)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"56b408033e92a640564d1ac2b75aad14b5052f03","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Added keystone identity provider installation to Devstack plugin"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Devstack, alongside testshib, will now setup keystone as an idp."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"bp devstack-plugin"},{"line_number":12,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":11,"id":"9fdfeff1_5165ecb3","line":9,"range":{"start_line":9,"start_character":20,"end_line":9,"end_character":28},"updated":"2019-02-14 15:13:37.000000000","message":"samltest","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"}],"devstack/files/federation/shib_apache_handler.txt":[{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"c47456be6323c7052cbbdc986b88aa7e38428bb6","unresolved":false,"context_lines":[{"line_number":3,"context_line":"    SetHandler shib"},{"line_number":4,"context_line":"\u003c/Location\u003e"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"\u003cLocation /identity/v3/OS-FEDERATION/identity_providers/testshib/protocols/mapped/auth\u003e"},{"line_number":7,"context_line":"    ShibRequestSetting requireSession 1"},{"line_number":8,"context_line":"    AuthType shibboleth"},{"line_number":9,"context_line":"    ShibExportAssertion Off"}],"source_content_type":"text/plain","patch_set":9,"id":"5f7c97a3_170e3d3c","line":6,"range":{"start_line":6,"start_character":56,"end_line":6,"end_character":64},"updated":"2018-07-10 19:02:12.000000000","message":"I should\u0027ve left this a variable, oops.","commit_id":"57160645a8d9e727cd4f6c53c5d43ae4b8a7ea0c"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"68d07aa1c5f4baf58800e25adafb1c670bf017f5","unresolved":false,"context_lines":[{"line_number":3,"context_line":"    SetHandler shib"},{"line_number":4,"context_line":"\u003c/Location\u003e"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"\u003cLocation /identity/v3/OS-FEDERATION/identity_providers/testshib/protocols/mapped/auth\u003e"},{"line_number":7,"context_line":"    ShibRequestSetting requireSession 1"},{"line_number":8,"context_line":"    AuthType shibboleth"},{"line_number":9,"context_line":"    ShibExportAssertion Off"}],"source_content_type":"text/plain","patch_set":9,"id":"5f7c97a3_6357a1cb","line":6,"range":{"start_line":6,"start_character":56,"end_line":6,"end_character":64},"in_reply_to":"5f7c97a3_170e3d3c","updated":"2018-08-02 22:33:20.000000000","message":"yeah, can you change back to the variable?","commit_id":"57160645a8d9e727cd4f6c53c5d43ae4b8a7ea0c"}],"devstack/files/federation/shibboleth2.xml":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bdb14b4d290a8d736cc273a5dd58e4ebca913b8c","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"            \u003c!-- Triggers a login request directly to the TestShib IdP. --\u003e"},{"line_number":23,"context_line":"            \u003c!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO --\u003e"},{"line_number":24,"context_line":"            \u003cSSO entityID\u003d\"%IDP_REMOTE_ID%\" ECP\u003d\"true\"\u003e"},{"line_number":25,"context_line":"                SAML2 SAML1"},{"line_number":26,"context_line":"            \u003c/SSO\u003e"},{"line_number":27,"context_line":""}],"source_content_type":"application/xml","patch_set":9,"id":"5f7c97a3_bc23aeba","side":"PARENT","line":24,"range":{"start_line":24,"start_character":28,"end_line":24,"end_character":41},"updated":"2018-07-10 18:15:28.000000000","message":"Does this make the configuration general enough for both keystone and testshib?","commit_id":"83dc62ac906be209eda7575b28b476cde69f480e"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"c47456be6323c7052cbbdc986b88aa7e38428bb6","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":"            \u003c!