)]}'
{"doc/source/contributor/services.rst":[{"author":{"_account_id":27006,"name":"Kirsten G.","email":"kikis.github@gmail.com","username":"oikiki"},"change_message_id":"486f2c4b38130e59657c72bbd8cca3c55a740f7f","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    authorization on domains outside of their domain."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Project"},{"line_number":57,"context_line":"    A container and a namespace for resources isolation within OpenStack. A"},{"line_number":58,"context_line":"    user, or group of users, must have a role on a project in order to interact"},{"line_number":59,"context_line":"    with it."},{"line_number":60,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"df7087c5_9f88b2c6","line":57,"range":{"start_line":57,"start_character":46,"end_line":57,"end_character":55},"updated":"2018-03-21 19:34:07.000000000","message":"isolated","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f04e13e68026adfe11cd36fd1e0cf595f0a1df43","unresolved":false,"context_lines":[{"line_number":54,"context_line":"    authorization on domains outside of their domain."},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Project"},{"line_number":57,"context_line":"    A container and a namespace for resources isolation within OpenStack. A"},{"line_number":58,"context_line":"    user, or group of users, must have a role on a project in order to interact"},{"line_number":59,"context_line":"    with it."},{"line_number":60,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_aeaf107b","line":57,"range":{"start_line":57,"start_character":46,"end_line":57,"end_character":55},"in_reply_to":"df7087c5_9f88b2c6","updated":"2018-05-31 20:10:51.000000000","message":"Done","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c308184d763943836ae2dc5ac9d58234e5457a7c","unresolved":false,"context_lines":[{"line_number":116,"context_line":"Authorization Scopes"},{"line_number":117,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The Identity API uses tokens to relay a user\u0027s authorization, which is"},{"line_number":120,"context_line":"sometimes referred to as a token\u0027s *scope*. This happens when a user presents"},{"line_number":121,"context_line":"credentials, in some form or fashion, to keystone in addition to a desired"},{"line_number":122,"context_line":"scope. If keystone can prove the user is who they say they are (authN), it will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df7087c5_75271ab8","line":119,"range":{"start_line":119,"start_character":32,"end_line":119,"end_character":37},"updated":"2018-03-21 01:04:39.000000000","message":"relay where?","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"2cafb98702bc493839771c89170cf3fc91a2a47c","unresolved":false,"context_lines":[{"line_number":116,"context_line":"Authorization Scopes"},{"line_number":117,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The Identity API uses tokens to relay a user\u0027s authorization, which is"},{"line_number":120,"context_line":"sometimes referred to as a token\u0027s *scope*. This happens when a user presents"},{"line_number":121,"context_line":"credentials, in some form or fashion, to keystone in addition to a desired"},{"line_number":122,"context_line":"scope. If keystone can prove the user is who they say they are (authN), it will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df7087c5_cb450772","line":119,"range":{"start_line":119,"start_character":32,"end_line":119,"end_character":37},"in_reply_to":"df7087c5_75271ab8","updated":"2018-03-21 23:05:59.000000000","message":"\"identify\", \"validate\", \"prove\", \"represent\"\n\nmaybe one of those?","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f04e13e68026adfe11cd36fd1e0cf595f0a1df43","unresolved":false,"context_lines":[{"line_number":116,"context_line":"Authorization Scopes"},{"line_number":117,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":118,"context_line":""},{"line_number":119,"context_line":"The Identity API uses tokens to relay a user\u0027s authorization, which is"},{"line_number":120,"context_line":"sometimes referred to as a token\u0027s *scope*. This happens when a user presents"},{"line_number":121,"context_line":"credentials, in some form or fashion, to keystone in addition to a desired"},{"line_number":122,"context_line":"scope. If keystone can prove the user is who they say they are (authN), it will"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_ce836cca","line":119,"range":{"start_line":119,"start_character":32,"end_line":119,"end_character":37},"in_reply_to":"df7087c5_cb450772","updated":"2018-05-31 