)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"402d38aac919d04f744ca160d96708999a9ef341","unresolved":false,"context_lines":[{"line_number":9,"context_line":"This patch adds a new section for describing the Read Only"},{"line_number":10,"context_line":"LDAP configuration option that is now available in Havana."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Fixes Bug1235778"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I964d410d247083a8ff43b0177cb0b2ba920310fd"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"AAAATn%2F%2FBmI%3D","line":12,"updated":"2013-11-15 14:35:03.000000000","message":"not sure if this matters, but gerrit isn\u0027t hyperlinking the bug: write it as: \n\nfixes bug: #1235778","commit_id":"e775615183677bb4253568a0fa2ec9aef9b23340"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"94111b58ab298ef748e6110bb307a1bbee2aabaa","unresolved":false,"context_lines":[{"line_number":9,"context_line":"This patch adds a new section for describing the Read Only"},{"line_number":10,"context_line":"LDAP configuration option that is now available in Havana."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Fixes Bug1235778"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I964d410d247083a8ff43b0177cb0b2ba920310fd"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":4,"id":"AAAATn%2F%2FBfk%3D","line":12,"in_reply_to":"AAAATn%2F%2FBmI%3D","updated":"2013-11-15 19:45:09.000000000","message":"Good catch!! Thanks","commit_id":"e775615183677bb4253568a0fa2ec9aef9b23340"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"c2706ff83888005001cd0e13d756b8c2b4af585f","unresolved":false,"context_lines":[{"line_number":9,"context_line":"This patch adds a new section for describing the Read Only"},{"line_number":10,"context_line":"LDAP configuration option that is now available in Havana."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Fixes Bug: #1235778"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I964d410d247083a8ff43b0177cb0b2ba920310fd"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"AAAATn%2F%2FANA%3D","line":12,"updated":"2013-11-15 21:08:38.000000000","message":"I think this might need to be Closes-Bug: #1235778?\n\nThe link to the bug report isn\u0027t working for me.","commit_id":"3999d2a88527943a100b7647d0943af89d814de9"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"44d6ca0a3fa010af28bf0afceeba4d05b2e6f397","unresolved":false,"context_lines":[{"line_number":9,"context_line":"This patch adds a new section for describing the Read Only"},{"line_number":10,"context_line":"LDAP configuration option that is now available in Havana."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Fixes Bug: #1235778"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: I964d410d247083a8ff43b0177cb0b2ba920310fd"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"AAAATn%2F%2B%2F6g%3D","line":12,"in_reply_to":"AAAATn%2F%2FANA%3D","updated":"2013-11-15 22:59:01.000000000","message":"Thanks for figuring this out. Much appreciated!!!","commit_id":"3999d2a88527943a100b7647d0943af89d814de9"}],"doc/source/configuration.rst":[{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"206800bbfd15e7b9d17b666c6b7ea3c5900d1e3b","unresolved":false,"context_lines":[{"line_number":1329,"context_line":"In the above scenario, the existing LDAP configuration in keystone.conf"},{"line_number":1330,"context_line":"is still valid.  However, the LDAP configuration values for entities that"},{"line_number":1331,"context_line":"are now in the assignment backend (e.g. projects, roles, role assignments,"},{"line_number":1332,"context_line":"and domains) will be ignored."}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAATn%2F%2FK9w%3D","line":1332,"updated":"2013-11-13 12:04:30.000000000","message":"The way this is described it sounds like I have to set some other \"switch\" to enable the RO option...is that true of do I just start using it and \"write\" operations will fail?","commit_id":"03fbe3a0663dbc713cd8dba9100c0083db0642ad"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"6b898fe483ac031c72680c2c79da594abb57b63c","unresolved":false,"context_lines":[{"line_number":1329,"context_line":"In the above scenario, the existing LDAP configuration in keystone.conf"},{"line_number":1330,"context_line":"is still valid.  However, the LDAP configuration values for entities that"},{"line_number":1331,"context_line":"are now in the assignment backend (e.g. projects, roles, role assignments,"},{"line_number":1332,"context_line":"and domains) will be ignored."}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAATn%2F%2FKoc%3D","line":1332,"in_reply_to":"AAAATn%2F%2FK9w%3D","updated":"2013-11-13 13:56:52.000000000","message":"hmmm.  I think the section title of Read Only LDAP is confusing.  Having a read only LDAP is the most compelling use case but in reality whats more important is the smaller amount of information that needs to be available from LDAP as opposed to whether or not that smaller amount of information is read only or not.   Let me try a rewrite emphasizing that","commit_id":"03fbe3a0663dbc713cd8dba9100c0083db0642ad"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"702f37addd2f730e039c281b778f1972e33e2eea","unresolved":false,"context_lines":[{"line_number":1312,"context_line":"Read Only LDAP"},{"line_number":1313,"context_line":"--------------"},{"line_number":1314,"context_line":""},{"line_number":1315,"context_line":"Many IT environments typically have an LDAP that only"},{"line_number":1316,"context_line":"contains user and group information and is also read only."},{"line_number":1317,"context_line":"With previous versions of Keystone, these types of LDAPs were"},{"line_number":1318,"context_line":"problematic because Keystone would attempt to store its assignment"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAATn%2F%2FIbo%3D","line":1315,"updated":"2013-11-14 02:05:45.000000000","message":"Technically, they are Directories, with LDAP the protocol.  Let\u0027s not refer to them as LDAPs.  Use  \"Directoreis accessed by LDAP\"  the first time, and directories after that.","commit_id":"3eff2609699ce9bf105d6df8703c1c9996d0dc64"},{"author":{"_account_id":5707,"name":"Henry Nash","email":"henryn@linux.vnet.ibm.com","username":"henry-nash"},"change_message_id":"fa387ad3b5162d8976da8ebbe3fa99f76ac78b7d","unresolved":false,"context_lines":[{"line_number":1314,"context_line":""},{"line_number":1315,"context_line":"Many IT environments typically have an LDAP that only"},{"line_number":1316,"context_line":"contains user and group information and is also read only."},{"line_number":1317,"context_line":"With previous versions of Keystone, these types of LDAPs were"},{"line_number":1318,"context_line":"problematic because Keystone would attempt to store its assignment"},{"line_number":1319,"context_line":"entities such as projects, roles, role assignments, and domains in"},{"line_number":1320,"context_line":"the LDAP as well and this is not possible if the LDAP is read only or"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAATn%2F%2FHZg%3D","line":1317,"updated":"2013-11-14 08:51:06.000000000","message":"nit: With rather than with","commit_id":"3eff2609699ce9bf105d6df8703c1c9996d0dc64"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"702f37addd2f730e039c281b778f1972e33e2eea","unresolved":false,"context_lines":[{"line_number":1316,"context_line":"contains user and group information and is also read only."