-- Triggers a login request directly to the TestShib IdP. --\u003e"},{"line_number":23,"context_line":"            \u003c!-- https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO --\u003e"},{"line_number":24,"context_line":"            \u003cSSO entityID\u003d\"%IDP_REMOTE_ID%\" ECP\u003d\"true\"\u003e"},{"line_number":25,"context_line":"                SAML2 SAML1"},{"line_number":26,"context_line":"            \u003c/SSO\u003e"},{"line_number":27,"context_line":""}],"source_content_type":"application/xml","patch_set":9,"id":"5f7c97a3_d72205ba","side":"PARENT","line":24,"range":{"start_line":24,"start_character":28,"end_line":24,"end_character":41},"in_reply_to":"5f7c97a3_bc23aeba","updated":"2018-07-10 19:02:12.000000000","message":"Yes, we\u0027re currently doing both testshib and k2k.","commit_id":"83dc62ac906be209eda7575b28b476cde69f480e"}],"devstack/lib/federation.sh":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fe7946d54b9531b6d56f2a75d579dbbb4852bf2e","unresolved":false,"context_lines":[{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    sudo cp \"$FEDERATION_FILES/attribute-map.xml\" $ATTRIBUTE_MAP"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    restart_service shibd"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"    # Enable the mapped auth method in /etc/keystone.conf"},{"line_number":107,"context_line":"    iniset $KEYSTONE_CONF auth methods \"external,password,token,mapped\""}],"source_content_type":"text/x-sh","patch_set":4,"id":"df3967d1_bbd70dc0","side":"PARENT","line":104,"updated":"2017-07-31 16:47:25.000000000","message":"This use to set up testshib, but now it looks like it only does keystone as an idp. Is it useful to offer both paths?","commit_id":"c3b5d2d77b029880521912e43ad963f9b0c5bf99"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"fe7946d54b9531b6d56f2a75d579dbbb4852bf2e","unresolved":false,"context_lines":[{"line_number":24,"context_line":"IDP_ECP_URL\u003d${IDP_ECP_URL:-https://idp.testshib.org/idp/profile/SAML2/SOAP/ECP}"},{"line_number":25,"context_line":"IDP_METADATA_URL\u003d${IDP_METADATA_URL:-http://www.testshib.org/metadata/testshib-providers.xml}"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"KEYSTONE_METADATA_URL\u003d${KEYSTONE_METADATA_URL:-\"http://$HOST_IP/identity/v3/OS-FEDERATION/saml2/metadata\"}"},{"line_number":28,"context_line":"KEYSTONE_REMOTE_ID\u003d${KEYSTONE_REMOTE_ID:-\"http://$HOST_IP/identity/v3/OS-FEDERATION/saml2/idp\"}"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"MAPPING_REMOTE_TYPE\u003d${MAPPING_REMOTE_TYPE:-eppn}"}],"source_content_type":"text/x-sh","patch_set":4,"id":"df3967d1_3b19ddd6","line":27,"updated":"2017-07-31 16:47:25.000000000","message":"nit: It would be nice if these env names were more description of which keystone we are talking about. We should also try and match the convention with the IDP_* envs above. Maybe we can refactor each to be more description of what they are?\n\n  TESTSHIB_IDP_METADATA_URL\u003d..\n  \u003csnip\u003e\n  KEYSTONE_IDP_METADATA_URL\u003d...