)]}'
{"doc/source/federation/mapping_combinations.rst":[{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"13592f5d339bc86993dd3e770f2546a247350b85","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Description"},{"line_number":21,"context_line":"-----------"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"During the authentication process and IdP will present keystone with a set of user"},{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_2374fe33","line":23,"range":{"start_line":23,"start_character":34,"end_line":23,"end_character":37},"updated":"2017-02-03 18:42:49.000000000","message":"an","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"52c771aee8bd83fab1d2416961e700efdbef3ccc","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Description"},{"line_number":21,"context_line":"-----------"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"During the authentication process and IdP will present keystone with a set of user"},{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_a30e2e32","line":23,"updated":"2017-02-03 20:42:22.000000000","message":"an*","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"ce4fa0631fded7e5b0eb3772f4f5fdf01d4868bf","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Description"},{"line_number":21,"context_line":"-----------"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"During the authentication process and IdP will present keystone with a set of user"},{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_bbf56e84","line":23,"in_reply_to":"1a430d35_2374fe33","updated":"2017-02-03 20:32:48.000000000","message":"Done","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"07b831c34c1725e13c4d573c84535a3f9550aa71","unresolved":false,"context_lines":[{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"keystone does not directly deal with the federated attributes in the flow. Instead"},{"line_number":28,"context_line":"it expects third-party software to handle the federated authentication flow and"},{"line_number":29,"context_line":"present the federated attributes as environment variables. This is how the"},{"line_number":30,"context_line":"`Shibboleth` and `Mellon` implementations work."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_3e9b31cb","line":27,"range":{"start_line":27,"start_character":0,"end_line":27,"end_character":8},"updated":"2017-02-03 18:56:08.000000000","message":"Keystone","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"aae5336f0d576dcb0bdcfeefd2375d3cbc6c648b","unresolved":false,"context_lines":[{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"keystone does not directly deal with the federated attributes in the flow. Instead"},{"line_number":28,"context_line":"it expects third-party software to handle the federated authentication flow and"},{"line_number":29,"context_line":"present the federated attributes as environment variables. This is how the"},{"line_number":30,"context_line":"`Shibboleth` and `Mellon` implementations work."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_6e87c60f","line":27,"in_reply_to":"1a430d35_3b65fe44","updated":"2017-02-03 20:54:44.000000000","message":"Yeah, I would vote for capital, but understand the reasoning.","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"ce4fa0631fded7e5b0eb3772f4f5fdf01d4868bf","unresolved":false,"context_lines":[{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"keystone does not directly deal with the federated attributes in the flow. Instead"},{"line_number":28,"context_line":"it expects third-party software to handle the federated authentication flow and"},{"line_number":29,"context_line":"present the federated attributes as environment variables. This is how the"},{"line_number":30,"context_line":"`Shibboleth` and `Mellon` implementations work."}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_3b65fe44","line":27,"in_reply_to":"1a430d35_3e9b31cb","updated":"2017-02-03 20:32:48.000000000","message":"I was treating \u0027keystone\u0027 as the project name since we longer officially title case it. There is differing opinions on if it\u0027s the first work in a sentence. I typically go with the iPhone approach...it\u0027s the name so the case always stays. I\u0027ll change this is other disagree or if there is some official rule (I could not find one in the past)","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"52c771aee8bd83fab1d2416961e700efdbef3ccc","unresolved":false,"context_lines":[{"line_number":52,"context_line":"                    {"},{"line_number":53,"context_line":"                        \u003cuser\u003e"},{"line_number":54,"context_line":"                        [\u003cgroup\u003e]"},{"line_number":55,"context_line":" \t\t\t[\u003cproject\u003e]"},{"line_number":56,"context_line":"                    }"},{"line_number":57,"context_line":"                ],"},{"line_number":58,"context_line":"                \"remote\": ["}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_034c626f","line":55,"updated":"2017-02-03 20:42:22.000000000","message":"tabs?","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"068629c8c8360ed715425e6eab42e0950e944d24","unresolved":false,"context_lines":[{"line_number":52,"context_line":"                    {"},{"line_number":53,"context_line":"                        \u003cuser\u003e"},{"line_number":54,"context_line":"                        [\u003cgroup\u003e]"},{"line_number":55,"context_line":" \t\t\t[\u003cproject\u003e]"},{"line_number":56,"context_line":"                    }"},{"line_number":57,"context_line":"                ],"},{"line_number":58,"context_line":"                \"remote\": ["}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_0eb642dc","line":55,"in_reply_to":"1a430d35_034c626f","updated":"2017-02-03 20:54:36.000000000","message":"Fixed. copy-n-paste fail","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"52c771aee8bd83fab1d2416961e700efdbef3ccc","unresolved":false,"context_lines":[{"line_number":70,"context_line":"* `rule`: a JSON object containing `local` and `remote` properties to define"},{"line_number":71,"context_line":"  the rule. There is no explicit `rule` property."},{"line_number":72,"context_line":"* `local`: a JSON object containing information on what local attributes will"},{"line_number":73,"context_line":"  be mapped. The mapping engines processes this using the `context` (defined"},{"line_number":74,"context_line":"  below) and the result is a representation of the user from keystone\u0027s"},{"line_number":75,"context_line":"  perspective."},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_439bcac9","line":73,"updated":"2017-02-03 20:42:22.000000000","message":"engine*?","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"13592f5d339bc86993dd3e770f2546a247350b85","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* `remote`: a JSON object containing information on what remote attributes will be mapped."