)]}'
{"doc/source/federation/mapping_combinations.rst":[{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"49f0239c03f94f63ade14eb896d9a340e61e71af","unresolved":false,"context_lines":[{"line_number":672,"context_line":"using a mapping:"},{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."},{"line_number":675,"context_line":"* Projects will be created with the domain of the Identity Provider."},{"line_number":676,"context_line":"* Projects defined in the mapping must also contain roles."},{"line_number":677,"context_line":"* Roles within the project must already exist in the deployment or domain."},{"line_number":678,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a3c09a3_d79defbc","line":675,"range":{"start_line":675,"start_character":27,"end_line":675,"end_character":31},"updated":"2017-01-18 13:18:41.000000000","message":"within?","commit_id":"997ae0a5acc4254108312ad3f31a86210e9f39e5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2e875fb4f5f8b07221dc894205d39bbe5ad10a78","unresolved":false,"context_lines":[{"line_number":672,"context_line":"using a mapping:"},{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."},{"line_number":675,"context_line":"* Projects will be created with the domain of the Identity Provider."},{"line_number":676,"context_line":"* Projects defined in the mapping must also contain roles."},{"line_number":677,"context_line":"* Roles within the project must already exist in the deployment or domain."},{"line_number":678,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a3c09a3_4b44f348","line":675,"in_reply_to":"7a3c09a3_d79defbc","updated":"2017-01-18 15:18:58.000000000","message":"Done","commit_id":"997ae0a5acc4254108312ad3f31a86210e9f39e5"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"40ca1f261709f9048dacf8dbaf1cb93e2b35117a","unresolved":false,"context_lines":[{"line_number":680,"context_line":"services in the deployment, it is expected that roles are created ahead of"},{"line_number":681,"context_line":"time. Federated authentication should also be considered idempotent if the"},{"line_number":682,"context_line":"attributes from the SAML assertion have not changed. In the example from above,"},{"line_number":683,"context_line":"if the user\u0027s username is still ``jsmith``, then no new projects will be"},{"line_number":684,"context_line":"created as a result of authentication."},{"line_number":685,"context_line":""},{"line_number":686,"context_line":"Keystone to Keystone"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a3c09a3_31949f41","line":683,"range":{"start_line":683,"start_character":7,"end_line":683,"end_character":23},"updated":"2017-01-18 01:00:57.000000000","message":"user\u0027s username sounds a bit redundant.  maybe just user\u0027s name since even the field is called name","commit_id":"997ae0a5acc4254108312ad3f31a86210e9f39e5"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2e875fb4f5f8b07221dc894205d39bbe5ad10a78","unresolved":false,"context_lines":[{"line_number":680,"context_line":"services in the deployment, it is expected that roles are created ahead of"},{"line_number":681,"context_line":"time. Federated authentication should also be considered idempotent if the"},{"line_number":682,"context_line":"attributes from the SAML assertion have not changed. In the example from above,"},{"line_number":683,"context_line":"if the user\u0027s username is still ``jsmith``, then no new projects will be"},{"line_number":684,"context_line":"created as a result of authentication."},{"line_number":685,"context_line":""},{"line_number":686,"context_line":"Keystone to Keystone"}],"source_content_type":"text/x-rst","patch_set":1,"id":"7a3c09a3_0b6d8bcb","line":683,"in_reply_to":"7a3c09a3_31949f41","updated":"2017-01-18 15:18:58.000000000","message":"Done","commit_id":"997ae0a5acc4254108312ad3f31a86210e9f39e5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":660,"context_line":"The ``remote`` section of the mapping is relatively straight-forward. The main"},{"line_number":661,"context_line":"difference between this mapping and the other examples is the addition of a"},{"line_number":662,"context_line":"``projects`` section within the ``local`` rules. The ``projects`` list supplies"},{"line_number":663,"context_line":"a list of projects that the federated user should have some level of access to."},{"line_number":664,"context_line":"This is achieved when a user has successfully authenticated and the mapping"},{"line_number":665,"context_line":"engine has applied values from the assertion and mapped them into the ``local``"},{"line_number":666,"context_line":"rules. In the above example, we can see that after a valid SAML assertion has"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_fa870210","line":663,"range":{"start_line":663,"start_character":43,"end_line":663,"end_character":69},"updated":"2017-01-19 13:00:50.000000000","message":"will be given* ?","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":660,"context_line":"The ``remote`` section of the mapping is relatively straight-forward. The main"},{"line_number":661,"context_line":"difference between this mapping and the other examples is the addition of a"},{"line_number":662,"context_line":"``projects`` section within the ``local`` rules. The ``projects`` list supplies"},{"line_number":663,"context_line":"a list of projects that the federated user should have some level of access to."