},{"line_number":1317,"context_line":"With previous versions of Keystone, these types of LDAPs were"},{"line_number":1318,"context_line":"problematic because Keystone would attempt to store its assignment"},{"line_number":1319,"context_line":"entities such as projects, roles, role assignments, and domains in"},{"line_number":1320,"context_line":"the LDAP as well and this is not possible if the LDAP is read only or"},{"line_number":1321,"context_line":"is only intended to store user and group information."},{"line_number":1322,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAATn%2F%2FIbc%3D","line":1319,"updated":"2013-11-14 02:05:45.000000000","message":"it is OK to say \"store via LDAP\"  as that is using the protocol,  but not \"stored in LDAP\"","commit_id":"3eff2609699ce9bf105d6df8703c1c9996d0dc64"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"702f37addd2f730e039c281b778f1972e33e2eea","unresolved":false,"context_lines":[{"line_number":1333,"context_line":"  [assignment]"},{"line_number":1334,"context_line":"  driver \u003d keystone.assignment.backends.sql.Assignment"},{"line_number":1335,"context_line":""},{"line_number":1336,"context_line":"In the above scenario, the existing LDAP configuration in keystone.conf"},{"line_number":1337,"context_line":"is still valid.  However, the LDAP configuration values for entities that"},{"line_number":1338,"context_line":"are now in the assignment backend (e.g. projects, roles, role assignments,"},{"line_number":1339,"context_line":"and domains) will be ignored.  Also note that whether or not the LDAP is to be considered"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAATn%2F%2FIa0%3D","line":1336,"updated":"2013-11-14 02:05:45.000000000","message":"Please add a note in here that if there is and LDAP Identity, and no Assignment backend is specified, the Assignment Backend will default to LDAP.  While this is counterintuitive, it is provided for backward\u0027s compatibility.  But, the Explicit option will always over ride r the implicit option, people who specify as above will have it right.","commit_id":"3eff2609699ce9bf105d6df8703c1c9996d0dc64"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"702f37addd2f730e039c281b778f1972e33e2eea","unresolved":false,"context_lines":[{"line_number":1337,"context_line":"is still valid.  However, the LDAP configuration values for entities that"},{"line_number":1338,"context_line":"are now in the assignment backend (e.g. projects, roles, role assignments,"},{"line_number":1339,"context_line":"and domains) will be ignored.  Also note that whether or not the LDAP is to be considered"},{"line_number":1340,"context_line":"read only is still configured as described in a previous section above by setting "},{"line_number":1341,"context_line":"values such as the following in the ldap configuration section::"},{"line_number":1342,"context_line":""},{"line_number":1343,"context_line":"[ldap]"}],"source_content_type":"text/x-rst","patch_set":2,"id":"AAAATn%2F%2FIbM%3D","line":1340,"updated":"2013-11-14 02:05:45.000000000","message":"I see RED!  Eradicate! Deredify!","commit_id":"3eff2609699ce9bf105d6df8703c1c9996d0dc64"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"402d38aac919d04f744ca160d96708999a9ef341","unresolved":false,"context_lines":[{"line_number":1320,"context_line":"the directory as well and this is not possible if the directory is read only or"},{"line_number":1321,"context_line":"is only intended to store user and group information."},{"line_number":1322,"context_line":""},{"line_number":1323,"context_line":"Keystone now provides an option whereby these types"},{"line_number":1324,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1325,"context_line":"entities (which comprises users, groups, and group assignments) to be"},{"line_number":1326,"context_line":"served out of directories and assignments (which comprises projects, roles,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAATn%2F%2FBms%3D","line":1323,"updated":"2013-11-15 14:35:03.000000000","message":"a word is missing between types and directories? of?\n\u0027these types *of* directories\u0027 ?","commit_id":"e775615183677bb4253568a0fa2ec9aef9b23340"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"94111b58ab298ef748e6110bb307a1bbee2aabaa","unresolved":false,"context_lines":[{"line_number":1320,"context_line":"the directory as well and this is not possible if the directory is read only or"},{"line_number":1321,"context_line":"is only intended to store user and group information."},{"line_number":1322,"context_line":""},{"line_number":1323,"context_line":"Keystone now provides an option whereby these types"},{"line_number":1324,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1325,"context_line":"entities (which comprises users, groups, and group assignments) to be"},{"line_number":1326,"context_line":"served out of directories and assignments (which comprises projects, roles,"}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAATn%2F%2FAZM%3D","line":1323,"in_reply_to":"AAAATn%2F%2FBms%3D","updated":"2013-11-15 19:45:09.000000000","message":"Done","commit_id":"e775615183677bb4253568a0fa2ec9aef9b23340"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"402d38aac919d04f744ca160d96708999a9ef341","unresolved":false,"context_lines":[{"line_number":1338,"context_line":"are now in the assignment backend (e.g. projects, roles, role assignments,"},{"line_number":1339,"context_line":"and domains) will be ignored. Futhermore, if there is an LDAP Identity,"},{"line_number":1340,"context_line":"and no assignment backend is specified, the assignment backend will default to LDAP."},{"line_number":1341,"context_line":"Although this may seem counterintuitive, it is provided for backwards compatibility."},{"line_number":1342,"context_line":"Nonetheless, the explicit option will always override the implicit option, so specifying the"},{"line_number":1343,"context_line":"options as shown above will always be correct.  Finally, it is also worth noting that whether"},{"line_number":1344,"context_line":"or not the LDAP accessible directory is to be considered read only is still configured"}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAATn%2F%2FBmU%3D","line":1341,"updated":"2013-11-15 14:35:03.000000000","message":"a few of these lines (up above too) are too long. limit it to 80 characters per line.","commit_id":"e775615183677bb4253568a0fa2ec9aef9b23340"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"94111b58ab298ef748e6110bb307a1bbee2aabaa","unresolved":false,"context_lines":[{"line_number":1338,"context_line":"are now in the assignment backend (e.g. projects, roles, role assignments,"},{"line_number":1339,"context_line":"and domains) will be ignored. Futhermore, if there is an LDAP Identity,"},{"line_number":1340,"context_line":"and no assignment backend is specified, the assignment backend will default to LDAP."},{"line_number":1341,"context_line":"Although this may seem counterintuitive, it is provided for backwards compatibility."},{"line_number":1342,"context_line":"Nonetheless, the explicit option will always override the implicit option, so specifying the"},{"line_number":1343,"context_line":"options as shown above will always be correct.  