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"  * `\u003cmatch\u003e`: a JSON object that tell the mapping engine what federated attribute"},{"line_number":84,"context_line":"    to make available for substitution in the local object. There can be one or more"},{"line_number":85,"context_line":"    of these objects in the `remote` list."},{"line_number":86,"context_line":"  * `\u003ccondition\u003e`: a JSON object containing conditions that allow a rule. There can be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_e33cb631","line":83,"range":{"start_line":83,"start_character":34,"end_line":83,"end_character":38},"updated":"2017-02-03 18:42:49.000000000","message":"tells","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"52c771aee8bd83fab1d2416961e700efdbef3ccc","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* `remote`: a JSON object containing information on what remote attributes will be mapped."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"  * `\u003cmatch\u003e`: a JSON object that tell the mapping engine what federated attribute"},{"line_number":84,"context_line":"    to make available for substitution in the local object. There can be one or more"},{"line_number":85,"context_line":"    of these objects in the `remote` list."},{"line_number":86,"context_line":"  * `\u003ccondition\u003e`: a JSON object containing conditions that allow a rule. There can be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_0391c299","line":83,"updated":"2017-02-03 20:42:22.000000000","message":"that tells*?","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"068629c8c8360ed715425e6eab42e0950e944d24","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* `remote`: a JSON object containing information on what remote attributes will be mapped."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"  * `\u003cmatch\u003e`: a JSON object that tell the mapping engine what federated attribute"},{"line_number":84,"context_line":"    to make available for substitution in the local object. There can be one or more"},{"line_number":85,"context_line":"    of these objects in the `remote` list."},{"line_number":86,"context_line":"  * `\u003ccondition\u003e`: a JSON object containing conditions that allow a rule. There can be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_2ebbfec5","line":83,"in_reply_to":"1a430d35_0391c299","updated":"2017-02-03 20:54:36.000000000","message":"Done","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"ce4fa0631fded7e5b0eb3772f4f5fdf01d4868bf","unresolved":false,"context_lines":[{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* `remote`: a JSON object containing information on what remote attributes will be mapped."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"  * `\u003cmatch\u003e`: a JSON object that tell the mapping engine what federated attribute"},{"line_number":84,"context_line":"    to make available for substitution in the local object. There can be one or more"},{"line_number":85,"context_line":"    of these objects in the `remote` list."},{"line_number":86,"context_line":"  * `\u003ccondition\u003e`: a JSON object containing conditions that allow a rule. There can be"}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_bb51ee64","line":83,"in_reply_to":"1a430d35_e33cb631","updated":"2017-02-03 20:32:48.000000000","message":"Done","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"07b831c34c1725e13c4d573c84535a3f9550aa71","unresolved":false,"context_lines":[{"line_number":101,"context_line":"How Mappings Are Processed"},{"line_number":102,"context_line":"--------------------------"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"A mapping is selected by IdP and protocol. We take this mapping and process each"},{"line_number":105,"context_line":"rule sequentially stopping after the first matched rule. A rule is matched when"},{"line_number":106,"context_line":"all of its conditions are met."},{"line_number":107,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_febe09fe","line":104,"range":{"start_line":104,"start_character":43,"end_line":104,"end_character":45},"updated":"2017-02-03 18:56:08.000000000","message":"Probably better to use Keystone than \"We\"","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"ce4fa0631fded7e5b0eb3772f4f5fdf01d4868bf","unresolved":false,"context_lines":[{"line_number":101,"context_line":"How Mappings Are Processed"},{"line_number":102,"context_line":"--------------------------"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"A mapping is selected by IdP and protocol. We take this mapping and process each"},{"line_number":105,"context_line":"rule sequentially stopping after the first matched rule. A rule is matched when"},{"line_number":106,"context_line":"all of its conditions are met."},{"line_number":107,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_1bc76213","line":104,"in_reply_to":"1a430d35_febe09fe","updated":"2017-02-03 20:32:48.000000000","message":"Done","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"07b831c34c1725e13c4d573c84535a3f9550aa71","unresolved":false,"context_lines":[{"line_number":187,"context_line":"    $ keystone-manage mapping_engine --rules \u003cfile\u003e --input \u003cfile\u003e"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":".. NOTE::"},{"line_number":190,"context_line":"    Although the rules file are formated as JSON the input file of assertion"},{"line_number":191,"context_line":"    data is formatted as individual lines of key: value pairs, see"},{"line_number":192,"context_line":"    `keystone-manage mapping_engine --help` for details."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_def6add6","line":190,"range":{"start_line":190,"start_character":28,"end_line":190,"end_character":31},"updated":"2017-02-03 18:56:08.000000000","message":"\"is\" was correct.  file is singular","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"07b831c34c1725e13c4d573c84535a3f9550aa71","unresolved":false,"context_lines":[{"line_number":187,"context_line":"    $ keystone-manage mapping_engine --rules \u003cfile\u003e --input \u003cfile\u003e"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":".. NOTE::"},{"line_number":190,"context_line":"    Although the rules file are formated as JSON the input file of assertion"},{"line_number":191,"context_line":"    data is formatted as individual lines of key: value pairs, see"},{"line_number":192,"context_line":"    `keystone-manage mapping_engine --help` for details."