)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"0d93b9f0b0baeec41ede7ca9eba8770ecd191883","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Suramya Shah \u003cshah.suramya@gmail.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2018-02-22 23:11:56 +0530"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Consolidate Keystone docs: admin/identity-external-authentication.rst"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Consolidate advanced-topics/external-auth.rst into admin/identity-external-authentication.rst as most of the information is duplicate and can be merged."},{"line_number":10,"context_line":""}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3fa0c359_eebe92ac","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":68},"updated":"2018-02-22 19:19:17.000000000","message":"Reduce this commit title down to \u003c 50 characters","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"0d93b9f0b0baeec41ede7ca9eba8770ecd191883","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Consolidate Keystone docs: admin/identity-external-authentication.rst"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Consolidate advanced-topics/external-auth.rst into admin/identity-external-authentication.rst as most of the information is duplicate and can be merged."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Change-Id: Ic4e9c37f41c4998fbdfe4b21c7b57b2de4776432"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"3fa0c359_aee2cad3","line":9,"range":{"start_line":9,"start_character":0,"end_line":9,"end_character":152},"updated":"2018-02-22 19:19:17.000000000","message":"wrap the text here to less than 80 characters","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"}],"doc/source/admin/identity-external-authentication.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5fb4914bacfe68dc92a0616b147a0a53692a1509","unresolved":false,"context_lines":[{"line_number":2,"context_line":"External authentication with Identity"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"When Identity runs in ``apache-httpd``, you can use external"},{"line_number":6,"context_line":"authentication methods that differ from the authentication provided by"},{"line_number":7,"context_line":"the identity store back end. For example, you can use an SQL identity"},{"line_number":8,"context_line":"back end together with X.509 authentication and Kerberos, instead of"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_07bac0bf","line":5,"range":{"start_line":5,"start_character":22,"end_line":5,"end_character":38},"updated":"2018-02-22 20:58:52.000000000","message":"We could be more general about this statement, since keystone can run in other web servers and not just apache. For example:\n\nWhen Identity runs in a web server that support authentication plugins, you can configure Identity to leverage authentication done by the web server.","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5fb4914bacfe68dc92a0616b147a0a53692a1509","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"When Identity runs in ``apache-httpd``, you can use external"},{"line_number":6,"context_line":"authentication methods that differ from the authentication provided by"},{"line_number":7,"context_line":"the identity store back end. For example, you can use an SQL identity"},{"line_number":8,"context_line":"back end together with X.509 authentication and Kerberos, instead of"},{"line_number":9,"context_line":"using the user name and password combination."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Configuration"},{"line_number":12,"context_line":"~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_0730809e","line":9,"range":{"start_line":7,"start_character":29,"end_line":9,"end_character":45},"updated":"2018-02-22 20:58:52.000000000","message":"I\u0027m not sure this sentence really get the right message across. Reading the other document makes it seem like it\u0027s trying to describe that external authentication isn\u0027t mutually exclusive with authentication methods provided by keystone. Maybe we can take an opportunity to clarify that a bit here:\n\nExternal authentication and authentication methods supported by Identity is not mutually exclusive. For example, you can configure Identity in such a way to allow some users to authenticate with X.509 certificates and other users to authenticate with usernames and passwords.","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5fb4914bacfe68dc92a0616b147a0a53692a1509","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":".. CAUTION::"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    You should disable the external auth method if you are currently using"},{"line_number":35,"context_line":"    federation. External auth and federation both use the ``REMOTE_USER``"},{"line_number":36,"context_line":"    variable. Since both the mapped and external plugin are being invoked to"},{"line_number":37,"context_line":"    validate attributes in the request environment, it can cause conflicts."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_67f62460","line":34,"range":{"start_line":34,"start_character":36,"end_line":34,"end_character":40},"updated":"2018-02-22 20:58:52.000000000","message":"We should be explicit as possible in official documentation. Auth can be short for authentication or authorization. Here I think we want authentication.","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"644d20ed52ba120f306f7f627e0b610a1b97c2b3","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":".. CAUTION::"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    You should disable the external auth method if you are currently using"},{"line_number":35,"context_line":"    federation. External auth and federation both use the ``REMOTE_USER``"},{"line_number":36,"context_line":"    variable. Since both the mapped and external plugin are being invoked to"},{"line_number":37,"context_line":"    validate attributes in the request environment, it can cause conflicts."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_54ef16b1","line":34,"range":{"start_line":34,"start_character":36,"end_line":34,"end_character":40},"in_reply_to":"3f79a3b5_a9717715","updated":"2018-12-07 14:45:32.000000000","message":"That\u0027s fair","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bd277b2c9c88f6ad3ef90880166dcfe60fd9d691","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":".. CAUTION::"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    You should disable the external auth method if you are currently using"},{"line_number":35,"context_line":"    federation. External auth and federation both use the ``REMOTE_USER``"},{"line_number":36,"context_line":"    variable. Since both the mapped and external plugin are being invoked to"},{"line_number":37,"context_line":"    validate attributes in the request environment, it can cause conflicts."