20:10:51.000000000","message":"Done","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":27006,"name":"Kirsten G.","email":"kikis.github@gmail.com","username":"oikiki"},"change_message_id":"486f2c4b38130e59657c72bbd8cca3c55a740f7f","unresolved":false,"context_lines":[{"line_number":120,"context_line":"sometimes referred to as a token\u0027s *scope*. This happens when a user presents"},{"line_number":121,"context_line":"credentials, in some form or fashion, to keystone in addition to a desired"},{"line_number":122,"context_line":"scope. If keystone can prove the user is who they say they are (authN), it will"},{"line_number":123,"context_line":"then validate the user has access to the scope they are requesting (authZ). If"},{"line_number":124,"context_line":"successful, the token response will contain a token ID and data about the"},{"line_number":125,"context_line":"transaction, like the scope target and role assignments. Users can use this"},{"line_number":126,"context_line":"token ID in requests to other OpenStack services, which consume the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df7087c5_ff6f6ef9","line":123,"range":{"start_line":123,"start_character":13,"end_line":123,"end_character":22},"updated":"2018-03-21 19:34:07.000000000","message":"seem to be missing a word here. try: \"that the user has...\"","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f04e13e68026adfe11cd36fd1e0cf595f0a1df43","unresolved":false,"context_lines":[{"line_number":120,"context_line":"sometimes referred to as a token\u0027s *scope*. This happens when a user presents"},{"line_number":121,"context_line":"credentials, in some form or fashion, to keystone in addition to a desired"},{"line_number":122,"context_line":"scope. If keystone can prove the user is who they say they are (authN), it will"},{"line_number":123,"context_line":"then validate the user has access to the scope they are requesting (authZ). If"},{"line_number":124,"context_line":"successful, the token response will contain a token ID and data about the"},{"line_number":125,"context_line":"transaction, like the scope target and role assignments. Users can use this"},{"line_number":126,"context_line":"token ID in requests to other OpenStack services, which consume the"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_2e7460fd","line":123,"range":{"start_line":123,"start_character":13,"end_line":123,"end_character":22},"in_reply_to":"df7087c5_ff6f6ef9","updated":"2018-05-31 20:10:51.000000000","message":"Done","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"2cafb98702bc493839771c89170cf3fc91a2a47c","unresolved":false,"context_lines":[{"line_number":122,"context_line":"scope. If keystone can prove the user is who they say they are (authN), it will"},{"line_number":123,"context_line":"then validate the user has access to the scope they are requesting (authZ). If"},{"line_number":124,"context_line":"successful, the token response will contain a token ID and data about the"},{"line_number":125,"context_line":"transaction, like the scope target and role assignments. Users can use this"},{"line_number":126,"context_line":"token ID in requests to other OpenStack services, which consume the"},{"line_number":127,"context_line":"authorization information associated to that token."},{"line_number":128,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"df7087c5_ae0d4136","line":125,"range":{"start_line":125,"start_character":13,"end_line":125,"end_character":17},"updated":"2018-03-21 23:05:59.000000000","message":"s/like/such as/","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f04e13e68026adfe11cd36fd1e0cf595f0a1df43","unresolved":false,"context_lines":[{"line_number":122,"context_line":"scope. If keystone can prove the user is who they say they are (authN), it will"},{"line_number":123,"context_line":"then validate the user has access to the scope they are requesting (authZ). If"},{"line_number":124,"context_line":"successful, the token response will contain a token ID and data about the"},{"line_number":125,"context_line":"transaction, like the scope target and role assignments. Users can use this"},{"line_number":126,"context_line":"token ID in requests to other OpenStack services, which consume the"},{"line_number":127,"context_line":"authorization information associated to that token."