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_1e18351d","line":190,"range":{"start_line":190,"start_character":44,"end_line":190,"end_character":48},"updated":"2017-02-03 18:56:08.000000000","message":"JSON,","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"ce4fa0631fded7e5b0eb3772f4f5fdf01d4868bf","unresolved":false,"context_lines":[{"line_number":187,"context_line":"    $ keystone-manage mapping_engine --rules \u003cfile\u003e --input \u003cfile\u003e"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":".. NOTE::"},{"line_number":190,"context_line":"    Although the rules file are formated as JSON the input file of assertion"},{"line_number":191,"context_line":"    data is formatted as individual lines of key: value pairs, see"},{"line_number":192,"context_line":"    `keystone-manage mapping_engine --help` for details."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_3bf33e75","line":190,"in_reply_to":"1a430d35_1e18351d","updated":"2017-02-03 20:32:48.000000000","message":"Done","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"ce4fa0631fded7e5b0eb3772f4f5fdf01d4868bf","unresolved":false,"context_lines":[{"line_number":187,"context_line":"    $ keystone-manage mapping_engine --rules \u003cfile\u003e --input \u003cfile\u003e"},{"line_number":188,"context_line":""},{"line_number":189,"context_line":".. NOTE::"},{"line_number":190,"context_line":"    Although the rules file are formated as JSON the input file of assertion"},{"line_number":191,"context_line":"    data is formatted as individual lines of key: value pairs, see"},{"line_number":192,"context_line":"    `keystone-manage mapping_engine --help` for details."},{"line_number":193,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"1a430d35_3b9a5e15","line":190,"in_reply_to":"1a430d35_def6add6","updated":"2017-02-03 20:32:48.000000000","message":"Done. I rephrased this in a prior version, but backed off and accidentally left this in.","commit_id":"6f892f2cddeb40c0130037d5cb4f1c099bda202a"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9384fcbf8f18403399a77b8a8d3348b57b824c15","unresolved":false,"context_lines":[{"line_number":105,"context_line":"process each rule sequentially stopping after the first matched rule. A rule"},{"line_number":106,"context_line":"is matched when all of its conditions are met."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"First we evaluate each condition from the rule\u0027s remote property to see if the"},{"line_number":109,"context_line":"rule is a match. If it is a match we save the data captured by each of the"},{"line_number":110,"context_line":"matches from the rule\u0027s remote property in an ordered list. We call these"},{"line_number":111,"context_line":"matches `direct mappings` since they can be used in the next step."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a430d35_2e94de35","line":108,"range":{"start_line":108,"start_character":6,"end_line":108,"end_character":8},"updated":"2017-02-03 20:54:37.000000000","message":"Sorry more uses of \"we\"","commit_id":"7367307d69fd46c5ef72aef464c4b54c8cda15f7"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"11a1504169a63bb72184dd9e7f74ee160f219997","unresolved":false,"context_lines":[{"line_number":105,"context_line":"process each rule sequentially stopping after the first matched rule. A rule"},{"line_number":106,"context_line":"is matched when all of its conditions are met."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"First we evaluate each condition from the rule\u0027s remote property to see if the"},{"line_number":109,"context_line":"rule is a match. If it is a match we save the data captured by each of the"},{"line_number":110,"context_line":"matches from the rule\u0027s remote property in an ordered list. We call these"},{"line_number":111,"context_line":"matches `direct mappings` since they can be used in the next step."}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a430d35_4e6daa03","line":108,"in_reply_to":"1a430d35_2e94de35","updated":"2017-02-03 21:08:25.000000000","message":"Done","commit_id":"7367307d69fd46c5ef72aef464c4b54c8cda15f7"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9384fcbf8f18403399a77b8a8d3348b57b824c15","unresolved":false,"context_lines":[{"line_number":106,"context_line":"is matched when all of its conditions are met."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"First we evaluate each condition from the rule\u0027s remote property to see if the"},{"line_number":109,"context_line":"rule is a match. If it is a match we save the data captured by each of the"},{"line_number":110,"context_line":"matches from the rule\u0027s remote property in an ordered list. We call these"},{"line_number":111,"context_line":"matches `direct mappings` since they can be used in the next step."},{"line_number":112,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a430d35_4e992a6e","line":109,"range":{"start_line":109,"start_character":34,"end_line":109,"end_character":36},"updated":"2017-02-03 20:54:37.000000000","message":"Sorry more uses of \"we\"","commit_id":"7367307d69fd46c5ef72aef464c4b54c8cda15f7"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"11a1504169a63bb72184dd9e7f74ee160f219997","unresolved":false,"context_lines":[{"line_number":106,"context_line":"is matched when all of its conditions are met."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"First we evaluate each condition from the rule\u0027s remote property to see if the"},{"line_number":109,"context_line":"rule is a match. If it is a match we save the data captured by each of the"},{"line_number":110,"context_line":"matches from the rule\u0027s remote property in an ordered list. We call these"},{"line_number":111,"context_line":"matches `direct mappings` since they can be used in the next step."},{"line_number":112,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a430d35_6e7266e7","line":109,"in_reply_to":"1a430d35_4e992a6e","updated":"2017-02-03 21:08:25.000000000","message":"Done","commit_id":"7367307d69fd46c5ef72aef464c4b54c8cda15f7"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9384fcbf8f18403399a77b8a8d3348b57b824c15","unresolved":false,"context_lines":[{"line_number":107,"context_line":""},{"line_number":108,"context_line":"First we evaluate each condition from the rule\u0027s remote property to see if the"},{"line_number":109,"context_line":"rule is a match. If it is a match we save the data captured by each of the"},{"line_number":110,"context_line":"matches from the rule\u0027s remote property in an ordered list. We call these"},{"line_number":111,"context_line":"matches `direct mappings` since they can be used in the next step."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"After the rule is found using the rule\u0027s conditions and a list of direct mappings is"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a430d35_8ea3129e","line":110,"range":{"start_line":110,"start_character":60,"end_line":110,"end_character":62},"updated":"2017-02-03 20:54:37.000000000","message":"Sorry more uses of \"we\"","commit_id":"7367307d69fd46c5ef72aef464c4b54c8cda15f7"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"11a1504169a63bb72184dd9e7f74ee160f219997","unresolved":false,"context_lines":[{"line_number":107,"context_line":""},{"line_number":108,"context_line":"First we evaluate each condition from the rule\u0027s remote property to see if the"},{"line_number":109,"context_line":"rule is a match. If it is a match we save the data captured by each of the"},{"line_number":110,"context_line":"matches from the rule\u0027s remote property in an ordered list. We call these"},{"line_number":111,"context_line":"matches `direct mappings` since they can be used in the next step."