Finally, it is also worth noting that whether"},{"line_number":1344,"context_line":"or not the LDAP accessible directory is to be considered read only is still configured"}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAATn%2F%2FAZI%3D","line":1341,"in_reply_to":"AAAATn%2F%2FBmU%3D","updated":"2013-11-15 19:45:09.000000000","message":"Done","commit_id":"e775615183677bb4253568a0fa2ec9aef9b23340"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"402d38aac919d04f744ca160d96708999a9ef341","unresolved":false,"context_lines":[{"line_number":1345,"context_line":"as described in a previous section above by setting values such as the following in the"},{"line_number":1346,"context_line":"ldap configuration section::"},{"line_number":1347,"context_line":""},{"line_number":1348,"context_line":"[ldap]"},{"line_number":1349,"context_line":"  user_allow_create \u003d False"},{"line_number":1350,"context_line":"  user_allow_update \u003d False"},{"line_number":1351,"context_line":"  user_allow_delete \u003d False"}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAATn%2F%2FBnU%3D","line":1348,"updated":"2013-11-15 14:35:03.000000000","message":"indentations for lines 1348-1351 don\u0027t match those of 1330-1334","commit_id":"e775615183677bb4253568a0fa2ec9aef9b23340"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"94111b58ab298ef748e6110bb307a1bbee2aabaa","unresolved":false,"context_lines":[{"line_number":1345,"context_line":"as described in a previous section above by setting values such as the following in the"},{"line_number":1346,"context_line":"ldap configuration section::"},{"line_number":1347,"context_line":""},{"line_number":1348,"context_line":"[ldap]"},{"line_number":1349,"context_line":"  user_allow_create \u003d False"},{"line_number":1350,"context_line":"  user_allow_update \u003d False"},{"line_number":1351,"context_line":"  user_allow_delete \u003d False"}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAATn%2F%2FAZE%3D","line":1348,"in_reply_to":"AAAATn%2F%2FBnU%3D","updated":"2013-11-15 19:45:09.000000000","message":"Done","commit_id":"e775615183677bb4253568a0fa2ec9aef9b23340"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"a2a98d9e45d733fba12a4c9d72f663ba1da7843e","unresolved":false,"context_lines":[{"line_number":1313,"context_line":"--------------"},{"line_number":1314,"context_line":""},{"line_number":1315,"context_line":"Many IT environments typically have directories accessed by LDAP"},{"line_number":1316,"context_line":"that only contains user and group information and is also read only."},{"line_number":1317,"context_line":"With previous versions of Keystone, these types of directories were"},{"line_number":1318,"context_line":"problematic because Keystone would attempt to store via LDAP its assignment"},{"line_number":1319,"context_line":"entities such as projects, roles, role assignments, and domains in"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2B0CU%3D","line":1316,"updated":"2013-11-19 20:00:00.000000000","message":"I\u0027d rather rephrase to \"read-only directories accessed by LDAP ...\" and remove \"and is also read only\", but I am not a native English speaker so I may be totally wrong.","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"7583004eedd50f847ce734bc315f38b08bdd6520","unresolved":false,"context_lines":[{"line_number":1313,"context_line":"--------------"},{"line_number":1314,"context_line":""},{"line_number":1315,"context_line":"Many IT environments typically have directories accessed by LDAP"},{"line_number":1316,"context_line":"that only contains user and group information and is also read only."},{"line_number":1317,"context_line":"With previous versions of Keystone, these types of directories were"},{"line_number":1318,"context_line":"problematic because Keystone would attempt to store via LDAP its assignment"},{"line_number":1319,"context_line":"entities such as projects, roles, role assignments, and domains in"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2BwqI%3D","line":1316,"in_reply_to":"AAAATn%2F%2B0CU%3D","updated":"2013-11-20 15:21:11.000000000","message":"drop the word \"only\"\n\nIt is not that the information is \"read only\" but rather that the application developer is not allowed to modify it:  it is a question of permission, not permanence.\n\n\"Many environments typically have user and group information in directories that are accessable by LDAP.  This information is for read-only use in a wide array of applications. \"","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5515f20cf681acc44536545c75da0944d90eff59","unresolved":false,"context_lines":[{"line_number":1313,"context_line":"--------------"},{"line_number":1314,"context_line":""},{"line_number":1315,"context_line":"Many IT environments typically have directories accessed by LDAP"},{"line_number":1316,"context_line":"that only contains user and group information and is also read only."},{"line_number":1317,"context_line":"With previous versions of Keystone, these types of directories were"},{"line_number":1318,"context_line":"problematic because Keystone would attempt to store via LDAP its assignment"},{"line_number":1319,"context_line":"entities such as projects, roles, role assignments, and domains in"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2BvK0%3D","line":1316,"in_reply_to":"AAAATn%2F%2BwqI%3D","updated":"2013-11-20 21:46:31.000000000","message":"I will make the changes suggested by ayoung","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"a2a98d9e45d733fba12a4c9d72f663ba1da7843e","unresolved":false,"context_lines":[{"line_number":1314,"context_line":""},{"line_number":1315,"context_line":"Many IT environments typically have directories accessed by LDAP"},{"line_number":1316,"context_line":"that only contains user and group information and is also read only."},{"line_number":1317,"context_line":"With previous versions of Keystone, these types of directories were"},{"line_number":1318,"context_line":"problematic because Keystone would attempt to store via LDAP its assignment"},{"line_number":1319,"context_line":"entities such as projects, roles, role assignments, and domains in"},{"line_number":1320,"context_line":"the directory as well and this is not possible if the directory is read only"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2B0Bo%3D","line":1317,"updated":"2013-11-19 20:00:00.000000000","message":"Which version? I\u0027d rather specify \"versions prior to Havana\".","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5515f20cf681acc44536545c75da0944d90eff59","unresolved":false,"context_lines":[{"line_number":1314,"context_line":""},{"line_number":1315,"context_line":"Many IT environments typically have directories accessed by LDAP"},{"line_number":1316,"context_line":"that only contains user and group information and is also read only."