000000","message":"removed this as we should be discouraging this type of auth","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":1452,"context_line":"    $ export OS_PROJECT_NAME\u003dmy_project"},{"line_number":1453,"context_line":"    $ export OS_AUTH_URL\u003dhttp://localhost:35357/v2.0"},{"line_number":1454,"context_line":""},{"line_number":1455,"context_line":"If using ``python-keystoneclient``, set the following instead:"},{"line_number":1456,"context_line":""},{"line_number":1457,"context_line":"* ``--os-tenant-name OS_TENANT_NAME``: equivalent to"},{"line_number":1458,"context_line":"  ``--os-project-name OS_PROJECT_NAME``"},{"line_number":1459,"context_line":""},{"line_number":1460,"context_line":""},{"line_number":1461,"context_line":"Example usage"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_d5997a7a","side":"PARENT","line":1458,"range":{"start_line":1455,"start_character":0,"end_line":1458,"end_character":39},"updated":"2016-11-18 19:29:37.000000000","message":"this just doesn\u0027t work","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":1472,"context_line":""},{"line_number":1473,"context_line":".. code-block:: bash"},{"line_number":1474,"context_line":""},{"line_number":1475,"context_line":"    # Using token authentication, with environment variables"},{"line_number":1476,"context_line":"    $ export OS_URL\u003dhttp://127.0.0.1:35357/v2.0/"},{"line_number":1477,"context_line":"    $ export OS_TOKEN\u003dsecrete_token"},{"line_number":1478,"context_line":"    $ openstack user list"},{"line_number":1479,"context_line":"    $ openstack project create demo"},{"line_number":1480,"context_line":""},{"line_number":1481,"context_line":"    # Using token authentication, with flags"},{"line_number":1482,"context_line":"    $ openstack --os-token\u003dsecrete --os-url\u003dhttp://127.0.0.1:35357/v2.0/ user list"},{"line_number":1483,"context_line":"    $ openstack --os-token\u003dsecrete --os-url\u003dhttp://127.0.0.1:35357/v2.0/ project create demo"},{"line_number":1484,"context_line":""},{"line_number":1485,"context_line":"    # Using password authentication, with environment variables"},{"line_number":1486,"context_line":"    $ export OS_USERNAME\u003dadmin"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_559baa65","side":"PARENT","line":1483,"range":{"start_line":1475,"start_character":4,"end_line":1483,"end_character":92},"updated":"2016-11-18 19:29:37.000000000","message":"avoid showing examples that use the token in favor of password, if a reader wants to know how it works, they can read the OSC docs.","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":1494,"context_line":"    $ openstack --os-username\u003dadmin --os-password\u003dsecrete --os-project-name\u003dadmin --os-auth-url\u003dhttp://localhost:35357/v2.0 user list"},{"line_number":1495,"context_line":"    $ openstack --os-username\u003dadmin --os-password\u003dsecrete --os-project-name\u003dadmin --os-auth-url\u003dhttp://localhost:35357/v2.0 project create demo"},{"line_number":1496,"context_line":""},{"line_number":1497,"context_line":"Removing Expired Tokens"},{"line_number":1498,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":1499,"context_line":""},{"line_number":1500,"context_line":"In the SQL backend expired tokens are not automatically removed. These tokens"},{"line_number":1501,"context_line":"can be removed with:"},{"line_number":1502,"context_line":""},{"line_number":1503,"context_line":".. code-block:: bash"},{"line_number":1504,"context_line":""},{"line_number":1505,"context_line":"    $ keystone-manage token_flush"},{"line_number":1506,"context_line":""},{"line_number":1507,"context_line":"The memcache backend automatically discards expired tokens and so flushing is"},{"line_number":1508,"context_line":"unnecessary and if attempted will fail with a NotImplemented error."},{"line_number":1509,"context_line":""},{"line_number":1510,"context_line":""},{"line_number":1511,"context_line":"Configuring the LDAP Identity Provider"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_b575de32","side":"PARENT","line":1508,"range":{"start_line":1497,"start_character":0,"end_line":1508,"end_character":67},"updated":"2016-11-18 19:29:37.000000000","message":"moved near the keystone-manage section","commit_id":"d7a53cc6b391c7b1d2c97bc99264dba6d70c8cd6"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":41,"context_line":"   configuration file, i.e. configuration in ``keystone-paste.ini``"},{"line_number":42,"context_line":"   is not supported."