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"After the rule is found using the rule\u0027s conditions and a list of direct mappings is"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a430d35_8e7792d3","line":110,"in_reply_to":"1a430d35_8ea3129e","updated":"2017-02-03 21:08:25.000000000","message":"Done","commit_id":"7367307d69fd46c5ef72aef464c4b54c8cda15f7"},{"author":{"_account_id":8119,"name":"Eric Brown","email":"eric_wade_brown@yahoo.com","username":"ericwb"},"change_message_id":"9384fcbf8f18403399a77b8a8d3348b57b824c15","unresolved":false,"context_lines":[{"line_number":111,"context_line":"matches `direct mappings` since they can be used in the next step."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"After the rule is found using the rule\u0027s conditions and a list of direct mappings is"},{"line_number":114,"context_line":"stored, we begin processing the rule\u0027s `local` property. Each object in the `local`"},{"line_number":115,"context_line":"property is collapsed into a single JSON object. For example:"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a430d35_aea0ce91","line":114,"range":{"start_line":114,"start_character":8,"end_line":114,"end_character":10},"updated":"2017-02-03 20:54:37.000000000","message":"Sorry more uses of \"we\"","commit_id":"7367307d69fd46c5ef72aef464c4b54c8cda15f7"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"11a1504169a63bb72184dd9e7f74ee160f219997","unresolved":false,"context_lines":[{"line_number":111,"context_line":"matches `direct mappings` since they can be used in the next step."},{"line_number":112,"context_line":""},{"line_number":113,"context_line":"After the rule is found using the rule\u0027s conditions and a list of direct mappings is"},{"line_number":114,"context_line":"stored, we begin processing the rule\u0027s `local` property. Each object in the `local`"},{"line_number":115,"context_line":"property is collapsed into a single JSON object. For example:"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":".. code-block:: javascript"}],"source_content_type":"text/x-rst","patch_set":3,"id":"1a430d35_ae744ecf","line":114,"in_reply_to":"1a430d35_aea0ce91","updated":"2017-02-03 21:08:25.000000000","message":"Done","commit_id":"7367307d69fd46c5ef72aef464c4b54c8cda15f7"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"08b990d3304f5e499093f69ffa8e6a73336b6667","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Description"},{"line_number":21,"context_line":"-----------"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"During the authentication process an IdP will present keystone with a set of user"},{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_7321229f","line":23,"updated":"2017-02-06 22:09:50.000000000","message":"Is this the first use of `IdP` in the overall document? Does it need to be changed to `Identity Provider (IdP)`?","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"05eb2ffc5e53ba34977717824621206f4d963247","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Description"},{"line_number":21,"context_line":"-----------"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"During the authentication process an IdP will present keystone with a set of user"},{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_c2ca016e","line":23,"in_reply_to":"1a430d35_7321229f","updated":"2017-02-06 23:26:43.000000000","message":"++","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c9a9079050a19a0ee7136887e681405710e677d5","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Description"},{"line_number":21,"context_line":"-----------"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"During the authentication process an IdP will present keystone with a set of user"},{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_50f2c49b","line":23,"in_reply_to":"1a430d35_7321229f","updated":"2017-02-09 21:52:07.000000000","message":"Done","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"05eb2ffc5e53ba34977717824621206f4d963247","unresolved":false,"context_lines":[{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"keystone does not directly deal with the federated attributes in the flow. Instead"},{"line_number":28,"context_line":"it expects third-party software to handle the federated authentication flow and"},{"line_number":29,"context_line":"present the federated attributes as environment variables. This is how the"},{"line_number":30,"context_line":"`Shibboleth` and `Mellon` implementations work."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_22a2e5ae","line":27,"range":{"start_line":27,"start_character":0,"end_line":27,"end_character":1},"updated":"2017-02-06 23:26:43.000000000","message":"I think this should be capitalized since it\u0027s the beginning of a sentence?","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c9a9079050a19a0ee7136887e681405710e677d5","unresolved":false,"context_lines":[{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"keystone does not directly deal with the federated attributes in the flow. Instead"},{"line_number":28,"context_line":"it expects third-party software to handle the federated authentication flow and"},{"line_number":29,"context_line":"present the federated attributes as environment variables. This is how the"},{"line_number":30,"context_line":"`Shibboleth` and `Mellon` implementations work."}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_f039f842","line":27,"in_reply_to":"1a430d35_22a2e5ae","updated":"2017-02-09 21:52:07.000000000","message":"Did you see my prior comment about this?","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"e1f27cc40fb8a2377a0d620cf4e44e0d1862a07d","unresolved":false,"context_lines":[{"line_number":24,"context_line":"attributes about the user that is authenticating. For example, in the SAML2"},{"line_number":25,"context_line":"flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"keystone does not directly deal with the federated attributes in the flow. Instead"},{"line_number":28,"context_line":"it expects third-party software to handle the federated authentication flow and"},{"line_number":29,"context_line":"present the federated attributes as environment variables. This is how the"},{"line_number":30,"context_line":"`Shibboleth` and `Mellon` implementations work."