\n  KEYSTONE_IDP_REMOTE_ID\u003d...","commit_id":"bab5fb68922b4eb0045653e48011c682ca242c9b"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"bdb14b4d290a8d736cc273a5dd58e4ebca913b8c","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    # ... and replace the %HOST_IP%, %IDP_REMOTE_ID%,and %IDP_METADATA_URL% placeholders"},{"line_number":68,"context_line":"    sudo sed -i -e \""},{"line_number":69,"context_line":"        s|%HOST_IP%|$HOST_IP|g;"},{"line_number":70,"context_line":"        s|%IDP_METADATA_URL%|$IDP_METADATA_URL|g;"},{"line_number":71,"context_line":"        s|%KEYSTONE_METADATA_URL%|$KEYSTONE_IDP_METADATA_URL|g;"},{"line_number":72,"context_line":"        \" $SHIBBOLETH_XML"},{"line_number":73,"context_line":""}],"source_content_type":"text/x-sh","patch_set":9,"id":"5f7c97a3_3c11de5c","line":70,"range":{"start_line":70,"start_character":30,"end_line":70,"end_character":46},"updated":"2018-07-10 18:15:28.000000000","message":"This is pointing to testshib?","commit_id":"57160645a8d9e727cd4f6c53c5d43ae4b8a7ea0c"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"c47456be6323c7052cbbdc986b88aa7e38428bb6","unresolved":false,"context_lines":[{"line_number":67,"context_line":"    # ... and replace the %HOST_IP%, %IDP_REMOTE_ID%,and %IDP_METADATA_URL% placeholders"},{"line_number":68,"context_line":"    sudo sed -i -e \""},{"line_number":69,"context_line":"        s|%HOST_IP%|$HOST_IP|g;"},{"line_number":70,"context_line":"        s|%IDP_METADATA_URL%|$IDP_METADATA_URL|g;"},{"line_number":71,"context_line":"        s|%KEYSTONE_METADATA_URL%|$KEYSTONE_IDP_METADATA_URL|g;"},{"line_number":72,"context_line":"        \" $SHIBBOLETH_XML"},{"line_number":73,"context_line":""}],"source_content_type":"text/x-sh","patch_set":9,"id":"5f7c97a3_b7fc290d","line":70,"range":{"start_line":70,"start_character":30,"end_line":70,"end_character":46},"in_reply_to":"5f7c97a3_3c11de5c","updated":"2018-07-10 19:02:12.000000000","message":"Yes, we\u0027re doing both testshib and k2k.","commit_id":"57160645a8d9e727cd4f6c53c5d43ae4b8a7ea0c"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"21f98887e9fe68e016360987dbf9b6332efdf901","unresolved":false,"context_lines":[{"line_number":89,"context_line":"        # NOTE(knikolla): For CentOS/RHEL, installing shibboleth is tricky"},{"line_number":90,"context_line":"        # It requires adding a separate repo not officially supported"},{"line_number":91,"context_line":"        echo \"Skipping installation of shibboleth for non ubuntu host\""},{"line_number":92,"context_line":"        install_package xmlsec1-openssl"},{"line_number":93,"context_line":"    fi"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"    pip_install pysaml2"}],"source_content_type":"text/x-sh","patch_set":9,"id":"5f7c97a3_f09ed966","line":92,"range":{"start_line":92,"start_character":8,"end_line":92,"end_character":39},"updated":"2018-07-25 12:09:24.000000000","message":"Why install this package if we\u0027re not going to install shibboleth, as per the comment above?","commit_id":"57160645a8d9e727cd4f6c53c5d43ae4b8a7ea0c"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"21f98887e9fe68e016360987dbf9b6332efdf901","unresolved":false,"context_lines":[{"line_number":117,"context_line":"        iniset $KEYSTONE_CONF saml certfile \"$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt\""},{"line_number":118,"context_line":"        iniset $KEYSTONE_CONF saml keyfile \"$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key\""},{"line_number":119,"context_line":"    else"},{"line_number":120,"context_line":"        openssl genrsa -out /etc/keystone/ca.key 4096"},{"line_number":121,"context_line":"        openssl req -new -x509 -days 1826 -key /etc/keystone/ca.key -out /etc/keystone/ca.crt \\"},{"line_number":122,"context_line":"            -subj \"/C\u003dUS/ST\u003dDenial/L\u003dSpringfield/O\u003dDis/CN\u003dwww.example.com\""},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"        iniset $KEYSTONE_CONF saml certfile \"/etc/keystone/ca.crt\""},{"line_number":125,"context_line":"        iniset $KEYSTONE_CONF saml keyfile \"/etc/keystone/ca.key\""}],"source_content_type":"text/x-sh","patch_set":9,"id":"5f7c97a3_70988966","line":122,"range":{"start_line":120,"start_character":8,"end_line":122,"end_character":74},"updated":"2018-07-25 