)]}'
{"releasenotes/notes/MFA-Rules-User-Options-Added-feb95fd907be4b40.yaml":[{"author":{"_account_id":22604,"name":"Samuel Pilla","email":"sp516w@att.com","username":"samuel.pilla"},"change_message_id":"bdbda4b2d99399a3111e736d0f252062c6df2c25","unresolved":false,"context_lines":[{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Per-user Multi-Factor-Auth rules (MFA Rules) have been implemented for"},{"line_number":5,"context_line":"    Keystone. These rules set requirements for which auth methods (e.g."},{"line_number":6,"context_line":"    Password, TOTP) and provides the ability to require multiple auth forms to"},{"line_number":7,"context_line":"    successfully get a token."},{"line_number":8,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3a461143_ff31e4a2","line":5,"range":{"start_line":5,"start_character":43,"end_line":5,"end_character":65},"updated":"2017-01-31 21:07:50.000000000","message":"\"for which auth methods can be used\" or something like that.","commit_id":"86f09a9a986586666b21776adefb9b6b7a2c3777"},{"author":{"_account_id":22604,"name":"Samuel Pilla","email":"sp516w@att.com","username":"samuel.pilla"},"change_message_id":"bdbda4b2d99399a3111e736d0f252062c6df2c25","unresolved":false,"context_lines":[{"line_number":7,"context_line":"    successfully get a token."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"    The MFA rules are set via the user create and update API"},{"line_number":10,"context_line":"    (``POST/PATCH /v3/users``) call, the options allow an admin to force a user"},{"line_number":11,"context_line":"    to use specific forms of authentication or combinations of forms of"},{"line_number":12,"context_line":"    authentication to get a token. The rules are specified as follows::"},{"line_number":13,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3a461143_6d46317c","line":10,"range":{"start_line":10,"start_character":35,"end_line":10,"end_character":38},"updated":"2017-01-31 21:07:50.000000000","message":"\"call. The options\"","commit_id":"86f09a9a986586666b21776adefb9b6b7a2c3777"},{"author":{"_account_id":22604,"name":"Samuel Pilla","email":"sp516w@att.com","username":"samuel.pilla"},"change_message_id":"bdbda4b2d99399a3111e736d0f252062c6df2c25","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    ``keystone.conf`` file in the ``[auth]\\methods`` option."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    Each list of methods specifies a rule. If the auth methods provided by a"},{"line_number":22,"context_line":"    user match (or exceed) the auth methods in the list, that rules is used."},{"line_number":23,"context_line":"    The first rule found (rules will not be processed in a specific order)"},{"line_number":24,"context_line":"    that matches will be used. If a user has the a ruleset defined as"},{"line_number":25,"context_line":"    ``[[\"password\", \"totp\"]]`` the user must provide both password and totp"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3a461143_7f117451","line":22,"range":{"start_line":22,"start_character":57,"end_line":22,"end_character":75},"updated":"2017-01-31 21:07:50.000000000","message":"\"those rules are used.\"","commit_id":"86f09a9a986586666b21776adefb9b6b7a2c3777"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"a1009c30c9c2698e6f63166038b98fde645babb1","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    ``keystone.conf`` file in the ``[auth]\\methods`` option."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    Each list of methods specifies a rule. If the auth methods provided by a"},{"line_number":22,"context_line":"    user match (or exceed) the auth methods in the list, that rules is used."},{"line_number":23,"context_line":"    The first rule found (rules will not be processed in a specific order)"},{"line_number":24,"context_line":"    that matches will be used. If a user has the a ruleset defined as"},{"line_number":25,"context_line":"    ``[[\"password\", \"totp\"]]`` the user must provide both password and totp"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3a461143_ff4f248f","line":22,"range":{"start_line":22,"start_character":57,"end_line":22,"end_character":75},"in_reply_to":"3a461143_7f117451","updated":"2017-01-31 21:30:32.000000000","message":"Singluar here not, those. See next.","commit_id":"86f09a9a986586666b21776adefb9b6b7a2c3777"},{"author":{"_account_id":22604,"name":"Samuel Pilla","email":"sp516w@att.com","username":"samuel.pilla"},"change_message_id":"bdbda4b2d99399a3111e736d0f252062c6df2c25","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    Each list of methods specifies a rule. If the auth methods provided by a"},{"line_number":22,"context_line":"    user match (or exceed) the auth methods in the list, that rules is used."