},{"line_number":128,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_4e6f5c27","line":125,"range":{"start_line":125,"start_character":13,"end_line":125,"end_character":17},"in_reply_to":"df7087c5_ae0d4136","updated":"2018-05-31 20:10:51.000000000","message":"Done","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"2cafb98702bc493839771c89170cf3fc91a2a47c","unresolved":false,"context_lines":[{"line_number":126,"context_line":"token ID in requests to other OpenStack services, which consume the"},{"line_number":127,"context_line":"authorization information associated to that token."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"This section describes the various scopes availabe, and what they mean for"},{"line_number":130,"context_line":"services consuming tokens."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"System Scope"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df7087c5_4e1ca569","line":129,"range":{"start_line":129,"start_character":42,"end_line":129,"end_character":50},"updated":"2018-03-21 23:05:59.000000000","message":"available*","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f04e13e68026adfe11cd36fd1e0cf595f0a1df43","unresolved":false,"context_lines":[{"line_number":126,"context_line":"token ID in requests to other OpenStack services, which consume the"},{"line_number":127,"context_line":"authorization information associated to that token."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"This section describes the various scopes availabe, and what they mean for"},{"line_number":130,"context_line":"services consuming tokens."},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"System Scope"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_ae59508e","line":129,"range":{"start_line":129,"start_character":42,"end_line":129,"end_character":50},"in_reply_to":"df7087c5_4e1ca569","updated":"2018-05-31 20:10:51.000000000","message":"Done","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"2cafb98702bc493839771c89170cf3fc91a2a47c","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"A *system-scoped* token implies the user has authorization to act on the"},{"line_number":136,"context_line":"*deployment system*. These tokens are useful for interacting with resources"},{"line_number":137,"context_line":"that affect the deployment as a whole, or exposes resources that might"},{"line_number":138,"context_line":"otherwise violate project or domain isolation."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Good examples of system-scoped resources include:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df7087c5_8e3b9dcf","line":137,"range":{"start_line":137,"start_character":65,"end_line":137,"end_character":70},"updated":"2018-03-21 23:05:59.000000000","message":"s/might/may","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f04e13e68026adfe11cd36fd1e0cf595f0a1df43","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"A *system-scoped* token implies the user has authorization to act on the"},{"line_number":136,"context_line":"*deployment system*. These tokens are useful for interacting with resources"},{"line_number":137,"context_line":"that affect the deployment as a whole, or exposes resources that might"},{"line_number":138,"context_line":"otherwise violate project or domain isolation."},{"line_number":139,"context_line":""},{"line_number":140,"context_line":"Good examples of system-scoped resources include:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_6e57b859","line":137,"range":{"start_line":137,"start_character":65,"end_line":137,"end_character":70},"in_reply_to":"df7087c5_8e3b9dcf","updated":"2018-05-31 20:10:51.000000000","message":"Done","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"2cafb98702bc493839771c89170cf3fc91a2a47c","unresolved":false,"context_lines":[{"line_number":160,"context_line":"workload. If Alice is a domain administrator for `Foo`, she should be able to"},{"line_number":161,"context_line":"pass her domain-scoped token to nova and ask for a list of instances. If nova"},{"line_number":162,"context_line":"supports domain-scoped token, the response would contain all instances in"},{"line_number":163,"context_line":"projects `bar` and `baz`."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Another example of using a domain-scoped token would be if Alice wanted to"},{"line_number":166,"context_line":"create a new project in domain `Foo`. When Alice sends a request for keystone"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df7087c5_0e76ada5","line":163,"updated":"2018-03-21 23:05:59.000000000","message":"Could add a \u0027:\u0027 here for clarity","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f04e13e68026adfe11cd36fd1e0cf595f0a1df43","unresolved":false,"context_lines":[{"line_number":160,"context_line":"workload. If Alice is a domain administrator for `Foo`, she should be able to"},{"line_number":161,"context_line":"pass her domain-scoped token to nova and ask for a list of instances. If nova"},{"line_number":162,"context_line":"supports domain-scoped token, the response would contain all instances in"},{"line_number":163,"context_line":"projects `bar` and `baz`."