12:09:24.000000000","message":"nit 1 - You could make this a oneliner\n\n openssl req -x509 -newkey rsa:4096 -keyout /etc/keystone/ca.key -out /etc/keystone/ca.crt -days 1826\n\nnit 2 - I would probably put them in /etc/keystone/certs and /etc/keystone/private","commit_id":"57160645a8d9e727cd4f6c53c5d43ae4b8a7ea0c"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"68d07aa1c5f4baf58800e25adafb1c670bf017f5","unresolved":false,"context_lines":[{"line_number":117,"context_line":"        iniset $KEYSTONE_CONF saml certfile \"$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt\""},{"line_number":118,"context_line":"        iniset $KEYSTONE_CONF saml keyfile \"$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key\""},{"line_number":119,"context_line":"    else"},{"line_number":120,"context_line":"        openssl genrsa -out /etc/keystone/ca.key 4096"},{"line_number":121,"context_line":"        openssl req -new -x509 -days 1826 -key /etc/keystone/ca.key -out /etc/keystone/ca.crt \\"},{"line_number":122,"context_line":"            -subj \"/C\u003dUS/ST\u003dDenial/L\u003dSpringfield/O\u003dDis/CN\u003dwww.example.com\""},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"        iniset $KEYSTONE_CONF saml certfile \"/etc/keystone/ca.crt\""},{"line_number":125,"context_line":"        iniset $KEYSTONE_CONF saml keyfile \"/etc/keystone/ca.key\""}],"source_content_type":"text/x-sh","patch_set":9,"id":"5f7c97a3_4352a5dc","line":122,"range":{"start_line":120,"start_character":8,"end_line":122,"end_character":74},"in_reply_to":"5f7c97a3_70988966","updated":"2018-08-02 22:33:20.000000000","message":"+1 for both nits","commit_id":"57160645a8d9e727cd4f6c53c5d43ae4b8a7ea0c"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"56b408033e92a640564d1ac2b75aad14b5052f03","unresolved":false,"context_lines":[{"line_number":16,"context_line":"PROJECT_NAME\u003d${PROJECT_NAME:-federated_project}"},{"line_number":17,"context_line":"GROUP_NAME\u003d${GROUP_NAME:-federated_users}"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"IDP_ID\u003d${IDP_ID:-samltest}"},{"line_number":20,"context_line":"IDP_USERNAME\u003d${IDP_USERNAME:-morty}"},{"line_number":21,"context_line":"IDP_PASSWORD\u003d${IDP_PASSWORD:-panic}"},{"line_number":22,"context_line":"IDP_REMOTE_ID\u003d${IDP_REMOTE_ID:-https://samltest.id/saml/idp}"}],"source_content_type":"text/x-sh","patch_set":11,"id":"9fdfeff1_9166f4ba","line":19,"updated":"2019-02-14 15:13:37.000000000","message":"Is it up to the tempest plugin to configure this? Or how do we choose in the CI which IdP will be used?","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"05a3d5d1acd77b254eb0c805791deccbcd263b40","unresolved":false,"context_lines":[{"line_number":16,"context_line":"PROJECT_NAME\u003d${PROJECT_NAME:-federated_project}"},{"line_number":17,"context_line":"GROUP_NAME\u003d${GROUP_NAME:-federated_users}"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"IDP_ID\u003d${IDP_ID:-samltest}"},{"line_number":20,"context_line":"IDP_USERNAME\u003d${IDP_USERNAME:-morty}"},{"line_number":21,"context_line":"IDP_PASSWORD\u003d${IDP_PASSWORD:-panic}"},{"line_number":22,"context_line":"IDP_REMOTE_ID\u003d${IDP_REMOTE_ID:-https://samltest.id/saml/idp}"}],"source_content_type":"text/x-sh","patch_set":11,"id":"5fc1f717_5b97053c","line":19,"in_reply_to":"5fc1f717_3b0eb932","updated":"2019-03-19 15:21:45.000000000","message":"My point is in configure_tests_settings we have `iniset $TEMPEST_CONFIG fed_scenario idp_id $IDP_ID` and so unless this default changes or we configure the CI somehow to change the default, the tempest