},{"line_number":664,"context_line":"This is achieved when a user has successfully authenticated and the mapping"},{"line_number":665,"context_line":"engine has applied values from the assertion and mapped them into the ``local``"},{"line_number":666,"context_line":"rules. In the above example, we can see that after a valid SAML assertion has"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_f45552c6","line":663,"in_reply_to":"5a3905b3_fa870210","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":661,"context_line":"difference between this mapping and the other examples is the addition of a"},{"line_number":662,"context_line":"``projects`` section within the ``local`` rules. The ``projects`` list supplies"},{"line_number":663,"context_line":"a list of projects that the federated user should have some level of access to."},{"line_number":664,"context_line":"This is achieved when a user has successfully authenticated and the mapping"},{"line_number":665,"context_line":"engine has applied values from the assertion and mapped them into the ``local``"},{"line_number":666,"context_line":"rules. In the above example, we can see that after a valid SAML assertion has"},{"line_number":667,"context_line":"proved a user\u0027s identity, they will be granted the ``observer`` role on the"},{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_5a87360f","line":666,"range":{"start_line":664,"start_character":0,"end_line":666,"end_character":7},"updated":"2017-01-19 13:00:50.000000000","message":"remove this, it happens for literally any mapping","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":663,"context_line":"a list of projects that the federated user should have some level of access to."},{"line_number":664,"context_line":"This is achieved when a user has successfully authenticated and the mapping"},{"line_number":665,"context_line":"engine has applied values from the assertion and mapped them into the ``local``"},{"line_number":666,"context_line":"rules. In the above example, we can see that after a valid SAML assertion has"},{"line_number":667,"context_line":"proved a user\u0027s identity, they will be granted the ``observer`` role on the"},{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_f4f1d2ce","line":666,"in_reply_to":"5a3905b3_5a87360f","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":663,"context_line":"a list of projects that the federated user should have some level of access to."},{"line_number":664,"context_line":"This is achieved when a user has successfully authenticated and the mapping"},{"line_number":665,"context_line":"engine has applied values from the assertion and mapped them into the ``local``"},{"line_number":666,"context_line":"rules. In the above example, we can see that after a valid SAML assertion has"},{"line_number":667,"context_line":"proved a user\u0027s identity, they will be granted the ``observer`` role on the"},{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_baad7a8a","line":667,"range":{"start_line":666,"start_character":29,"end_line":667,"end_character":35},"updated":"2017-01-19 13:00:50.000000000","message":"remove this with \"an authenticated federated user\"","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":664,"context_line":"This is achieved when a user has successfully authenticated and the mapping"},{"line_number":665,"context_line":"engine has applied values from the assertion and mapped them into the ``local``"},{"line_number":666,"context_line":"rules. In the above example, we can see that after a valid SAML assertion has"},{"line_number":667,"context_line":"proved a user\u0027s identity, they will be granted the ``observer`` role on the"},{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_d4a05693","line":667,"in_reply_to":"5a3905b3_baad7a8a","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":665,"context_line":"engine has applied values from the assertion and mapped them into the ``local``"},{"line_number":666,"context_line":"rules. In the above example, we can see that after a valid SAML assertion has"},{"line_number":667,"context_line":"proved a user\u0027s identity, they will be granted the ``observer`` role on the"},{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"It is important to note that the follow constraints apply to auto-provisioning"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_5ab576cb","line":668,"range":{"start_line":668,"start_character":24,"end_line":668,"end_character":34},"updated":"2017-01-19 13:00:50.000000000","message":"``member`` role*","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":665,"context_line":"engine has applied values from the assertion and mapped them into