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"Another example of using a domain-scoped token would be if Alice wanted to"},{"line_number":166,"context_line":"create a new project in domain `Foo`. When Alice sends a request for keystone"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_8ed7b4bf","line":163,"in_reply_to":"df7087c5_0e76ada5","updated":"2018-05-31 20:10:51.000000000","message":"Where?","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":27006,"name":"Kirsten G.","email":"kikis.github@gmail.com","username":"oikiki"},"change_message_id":"486f2c4b38130e59657c72bbd8cca3c55a740f7f","unresolved":false,"context_lines":[{"line_number":170,"context_line":".. WARNING::"},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"    This behavior isn\u0027t completely implemented, and is still in progress. This"},{"line_number":173,"context_line":"    example describe the ideal behavior, specifically for developers looking to"},{"line_number":174,"context_line":"    implement scope into their APIs."},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"Project Scope"}],"source_content_type":"text/x-rst","patch_set":1,"id":"df7087c5_3f1de672","line":173,"range":{"start_line":173,"start_character":12,"end_line":173,"end_character":20},"updated":"2018-03-21 19:34:07.000000000","message":"Is the warning just for the second example?  If so change \"describe\" to \"describes\". Otherwise change \"this example\" to \"these examples\".","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f04e13e68026adfe11cd36fd1e0cf595f0a1df43","unresolved":false,"context_lines":[{"line_number":170,"context_line":".. WARNING::"},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"    This behavior isn\u0027t completely implemented, and is still in progress. This"},{"line_number":173,"context_line":"    example describe the ideal behavior, specifically for developers looking to"},{"line_number":174,"context_line":"    implement scope into their APIs."},{"line_number":175,"context_line":""},{"line_number":176,"context_line":"Project Scope"}],"source_content_type":"text/x-rst","patch_set":1,"id":"5f7c97a3_0ef5e456","line":173,"range":{"start_line":173,"start_character":12,"end_line":173,"end_character":20},"in_reply_to":"df7087c5_3f1de672","updated":"2018-05-31 20:10:51.000000000","message":"Done","commit_id":"acdfa8b7807baa82e8869cc2315e6463a30504ac"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bd8c09c0ff37af6961970f1b2fa2496079d32992","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    system*."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Service"},{"line_number":49,"context_line":"    OpenStack services like identity, compute, image, et cetera."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Domain"},{"line_number":52,"context_line":"    A container for users, projects, and groups. A domain is also an assignment"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_99543700","line":49,"range":{"start_line":49,"start_character":54,"end_line":49,"end_character":63},"updated":"2018-08-10 10:36:24.000000000","message":"(nit) \u0027etc.\u0027 is the standard contraction, no need to expand it IMO","commit_id":"70e60535f8b88a408b9875d7e112a77e1ac5ac34"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"705761af8147ce249b2ac24d09319a58ac347bff","unresolved":false,"context_lines":[{"line_number":46,"context_line":"    system*."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Service"},{"line_number":49,"context_line":"    OpenStack services like identity, compute, image, et cetera."},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Domain"},{"line_number":52,"context_line":"    A container for users, projects, and groups. A domain is also an assignment"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_a984170f","line":49,"range":{"start_line":49,"start_character":54,"end_line":49,"end_character":63},"in_reply_to":"3f79a3b5_99543700","updated":"2018-11-07 22:35:46.000000000","message":"Done","commit_id":"70e60535f8b88a408b9875d7e112a77e1ac5ac34"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bd8c09c0ff37af6961970f1b2fa2496079d32992","unresolved":false,"context_lines":[{"line_number":118,"context_line":""},{"line_number":119,"context_line":"End users use the Identity API as a way to express their authoritative power