tests will always run with samltest.id as the IdP, whereas I thought we wanted to switch to using keystone as the IdP.","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"3125ff14407bbff442bd8bff7bf770e556f6bef5","unresolved":false,"context_lines":[{"line_number":16,"context_line":"PROJECT_NAME\u003d${PROJECT_NAME:-federated_project}"},{"line_number":17,"context_line":"GROUP_NAME\u003d${GROUP_NAME:-federated_users}"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"IDP_ID\u003d${IDP_ID:-samltest}"},{"line_number":20,"context_line":"IDP_USERNAME\u003d${IDP_USERNAME:-morty}"},{"line_number":21,"context_line":"IDP_PASSWORD\u003d${IDP_PASSWORD:-panic}"},{"line_number":22,"context_line":"IDP_REMOTE_ID\u003d${IDP_REMOTE_ID:-https://samltest.id/saml/idp}"}],"source_content_type":"text/x-sh","patch_set":11,"id":"5fc1f717_97cf5556","line":19,"in_reply_to":"5fc1f717_5b97053c","updated":"2019-03-21 09:40:13.000000000","message":"We discussed this on IRC, this will be managed by the tempest plugin and both IdPs will be available in parallel at least for now.","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"b0175f5aa5c6b668e461046520362f62f4f2e584","unresolved":false,"context_lines":[{"line_number":16,"context_line":"PROJECT_NAME\u003d${PROJECT_NAME:-federated_project}"},{"line_number":17,"context_line":"GROUP_NAME\u003d${GROUP_NAME:-federated_users}"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"IDP_ID\u003d${IDP_ID:-samltest}"},{"line_number":20,"context_line":"IDP_USERNAME\u003d${IDP_USERNAME:-morty}"},{"line_number":21,"context_line":"IDP_PASSWORD\u003d${IDP_PASSWORD:-panic}"},{"line_number":22,"context_line":"IDP_REMOTE_ID\u003d${IDP_REMOTE_ID:-https://samltest.id/saml/idp}"}],"source_content_type":"text/x-sh","patch_set":11,"id":"9fdfeff1_be2e0ea9","line":19,"in_reply_to":"9fdfeff1_00070f1a","updated":"2019-02-19 16:43:42.000000000","message":"Ah, my apologies. It seems that I mistakenly merged the two sections when fixing the merge conflicts. Will keep a separate section for %IDP_ID% and \u0027keystone\u0027. Will revise in next patchset.","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"f67d012277024c19fa4b49a06410d347bd7df8c5","unresolved":false,"context_lines":[{"line_number":16,"context_line":"PROJECT_NAME\u003d${PROJECT_NAME:-federated_project}"},{"line_number":17,"context_line":"GROUP_NAME\u003d${GROUP_NAME:-federated_users}"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"IDP_ID\u003d${IDP_ID:-samltest}"},{"line_number":20,"context_line":"IDP_USERNAME\u003d${IDP_USERNAME:-morty}"},{"line_number":21,"context_line":"IDP_PASSWORD\u003d${IDP_PASSWORD:-panic}"},{"line_number":22,"context_line":"IDP_REMOTE_ID\u003d${IDP_REMOTE_ID:-https://samltest.id/saml/idp}"}],"source_content_type":"text/x-sh","patch_set":11,"id":"9fdfeff1_00070f1a","line":19,"in_reply_to":"9fdfeff1_0c6e6bff","updated":"2019-02-14 16:20:24.000000000","message":"It will leave the defaults? So it will call the keystone idp \u0027samltest\u0027? That won\u0027t work with the apache config which calls it \u0027keystone\u0027. How do we configure the CI to use the keystone idp and not samltest.id?","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"b7f263b290a7a16b67002c9a0a39dc419ac425a7","unresolved":false,"context_lines":[{"line_number":16,"context_line":"PROJECT_NAME\u003d${PROJECT_NAME:-federated_project}"},{"line_number":17,"context_line":"GROUP_NAME\u003d${GROUP_NAME:-federated_users}"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"IDP_ID\u003d${IDP_ID:-samltest}"},{"line_number":20,"context_line":"IDP_USERNAME\u003d${IDP_USERNAME:-morty}"},{"line_number":21,"context_line":"IDP_PASSWORD\u003d${IDP_PASSWORD:-panic}"},{"line_number":22,"context_line":"IDP_REMOTE_ID\u003d${IDP_REMOTE_ID:-https://samltest.id/saml/idp}"}],"source_content_type":"text/x-sh","patch_set":11,"id":"9fdfeff1_0c6e6bff","line":19,"in_reply_to":"9fdfeff1_9166f4ba","updated":"2019-02-14 