the ``local``"},{"line_number":666,"context_line":"rules. In the above example, we can see that after a valid SAML assertion has"},{"line_number":667,"context_line":"proved a user\u0027s identity, they will be granted the ``observer`` role on the"},{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"It is important to note that the follow constraints apply to auto-provisioning"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_f4ad5289","line":668,"in_reply_to":"5a3905b3_5ab576cb","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":666,"context_line":"rules. In the above example, we can see that after a valid SAML assertion has"},{"line_number":667,"context_line":"proved a user\u0027s identity, they will be granted the ``observer`` role on the"},{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"It is important to note that the follow constraints apply to auto-provisioning"},{"line_number":672,"context_line":"using a mapping:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_bac49a40","line":669,"range":{"start_line":669,"start_character":15,"end_line":669,"end_character":25},"updated":"2017-01-19 13:00:50.000000000","message":"s/privileges/role","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":666,"context_line":"rules. In the above example, we can see that after a valid SAML assertion has"},{"line_number":667,"context_line":"proved a user\u0027s identity, they will be granted the ``observer`` role on the"},{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"It is important to note that the follow constraints apply to auto-provisioning"},{"line_number":672,"context_line":"using a mapping:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_74b082de","line":669,"in_reply_to":"5a3905b3_bac49a40","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"It is important to note that the follow constraints apply to auto-provisioning"},{"line_number":672,"context_line":"using a mapping:"},{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_7ad152fb","line":671,"range":{"start_line":671,"start_character":33,"end_line":671,"end_character":39},"updated":"2017-01-19 13:00:50.000000000","message":"following*","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"It is important to note that the follow constraints apply to auto-provisioning"},{"line_number":672,"context_line":"using a mapping:"},{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_badbba1a","line":671,"range":{"start_line":671,"start_character":58,"end_line":671,"end_character":60},"updated":"2017-01-19 13:00:50.000000000","message":"when*","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"It is important to note that the follow constraints apply to auto-provisioning"},{"line_number":672,"context_line":"using a mapping:"},{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_f44e32c0","line":671,"in_reply_to":"5a3905b3_7ad152fb","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":668,"context_line":"``Production`` project, ``member`` on the ``Staging`` project, and they will"},{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"It is important to note that the follow constraints apply to auto-provisioning"},{"line_number":672,"context_line":"using a mapping:"},{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_d4513664","line":671,"in_reply_to":"5a3905b3_badbba1a","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"It is important to note that the follow constraints apply to auto-provisioning"},{"line_number":672,"context_line":"using a mapping:"},{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."},{"line_number":675,"context_line":"* Projects will be created within the domain of the Identity Provider."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_fa038274","line":672,"range":{"start_line":672,"start_character":0,"end_line":672,"end_character":15},"updated":"2017-01-19 13:00:50.000000000","message":"remove","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":669,"context_line":"have ``admin`` privileges on the ``Project for jsmith``."},{"line_number":670,"context_line":""},{"line_number":671,"context_line":"It is important to note that the follow constraints apply to auto-provisioning"},{"line_number":672,"context_line":"using a mapping:"},{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."},{"line_number":675,"context_line":"* Projects will be created within the domain of the Identity Provider."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_f4e552a8","line":672,"in_reply_to":"5a3905b3_fa038274","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":672,"context_line":"using a mapping:"},{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."},{"line_number":675,"context_line":"* Projects will be created within the domain of the Identity Provider."},{"line_number":676,"context_line":"* Projects defined in the mapping must also contain roles."},{"line_number":677,"context_line":"* Roles within the project must already exist in the deployment or domain."