},{"line_number":1317,"context_line":"With previous versions of Keystone, these types of directories were"},{"line_number":1318,"context_line":"problematic because Keystone would attempt to store via LDAP its assignment"},{"line_number":1319,"context_line":"entities such as projects, roles, role assignments, and domains in"},{"line_number":1320,"context_line":"the directory as well and this is not possible if the directory is read only"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2BvKk%3D","line":1317,"in_reply_to":"AAAATn%2F%2B0Bo%3D","updated":"2013-11-20 21:46:31.000000000","message":"I will update as requested","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e6db606718b121e773ad72e07750964f34fb4e03","unresolved":false,"context_lines":[{"line_number":1328,"context_line":"To enable this option, you must have the following keystone.conf options set::"},{"line_number":1329,"context_line":""},{"line_number":1330,"context_line":"  [identity]"},{"line_number":1331,"context_line":"  driver \u003d keystone.identity.backends.ldap.Identity"},{"line_number":1332,"context_line":""},{"line_number":1333,"context_line":"  [assignment]"},{"line_number":1334,"context_line":"  driver \u003d keystone.assignment.backends.sql.Assignment"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2Bzd8%3D","line":1331,"updated":"2013-11-19 23:07:29.000000000","message":"Just a brain-fart ... I think we may need to have a read-only LDAP backend. Something like\n\ndriver \u003d keystone.identity.backends.ldap.ReadOnlyIdentity\n\ninstead of this an a bunch of options like\n\nuser_allow_* \u003d False\n\nWe should aim for simplicity.","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5515f20cf681acc44536545c75da0944d90eff59","unresolved":false,"context_lines":[{"line_number":1328,"context_line":"To enable this option, you must have the following keystone.conf options set::"},{"line_number":1329,"context_line":""},{"line_number":1330,"context_line":"  [identity]"},{"line_number":1331,"context_line":"  driver \u003d keystone.identity.backends.ldap.Identity"},{"line_number":1332,"context_line":""},{"line_number":1333,"context_line":"  [assignment]"},{"line_number":1334,"context_line":"  driver \u003d keystone.assignment.backends.sql.Assignment"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2BvMA%3D","line":1331,"in_reply_to":"AAAATn%2F%2Bwpw%3D","updated":"2013-11-20 21:46:31.000000000","message":"Thank you! And no thanks to Guang-yee for shooting the messenger :-).  Guang do you want you or me to open a bug on this?","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"7583004eedd50f847ce734bc315f38b08bdd6520","unresolved":false,"context_lines":[{"line_number":1328,"context_line":"To enable this option, you must have the following keystone.conf options set::"},{"line_number":1329,"context_line":""},{"line_number":1330,"context_line":"  [identity]"},{"line_number":1331,"context_line":"  driver \u003d keystone.identity.backends.ldap.Identity"},{"line_number":1332,"context_line":""},{"line_number":1333,"context_line":"  [assignment]"},{"line_number":1334,"context_line":"  driver \u003d keystone.assignment.backends.sql.Assignment"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2Bwpw%3D","line":1331,"in_reply_to":"AAAATn%2F%2Bzd8%3D","updated":"2013-11-20 15:21:11.000000000","message":"A single, overriding configuration option makes more sense than a separate backend.  But that is not a documentation issue.","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e6db606718b121e773ad72e07750964f34fb4e03","unresolved":false,"context_lines":[{"line_number":1334,"context_line":"  driver \u003d keystone.assignment.backends.sql.Assignment"},{"line_number":1335,"context_line":""},{"line_number":1336,"context_line":"In the above scenario, the existing LDAP configuration in keystone.conf"},{"line_number":1337,"context_line":"is still valid.  However, the LDAP configuration values for entities that"},{"line_number":1338,"context_line":"are now in the assignment backend (e.g. projects, roles, role assignments,"},{"line_number":1339,"context_line":"and domains) will be ignored. Futhermore, if there is an LDAP Identity,"},{"line_number":1340,"context_line":"and no assignment backend is specified, the assignment backend will default to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2BzfY%3D","line":1337,"updated":"2013-11-19 23:07:29.000000000","message":"Can you please translate this sentence into plain English?\n\n\"In the above scenario, the existing LDAP configuration in keystone.conf is still valid.\"","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"3aa41a34c1dc6259bd0a528b7e755620a7ba8202","unresolved":false,"context_lines":[{"line_number":1334,"context_line":"  driver \u003d keystone.assignment.backends.sql.Assignment"},{"line_number":1335,"context_line":""},{"line_number":1336,"context_line":"In the above scenario, the existing LDAP configuration in keystone.conf"},{"line_number":1337,"context_line":"is still valid.  However, the LDAP configuration values for entities that"},{"line_number":1338,"context_line":"are now in the assignment backend (e.g. projects, roles, role assignments,"},{"line_number":1339,"context_line":"and domains) will be ignored. Futhermore, if there is an LDAP Identity,"},{"line_number":1340,"context_line":"and no assignment backend is specified, the assignment backend will default to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2BvJM%3D","line":1337,"in_reply_to":"AAAATn%2F%2BwpI%3D","updated":"2013-11-20 22:03:24.000000000","message":"I will update as ayoung suggests.","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"7583004eedd50f847ce734bc315f38b08bdd6520","unresolved":false,"context_lines":[{"line_number":1334,"context_line":"  driver \u003d keystone.assignment.backends.sql.Assignment"},{"line_number":1335,"context_line":""},{"line_number":1336,"context_line":"In the above scenario, the existing LDAP configuration in keystone.conf"},{"line_number":1337,"context_line":"is still valid.  However, the LDAP configuration values for entities that"},{"line_number":1338,"context_line":"are now in the assignment backend (e.g. projects, roles, role assignments,"},{"line_number":1339,"context_line":"and domains) will be ignored. Futhermore, if there is an LDAP Identity,"},{"line_number":1340,"context_line":"and no assignment backend is specified, the assignment backend will default to"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2BwpI%3D","line":1337,"in_reply_to":"AAAATn%2F%2BzfY%3D","updated":"2013-11-20 15:21:11.000000000","message":"\"Once the assignment driver  has been explicitly set to the sql, the LDAP configuration values for projects, roles, role assignments, and domains will be stored and fetched from the SQL database; Values in LDAP will be ignored.\"","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":91,"name":"Alvaro","email":"aloga@ifca.unican.es","username":"aloga"},"change_message_id":"a2a98d9e45d733fba12a4c9d72f663ba1da7843e","unresolved":false,"context_lines":[{"line_number":1335,"context_line":""},{"line_number":1336,"context_line":"In the above scenario, the existing LDAP configuration in keystone.conf"},{"line_number":1337,"context_line":"is still valid.  However, the LDAP configuration values for entities that"},{"line_number":1338,"context_line":"are now in the assignment backend (e.g. projects, roles, role assignments,"},{"line_number":1339,"context_line":"and domains) will be ignored. Futhermore, if there is an LDAP Identity,"},{"line_number":1340,"context_line":"and no assignment backend is specified, the assignment backend will default to"},{"line_number":1341,"context_line":"LDAP. Although this may seem counterintuitive, it is provided for backwards"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2B0BE%3D","line":1338,"updated":"2013-11-19 20:00:00.000000000","message":"e.g. or i.e.?","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"3aa41a34c1dc6259bd0a528b7e755620a7ba8202","unresolved":false,"context_lines":[{"line_number":1335,"context_line":""},{"line_number":1336,"context_line":"In the above scenario, the existing LDAP configuration in keystone.conf"},{"line_number":1337,"context_line":"is still valid.  