16:15:03.000000000","message":"This allows people that are deploying the devstack plugin outside of the CI to overwrite the defaults and test their own IDP. \n\nTempest plugin will just leave the defaults.","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"3b0697c01c2cadd395b3fdf51f88bb2819a1c4fb","unresolved":false,"context_lines":[{"line_number":16,"context_line":"PROJECT_NAME\u003d${PROJECT_NAME:-federated_project}"},{"line_number":17,"context_line":"GROUP_NAME\u003d${GROUP_NAME:-federated_users}"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"IDP_ID\u003d${IDP_ID:-samltest}"},{"line_number":20,"context_line":"IDP_USERNAME\u003d${IDP_USERNAME:-morty}"},{"line_number":21,"context_line":"IDP_PASSWORD\u003d${IDP_PASSWORD:-panic}"},{"line_number":22,"context_line":"IDP_REMOTE_ID\u003d${IDP_REMOTE_ID:-https://samltest.id/saml/idp}"}],"source_content_type":"text/x-sh","patch_set":11,"id":"5fc1f717_3b0eb932","line":19,"in_reply_to":"9fdfeff1_be2e0ea9","updated":"2019-03-19 15:10:55.000000000","message":"Actually, it seems correct. There are two apache sections in the apache config. One for keystone and one for IDP_ID.","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"56b408033e92a640564d1ac2b75aad14b5052f03","unresolved":false,"context_lines":[{"line_number":23,"context_line":"IDP_ECP_URL\u003d${IDP_ECP_URL:-https://samltest.id/idp/profile/SAML2/SOAP/ECP}"},{"line_number":24,"context_line":"IDP_METADATA_URL\u003d${IDP_METADATA_URL:-https://samltest.id/saml/idp}"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"MAPPING_REMOTE_TYPE\u003d${MAPPING_REMOTE_TYPE:-uid}"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"KEYSTONE_IDP_METADATA_URL\u003d${KEYSTONE_IDP_METADATA_URL:-\"http://$HOST_IP/identity/v3/OS-FEDERATION/saml2/metadata\"}"},{"line_number":29,"context_line":"KEYSTONE_IDP_REMOTE_ID\u003d${KEYSTONE_IDP_REMOTE_ID:-\"http://$HOST_IP/identity/v3/OS-FEDERATION/saml2/idp\"}"}],"source_content_type":"text/x-sh","patch_set":11,"id":"9fdfeff1_f10c20ed","line":26,"updated":"2019-02-14 15:13:37.000000000","message":"This only makes sense for samltest, will the tempest plugin or zuul job configure it to use openstack_user?","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"b7f263b290a7a16b67002c9a0a39dc419ac425a7","unresolved":false,"context_lines":[{"line_number":23,"context_line":"IDP_ECP_URL\u003d${IDP_ECP_URL:-https://samltest.id/idp/profile/SAML2/SOAP/ECP}"},{"line_number":24,"context_line":"IDP_METADATA_URL\u003d${IDP_METADATA_URL:-https://samltest.id/saml/idp}"},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"MAPPING_REMOTE_TYPE\u003d${MAPPING_REMOTE_TYPE:-uid}"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"KEYSTONE_IDP_METADATA_URL\u003d${KEYSTONE_IDP_METADATA_URL:-\"http://$HOST_IP/identity/v3/OS-FEDERATION/saml2/metadata\"}"},{"line_number":29,"context_line":"KEYSTONE_IDP_REMOTE_ID\u003d${KEYSTONE_IDP_REMOTE_ID:-\"http://$HOST_IP/identity/v3/OS-FEDERATION/saml2/idp\"}"}],"source_content_type":"text/x-sh","patch_set":11,"id":"9fdfeff1_8c79fbc5","line":26,"in_reply_to":"9fdfeff1_f10c20ed","updated":"2019-02-14 16:15:03.000000000","message":"See other