},{"line_number":23,"context_line":"    The first rule found (rules will not be processed in a specific order)"},{"line_number":24,"context_line":"    that matches will be used. If a user has the a ruleset defined as"},{"line_number":25,"context_line":"    ``[[\"password\", \"totp\"]]`` the user must provide both password and totp"},{"line_number":26,"context_line":"    auth methods (and both methods must succeed) to receive a token. However,"},{"line_number":27,"context_line":"    if a user has a rule list defined as ``[[\"password\"], [\"password\", \"totp\"]]``"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3a461143_df28a888","line":24,"range":{"start_line":24,"start_character":45,"end_line":24,"end_character":58},"updated":"2017-01-31 21:07:50.000000000","message":"\"the ruleset\"","commit_id":"86f09a9a986586666b21776adefb9b6b7a2c3777"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"a1009c30c9c2698e6f63166038b98fde645babb1","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    Each list of methods specifies a rule. If the auth methods provided by a"},{"line_number":22,"context_line":"    user match (or exceed) the auth methods in the list, that rules is used."},{"line_number":23,"context_line":"    The first rule found (rules will not be processed in a specific order)"},{"line_number":24,"context_line":"    that matches will be used. If a user has the a ruleset defined as"},{"line_number":25,"context_line":"    ``[[\"password\", \"totp\"]]`` the user must provide both password and totp"},{"line_number":26,"context_line":"    auth methods (and both methods must succeed) to receive a token. However,"},{"line_number":27,"context_line":"    if a user has a rule list defined as ``[[\"password\"], [\"password\", \"totp\"]]``"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3a461143_1f43106d","line":24,"range":{"start_line":24,"start_character":45,"end_line":24,"end_character":58},"in_reply_to":"3a461143_df28a888","updated":"2017-01-31 21:30:32.000000000","message":"Fixed in next.","commit_id":"86f09a9a986586666b21776adefb9b6b7a2c3777"},{"author":{"_account_id":22604,"name":"Samuel Pilla","email":"sp516w@att.com","username":"samuel.pilla"},"change_message_id":"bdbda4b2d99399a3111e736d0f252062c6df2c25","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    that matches will be used. If a user has the a ruleset defined as"},{"line_number":25,"context_line":"    ``[[\"password\", \"totp\"]]`` the user must provide both password and totp"},{"line_number":26,"context_line":"    auth methods (and both methods must succeed) to receive a token. However,"},{"line_number":27,"context_line":"    if a user has a rule list defined as ``[[\"password\"], [\"password\", \"totp\"]]``"},{"line_number":28,"context_line":"    the user may use the ``password`` method on it\u0027s own but would be required"},{"line_number":29,"context_line":"    to use both ``password`` and ``totp`` if ``totp`` is specified at all."},{"line_number":30,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3a461143_3f70cca3","line":27,"range":{"start_line":27,"start_character":20,"end_line":27,"end_character":29},"updated":"2017-01-31 21:07:50.000000000","message":"Should this be \"rule list\" or \"ruleset\"?","commit_id":"86f09a9a986586666b21776adefb9b6b7a2c3777"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"a1009c30c9c2698e6f63166038b98fde645babb1","unresolved":false,"context_lines":[{"line_number":24,"context_line":"    that matches will be used. If a user has the a ruleset defined as"},{"line_number":25,"context_line":"    ``[[\"password\", \"totp\"]]`` the user must provide both password and totp"},{"line_number":26,"context_line":"    auth methods (and both methods must succeed) to receive a token. However,"},{"line_number":27,"context_line":"    if a user has a rule list defined as ``[[\"password\"], [\"password\", \"totp\"]]``"},{"line_number":28,"context_line":"    the user may use the ``password`` method on it\u0027s own but would be required"},{"line_number":29,"context_line":"    to use both ``password`` and ``totp`` if ``totp`` is specified at all."},{"line_number":30,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3a461143_3f460c7b","line":27,"range":{"start_line":27,"start_character":20,"end_line":27,"end_character":29},"in_reply_to":"3a461143_3f70cca3","updated":"2017-01-31 21:30:32.000000000","message":"rule set propbably.","commit_id":"86f09a9a986586666b21776adefb9b6b7a2c3777"},{"author":{"_account_id":22604,"name":"Samuel Pilla","email":"sp516w@att.com","username":"samuel.pilla"},"change_message_id":"bdbda4b2d99399a3111e736d0f252062c6df2c25","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    default manner: any single configured auth method is sufficient to receive"},{"line_number":37,"context_line":"    a token."