However, the LDAP configuration values for entities that"},{"line_number":1338,"context_line":"are now in the assignment backend (e.g. projects, roles, role assignments,"},{"line_number":1339,"context_line":"and domains) will be ignored. Futhermore, if there is an LDAP Identity,"},{"line_number":1340,"context_line":"and no assignment backend is specified, the assignment backend will default to"},{"line_number":1341,"context_line":"LDAP. Although this may seem counterintuitive, it is provided for backwards"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2BvIQ%3D","line":1338,"in_reply_to":"AAAATn%2F%2B0BE%3D","updated":"2013-11-20 22:03:24.000000000","message":"this goes away when I use ayoung\u0027s substitute","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e6db606718b121e773ad72e07750964f34fb4e03","unresolved":false,"context_lines":[{"line_number":1339,"context_line":"and domains) will be ignored. Futhermore, if there is an LDAP Identity,"},{"line_number":1340,"context_line":"and no assignment backend is specified, the assignment backend will default to"},{"line_number":1341,"context_line":"LDAP. Although this may seem counterintuitive, it is provided for backwards"},{"line_number":1342,"context_line":"compatibility. Nonetheless, the explicit option will always override the"},{"line_number":1343,"context_line":"implicit option, so specifying the options as shown above will always be"},{"line_number":1344,"context_line":"correct.  Finally, it is also worth noting that whether or not the LDAP"},{"line_number":1345,"context_line":"accessible directory is to be considered read only is still configured"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2Bzek%3D","line":1342,"updated":"2013-11-19 23:07:29.000000000","message":"I think its universally understood that explicit overrides implicit. Not sure we even need to mention it.","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5515f20cf681acc44536545c75da0944d90eff59","unresolved":false,"context_lines":[{"line_number":1339,"context_line":"and domains) will be ignored. Futhermore, if there is an LDAP Identity,"},{"line_number":1340,"context_line":"and no assignment backend is specified, the assignment backend will default to"},{"line_number":1341,"context_line":"LDAP. Although this may seem counterintuitive, it is provided for backwards"},{"line_number":1342,"context_line":"compatibility. Nonetheless, the explicit option will always override the"},{"line_number":1343,"context_line":"implicit option, so specifying the options as shown above will always be"},{"line_number":1344,"context_line":"correct.  Finally, it is also worth noting that whether or not the LDAP"},{"line_number":1345,"context_line":"accessible directory is to be considered read only is still configured"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2BvLg%3D","line":1342,"in_reply_to":"AAAATn%2F%2Bzek%3D","updated":"2013-11-20 21:46:31.000000000","message":"ayoung asked me to put it in","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"e6db606718b121e773ad72e07750964f34fb4e03","unresolved":false,"context_lines":[{"line_number":1346,"context_line":"as described in a previous section above by setting values such as the"},{"line_number":1347,"context_line":"following in the ldap configuration section::"},{"line_number":1348,"context_line":""},{"line_number":1349,"context_line":"  [ldap]"},{"line_number":1350,"context_line":"  user_allow_create \u003d False"},{"line_number":1351,"context_line":"  user_allow_update \u003d False"},{"line_number":1352,"context_line":"  user_allow_delete \u003d False"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2Bzdo%3D","line":1349,"updated":"2013-11-19 23:07:29.000000000","message":"Ugly! We should really have a ReadOnlyIdentity driver instead of these. And why do we need three? Do we even have a use case where we only allow to create but not update or delete? I haven\u0027t seen one.","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"5515f20cf681acc44536545c75da0944d90eff59","unresolved":false,"context_lines":[{"line_number":1346,"context_line":"as described in a previous section above by setting values such as the"},{"line_number":1347,"context_line":"following in the ldap configuration section::"},{"line_number":1348,"context_line":""},{"line_number":1349,"context_line":"  [ldap]"},{"line_number":1350,"context_line":"  user_allow_create \u003d False"},{"line_number":1351,"context_line":"  user_allow_update \u003d False"},{"line_number":1352,"context_line":"  user_allow_delete \u003d False"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2BvLs%3D","line":1349,"in_reply_to":"AAAATn%2F%2Bwo8%3D","updated":"2013-11-20 21:46:31.000000000","message":"I agree with ayoung. Need to document what we have and open a bug for the change","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"7583004eedd50f847ce734bc315f38b08bdd6520","unresolved":false,"context_lines":[{"line_number":1346,"context_line":"as described in a previous section above by setting values such as the"},{"line_number":1347,"context_line":"following in the ldap configuration section::"},{"line_number":1348,"context_line":""},{"line_number":1349,"context_line":"  [ldap]"},{"line_number":1350,"context_line":"  user_allow_create \u003d False"},{"line_number":1351,"context_line":"  user_allow_update \u003d False"},{"line_number":1352,"context_line":"  user_allow_delete \u003d False"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAATn%2F%2Bwo8%3D","line":1349,"in_reply_to":"AAAATn%2F%2Bzdo%3D","updated":"2013-11-20 15:21:11.000000000","message":"Open A bug for that, but for now, we need to document what is in the existing driver.","commit_id":"cf6d01f8cac80e42603ea752e69080cfdd43b8ee"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6e127849fdb26ad11cb1e2665f7977091b916e3d","unresolved":false,"context_lines":[{"line_number":1314,"context_line":""},{"line_number":1315,"context_line":"Many environments typically have user and group information in directories that"},{"line_number":1316,"context_line":"are accessable by LDAP. This information is for read-only use in a wide array"},{"line_number":1317,"context_line":"of applications.  With versions of Keystone prior to Havana, these types of"},{"line_number":1318,"context_line":"directories were problematic because Keystone would attempt to store via LDAP"},{"line_number":1319,"context_line":"its assignment entities such as projects, roles, role assignments, and domains"},{"line_number":1320,"context_line":"in the directory as well and this is not possible if the directory is read only"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Bux0%3D","line":1317,"updated":"2013-11-21 00:23:32.000000000","message":"why are there two spaces after the period? \"applications.  With\"","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"aa1166348d207c4fe4d20af09b90a5895723f980","unresolved":false,"context_lines":[{"line_number":1314,"context_line":""},{"line_number":1315,"context_line":"Many environments typically have user and group information in directories that"},{"line_number":1316,"context_line":"are accessable by LDAP. This information is for read-only use in a wide array"},{"line_number":1317,"context_line":"of applications.  With versions of Keystone prior to Havana, these types of"},{"line_number":1318,"context_line":"directories were problematic because Keystone would attempt to store via LDAP"},{"line_number":1319,"context_line":"its assignment entities such as projects, roles, role assignments, and domains"},{"line_number":1320,"context_line":"in the directory as well and this is not possible if the directory is read only"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Bt0A%3D","line":1317,"in_reply_to":"AAAATn%2F%2Bux0%3D","updated":"2013-11-21 06:43:44.000000000","message":"Done","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6e127849fdb26ad11cb1e2665f7977091b916e3d","unresolved":false,"context_lines":[{"line_number":1318,"context_line":"directories were problematic because Keystone would attempt to store via LDAP"},{"line_number":1319,"context_line":"its assignment entities such as projects, roles, role assignments, and domains"},{"line_number":1320,"context_line":"in the directory as well and this is not possible if the directory is read only"},{"line_number":1321,"context_line":"or is only intended to store user and group information."