to"},{"line_number":120,"context_line":"other OpenStack services. This is done using tokens, which can be scoped to one"},{"line_number":121,"context_line":"of several targets depending on the users role assignments. This is typically"},{"line_number":122,"context_line":"referred to as a token\u0027s *scope*. This happens when a user presents"},{"line_number":123,"context_line":"credentials, in some form or fashion, to keystone in addition to a desired"},{"line_number":124,"context_line":"scope. If keystone can prove the user is who they say they are (authN), it will"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_196107d4","line":121,"range":{"start_line":121,"start_character":36,"end_line":121,"end_character":41},"updated":"2018-08-10 10:36:24.000000000","message":"(nit) \"users\u0027\" (possessive plural apostrophe)","commit_id":"70e60535f8b88a408b9875d7e112a77e1ac5ac34"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"705761af8147ce249b2ac24d09319a58ac347bff","unresolved":false,"context_lines":[{"line_number":118,"context_line":""},{"line_number":119,"context_line":"End users use the Identity API as a way to express their authoritative power to"},{"line_number":120,"context_line":"other OpenStack services. This is done using tokens, which can be scoped to one"},{"line_number":121,"context_line":"of several targets depending on the users role assignments. This is typically"},{"line_number":122,"context_line":"referred to as a token\u0027s *scope*. This happens when a user presents"},{"line_number":123,"context_line":"credentials, in some form or fashion, to keystone in addition to a desired"},{"line_number":124,"context_line":"scope. If keystone can prove the user is who they say they are (authN), it will"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_2978072a","line":121,"range":{"start_line":121,"start_character":36,"end_line":121,"end_character":41},"in_reply_to":"3f79a3b5_196107d4","updated":"2018-11-07 22:35:46.000000000","message":"Done","commit_id":"70e60535f8b88a408b9875d7e112a77e1ac5ac34"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bd8c09c0ff37af6961970f1b2fa2496079d32992","unresolved":false,"context_lines":[{"line_number":174,"context_line":""},{"line_number":175,"context_line":"    This behavior isn\u0027t completely implemented, and is still in progress. This"},{"line_number":176,"context_line":"    example describes the ideal behavior, specifically for developers looking"},{"line_number":177,"context_line":"    to implement scope into their APIs."},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"Project Scope"},{"line_number":180,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_f98a0b68","line":177,"updated":"2018-08-10 10:36:24.000000000","message":"Do we have any examples of how a domain-scoped token is useful *today*?","commit_id":"70e60535f8b88a408b9875d7e112a77e1ac5ac34"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"705761af8147ce249b2ac24d09319a58ac347bff","unresolved":false,"context_lines":[{"line_number":174,"context_line":""},{"line_number":175,"context_line":"    This behavior isn\u0027t completely implemented, and is still in progress. This"},{"line_number":176,"context_line":"    example describes the ideal behavior, specifically for developers looking"},{"line_number":177,"context_line":"    to implement scope into their APIs."},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"Project Scope"},{"line_number":180,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_299d6757","line":177,"in_reply_to":"3f79a3b5_f98a0b68","updated":"2018-11-07 22:35:46.000000000","message":"Well, prior to refactoring for scope types, we use it for project and user creation.","commit_id":"70e60535f8b88a408b9875d7e112a77e1ac5ac34"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bd8c09c0ff37af6961970f1b2fa2496079d32992","unresolved":false,"context_lines":[{"line_number":197,"context_line":"various scoped tokens if a user has authorization on the requested scope."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"Unscoped tokens might be useful for controlling access to things that are very"},{"line_number":200,"context_line":"user-specific. SSH key pairs are a good example of a resource that shouldn\u0027t"},{"line_number":201,"context_line":"require any project, domain, or system authorization in order to manage."