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    In the case a user should be excempt from MFA Rules, regardless if they are"},{"line_number":40,"context_line":"    set) the User-Option ``multi_factor_auth_enabled`` may  be set to"},{"line_number":41,"context_line":"    ``False`` for that user via the user create and update API"},{"line_number":42,"context_line":"    (``POST/PATCH /v3/users``) call. If this option is set to ``False`` the"},{"line_number":43,"context_line":"    MFA rules will be ignored for the user. Any other value except ``False``"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3a461143_ff3c8494","line":40,"range":{"start_line":39,"start_character":57,"end_line":40,"end_character":24},"updated":"2017-01-31 21:07:50.000000000","message":"Maybe \"(regardless if they set the User-Option)\" or \", regardless if they set the User-Option,\"","commit_id":"86f09a9a986586666b21776adefb9b6b7a2c3777"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"a1009c30c9c2698e6f63166038b98fde645babb1","unresolved":false,"context_lines":[{"line_number":36,"context_line":"    default manner: any single configured auth method is sufficient to receive"},{"line_number":37,"context_line":"    a token."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    In the case a user should be excempt from MFA Rules, regardless if they are"},{"line_number":40,"context_line":"    set) the User-Option ``multi_factor_auth_enabled`` may  be set to"},{"line_number":41,"context_line":"    ``False`` for that user via the user create and update API"},{"line_number":42,"context_line":"    (``POST/PATCH /v3/users``) call. If this option is set to ``False`` the"},{"line_number":43,"context_line":"    MFA rules will be ignored for the user. Any other value except ``False``"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3a461143_9f570025","line":40,"range":{"start_line":39,"start_character":57,"end_line":40,"end_character":24},"in_reply_to":"3a461143_ff3c8494","updated":"2017-01-31 21:30:32.000000000","message":"comma, not )\n\nin next","commit_id":"86f09a9a986586666b21776adefb9b6b7a2c3777"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ef72d21a9c41105732b13637ce4cb5b1153d8e2e","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"3a461143_82e5e709","updated":"2017-01-31 22:00:38.000000000","message":"rename the file to bp-per-user-auth-plugin-reqs-feb95fd907be4b40.yaml","commit_id":"9c6b34c4495d713a50c09fbf1f6e3d112575b21d"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b2fa9082d45cc5a53840f5e644843d8263f60fb2","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":3,"id":"3a461143_3511cb04","in_reply_to":"3a461143_82e5e709","updated":"2017-01-31 22:04:11.000000000","message":"I don\u0027t wanna :P","commit_id":"9c6b34c4495d713a50c09fbf1f6e3d112575b21d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ef72d21a9c41105732b13637ce4cb5b1153d8e2e","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Per-user Multi-Factor-Auth rules (MFA Rules) have been implemented for"},{"line_number":5,"context_line":"    Keystone. These rules define which auth methods can be used (e.g."},{"line_number":6,"context_line":"    Password, TOTP) and provides the ability to require multiple auth forms to"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3a461143_22b3530b","line":3,"range":{"start_line":3,"start_character":4,"end_line":3,"end_character":5},"updated":"2017-01-31 22:00:38.000000000","message":"add this in the beginning:\n\n      [`blueprint per-user-auth-plugin-reqs \u003chttps://blueprints.launchpad.net/keystone/+spec/per-user-auth-plugin-reqs\u003e`_]","commit_id":"9c6b34c4495d713a50c09fbf1f6e3d112575b21d"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b2fa9082d45cc5a53840f5e644843d8263f60fb2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Per-user Multi-Factor-Auth rules (MFA Rules) have been implemented for"},{"line_number":5,"context_line":"    Keystone. These rules define which auth methods can be used (e.g."},{"line_number":6,"context_line":"    Password, TOTP) and provides the ability to require multiple auth forms to"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3a461143_55fc97b7","line":3,"range":{"start_line":3,"start_character":4,"end_line":3,"end_character":5},"in_reply_to":"3a461143_22b3530b","updated":"2017-01-31 22:04:11.000000000","message":"See above response ^_^","commit_id":"9c6b34c4495d713a50c09fbf1f6e3d112575b21d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ef72d21a9c41105732b13637ce4cb5b1153d8e2e","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Per-user Multi-Factor-Auth rules (MFA Rules) have been implemented for"},{"line_number":5,"context_line":"    Keystone. These rules define which auth methods can be used (e.g."},{"line_number":6,"context_line":"    Password, TOTP) and provides the ability to require multiple auth forms to"},{"line_number":7,"context_line":"    successfully get a token."},{"line_number":8,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3a461143_c2c28f52","line":5,"range":{"start_line":4,"start_character":71,"end_line":5,"end_character":12},"updated":"2017-01-31 22:00:38.000000000","message":"superfluous","commit_id":"9c6b34c4495d713a50c09fbf1f6e3d112575b21d"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b2fa9082d45cc5a53840f5e644843d8263f60fb2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Per-user Multi-Factor-Auth rules (MFA Rules) have been implemented for"},{"line_number":5,"context_line":"    Keystone. These rules define which auth methods can be used (e.g."