},{"line_number":1322,"context_line":""},{"line_number":1323,"context_line":"Keystone now provides an option whereby these types of"},{"line_number":1324,"context_line":"directories can be easily integrated as it now enables its identity"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Buuo%3D","line":1321,"updated":"2013-11-21 00:23:32.000000000","message":"This sentence still sound weird, for a non-English speaker like me anyway. :) Maybe this?\n\nPrior to Havana release, we cannot deploy Keystone with read-only directories as backends because Keystone also need to store information such as projects, roles, domains and role assignments into the directories, in conjunction with reading user and group information.","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"aa1166348d207c4fe4d20af09b90a5895723f980","unresolved":false,"context_lines":[{"line_number":1318,"context_line":"directories were problematic because Keystone would attempt to store via LDAP"},{"line_number":1319,"context_line":"its assignment entities such as projects, roles, role assignments, and domains"},{"line_number":1320,"context_line":"in the directory as well and this is not possible if the directory is read only"},{"line_number":1321,"context_line":"or is only intended to store user and group information."},{"line_number":1322,"context_line":""},{"line_number":1323,"context_line":"Keystone now provides an option whereby these types of"},{"line_number":1324,"context_line":"directories can be easily integrated as it now enables its identity"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Btyo%3D","line":1321,"in_reply_to":"AAAATn%2F%2Buuo%3D","updated":"2013-11-21 06:43:44.000000000","message":"Done","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6e127849fdb26ad11cb1e2665f7977091b916e3d","unresolved":false,"context_lines":[{"line_number":1322,"context_line":""},{"line_number":1323,"context_line":"Keystone now provides an option whereby these types of"},{"line_number":1324,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1325,"context_line":"entities (which comprises users, groups, and group assignments) to be"},{"line_number":1326,"context_line":"served out of directories and assignments (which comprises projects, roles,"},{"line_number":1327,"context_line":"role assignments, and domains) to be served from the Keystone SQL backend."},{"line_number":1328,"context_line":"To enable this option, you must have the following keystone.conf options set::"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2BuuE%3D","line":1325,"updated":"2013-11-21 00:23:32.000000000","message":"group assignments -\u003e group membership","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"aa1166348d207c4fe4d20af09b90a5895723f980","unresolved":false,"context_lines":[{"line_number":1322,"context_line":""},{"line_number":1323,"context_line":"Keystone now provides an option whereby these types of"},{"line_number":1324,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1325,"context_line":"entities (which comprises users, groups, and group assignments) to be"},{"line_number":1326,"context_line":"served out of directories and assignments (which comprises projects, roles,"},{"line_number":1327,"context_line":"role assignments, and domains) to be served from the Keystone SQL backend."},{"line_number":1328,"context_line":"To enable this option, you must have the following keystone.conf options set::"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Btyg%3D","line":1325,"in_reply_to":"AAAATn%2F%2BuuE%3D","updated":"2013-11-21 06:43:44.000000000","message":"Done","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6e127849fdb26ad11cb1e2665f7977091b916e3d","unresolved":false,"context_lines":[{"line_number":1323,"context_line":"Keystone now provides an option whereby these types of"},{"line_number":1324,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1325,"context_line":"entities (which comprises users, groups, and group assignments) to be"},{"line_number":1326,"context_line":"served out of directories and assignments (which comprises projects, roles,"},{"line_number":1327,"context_line":"role assignments, and domains) to be served from the Keystone SQL backend."},{"line_number":1328,"context_line":"To enable this option, you must have the following keystone.conf options set::"},{"line_number":1329,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2But0%3D","line":1326,"updated":"2013-11-21 00:23:32.000000000","message":"served out of directories while assignments ...","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"aa1166348d207c4fe4d20af09b90a5895723f980","unresolved":false,"context_lines":[{"line_number":1323,"context_line":"Keystone now provides an option whereby these types of"},{"line_number":1324,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1325,"context_line":"entities (which comprises users, groups, and group assignments) to be"},{"line_number":1326,"context_line":"served out of directories and assignments (which comprises projects, roles,"},{"line_number":1327,"context_line":"role assignments, and domains) to be served from the Keystone SQL backend."},{"line_number":1328,"context_line":"To enable this option, you must have the following keystone.conf options set::"},{"line_number":1329,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2BtyE%3D","line":1326,"in_reply_to":"AAAATn%2F%2But0%3D","updated":"2013-11-21 06:43:44.000000000","message":"Done","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6e127849fdb26ad11cb1e2665f7977091b916e3d","unresolved":false,"context_lines":[{"line_number":1324,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1325,"context_line":"entities (which comprises users, groups, and group assignments) to be"},{"line_number":1326,"context_line":"served out of directories and assignments (which comprises projects, roles,"},{"line_number":1327,"context_line":"role assignments, and domains) to be served from the Keystone SQL backend."},{"line_number":1328,"context_line":"To enable this option, you must have the following keystone.conf options set::"},{"line_number":1329,"context_line":""},{"line_number":1330,"context_line":"  [identity]"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2ButU%3D","line":1327,"updated":"2013-11-21 00:23:32.000000000","message":"How about \"served from a different Keystone backend (i.e. SQL).\" because it doesn\u0027t have to be SQL. We support other backends.","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"aa1166348d207c4fe4d20af09b90a5895723f980","unresolved":false,"context_lines":[{"line_number":1324,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1325,"context_line":"entities (which comprises users, groups, and group assignments) to be"},{"line_number":1326,"context_line":"served out of directories and assignments (which comprises projects, roles,"},{"line_number":1327,"context_line":"role assignments, and domains) to be served from the Keystone SQL backend."