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Sample Configuration Files"},{"line_number":45,"context_line":"--------------------------"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"The ``etc/`` folder distributed with keystone contains example configuration"},{"line_number":48,"context_line":"files for each Server application."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"* ``etc/keystone.conf.sample``"},{"line_number":51,"context_line":"* ``etc/keystone-paste.ini``"},{"line_number":52,"context_line":"* ``etc/logging.conf.sample``"},{"line_number":53,"context_line":"* ``etc/default_catalog.templates``"},{"line_number":54,"context_line":"* ``etc/sso_callback_template.html``"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"``keystone.conf`` sections"},{"line_number":57,"context_line":"--------------------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_756b46b7","line":54,"range":{"start_line":44,"start_character":0,"end_line":54,"end_character":36},"updated":"2016-11-18 19:29:37.000000000","message":"this is a move of line 1154 (old version), so it\u0027s closer to the config file section","commit_id":"6864752681aeb67610d1f96c72b047a4bcdae15d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":53,"context_line":"* ``etc/default_catalog.templates``"},{"line_number":54,"context_line":"* ``etc/sso_callback_template.html``"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"``keystone.conf`` sections"},{"line_number":57,"context_line":"--------------------------"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"The primary configuration file is organized into the following sections:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_15a132f8","line":56,"range":{"start_line":56,"start_character":0,"end_line":56,"end_character":26},"updated":"2016-11-18 19:29:37.000000000","message":"i added this title","commit_id":"6864752681aeb67610d1f96c72b047a4bcdae15d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b2863c3a31e5dae915c57995a05a613284b45a00","unresolved":false,"context_lines":[{"line_number":422,"context_line":"Keystone supports customizable token providers and it is specified in the"},{"line_number":423,"context_line":"``[token]`` section of the configuration file. Keystone provides two token"},{"line_number":424,"context_line":"provider options (``fernet`` and ``uuid``, with ``fernet`` being the default)."},{"line_number":425,"context_line":"Users may register their own token rovider by configuring the"},{"line_number":426,"context_line":"``[token] provider`` property."},{"line_number":427,"context_line":""},{"line_number":428,"context_line":"* ``fernet`` - A Fernet based token provider. Implemented by"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_e1e1542b","line":425,"updated":"2016-11-18 21:42:18.000000000","message":"provider*","commit_id":"6864752681aeb67610d1f96c72b047a4bcdae15d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e6ff6d6aac840235f4817e6fd13b0549e8a6ab52","unresolved":false,"context_lines":[{"line_number":422,"context_line":"Keystone supports customizable token providers and it is specified in the"},{"line_number":423,"context_line":"``[token]`` section of the configuration file. Keystone provides two token"},{"line_number":424,"context_line":"provider options (``fernet`` and ``uuid``, with ``fernet`` being the default)."},{"line_number":425,"context_line":"Users may register their own token rovider by configuring the"},{"line_number":426,"context_line":"``[token] provider`` property."},{"line_number":427,"context_line":""},{"line_number":428,"context_line":"* ``fernet`` - A Fernet based token provider. Implemented by"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_ec178b42","line":425,"in_reply_to":"7a77a97e_e1e1542b","updated":"2016-11-18 22:19:05.000000000","message":"Done","commit_id":"6864752681aeb67610d1f96c72b047a4bcdae15d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":425,"context_line":"Users may register their own token rovider by configuring the"},{"line_number":426,"context_line":"``[token] provider`` property."