comment.","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"56b408033e92a640564d1ac2b75aad14b5052f03","unresolved":false,"context_lines":[{"line_number":26,"context_line":"MAPPING_REMOTE_TYPE\u003d${MAPPING_REMOTE_TYPE:-uid}"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"KEYSTONE_IDP_METADATA_URL\u003d${KEYSTONE_IDP_METADATA_URL:-\"http://$HOST_IP/identity/v3/OS-FEDERATION/saml2/metadata\"}"},{"line_number":29,"context_line":"KEYSTONE_IDP_REMOTE_ID\u003d${KEYSTONE_IDP_REMOTE_ID:-\"http://$HOST_IP/identity/v3/OS-FEDERATION/saml2/idp\"}"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"MAPPING_USER_NAME\u003d${MAPPING_USER_NAME:-\"{0}\"}"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-sh","patch_set":11,"id":"9fdfeff1_31d4e847","line":29,"updated":"2019-02-14 15:13:37.000000000","message":"This seems not to be used at all","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"b7f263b290a7a16b67002c9a0a39dc419ac425a7","unresolved":false,"context_lines":[{"line_number":26,"context_line":"MAPPING_REMOTE_TYPE\u003d${MAPPING_REMOTE_TYPE:-uid}"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"KEYSTONE_IDP_METADATA_URL\u003d${KEYSTONE_IDP_METADATA_URL:-\"http://$HOST_IP/identity/v3/OS-FEDERATION/saml2/metadata\"}"},{"line_number":29,"context_line":"KEYSTONE_IDP_REMOTE_ID\u003d${KEYSTONE_IDP_REMOTE_ID:-\"http://$HOST_IP/identity/v3/OS-FEDERATION/saml2/idp\"}"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"MAPPING_USER_NAME\u003d${MAPPING_USER_NAME:-\"{0}\"}"},{"line_number":32,"context_line":""}],"source_content_type":"text/x-sh","patch_set":11,"id":"9fdfeff1_0c474b79","line":29,"in_reply_to":"9fdfeff1_31d4e847","updated":"2019-02-14 16:15:03.000000000","message":"Good call, will remove.","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"3b0697c01c2cadd395b3fdf51f88bb2819a1c4fb","unresolved":false,"context_lines":[{"line_number":130,"context_line":"        iniset $KEYSTONE_CONF saml certfile \"$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt\""},{"line_number":131,"context_line":"        iniset $KEYSTONE_CONF saml keyfile \"$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key\""},{"line_number":132,"context_line":"    else"},{"line_number":133,"context_line":"        openssl req -x509 -newkey rsa:4096 \\"},{"line_number":134,"context_line":"            -keyout /etc/keystone/ca.key -out /etc/keystone/ca.crt -days 1826"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"        iniset $KEYSTONE_CONF saml certfile \"/etc/keystone/ca.crt\""}],"source_content_type":"text/x-sh","patch_set":11,"id":"5fc1f717_9b99edd1","line":134,"range":{"start_line":133,"start_character":8,"end_line":134,"end_character":77},"updated":"2019-03-19 15:10:55.000000000","message":"This seems to ask for a passphrase and therefore failing. Reverting back to the two-liner since that worked and I don\u0027t have time to debug.","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"03e6d1592fba1811325fce10e3f20aef6933d211","unresolved":false,"context_lines":[{"line_number":130,"context_line":"        iniset $KEYSTONE_CONF saml certfile \"$INT_CA_DIR/$DEVSTACK_CERT_NAME.crt\""},{"line_number":131,"context_line":"        iniset $KEYSTONE_CONF saml keyfile \"$INT_CA_DIR/private/$DEVSTACK_CERT_NAME.key\""},{"line_number":132,"context_line":"    else"},{"line_number":133,"context_line":"        openssl req -x509 -newkey rsa:4096 \\"},{"line_number":134,"context_line":"            -keyout /etc/keystone/ca.key -out /etc/keystone/ca.crt -days 1826"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":""},{"line_number":137,"context_line":"        iniset $KEYSTONE_CONF saml certfile \"/etc/keystone/ca.crt\""}],"source_content_type":"text/x-sh","patch_set":11,"id":"5fc1f717_1bc41d92","line":134,"range":{"start_line":133,"start_character":8,"end_line":134,"end_character":77},"in_reply_to":"5fc1f717_9b99edd1","updated":"2019-03-19 15:13:33.000000000","message":"-nodes is the flag to make it not ask for a passphrase","commit_id":"fbafca5219a8aeabc7b2abd5ba1fb93246d5cd73"}]}