}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_13dbf6ee","line":27,"in_reply_to":"fa31d9ce_f039f842","updated":"2017-02-09 22:17:49.000000000","message":"Yeah, I\u0027m fine with it either way. The \"rules\" seem a bit confusing with keeping it lowercase vs proper noun.","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"05eb2ffc5e53ba34977717824621206f4d963247","unresolved":false,"context_lines":[{"line_number":33,"context_line":"to a local keystone user. The mapping may also define group membership for"},{"line_number":34,"context_line":"that user and projects the user can access."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"An Identity Provider has exactly one mapping specified per protocol. Mappings"},{"line_number":37,"context_line":"themselves can be used multiple times by different combinations of Identity"},{"line_number":38,"context_line":"Provider and Protocol."},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_029c0968","line":36,"range":{"start_line":36,"start_character":3,"end_line":36,"end_character":20},"updated":"2017-02-06 23:26:43.000000000","message":"If we change the above mentioned IdP to \"Identity Provider\", we could abbreviate it here.","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c9a9079050a19a0ee7136887e681405710e677d5","unresolved":false,"context_lines":[{"line_number":33,"context_line":"to a local keystone user. The mapping may also define group membership for"},{"line_number":34,"context_line":"that user and projects the user can access."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"An Identity Provider has exactly one mapping specified per protocol. Mappings"},{"line_number":37,"context_line":"themselves can be used multiple times by different combinations of Identity"},{"line_number":38,"context_line":"Provider and Protocol."},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_90119cb2","line":36,"in_reply_to":"1a430d35_029c0968","updated":"2017-02-09 21:52:07.000000000","message":"Done","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"05eb2ffc5e53ba34977717824621206f4d963247","unresolved":false,"context_lines":[{"line_number":34,"context_line":"that user and projects the user can access."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"An Identity Provider has exactly one mapping specified per protocol. Mappings"},{"line_number":37,"context_line":"themselves can be used multiple times by different combinations of Identity"},{"line_number":38,"context_line":"Provider and Protocol."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"-----------"},{"line_number":41,"context_line":"Definitions"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_82863911","line":38,"range":{"start_line":37,"start_character":67,"end_line":38,"end_character":8},"updated":"2017-02-06 23:26:43.000000000","message":"Same here","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c9a9079050a19a0ee7136887e681405710e677d5","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"An Identity Provider has exactly one mapping specified per protocol. Mappings"},{"line_number":37,"context_line":"themselves can be used multiple times by different combinations of Identity"},{"line_number":38,"context_line":"Provider and Protocol."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"-----------"},{"line_number":41,"context_line":"Definitions"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_9078bcfa","line":38,"in_reply_to":"1a430d35_82863911","updated":"2017-02-09 21:52:07.000000000","message":"Done","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"08b990d3304f5e499093f69ffa8e6a73336b6667","unresolved":false,"context_lines":[{"line_number":75,"context_line":"  perspective."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"  * `\u003cuser\u003e`: the local user that will be mapped to the federated user."},{"line_number":78,"context_line":"  * `\u003cgroup\u003e`: (optional) the local groups mapped to the federated user."},{"line_number":79,"context_line":"  * `\u003cprojects\u003e`: (optional) the local projects mapped to the federated user."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* `remote`: a JSON object containing information on what remote attributes will be mapped."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_b3faaabb","line":78,"updated":"2017-02-06 22:09:50.000000000","message":"nit: the local groups the federated user will be placed in (?)","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c9a9079050a19a0ee7136887e681405710e677d5","unresolved":false,"context_lines":[{"line_number":75,"context_line":"  perspective."},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"  * `\u003cuser\u003e`: the local user that will be mapped to the federated user."},{"line_number":78,"context_line":"  * `\u003cgroup\u003e`: (optional) the local groups mapped to the federated user."},{"line_number":79,"context_line":"  * `\u003cprojects\u003e`: (optional) the local projects mapped to the federated user."},{"line_number":80,"context_line":""},{"line_number":81,"context_line":"* `remote`: a JSON object containing information on what remote attributes will be mapped."}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_50fc843e","line":78,"in_reply_to":"1a430d35_b3faaabb","updated":"2017-02-09 21:52:07.000000000","message":"Done","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"08b990d3304f5e499093f69ffa8e6a73336b6667","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    to make available for substitution in the local object. There can be one or more"},{"line_number":85,"context_line":"    of these objects in the `remote` list."},{"line_number":86,"context_line":"  * `\u003ccondition\u003e`: a JSON object containing conditions that allow a rule. There can be"},{"line_number":87,"context_line":"    zero or more of these object in the `remote` list."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* `direct mapping`: the mapping engine keeps track of each match and makes them"},{"line_number":90,"context_line":"  available to the local rule for substitution."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_332dda46","line":87,"updated":"2017-02-06 22:09:50.000000000","message":"objects*?","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"05eb2ffc5e53ba34977717824621206f4d963247","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    to make available for substitution in the local object. There can be one or more"},{"line_number":85,"context_line":"    of these objects in the `remote` list."},{"line_number":86,"context_line":"  * `\u003ccondition\u003e`: a JSON object containing conditions that allow a rule. There can be"},{"line_number":87,"context_line":"    zero or more of these object in the `remote` list."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* `direct mapping`: the mapping engine keeps track of each match and makes them"},{"line_number":90,"context_line":"  available to the local rule for substitution."