}],"source_content_type":"text/x-rst","patch_set":1,"id":"3f79a3b5_a9717715","line":34,"range":{"start_line":34,"start_character":36,"end_line":34,"end_character":40},"in_reply_to":"3fa0c359_67f62460","updated":"2018-12-07 14:10:23.000000000","message":"This refers to the [auth]/methods setting. We don\u0027t have authorization methods, we only have authentication methods, so I think this is clear enough.\n\nThis patch is just about consolidation of the guides, not correcting the content already in them.","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5fb4914bacfe68dc92a0616b147a0a53692a1509","unresolved":false,"context_lines":[{"line_number":32,"context_line":".. CAUTION::"},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    You should disable the external auth method if you are currently using"},{"line_number":35,"context_line":"    federation. External auth and federation both use the ``REMOTE_USER``"},{"line_number":36,"context_line":"    variable. Since both the mapped and external plugin are being invoked to"},{"line_number":37,"context_line":"    validate attributes in the request environment, it can cause conflicts."},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_277edce3","line":35,"range":{"start_line":35,"start_character":25,"end_line":35,"end_character":29},"updated":"2018-02-22 20:58:52.000000000","message":"authentication","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5fb4914bacfe68dc92a0616b147a0a53692a1509","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"    You should disable the external auth method if you are currently using"},{"line_number":35,"context_line":"    federation. External auth and federation both use the ``REMOTE_USER``"},{"line_number":36,"context_line":"    variable. Since both the mapped and external plugin are being invoked to"},{"line_number":37,"context_line":"    validate attributes in the request environment, it can cause conflicts."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"    For example, imagine there are two distinct users with the same username"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_079720ee","line":36,"range":{"start_line":36,"start_character":29,"end_line":36,"end_character":35},"updated":"2018-02-22 20:58:52.000000000","message":"We can put mapped and external in double backticks since we refer to them later as literals (``mapped`` and ``external``).","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5fb4914bacfe68dc92a0616b147a0a53692a1509","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    user_ids to set `foo` in the `Default` domain and the `BAR` domain."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"    To disable this, simply remove `external` from the `methods` option in"},{"line_number":49,"context_line":"    `keystone.conf`::"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"       methods \u003d external,password,token,oauth1"},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_27f57c57","line":49,"updated":"2018-02-22 20:58:52.000000000","message":"The wording here doesn\u0027t seem to highlight what we\u0027re trying to tell the user. I think what we\u0027re trying to tell them is if they want to user federated authentication instead of external authentication, they are going to have to modify the ``methods`` option in configuration. We can make this a bit more clear:\n\nSince the ``mapped`` and ``external`` plugins are mutually exclusive, you should remove ``external`` plugin from the list of methods in your configuration file for federated deployments::\n\n  methods \u003d password,token,oauth1,mapped","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5fb4914bacfe68dc92a0616b147a0a53692a1509","unresolved":false,"context_lines":[{"line_number":53,"context_line":"Use HTTPD authentication"},{"line_number":54,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Web servers, like Apache HTTP, support many methods of authentication."},{"line_number":57,"context_line":"Identity can allow the web server to perform the authentication. The web"},{"line_number":58,"context_line":"server then passes the authenticated user to Identity by using the"},{"line_number":59,"context_line":"``REMOTE_USER`` environment variable. This user must already exist in"},{"line_number":60,"context_line":"the Identity back end to get a token from the controller. To use this"},{"line_number":61,"context_line":"method, Identity should run on ``apache-httpd``."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"Use X.509"},{"line_number":64,"context_line":"~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_87b33098","line":61,"range":{"start_line":56,"start_character":0,"end_line":61,"end_character":48},"updated":"2018-02-22 20:58:52.000000000","message":"I wonder if we should pull this section up into the introduction, since it\u0027s going over information that\u0027s already been described in the Configuration section.","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"5fb4914bacfe68dc92a0616b147a0a53692a1509","unresolved":false,"context_lines":[{"line_number":82,"context_line":"       (...)"},{"line_number":83,"context_line":"   \u003c/VirtualHost\u003e"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Develop a WSGI middleware for authentication"},{"line_number":86,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"In addition to the method described above, it is possible to implement other"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_e76d5403","line":85,"updated":"2018-02-22 20:58:52.000000000","message":"This might be a better topic for the contributor guide. We could keep the section that describes how to put your own authentication plugin in the pipeline though, since that seems relevant to operators.","commit_id":"87b20e7b51fc968a5800f8a0e42c60f09cd05741"}],"doc/source/advanced-topics/external-auth.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8aaee4cd592112be186bbea7dbbfd25cfe18a3a0","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":2,"context_line":"Using external authentication with Keystone"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":".. _external-auth:"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"When Keystone is executed in a web server like Apache HTTPD,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3fa0c359_2a2d4394","side":"PARENT","line":3,"updated":"2018-02-22 21:00:07.000000000","message":"++ to Gage\u0027s suggestion. We\u0027ll need to remove this from the index.rst file in order to build correctly. Otherwise we\u0027re referencing a non-existent file.","commit_id":"68df7bf1f3b3d6ab3f691f59f1ce6de6b0b1deab"}]}