},{"line_number":427,"context_line":""},{"line_number":428,"context_line":"* ``fernet`` - A Fernet based token provider. Implemented by"},{"line_number":429,"context_line":"  :class:`keystone.token.providers.fernet.Provider`"},{"line_number":430,"context_line":""},{"line_number":431,"context_line":"* ``uuid`` - A UUID based token provider. Implemented by"},{"line_number":432,"context_line":"  :class:`keystone.token.providers.uuid.Provider`"},{"line_number":433,"context_line":""},{"line_number":434,"context_line":""},{"line_number":435,"context_line":"UUID or Fernet?"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_d5b33a4b","line":432,"range":{"start_line":428,"start_character":0,"end_line":432,"end_character":49},"updated":"2016-11-18 19:29:37.000000000","message":"general clean up","commit_id":"6864752681aeb67610d1f96c72b047a4bcdae15d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":458,"context_line":""},{"line_number":459,"context_line":".. support_matrix:: token-support-matrix.ini"},{"line_number":460,"context_line":""},{"line_number":461,"context_line":"Encryption Keys for Fernet Tokens"},{"line_number":462,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":463,"context_line":""},{"line_number":464,"context_line":"``keystone-manage fernet_setup`` will attempt to create a key repository as"},{"line_number":465,"context_line":"configured in the ``[fernet_tokens]`` section of ``keystone.conf`` and"},{"line_number":466,"context_line":"bootstrap it with encryption keys."},{"line_number":467,"context_line":""},{"line_number":468,"context_line":"A single 256-bit key is actually composed of two smaller keys: a 128-bit key"},{"line_number":469,"context_line":"used for SHA256 HMAC signing and a 128-bit key used for AES encryption. See the"},{"line_number":470,"context_line":"`Fernet token \u003chttps://github.com/fernet/spec\u003e`_ specification for more detail."},{"line_number":471,"context_line":""},{"line_number":472,"context_line":"``keystone-manage fernet_rotate`` will rotate encryption keys through the"},{"line_number":473,"context_line":"following states:"},{"line_number":474,"context_line":""},{"line_number":475,"context_line":"* **Staged key**: In a key rotation, a new key is introduced into the rotation"},{"line_number":476,"context_line":"  in this state. Only one key is considered to be the *staged* key at any given"},{"line_number":477,"context_line":"  time. This key will become the *primary* during the *next* key rotation. This"},{"line_number":478,"context_line":"  key is only used to validate tokens and serves to avoid race conditions in"},{"line_number":479,"context_line":"  multi-node deployments (all nodes should recognize all *primary* keys in the"},{"line_number":480,"context_line":"  deployment at all times). In a multi-node keystone deployment this would"},{"line_number":481,"context_line":"  allow for the *staged* key to be replicated to all keystone nodes before"},{"line_number":482,"context_line":"  being promoted to *primary* on a single node. This prevents the case where a"},{"line_number":483,"context_line":"  *primary* key is created on one keystone node and tokens encrypted/signed with"},{"line_number":484,"context_line":"  that new *primary* are rejected on another keystone node because the new"},{"line_number":485,"context_line":"  *primary* doesn\u0027t exist there yet."},{"line_number":486,"context_line":""},{"line_number":487,"context_line":"* **Primary key**: In a key rotation, the old *staged* key is promoted to be"},{"line_number":488,"context_line":"  the *primary*. Only one key is considered to be the *primary* key at any"},{"line_number":489,"context_line":"  given time. This is the key used to generate new tokens. This key is also"},{"line_number":490,"context_line":"  used to validate previously generated tokens."