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_82eb99af","line":87,"in_reply_to":"1a430d35_332dda46","updated":"2017-02-06 23:26:43.000000000","message":"++","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c9a9079050a19a0ee7136887e681405710e677d5","unresolved":false,"context_lines":[{"line_number":84,"context_line":"    to make available for substitution in the local object. There can be one or more"},{"line_number":85,"context_line":"    of these objects in the `remote` list."},{"line_number":86,"context_line":"  * `\u003ccondition\u003e`: a JSON object containing conditions that allow a rule. There can be"},{"line_number":87,"context_line":"    zero or more of these object in the `remote` list."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"* `direct mapping`: the mapping engine keeps track of each match and makes them"},{"line_number":90,"context_line":"  available to the local rule for substitution."}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_10dbecee","line":87,"in_reply_to":"1a430d35_332dda46","updated":"2017-02-09 21:52:07.000000000","message":"Done","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"05eb2ffc5e53ba34977717824621206f4d963247","unresolved":false,"context_lines":[{"line_number":101,"context_line":"How Mappings Are Processed"},{"line_number":102,"context_line":"--------------------------"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"A mapping is selected by IdP and protocol. keystone take this mapping and"},{"line_number":105,"context_line":"process each rule sequentially stopping after the first matched rule. A rule"},{"line_number":106,"context_line":"is matched when all of its conditions are met."},{"line_number":107,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_62ff8d67","line":104,"range":{"start_line":104,"start_character":43,"end_line":104,"end_character":44},"updated":"2017-02-06 23:26:43.000000000","message":"Maybe capitalize this as well?","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"05eb2ffc5e53ba34977717824621206f4d963247","unresolved":false,"context_lines":[{"line_number":105,"context_line":"process each rule sequentially stopping after the first matched rule. A rule"},{"line_number":106,"context_line":"is matched when all of its conditions are met."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"First keystone evaluates each condition from the rule\u0027s remote property to see"},{"line_number":109,"context_line":"if the rule is a match. If it is a match keystone saves the data captured by"},{"line_number":110,"context_line":"each of the matches from the rule\u0027s remote property in an ordered list. We call"},{"line_number":111,"context_line":"these matches `direct mappings` since they can be used in the next step."}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_2213c5b9","line":108,"range":{"start_line":108,"start_character":5,"end_line":108,"end_character":6},"updated":"2017-02-06 23:26:43.000000000","message":"add a \u0027,\u0027 here after \"First\"","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c9a9079050a19a0ee7136887e681405710e677d5","unresolved":false,"context_lines":[{"line_number":105,"context_line":"process each rule sequentially stopping after the first matched rule. A rule"},{"line_number":106,"context_line":"is matched when all of its conditions are met."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"First keystone evaluates each condition from the rule\u0027s remote property to see"},{"line_number":109,"context_line":"if the rule is a match. If it is a match keystone saves the data captured by"},{"line_number":110,"context_line":"each of the matches from the rule\u0027s remote property in an ordered list. We call"},{"line_number":111,"context_line":"these matches `direct mappings` since they can be used in the next step."}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_10892ccb","line":108,"in_reply_to":"1a430d35_2213c5b9","updated":"2017-02-09 21:52:07.000000000","message":"Done","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"05eb2ffc5e53ba34977717824621206f4d963247","unresolved":false,"context_lines":[{"line_number":106,"context_line":"is matched when all of its conditions are met."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"First keystone evaluates each condition from the rule\u0027s remote property to see"},{"line_number":109,"context_line":"if the rule is a match. If it is a match keystone saves the data captured by"},{"line_number":110,"context_line":"each of the matches from the rule\u0027s remote property in an ordered list. We call"},{"line_number":111,"context_line":"these matches `direct mappings` since they can be used in the next step."},{"line_number":112,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_227ae5f1","line":109,"range":{"start_line":109,"start_character":40,"end_line":109,"end_character":41},"updated":"2017-02-06 23:26:43.000000000","message":"\u0027,\u0027 after \"match\"","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c9a9079050a19a0ee7136887e681405710e677d5","unresolved":false,"context_lines":[{"line_number":106,"context_line":"is matched when all of its conditions are met."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"First keystone evaluates each condition from the rule\u0027s remote property to see"},{"line_number":109,"context_line":"if the rule is a match. If it is a match keystone saves the data captured by"},{"line_number":110,"context_line":"each of the matches from the rule\u0027s remote property in an ordered list. We call"},{"line_number":111,"context_line":"these matches `direct mappings` since they can be used in the next step."},{"line_number":112,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_5093a4fa","line":109,"in_reply_to":"1a430d35_227ae5f1","updated":"2017-02-09 21:52:07.000000000","message":"Done","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"08b990d3304f5e499093f69ffa8e6a73336b6667","unresolved":false,"context_lines":[{"line_number":119,"context_line":"    {"},{"line_number":120,"context_line":"        \"local\": ["},{"line_number":121,"context_line":"            {"},{"line_number":122,"context_line":"                \"user\": {...}"},{"line_number":123,"context_line":"            },"},{"line_number":124,"context_line":"            {"},{"line_number":125,"context_line":"                \"projects\": [...]"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_73acc2a0","line":122,"updated":"2017-02-06 22:09:50.000000000","message":"Is it possible/useful to include things inside the `user` and `projects` entities? Just to show how it\u0027s aggregated together afterwords?\n\n  {\n      \"local\": [\n          {\n              \"user\": {\n                  \"name\": \"jsmith\",\n                  \"other-user-attribute\": \"value\"\n              },\n              \"user\": {\n                  \"email\": \"jsmith@example.com\",\n                  \"another-user-attribute\": \"value2\"\n              }\n          }\n      ]","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c9a9079050a19a0ee7136887e681405710e677d5","unresolved":false,"context_lines":[{"line_number":119,"context_line":"    {"},{"line_number":120,"context_line":"        \"local\": ["},{"line_number":121,"context_line":"            {"},{"line_number":122,"context_line":"                \"user\": {...