},{"line_number":678,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_9af51e85","line":675,"range":{"start_line":675,"start_character":45,"end_line":675,"end_character":51},"updated":"2017-01-19 13:00:50.000000000","message":"associated with the*","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":672,"context_line":"using a mapping:"},{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."},{"line_number":675,"context_line":"* Projects will be created within the domain of the Identity Provider."},{"line_number":676,"context_line":"* Projects defined in the mapping must also contain roles."},{"line_number":677,"context_line":"* Roles within the project must already exist in the deployment or domain."},{"line_number":678,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_1491fef0","line":675,"in_reply_to":"5a3905b3_9af51e85","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."},{"line_number":675,"context_line":"* Projects will be created within the domain of the Identity Provider."},{"line_number":676,"context_line":"* Projects defined in the mapping must also contain roles."},{"line_number":677,"context_line":"* Roles within the project must already exist in the deployment or domain."},{"line_number":678,"context_line":""},{"line_number":679,"context_line":"Since the creation of roles typically requires policy changes across other"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_1a7e8ee4","line":676,"range":{"start_line":676,"start_character":2,"end_line":676,"end_character":10},"updated":"2017-01-19 13:00:50.000000000","message":"* The ``projects`` section in the mapping must also contain a ``roles`` section","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":673,"context_line":""},{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."},{"line_number":675,"context_line":"* Projects will be created within the domain of the Identity Provider."},{"line_number":676,"context_line":"* Projects defined in the mapping must also contain roles."},{"line_number":677,"context_line":"* Roles within the project must already exist in the deployment or domain."},{"line_number":678,"context_line":""},{"line_number":679,"context_line":"Since the creation of roles typically requires policy changes across other"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_d4093633","line":676,"in_reply_to":"5a3905b3_1a7e8ee4","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."},{"line_number":675,"context_line":"* Projects will be created within the domain of the Identity Provider."},{"line_number":676,"context_line":"* Projects defined in the mapping must also contain roles."},{"line_number":677,"context_line":"* Roles within the project must already exist in the deployment or domain."},{"line_number":678,"context_line":""},{"line_number":679,"context_line":"Since the creation of roles typically requires policy changes across other"},{"line_number":680,"context_line":"services in the deployment, it is expected that roles are created ahead of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_1accce34","line":677,"range":{"start_line":677,"start_character":2,"end_line":677,"end_character":73},"updated":"2017-01-19 13:00:50.000000000","message":"make this a sub bullet of the first one, and re-write as:\n\n  * The roles defined here must already exist in the deployment","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":674,"context_line":"* Projects are the only resource that will be created dynamically."},{"line_number":675,"context_line":"* Projects will be created within the domain of the Identity Provider."},{"line_number":676,"context_line":"* Projects defined in the mapping must also contain roles."},{"line_number":677,"context_line":"* Roles within the project must already exist in the deployment or domain."},{"line_number":678,"context_line":""},{"line_number":679,"context_line":"Since the creation of roles typically requires policy changes across other"},{"line_number":680,"context_line":"services in the deployment, it is expected that roles are created ahead of"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_d793f8a1","line":677,"in_reply_to":"5a3905b3_1accce34","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":683,"context_line":"if the user\u0027s name is still ``jsmith``, then no new projects will be"},{"line_number":684,"context_line":"created as a result of authentication."},{"line_number":685,"context_line":""},{"line_number":686,"context_line":"The mapping shown in the example above doesn\u0027t contain any ``groups`` in the"},{"line_number":687,"context_line":"``local`` rules. This will result in the federated user having direct role"},{"line_number":688,"context_line":"assignments on the projects in the ``projects`` list. The ability to use"},{"line_number":689,"context_line":"``groups`` in addition to ``projects`` can be used to mix direct assignments"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_3a9fca04","line":686,"range":{"start_line":686,"start_character":39,"end_line":686,"end_character":69},"updated":"2017-01-19 13:00:50.000000000","message":"does not contain a ``groups`` section","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":683,"context_line":"if the user\u0027s name is still ``jsmith``, then no new projects will be"},{"line_number":684,"context_line":"created as a result of authentication."