},{"line_number":491,"context_line":""},{"line_number":492,"context_line":"* **Secondary keys**: In a key rotation, the old *primary* key is demoted to be"},{"line_number":493,"context_line":"  a *secondary* key. *Secondary* keys are only used to validate previously"},{"line_number":494,"context_line":"  generated tokens. You can maintain any number of *secondary* keys, up to"},{"line_number":495,"context_line":"  ``[fernet_tokens] max_active_keys`` (where \"active\" refers to the sum of all"},{"line_number":496,"context_line":"  recognized keys in any state: *staged*, *primary* or *secondary*). When"},{"line_number":497,"context_line":"  ``max_active_keys`` is exceeded during a key rotation, the oldest keys are"},{"line_number":498,"context_line":"  discarded."},{"line_number":499,"context_line":""},{"line_number":500,"context_line":"When a new primary key is created, all new tokens will be encrypted using the"},{"line_number":501,"context_line":"new primary key. The old primary key is demoted to a secondary key, which can"},{"line_number":502,"context_line":"still be used for validating tokens. Excess secondary keys (beyond"},{"line_number":503,"context_line":"``[fernet_tokens] max_active_keys``) are revoked. Revoked keys are permanently"},{"line_number":504,"context_line":"deleted."},{"line_number":505,"context_line":""},{"line_number":506,"context_line":"Rotating keys too frequently, or with ``[fernet_tokens] max_active_keys`` set"},{"line_number":507,"context_line":"too low, will cause tokens to become invalid prior to their expiration."},{"line_number":508,"context_line":""},{"line_number":509,"context_line":"Caching Layer"},{"line_number":510,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_d58a5a63","line":507,"range":{"start_line":461,"start_character":0,"end_line":507,"end_character":71},"updated":"2016-11-18 19:29:37.000000000","message":"this is a move of line 747, so it\u0027s close to the token section","commit_id":"6864752681aeb67610d1f96c72b047a4bcdae15d"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b2863c3a31e5dae915c57995a05a613284b45a00","unresolved":false,"context_lines":[{"line_number":655,"context_line":""},{"line_number":656,"context_line":""},{"line_number":657,"context_line":"Certificates for PKI"},{"line_number":658,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":659,"context_line":""},{"line_number":660,"context_line":"PKI stands for Public Key Infrastructure. Tokens are documents,"},{"line_number":661,"context_line":"cryptographically signed using the X509 standard. In order to work correctly"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_415768c9","line":658,"updated":"2016-11-18 21:42:18.000000000","message":"Are these sections even needed anymore?","commit_id":"6864752681aeb67610d1f96c72b047a4bcdae15d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e6ff6d6aac840235f4817e6fd13b0549e8a6ab52","unresolved":false,"context_lines":[{"line_number":655,"context_line":""},{"line_number":656,"context_line":""},{"line_number":657,"context_line":"Certificates for PKI"},{"line_number":658,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":659,"context_line":""},{"line_number":660,"context_line":"PKI stands for Public Key Infrastructure. Tokens are documents,"},{"line_number":661,"context_line":"cryptographically signed using the X509 standard. In order to work correctly"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_4c087f28","line":658,"in_reply_to":"7a77a97e_415768c9","updated":"2016-11-18 22:19:05.000000000","message":"yes, until we get rid of the revocation list, they are needed to encrypt the returned content","commit_id":"6864752681aeb67610d1f96c72b047a4bcdae15d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"0c57cbb91f510cd65e4b23ef8444d88be1a4f719","unresolved":false,"context_lines":[{"line_number":1290,"context_line":""},{"line_number":1291,"context_line":".. include:: man/commands.rst"},{"line_number":1292,"context_line":""},{"line_number":1293,"context_line":"Removing Expired Tokens"},{"line_number":1294,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":1295,"context_line":""},{"line_number":1296,"context_line":"In the SQL backend expired tokens are not automatically removed. These tokens"},{"line_number":1297,"context_line":"can be removed with:"},{"line_number":1298,"context_line":""},{"line_number":1299,"context_line":".. code-block:: bash"},{"line_number":1300,"context_line":""},{"line_number":1301,"context_line":"    $ keystone-manage token_flush"},{"line_number":1302,"context_line":""},{"line_number":1303,"context_line":"The memcache backend automatically discards expired tokens and so flushing is"},{"line_number":1304,"context_line":"unnecessary and if attempted will fail with a NotImplemented error."