}"},{"line_number":123,"context_line":"            },"},{"line_number":124,"context_line":"            {"},{"line_number":125,"context_line":"                \"projects\": [...]"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_10776cd5","line":122,"in_reply_to":"1a430d35_73acc2a0","updated":"2017-02-09 21:52:07.000000000","message":"You mean put something like this in the example below?","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"08b990d3304f5e499093f69ffa8e6a73336b6667","unresolved":false,"context_lines":[{"line_number":170,"context_line":"We take this JSON object and then recursively process it in order to apply"},{"line_number":171,"context_line":"the direct mappings. This is simply looking for the pattern `{#}` and"},{"line_number":172,"context_line":"substituting it with values from the direct mappings list. The direct mapping"},{"line_number":173,"context_line":"list is zero-indexed."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"-------------"},{"line_number":176,"context_line":"Mapping Rules"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_139c5e68","line":173,"updated":"2017-02-06 22:09:50.000000000","message":"nit: The index of the direct mapping starts at zero.","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"c9a9079050a19a0ee7136887e681405710e677d5","unresolved":false,"context_lines":[{"line_number":170,"context_line":"We take this JSON object and then recursively process it in order to apply"},{"line_number":171,"context_line":"the direct mappings. This is simply looking for the pattern `{#}` and"},{"line_number":172,"context_line":"substituting it with values from the direct mappings list. The direct mapping"},{"line_number":173,"context_line":"list is zero-indexed."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"-------------"},{"line_number":176,"context_line":"Mapping Rules"}],"source_content_type":"text/x-rst","patch_set":5,"id":"fa31d9ce_90627c15","line":173,"in_reply_to":"1a430d35_139c5e68","updated":"2017-02-09 21:52:07.000000000","message":"Done","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"05eb2ffc5e53ba34977717824621206f4d963247","unresolved":false,"context_lines":[{"line_number":783,"context_line":"section within the ``local`` rules. The ``projects`` list supplies a list"},{"line_number":784,"context_line":"of projects that the federated user will be given access to. The projects"},{"line_number":785,"context_line":"will be automatically created if they don\u0027t exist when the user"},{"line_number":786,"context_line":"authenticated and the mapping engine has applied values from the assertion"},{"line_number":787,"context_line":"and mapped them into the ``local`` rules."},{"line_number":788,"context_line":""},{"line_number":789,"context_line":"In the above example, an authenticated federated user will be granted the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_e24ffdba","line":786,"range":{"start_line":786,"start_character":12,"end_line":786,"end_character":13},"updated":"2017-02-06 23:26:43.000000000","message":"nit: I think this was fine as \"authenticates\"","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"05eb2ffc5e53ba34977717824621206f4d963247","unresolved":false,"context_lines":[{"line_number":889,"context_line":"    \u003cAttribute name\u003d\"openstack_user\" id\u003d\"openstack_user\"/\u003e"},{"line_number":890,"context_line":"    \u003cAttribute name\u003d\"openstack_user_domain\" id\u003d\"openstack_user_domain\"/\u003e"},{"line_number":891,"context_line":""},{"line_number":892,"context_line":"The service provider must contain a mapping as shown below."},{"line_number":893,"context_line":"``openstack_user``, and ``openstack_user_domain`` match to the attribute"},{"line_number":894,"context_line":"names we have in the Identity Provider. It will map any user with the name"},{"line_number":895,"context_line":"``user1`` or ``admin`` in the ``openstack_user`` attribute and"}],"source_content_type":"text/x-rst","patch_set":5,"id":"1a430d35_a2033541","line":892,"range":{"start_line":892,"start_character":4,"end_line":892,"end_character":20},"updated":"2017-02-06 23:26:43.000000000","message":"I think these are supposed to be capitalized.","commit_id":"0be102baeab0f90ad50cbc31794cec24ccaa69de"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"8fad32e2437d57b2046432a7a43b4b3c82f321b6","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Description"},{"line_number":21,"context_line":"-----------"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"During the authentication process an identity provider (IdP) will present"},{"line_number":24,"context_line":"keystone with a set of user attributes about the user that is authenticating."},{"line_number":25,"context_line":"For example, in the SAML2 flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa31d9ce_04256aaa","line":23,"range":{"start_line":23,"start_character":33,"end_line":23,"end_character":34},"updated":"2017-02-09 23:50:51.000000000","message":"nit: add a \u0027,\u0027 here.","commit_id":"63d7fcb354b5c3113fd9227d0e4d71f7c45a0108"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"5b413f3f601c8bd3813766ec13b2ab23c7e93c7e","unresolved":false,"context_lines":[{"line_number":20,"context_line":"Description"},{"line_number":21,"context_line":"-----------"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"During the authentication process an identity provider (IdP) will present"},{"line_number":24,"context_line":"keystone with a set of user attributes about the user that is authenticating."},{"line_number":25,"context_line":"For example, in the SAML2 flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa31d9ce_44e4c20c","line":23,"in_reply_to":"fa31d9ce_04256aaa","updated":"2017-02-10 00:06:16.000000000","message":"I don\u0027t think the sentence should be broken up like that.","commit_id":"63d7fcb354b5c3113fd9227d0e4d71f7c45a0108"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"8fad32e2437d57b2046432a7a43b4b3c82f321b6","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"During the authentication process an identity provider (IdP) will present"},{"line_number":24,"context_line":"keystone with a set of user attributes about the user that is authenticating."