},{"line_number":1328,"context_line":"To enable this option, you must have the following keystone.conf options set::"},{"line_number":1329,"context_line":""},{"line_number":1330,"context_line":"  [identity]"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Btw4%3D","line":1327,"in_reply_to":"AAAATn%2F%2ButU%3D","updated":"2013-11-21 06:43:44.000000000","message":"Done","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6e127849fdb26ad11cb1e2665f7977091b916e3d","unresolved":false,"context_lines":[{"line_number":1325,"context_line":"entities (which comprises users, groups, and group assignments) to be"},{"line_number":1326,"context_line":"served out of directories and assignments (which comprises projects, roles,"},{"line_number":1327,"context_line":"role assignments, and domains) to be served from the Keystone SQL backend."},{"line_number":1328,"context_line":"To enable this option, you must have the following keystone.conf options set::"},{"line_number":1329,"context_line":""},{"line_number":1330,"context_line":"  [identity]"},{"line_number":1331,"context_line":"  driver \u003d keystone.identity.backends.ldap.Identity"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Busg%3D","line":1328,"updated":"2013-11-21 00:23:32.000000000","message":"``keystone.conf``","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"aa1166348d207c4fe4d20af09b90a5895723f980","unresolved":false,"context_lines":[{"line_number":1325,"context_line":"entities (which comprises users, groups, and group assignments) to be"},{"line_number":1326,"context_line":"served out of directories and assignments (which comprises projects, roles,"},{"line_number":1327,"context_line":"role assignments, and domains) to be served from the Keystone SQL backend."},{"line_number":1328,"context_line":"To enable this option, you must have the following keystone.conf options set::"},{"line_number":1329,"context_line":""},{"line_number":1330,"context_line":"  [identity]"},{"line_number":1331,"context_line":"  driver \u003d keystone.identity.backends.ldap.Identity"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2BtwM%3D","line":1328,"in_reply_to":"AAAATn%2F%2Busg%3D","updated":"2013-11-21 06:43:44.000000000","message":"Done","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6e127849fdb26ad11cb1e2665f7977091b916e3d","unresolved":false,"context_lines":[{"line_number":1332,"context_line":""},{"line_number":1333,"context_line":"  [assignment]"},{"line_number":1334,"context_line":"  driver \u003d keystone.assignment.backends.sql.Assignment"},{"line_number":1335,"context_line":""},{"line_number":1336,"context_line":"Once the assignment driver has been explicitly set to the sql option, the LDAP"},{"line_number":1337,"context_line":"configuration values for projects, roles, role assignments, and domains will be"},{"line_number":1338,"context_line":"stored and fetched from the SQL database and values in LDAP will be ignored."}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Buq8%3D","line":1335,"updated":"2013-11-21 00:23:32.000000000","message":"With the above configuration, Keystone will only lookup identity-related information such users, groups, and group membership from the directory, while assignment-related information will be provided by the SQL backend.","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"aa1166348d207c4fe4d20af09b90a5895723f980","unresolved":false,"context_lines":[{"line_number":1332,"context_line":""},{"line_number":1333,"context_line":"  [assignment]"},{"line_number":1334,"context_line":"  driver \u003d keystone.assignment.backends.sql.Assignment"},{"line_number":1335,"context_line":""},{"line_number":1336,"context_line":"Once the assignment driver has been explicitly set to the sql option, the LDAP"},{"line_number":1337,"context_line":"configuration values for projects, roles, role assignments, and domains will be"},{"line_number":1338,"context_line":"stored and fetched from the SQL database and values in LDAP will be ignored."}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2BtvQ%3D","line":1335,"in_reply_to":"AAAATn%2F%2Buq8%3D","updated":"2013-11-21 06:43:44.000000000","message":"Done","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6e127849fdb26ad11cb1e2665f7977091b916e3d","unresolved":false,"context_lines":[{"line_number":1339,"context_line":"Also note that if there is an LDAP Identity, and no assignment backend is"},{"line_number":1340,"context_line":"specified, the assignment backend will default to LDAP. Although this may seem"},{"line_number":1341,"context_line":"counterintuitive, it is provided for backwards compatibility. Nonetheless,"},{"line_number":1342,"context_line":"the explicit option will always override the implicit option, so specifying"},{"line_number":1343,"context_line":"the options as shown above will always be correct.  Finally, it is also"},{"line_number":1344,"context_line":"worth noting that whether or not the LDAP accessible directory is to be"},{"line_number":1345,"context_line":"considered read only is still configured as described in a previous section"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Buq4%3D","line":1342,"updated":"2013-11-21 00:23:32.000000000","message":"Still think this sentence is redundant. Isn\u0027t that universally understood that explicit overrides implicit? Anyway, if you guys want to keep it there, fine by me.","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"aa1166348d207c4fe4d20af09b90a5895723f980","unresolved":false,"context_lines":[{"line_number":1339,"context_line":"Also note that if there is an LDAP Identity, and no assignment backend is"},{"line_number":1340,"context_line":"specified, the assignment backend will default to LDAP. Although this may seem"},{"line_number":1341,"context_line":"counterintuitive, it is provided for backwards compatibility. Nonetheless,"},{"line_number":1342,"context_line":"the explicit option will always override the implicit option, so specifying"},{"line_number":1343,"context_line":"the options as shown above will always be correct.  Finally, it is also"},{"line_number":1344,"context_line":"worth noting that whether or not the LDAP accessible directory is to be"},{"line_number":1345,"context_line":"considered read only is still configured as described in a previous section"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Btv8%3D","line":1342,"in_reply_to":"AAAATn%2F%2Buq4%3D","updated":"2013-11-21 06:43:44.000000000","message":"I\u0027m going to err on being redundant to make sure the point is not overlooked.","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"6e127849fdb26ad11cb1e2665f7977091b916e3d","unresolved":false,"context_lines":[{"line_number":1343,"context_line":"the options as shown above will always be correct.  Finally, it is also"},{"line_number":1344,"context_line":"worth noting that whether or not the LDAP accessible directory is to be"},{"line_number":1345,"context_line":"considered read only is still configured as described in a previous section"},{"line_number":1346,"context_line":"above by setting values such as the following in the ldap configuration"},{"line_number":1347,"context_line":"section::"},{"line_number":1348,"context_line":""},{"line_number":1349,"context_line":"  [ldap]"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Buy0%3D","line":1346,"updated":"2013-11-21 00:23:32.000000000","message":"in the ``[ldap]`` section of the configuration file","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"aa1166348d207c4fe4d20af09b90a5895723f980","unresolved":false,"context_lines":[{"line_number":1343,"context_line":"the options as shown above will always be correct.  