},{"line_number":1305,"context_line":""},{"line_number":1306,"context_line":"Supported clients"},{"line_number":1307,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7a77a97e_75d426eb","line":1304,"range":{"start_line":1293,"start_character":0,"end_line":1304,"end_character":67},"updated":"2016-11-18 19:29:37.000000000","message":"this was moved up from line 1497","commit_id":"6864752681aeb67610d1f96c72b047a4bcdae15d"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"44b9cd6774037cef068cc7edebac2654216e228a","unresolved":false,"context_lines":[{"line_number":434,"context_line":""},{"line_number":435,"context_line":"UUID or Fernet?"},{"line_number":436,"context_line":"^^^^^^^^^^^^^^^"},{"line_number":437,"context_line":"Both token format uses different technologies to achieve various performance,"},{"line_number":438,"context_line":"scaling and architectural requirements."},{"line_number":439,"context_line":""},{"line_number":440,"context_line":"UUID tokens contain randomly generated UUID4 IDs that are issued and"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a77a97e_acc83356","line":437,"updated":"2016-11-18 22:39:03.000000000","message":"\"Each token format uses\" or \"Both token formats use\"","commit_id":"2acbe6ba93036e1e18e35187ed39c0cc716cde0c"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9167a48b027bcbcb3b5701f8ab2d67100e295dc9","unresolved":false,"context_lines":[{"line_number":434,"context_line":""},{"line_number":435,"context_line":"UUID or Fernet?"},{"line_number":436,"context_line":"^^^^^^^^^^^^^^^"},{"line_number":437,"context_line":"Both token format uses different technologies to achieve various performance,"},{"line_number":438,"context_line":"scaling and architectural requirements."},{"line_number":439,"context_line":""},{"line_number":440,"context_line":"UUID tokens contain randomly generated UUID4 IDs that are issued and"}],"source_content_type":"text/x-rst","patch_set":4,"id":"7a77a97e_a7668cea","line":437,"in_reply_to":"7a77a97e_acc83356","updated":"2016-11-18 22:55:56.000000000","message":"++","commit_id":"2acbe6ba93036e1e18e35187ed39c0cc716cde0c"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"4771653ebb44bd2c41a697203d053120e77a931c","unresolved":false,"context_lines":[{"line_number":1293,"context_line":"Removing Expired Tokens"},{"line_number":1294,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":1295,"context_line":""},{"line_number":1296,"context_line":"In the SQL backend expired tokens are not automatically removed. These tokens"},{"line_number":1297,"context_line":"can be removed with:"},{"line_number":1298,"context_line":""},{"line_number":1299,"context_line":".. code-block:: bash"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a77a97e_4a3da3ba","line":1296,"range":{"start_line":1296,"start_character":27,"end_line":1296,"end_character":33},"updated":"2016-11-21 08:01:46.000000000","message":"maybe we should specify that these are UUID tokens (and maybe even that fernet tokens need no flushing)","commit_id":"03c09f646ab9c2df9001a616ff5546f0beaf04f7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"4283e258557419cd86a78bbee916bc33f13aa5b9","unresolved":false,"context_lines":[{"line_number":1293,"context_line":"Removing Expired Tokens"},{"line_number":1294,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":1295,"context_line":""},{"line_number":1296,"context_line":"In the SQL backend expired tokens are not automatically removed. These tokens"},{"line_number":1297,"context_line":"can be removed with:"},{"line_number":1298,"context_line":""},{"line_number":1299,"context_line":".. code-block:: bash"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a77a97e_edc59b0a","line":1296,"range":{"start_line":1296,"start_character":27,"end_line":1296,"end_character":33},"in_reply_to":"7a77a97e_4a3da3ba","updated":"2016-11-21 