},{"line_number":685,"context_line":""},{"line_number":686,"context_line":"The mapping shown in the example above doesn\u0027t contain any ``groups`` in the"},{"line_number":687,"context_line":"``local`` rules. This will result in the federated user having direct role"},{"line_number":688,"context_line":"assignments on the projects in the ``projects`` list. The ability to use"},{"line_number":689,"context_line":"``groups`` in addition to ``projects`` can be used to mix direct assignments"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_d7485830","line":686,"in_reply_to":"5a3905b3_3a9fca04","updated":"2017-01-19 14:52:55.000000000","message":"Done","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":684,"context_line":"created as a result of authentication."},{"line_number":685,"context_line":""},{"line_number":686,"context_line":"The mapping shown in the example above doesn\u0027t contain any ``groups`` in the"},{"line_number":687,"context_line":"``local`` rules. This will result in the federated user having direct role"},{"line_number":688,"context_line":"assignments on the projects in the ``projects`` list. The ability to use"},{"line_number":689,"context_line":"``groups`` in addition to ``projects`` can be used to mix direct assignments"},{"line_number":690,"context_line":"and group memberships. Consider the following example:"},{"line_number":691,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_7a5eb246","line":688,"range":{"start_line":687,"start_character":17,"end_line":688,"end_character":53},"updated":"2017-01-19 13:00:50.000000000","message":"this sentence seems out of place, bring it back to the first paragraph after the first mapping, or in your bullet list after the first mapping","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":685,"context_line":""},{"line_number":686,"context_line":"The mapping shown in the example above doesn\u0027t contain any ``groups`` in the"},{"line_number":687,"context_line":"``local`` rules. This will result in the federated user having direct role"},{"line_number":688,"context_line":"assignments on the projects in the ``projects`` list. The ability to use"},{"line_number":689,"context_line":"``groups`` in addition to ``projects`` can be used to mix direct assignments"},{"line_number":690,"context_line":"and group memberships. Consider the following example:"},{"line_number":691,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_374a7c84","line":688,"in_reply_to":"5a3905b3_7a5eb246","updated":"2017-01-19 14:52:55.000000000","message":"I reworked this a bit - let me know what you think.","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"858c90fd809ec51bc925f4a6add6cac65f375943","unresolved":false,"context_lines":[{"line_number":685,"context_line":""},{"line_number":686,"context_line":"The mapping shown in the example above doesn\u0027t contain any ``groups`` in the"},{"line_number":687,"context_line":"``local`` rules. This will result in the federated user having direct role"},{"line_number":688,"context_line":"assignments on the projects in the ``projects`` list. The ability to use"},{"line_number":689,"context_line":"``groups`` in addition to ``projects`` can be used to mix direct assignments"},{"line_number":690,"context_line":"and group memberships. Consider the following example:"},{"line_number":691,"context_line":""},{"line_number":692,"context_line":".. code-block:: javascript"},{"line_number":693,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_ba2f3aa0","line":690,"range":{"start_line":688,"start_character":54,"end_line":690,"end_character":22},"updated":"2017-01-19 13:00:50.000000000","message":"did we have a test for this?","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"ee3f100677471b18b0652fcfb99823accc891a79","unresolved":false,"context_lines":[{"line_number":687,"context_line":"``local`` rules. This will result in the federated user having direct role"},{"line_number":688,"context_line":"assignments on the projects in the ``projects`` list. The ability to use"},{"line_number":689,"context_line":"``groups`` in addition to ``projects`` can be used to mix direct assignments"},{"line_number":690,"context_line":"and group memberships. Consider the following example:"},{"line_number":691,"context_line":""},{"line_number":692,"context_line":".. code-block:: javascript"},{"line_number":693,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5a3905b3_177f40ab","line":690,"in_reply_to":"5a3905b3_ba2f3aa0","updated":"2017-01-19 14:52:55.000000000","message":"Yep, it\u0027s the last test case in the previous patch. \n\nhttps://review.openstack.org/#/c/415895/15/keystone/tests/unit/test_v3_federation.py","commit_id":"c85374dc9beef643a0e306f694cb2486b4d2e47e"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"219dc05fbfc25d849956da2e70db44eb93e13ab6","unresolved":false,"context_lines":[{"line_number":603,"context_line":""},{"line_number":604,"context_line":"The mapping engine has the ability to aid in the auto-provisioning of resources"},{"line_number":605,"context_line":"when a federated user authenticates for the first time. This can be achieved"},{"line_number":606,"context_line":"using a specific mapping syntax that the mapping engine can parse and"},{"line_number":607,"context_line":"ultimately make decisions on."