},{"line_number":25,"context_line":"For example, in the SAML2 flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The attributes are typically processed by third-party software and are presented"},{"line_number":28,"context_line":"to keystone as environment variables. The original document from the IdP is"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa31d9ce_c4519210","line":25,"range":{"start_line":25,"start_character":56,"end_line":25,"end_character":57},"updated":"2017-02-09 23:50:51.000000000","message":"nit: add \"the form of\" between \"in\" and \"a\" here","commit_id":"63d7fcb354b5c3113fd9227d0e4d71f7c45a0108"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"5b413f3f601c8bd3813766ec13b2ab23c7e93c7e","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"During the authentication process an identity provider (IdP) will present"},{"line_number":24,"context_line":"keystone with a set of user attributes about the user that is authenticating."},{"line_number":25,"context_line":"For example, in the SAML2 flow this comes to keystone in a SAML document."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The attributes are typically processed by third-party software and are presented"},{"line_number":28,"context_line":"to keystone as environment variables. The original document from the IdP is"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa31d9ce_84179aec","line":25,"in_reply_to":"fa31d9ce_c4519210","updated":"2017-02-10 00:06:16.000000000","message":"Done","commit_id":"63d7fcb354b5c3113fd9227d0e4d71f7c45a0108"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"8fad32e2437d57b2046432a7a43b4b3c82f321b6","unresolved":false,"context_lines":[{"line_number":100,"context_line":"How Mappings Are Processed"},{"line_number":101,"context_line":"--------------------------"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"A mapping is selected by IdP and protocol. Then keystone takes the mapping and"},{"line_number":104,"context_line":"processes each rule sequentially stopping after the first matched rule. A rule"},{"line_number":105,"context_line":"is matched when all of its conditions are met."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa31d9ce_845f9a0d","line":103,"range":{"start_line":103,"start_character":47,"end_line":103,"end_character":48},"updated":"2017-02-09 23:50:51.000000000","message":"nit: add a \u0027,\u0027 after \"Then\"","commit_id":"63d7fcb354b5c3113fd9227d0e4d71f7c45a0108"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"5b413f3f601c8bd3813766ec13b2ab23c7e93c7e","unresolved":false,"context_lines":[{"line_number":100,"context_line":"How Mappings Are Processed"},{"line_number":101,"context_line":"--------------------------"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"A mapping is selected by IdP and protocol. Then keystone takes the mapping and"},{"line_number":104,"context_line":"processes each rule sequentially stopping after the first matched rule. A rule"},{"line_number":105,"context_line":"is matched when all of its conditions are met."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa31d9ce_04e2ca03","line":103,"in_reply_to":"fa31d9ce_845f9a0d","updated":"2017-02-10 00:06:16.000000000","message":"I\u0027m not intending a break pause here","commit_id":"63d7fcb354b5c3113fd9227d0e4d71f7c45a0108"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"5b413f3f601c8bd3813766ec13b2ab23c7e93c7e","unresolved":false,"context_lines":[{"line_number":100,"context_line":"How Mappings Are Processed"},{"line_number":101,"context_line":"--------------------------"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"A mapping is selected by IdP and protocol. Then keystone takes the mapping and"},{"line_number":104,"context_line":"processes each rule sequentially stopping after the first matched rule. A rule"},{"line_number":105,"context_line":"is matched when all of its conditions are met."},{"line_number":106,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa31d9ce_84eebaea","line":103,"in_reply_to":"fa31d9ce_845f9a0d","updated":"2017-02-10 00:06:16.000000000","message":"I\u0027m not intending a break pause here","commit_id":"63d7fcb354b5c3113fd9227d0e4d71f7c45a0108"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"8fad32e2437d57b2046432a7a43b4b3c82f321b6","unresolved":false,"context_lines":[{"line_number":101,"context_line":"--------------------------"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"A mapping is selected by IdP and protocol. Then keystone takes the mapping and"},{"line_number":104,"context_line":"processes each rule sequentially stopping after the first matched rule. A rule"},{"line_number":105,"context_line":"is matched when all of its conditions are met."},{"line_number":106,"context_line":""},{"line_number":107,"context_line":"First, keystone evaluates each condition from the rule\u0027s remote property to see"}],"source_content_type":"text/x-rst","patch_set":7,"id":"fa31d9ce_a481fe4f","line":104,"range":{"start_line":104,"start_character":32,"end_line":104,"end_character":33},"updated":"2017-02-09 23:50:51.000000000","message":"nit: add a \u0027,\u0027 here","commit_id":"63d7fcb354b5c3113fd9227d0e4d71f7c45a0108"},{"author":{"_account_id":18338,"name":"Ron De Rose","email":"ronald.de.rose@intel.com","username":"derosenet"},"change_message_id":"cc249dd0b3af7fa4237caba33f77ef3d182be69f","unresolved":false,"context_lines":[{"line_number":26,"context_line":"document."},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"The attributes are typically processed by third-party software and are presented"},{"line_number":29,"context_line":"to keystone as environment variables. The original document from the IdP is"},{"line_number":30,"context_line":"generally not available to keystone. This is how the `Shibboleth` and `Mellon`"},{"line_number":31,"context_line":"implementations work."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"The mapping format described in this document maps these environment variables"}],"source_content_type":"text/x-rst","patch_set":8,"id":"fa31d9ce_37c19be5","line":30,"range":{"start_line":29,"start_character":38,"end_line":30,"end_character":36},"updated":"2017-02-10 17:45:22.000000000","message":"I\u0027m not clear as to what you mean by this or why it is relevant.","commit_id":"0015e1a41e0ea355cc278db0eb060d1bab26fa7f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"db4b55d717f08e2e90a366d9e8ade182c2b6bc9e","unresolved":false,"context_lines":[{"line_number":66,"context_line":"    }"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"* `mapping`: a JSON object containing a list of rules."},{"line_number":69,"context_line":"* `rules`: a property in the mapping that contains the list of rules."},{"line_number":70,"context_line":"* `rule`: a JSON object containing `local` and `remote` properties to define"},{"line_number":71,"context_line":"  the rule. There is no explicit `rule` property."},{"line_number":72,"context_line":"* `local`: a JSON object containing information on what local attributes will"}],"source_content_type":"text/x-rst","patch_set":8,"id":"fa31d9ce_45dd996f","line":69,"range":{"start_line":69,"start_character":55,"end_line":69,"end_character":68},"updated":"2017-02-10 03:29:44.000000000","message":"does \"list of `\u003crule\u003e` objects\" make sense?","commit_id":"0015e1a41e0ea355cc278db0eb060d1bab26fa7f"}]}