14:18:08.000000000","message":"++","commit_id":"03c09f646ab9c2df9001a616ff5546f0beaf04f7"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"3f38284638ee49ebad382ac681e50e1a563c1fd1","unresolved":false,"context_lines":[{"line_number":1293,"context_line":"Removing Expired Tokens"},{"line_number":1294,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":1295,"context_line":""},{"line_number":1296,"context_line":"In the SQL backend expired tokens are not automatically removed. These tokens"},{"line_number":1297,"context_line":"can be removed with:"},{"line_number":1298,"context_line":""},{"line_number":1299,"context_line":".. code-block:: bash"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a77a97e_4bf2f407","line":1296,"range":{"start_line":1296,"start_character":27,"end_line":1296,"end_character":33},"in_reply_to":"7a77a97e_4a3da3ba","updated":"2016-11-21 15:39:52.000000000","message":"Done","commit_id":"03c09f646ab9c2df9001a616ff5546f0beaf04f7"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"4283e258557419cd86a78bbee916bc33f13aa5b9","unresolved":false,"context_lines":[{"line_number":1300,"context_line":""},{"line_number":1301,"context_line":"    $ keystone-manage token_flush"},{"line_number":1302,"context_line":""},{"line_number":1303,"context_line":"The memcache backend automatically discards expired tokens and so flushing is"},{"line_number":1304,"context_line":"unnecessary and if attempted will fail with a NotImplemented error."},{"line_number":1305,"context_line":""},{"line_number":1306,"context_line":"Supported clients"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a77a97e_cde1bf9c","line":1303,"range":{"start_line":1303,"start_character":4,"end_line":1303,"end_character":20},"updated":"2016-11-21 14:18:08.000000000","message":"this has been removed at https://review.openstack.org/#/c/374499/","commit_id":"03c09f646ab9c2df9001a616ff5546f0beaf04f7"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"3f38284638ee49ebad382ac681e50e1a563c1fd1","unresolved":false,"context_lines":[{"line_number":1300,"context_line":""},{"line_number":1301,"context_line":"    $ keystone-manage token_flush"},{"line_number":1302,"context_line":""},{"line_number":1303,"context_line":"The memcache backend automatically discards expired tokens and so flushing is"},{"line_number":1304,"context_line":"unnecessary and if attempted will fail with a NotImplemented error."},{"line_number":1305,"context_line":""},{"line_number":1306,"context_line":"Supported clients"}],"source_content_type":"text/x-rst","patch_set":5,"id":"7a77a97e_2bedb825","line":1303,"range":{"start_line":1303,"start_character":4,"end_line":1303,"end_character":20},"in_reply_to":"7a77a97e_cde1bf9c","updated":"2016-11-21 15:39:52.000000000","message":"Done","commit_id":"03c09f646ab9c2df9001a616ff5546f0beaf04f7"}],"doc/source/index.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2b2fa19db13e0c5cf5d810a8e9eaa1e676175b50","unresolved":false,"context_lines":[{"line_number":65,"context_line":".. toctree::"},{"line_number":66,"context_line":"   :maxdepth: 2"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"   configuration"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Advanced Topics"},{"line_number":71,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_88144a4d","line":68,"updated":"2016-11-18 18:54:38.000000000","message":"Are we planning on breaking this up or adding more files to it later?","commit_id":"cb367d02880fdaa2f58e8435ddc126d174a5bcc4"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"34a9bfa29910519020dddb29adde7f4160c281bd","unresolved":false,"context_lines":[{"line_number":65,"context_line":".. toctree::"},{"line_number":66,"context_line":"   :maxdepth: 2"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"   configuration"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"Advanced Topics"},{"line_number":71,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a77a97e_f5011606","line":68,"in_reply_to":"7a77a97e_88144a4d","updated":"2016-11-18 19:19:08.000000000","message":"no, but it allows the topics to appear on the landing page","commit_id":"cb367d02880fdaa2f58e8435ddc126d174a5bcc4"}]}