},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"Auth Token middleware"},{"line_number":204,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_f93d2b8f","line":201,"range":{"start_line":200,"start_character":15,"end_line":201,"end_character":72},"updated":"2018-08-10 10:36:24.000000000","message":"Is this true today? I don\u0027t think so - and I don\u0027t think it should be. I think an unscoped token should only ever be used to be exchanged for a scoped token. We should create something else, like a user scope or a my-own-project scope to describe things like this.\n\nIs there any use case where operators would want to use policy to restrict a user\u0027s ability to create SSH keypairs for themselves? I don\u0027t think we have any mechanism today to create rules for unscoped tokens.","commit_id":"70e60535f8b88a408b9875d7e112a77e1ac5ac34"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"705761af8147ce249b2ac24d09319a58ac347bff","unresolved":false,"context_lines":[{"line_number":197,"context_line":"various scoped tokens if a user has authorization on the requested scope."},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"Unscoped tokens might be useful for controlling access to things that are very"},{"line_number":200,"context_line":"user-specific. SSH key pairs are a good example of a resource that shouldn\u0027t"},{"line_number":201,"context_line":"require any project, domain, or system authorization in order to manage."},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"Auth Token middleware"},{"line_number":204,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_69a83f73","line":201,"range":{"start_line":200,"start_character":15,"end_line":201,"end_character":72},"in_reply_to":"3f79a3b5_f93d2b8f","updated":"2018-11-07 22:35:46.000000000","message":"That\u0027s fair... I\u0027ve omitted the last bit.","commit_id":"70e60535f8b88a408b9875d7e112a77e1ac5ac34"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"bd8c09c0ff37af6961970f1b2fa2496079d32992","unresolved":false,"context_lines":[{"line_number":199,"context_line":"Unscoped tokens might be useful for controlling access to things that are very"},{"line_number":200,"context_line":"user-specific. SSH key pairs are a good example of a resource that shouldn\u0027t"},{"line_number":201,"context_line":"require any project, domain, or system authorization in order to manage."},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"Auth Token middleware"},{"line_number":204,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":205,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_d9614fab","line":202,"updated":"2018-08-10 10:36:24.000000000","message":"I think the best example use case for unscoped tokens is the federated auth use case.","commit_id":"70e60535f8b88a408b9875d7e112a77e1ac5ac34"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"705761af8147ce249b2ac24d09319a58ac347bff","unresolved":false,"context_lines":[{"line_number":199,"context_line":"Unscoped tokens might be useful for controlling access to things that are very"},{"line_number":200,"context_line":"user-specific. SSH key pairs are a good example of a resource that shouldn\u0027t"},{"line_number":201,"context_line":"require any project, domain, or system authorization in order to manage."},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"Auth Token middleware"},{"line_number":204,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":205,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3f79a3b5_c9dcf318","line":202,"in_reply_to":"3f79a3b5_d9614fab","updated":"2018-11-07 22:35:46.000000000","message":"Done","commit_id":"70e60535f8b88a408b9875d7e112a77e1ac5ac34"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1f6147d2c6928f30062f6f21ddcf394f7570b7d","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Scope"},{"line_number":40,"context_line":"    A specific operating context. This is commonly used when describing the"},{"line_number":41,"context_line":"    authorization a user may have by way of obtaining tokens."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"System"},{"line_number":44,"context_line":"    An assignment target that refers to a collection of API services as a"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f79a3b5_d9ba53de","line":41,"range":{"start_line":41,"start_character":44,"end_line":41,"end_character":53},"updated":"2018-11-09 20:10:38.000000000","message":"obtaining and using, right? I can obtain a token and use it in a different scope and I may be or not authorized to do it.","commit_id":"f8e6258f08edfc37aba56eafa4803f096f9a0582"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"06d607b71d46d0f66e76ac5a7910b2ecd0593e94","unresolved":false,"context_lines":[{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Scope"},{"line_number":40,"context_line":"    A specific operating context. This is commonly used when describing the"},{"line_number":41,"context_line":"    authorization a user may have by way of obtaining tokens."