},{"line_number":6,"context_line":"    Password, TOTP) and provides the ability to require multiple auth forms to"},{"line_number":7,"context_line":"    successfully get a token."},{"line_number":8,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3a461143_b5fdbbb2","line":5,"range":{"start_line":4,"start_character":71,"end_line":5,"end_character":12},"in_reply_to":"3a461143_c2c28f52","updated":"2017-01-31 22:04:11.000000000","message":"You just like using big words ;)","commit_id":"9c6b34c4495d713a50c09fbf1f6e3d112575b21d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ef72d21a9c41105732b13637ce4cb5b1153d8e2e","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    The rules are specified as a list of lists. The elements of the sub-lists"},{"line_number":17,"context_line":"    must be strings and are intended to mirror the required authentication"},{"line_number":18,"context_line":"    method names (e.g. ``password``, ``totp``, etc) as defined in the"},{"line_number":19,"context_line":"    ``keystone.conf`` file in the ``[auth]\\methods`` option."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    Each list of methods specifies a rule. If the auth methods provided by a"},{"line_number":22,"context_line":"    user match (or exceed) the auth methods in the list, that rule is used."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3a461143_f52bc37f","line":19,"range":{"start_line":19,"start_character":42,"end_line":19,"end_character":43},"updated":"2017-01-31 22:00:38.000000000","message":"use a space instead of a slash, its what we\u0027ve been doing to reference config sections","commit_id":"9c6b34c4495d713a50c09fbf1f6e3d112575b21d"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b2fa9082d45cc5a53840f5e644843d8263f60fb2","unresolved":false,"context_lines":[{"line_number":16,"context_line":"    The rules are specified as a list of lists. The elements of the sub-lists"},{"line_number":17,"context_line":"    must be strings and are intended to mirror the required authentication"},{"line_number":18,"context_line":"    method names (e.g. ``password``, ``totp``, etc) as defined in the"},{"line_number":19,"context_line":"    ``keystone.conf`` file in the ``[auth]\\methods`` option."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"    Each list of methods specifies a rule. If the auth methods provided by a"},{"line_number":22,"context_line":"    user match (or exceed) the auth methods in the list, that rule is used."}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3a461143_3528eb32","line":19,"range":{"start_line":19,"start_character":42,"end_line":19,"end_character":43},"in_reply_to":"3a461143_f52bc37f","updated":"2017-01-31 22:04:11.000000000","message":"... *huff* fine! hehe, fixed in next.","commit_id":"9c6b34c4495d713a50c09fbf1f6e3d112575b21d"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"ef72d21a9c41105732b13637ce4cb5b1153d8e2e","unresolved":false,"context_lines":[{"line_number":29,"context_line":"    to use both ``password`` and ``totp`` if ``totp`` is specified at all."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    Any auth methods that are not defined in ``keystone.conf`` in the"},{"line_number":32,"context_line":"    ``[auth]\\methods`` option are ignored when the rules are processed. Empty"},{"line_number":33,"context_line":"    rules are not allowed. If a rule is empty due to no-valid auth methods"},{"line_number":34,"context_line":"    existing within it, the rule is discarded at authentication time. If there"},{"line_number":35,"context_line":"    are no rules or no valid rules for the user, authentication occurs in the"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3a461143_5599f7c2","line":32,"range":{"start_line":32,"start_character":12,"end_line":32,"end_character":13},"updated":"2017-01-31 22:00:38.000000000","message":"same comment as above","commit_id":"9c6b34c4495d713a50c09fbf1f6e3d112575b21d"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b2fa9082d45cc5a53840f5e644843d8263f60fb2","unresolved":false,"context_lines":[{"line_number":29,"context_line":"    to use both ``password`` and ``totp`` if ``totp`` is specified at all."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"    Any auth methods that are not defined in ``keystone.conf`` in the"},{"line_number":32,"context_line":"    ``[auth]\\methods`` option are ignored when the rules are processed. Empty"},{"line_number":33,"context_line":"    rules are not allowed. If a rule is empty due to no-valid auth methods"},{"line_number":34,"context_line":"    existing within it, the rule is discarded at authentication time. If there"},{"line_number":35,"context_line":"    are no rules or no valid rules for the user, authentication occurs in the"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"3a461143_5523b755","line":32,"range":{"start_line":32,"start_character":12,"end_line":32,"end_character":13},"in_reply_to":"3a461143_5599f7c2","updated":"2017-01-31 22:04:11.000000000","message":"same as above","commit_id":"9c6b34c4495d713a50c09fbf1f6e3d112575b21d"}]}