},{"line_number":608,"context_line":""},{"line_number":609,"context_line":"For example, consider the following mapping:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_1fd3ca39","line":606,"updated":"2017-01-19 18:46:48.000000000","message":"(nit) not sure i like the word syntax here because the syntax is still json. we\u0027re really just adding new content to the json document","commit_id":"ca5117778e3011eaf1ab4ae95b6754ce6220ebf8"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"219dc05fbfc25d849956da2e70db44eb93e13ab6","unresolved":false,"context_lines":[{"line_number":657,"context_line":"        ]"},{"line_number":658,"context_line":"    }"},{"line_number":659,"context_line":""},{"line_number":660,"context_line":"The ``remote`` section of the mapping is relatively straight-forward. The main"},{"line_number":661,"context_line":"difference between this mapping and the other examples is the addition of a"},{"line_number":662,"context_line":"``projects`` section within the ``local`` rules. The ``projects`` list supplies"},{"line_number":663,"context_line":"a list of projects that the federated user will be given access to. This is"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_7fb04ef5","line":660,"updated":"2017-01-19 18:46:48.000000000","message":"(nit) maybe say that the remote section semantics have not changed.","commit_id":"ca5117778e3011eaf1ab4ae95b6754ce6220ebf8"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"219dc05fbfc25d849956da2e70db44eb93e13ab6","unresolved":false,"context_lines":[{"line_number":660,"context_line":"The ``remote`` section of the mapping is relatively straight-forward. The main"},{"line_number":661,"context_line":"difference between this mapping and the other examples is the addition of a"},{"line_number":662,"context_line":"``projects`` section within the ``local`` rules. The ``projects`` list supplies"},{"line_number":663,"context_line":"a list of projects that the federated user will be given access to. This is"},{"line_number":664,"context_line":"achieved when a user has successfully authenticated and the mapping engine has"},{"line_number":665,"context_line":"applied values from the assertion and mapped them into the ``local`` rules. In"},{"line_number":666,"context_line":"the above example, an authenticated federated user will be granted the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_1f12eab4","line":663,"updated":"2017-01-19 18:46:48.000000000","message":"What is achieved?","commit_id":"ca5117778e3011eaf1ab4ae95b6754ce6220ebf8"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"8632fc3f8876a71fb0da85cbd265aadda15a6e22","unresolved":false,"context_lines":[{"line_number":674,"context_line":"* Projects will be created within the domain associated with the Identity"},{"line_number":675,"context_line":"  Provider."},{"line_number":676,"context_line":"* The ``projects`` section of the mapping must also contain a ``roles``"},{"line_number":677,"context_line":"  section."},{"line_number":678,"context_line":"  + Roles within the project must already exist in the deployment or domain."},{"line_number":679,"context_line":""},{"line_number":680,"context_line":"Since the creation of roles typically requires policy changes across other"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_451bc01b","line":677,"updated":"2017-01-19 18:55:21.000000000","message":"Also I forgot to mention that this is not going to make \u0027Roles...\u0027 a sub-list. I\u0027ll also fix that on the next patch.","commit_id":"ca5117778e3011eaf1ab4ae95b6754ce6220ebf8"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"219dc05fbfc25d849956da2e70db44eb93e13ab6","unresolved":false,"context_lines":[{"line_number":743,"context_line":"In the above example, a federated user will receive direct role assignments on"},{"line_number":744,"context_line":"the ``Marketing`` project, as well as a dedicated project specific to the"},{"line_number":745,"context_line":"federated user\u0027s name. In addition to that, they will also be placed in the"},{"line_number":746,"context_line":"``Finance`` group and receive all role assignments that group has on projects"},{"line_number":747,"context_line":"and domains."},{"line_number":748,"context_line":""},{"line_number":749,"context_line":"Keystone to Keystone"}],"source_content_type":"text/x-rst","patch_set":5,"id":"5a3905b3_c23b26ea","line":746,"updated":"2017-01-19 18:46:48.000000000","message":"It would be nice to call out the fact that the group membership is ephemeral.","commit_id":"ca5117778e3011eaf1ab4ae95b6754ce6220ebf8"}]}