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"System"},{"line_number":44,"context_line":"    An assignment target that refers to a collection of API services as a"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f79a3b5_43b574ef","line":41,"range":{"start_line":41,"start_character":44,"end_line":41,"end_character":53},"in_reply_to":"3f79a3b5_d9ba53de","updated":"2018-11-19 22:21:12.000000000","message":"Simplified this a bit.","commit_id":"f8e6258f08edfc37aba56eafa4803f096f9a0582"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1f6147d2c6928f30062f6f21ddcf394f7570b7d","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Project"},{"line_number":57,"context_line":"    A container and a namespace for resources isolated within OpenStack. A"},{"line_number":58,"context_line":"    user, or group of users, must have a role on a project in order to interact"},{"line_number":59,"context_line":"    with it."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Token"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f79a3b5_d99fb361","line":58,"range":{"start_line":58,"start_character":41,"end_line":58,"end_character":45},"updated":"2018-11-09 20:10:38.000000000","message":"we talk about roles, but we don\u0027t have it in the glossary. I think that another useful information is about \"role assignments\".","commit_id":"f8e6258f08edfc37aba56eafa4803f096f9a0582"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"06d607b71d46d0f66e76ac5a7910b2ecd0593e94","unresolved":false,"context_lines":[{"line_number":55,"context_line":""},{"line_number":56,"context_line":"Project"},{"line_number":57,"context_line":"    A container and a namespace for resources isolated within OpenStack. A"},{"line_number":58,"context_line":"    user, or group of users, must have a role on a project in order to interact"},{"line_number":59,"context_line":"    with it."},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Token"}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f79a3b5_0321bc4f","line":58,"range":{"start_line":58,"start_character":41,"end_line":58,"end_character":45},"in_reply_to":"3f79a3b5_d99fb361","updated":"2018-11-19 22:21:12.000000000","message":"Done","commit_id":"f8e6258f08edfc37aba56eafa4803f096f9a0582"},{"author":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"change_message_id":"d1f6147d2c6928f30062f6f21ddcf394f7570b7d","unresolved":false,"context_lines":[{"line_number":191,"context_line":"Unscoped"},{"line_number":192,"context_line":"--------"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"An *unscoped* token is a token that proves authentication, but doesn\u0027t carry"},{"line_number":195,"context_line":"any authorization. Users can obtain unscoped tokens by simply proving their"},{"line_number":196,"context_line":"identity with credentials. Unscoped tokens can be exchanged for any of the"},{"line_number":197,"context_line":"various scoped tokens if a user has authorization on the requested scope."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f79a3b5_1991ab50","line":194,"range":{"start_line":194,"start_character":0,"end_line":194,"end_character":57},"updated":"2018-11-09 20:10:38.000000000","message":"this contradicts what you say in the Token section in the glossary (specifically that a token carries a user\u0027s authorization): \"A self-service resource that carries a user\u0027s authorization, allowing them to interact with OpenStack services.\"","commit_id":"f8e6258f08edfc37aba56eafa4803f096f9a0582"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"06d607b71d46d0f66e76ac5a7910b2ecd0593e94","unresolved":false,"context_lines":[{"line_number":191,"context_line":"Unscoped"},{"line_number":192,"context_line":"--------"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"An *unscoped* token is a token that proves authentication, but doesn\u0027t carry"},{"line_number":195,"context_line":"any authorization. Users can obtain unscoped tokens by simply proving their"},{"line_number":196,"context_line":"identity with credentials. Unscoped tokens can be exchanged for any of the"},{"line_number":197,"context_line":"various scoped tokens if a user has authorization on the requested scope."}],"source_content_type":"text/x-rst","patch_set":4,"id":"3f79a3b5_834dcc3d","line":194,"range":{"start_line":194,"start_character":0,"end_line":194,"end_character":57},"in_reply_to":"3f79a3b5_1991ab50","updated":"2018-11-19 22:21:12.000000000","message":"Done","commit_id":"f8e6258f08edfc37aba56eafa4803f096f9a0582"}]}