Finally, it is also"},{"line_number":1344,"context_line":"worth noting that whether or not the LDAP accessible directory is to be"},{"line_number":1345,"context_line":"considered read only is still configured as described in a previous section"},{"line_number":1346,"context_line":"above by setting values such as the following in the ldap configuration"},{"line_number":1347,"context_line":"section::"},{"line_number":1348,"context_line":""},{"line_number":1349,"context_line":"  [ldap]"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAATn%2F%2Btv4%3D","line":1346,"in_reply_to":"AAAATn%2F%2Buy0%3D","updated":"2013-11-21 06:43:44.000000000","message":"Done","commit_id":"e7acac58d350bdccc7bf865bd4c5cce02608993c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"0d59430942062acfa8d5a06111e3e65ce17baef9","unresolved":false,"context_lines":[{"line_number":1312,"context_line":"Read Only LDAP"},{"line_number":1313,"context_line":"--------------"},{"line_number":1314,"context_line":""},{"line_number":1315,"context_line":"Many environments typically have user and group information in directories that"},{"line_number":1316,"context_line":"are accessable by LDAP. This information is for read-only use in a wide array"},{"line_number":1317,"context_line":"of applications. Prior to the Havana release, we could not deploy Keystone with"},{"line_number":1318,"context_line":"read-only directories as backends because Keystone also needed to store"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAATn%2F%2BiLc%3D","line":1315,"updated":"2013-11-25 01:15:30.000000000","message":"remove \"typically\" since it\u0027s redundant","commit_id":"a9fc0f5512f9658d05faf4f4f4a790e83c7cdb79"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"625ef1b6ebbfc14cbe275bd7be7ef7299f05c49b","unresolved":false,"context_lines":[{"line_number":1316,"context_line":"are accessable by LDAP. This information is for read-only use in a wide array"},{"line_number":1317,"context_line":"of applications. Prior to the Havana release, we could not deploy Keystone with"},{"line_number":1318,"context_line":"read-only directories as backends because Keystone also needed to store"},{"line_number":1319,"context_line":"information such as projects, roles, domains and role assignments into the"},{"line_number":1320,"context_line":"directories in conjunction with reading user and group information."},{"line_number":1321,"context_line":""},{"line_number":1322,"context_line":"Keystone now provides an option whereby these read-only"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAATn%2F%2BWSw%3D","line":1319,"updated":"2013-11-27 03:15:34.000000000","message":"and make it \"assignments, to  \"","commit_id":"a9fc0f5512f9658d05faf4f4f4a790e83c7cdb79"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"0d59430942062acfa8d5a06111e3e65ce17baef9","unresolved":false,"context_lines":[{"line_number":1316,"context_line":"are accessable by LDAP. This information is for read-only use in a wide array"},{"line_number":1317,"context_line":"of applications. Prior to the Havana release, we could not deploy Keystone with"},{"line_number":1318,"context_line":"read-only directories as backends because Keystone also needed to store"},{"line_number":1319,"context_line":"information such as projects, roles, domains and role assignments into the"},{"line_number":1320,"context_line":"directories in conjunction with reading user and group information."},{"line_number":1321,"context_line":""},{"line_number":1322,"context_line":"Keystone now provides an option whereby these read-only"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAATn%2F%2BiLU%3D","line":1319,"updated":"2013-11-25 01:15:30.000000000","message":"change \"assignments into\" to \"assignment to\"","commit_id":"a9fc0f5512f9658d05faf4f4f4a790e83c7cdb79"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"0d59430942062acfa8d5a06111e3e65ce17baef9","unresolved":false,"context_lines":[{"line_number":1317,"context_line":"of applications. Prior to the Havana release, we could not deploy Keystone with"},{"line_number":1318,"context_line":"read-only directories as backends because Keystone also needed to store"},{"line_number":1319,"context_line":"information such as projects, roles, domains and role assignments into the"},{"line_number":1320,"context_line":"directories in conjunction with reading user and group information."},{"line_number":1321,"context_line":""},{"line_number":1322,"context_line":"Keystone now provides an option whereby these read-only"},{"line_number":1323,"context_line":"directories can be easily integrated as it now enables its identity"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAATn%2F%2BiLQ%3D","line":1320,"updated":"2013-11-25 01:15:30.000000000","message":"change \"directories\" to \"directory\"","commit_id":"a9fc0f5512f9658d05faf4f4f4a790e83c7cdb79"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"0d59430942062acfa8d5a06111e3e65ce17baef9","unresolved":false,"context_lines":[{"line_number":1319,"context_line":"information such as projects, roles, domains and role assignments into the"},{"line_number":1320,"context_line":"directories in conjunction with reading user and group information."},{"line_number":1321,"context_line":""},{"line_number":1322,"context_line":"Keystone now provides an option whereby these read-only"},{"line_number":1323,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1324,"context_line":"entities (which comprises users, groups, and group memberships) to be"},{"line_number":1325,"context_line":"served out of directories while assignments (which comprises projects, roles,"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAATn%2F%2BiLM%3D","line":1322,"updated":"2013-11-25 01:15:30.000000000","message":"remove \"now\", suggest change to \"Since Havana, Keystone ...\"","commit_id":"a9fc0f5512f9658d05faf4f4f4a790e83c7cdb79"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"0d59430942062acfa8d5a06111e3e65ce17baef9","unresolved":false,"context_lines":[{"line_number":1320,"context_line":"directories in conjunction with reading user and group information."},{"line_number":1321,"context_line":""},{"line_number":1322,"context_line":"Keystone now provides an option whereby these read-only"},{"line_number":1323,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1324,"context_line":"entities (which comprises users, groups, and group memberships) to be"},{"line_number":1325,"context_line":"served out of directories while assignments (which comprises projects, roles,"},{"line_number":1326,"context_line":"role assignments, and domains) are to be served from a different Keystone"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAATn%2F%2BiLI%3D","line":1323,"updated":"2013-11-25 01:15:30.000000000","message":"remove \"now\"","commit_id":"a9fc0f5512f9658d05faf4f4f4a790e83c7cdb79"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"0d59430942062acfa8d5a06111e3e65ce17baef9","unresolved":false,"context_lines":[{"line_number":1322,"context_line":"Keystone now provides an option whereby these read-only"},{"line_number":1323,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1324,"context_line":"entities (which comprises users, groups, and group memberships) to be"},{"line_number":1325,"context_line":"served out of directories while assignments (which comprises projects, roles,"},{"line_number":1326,"context_line":"role assignments, and domains) are to be served from a different Keystone"},{"line_number":1327,"context_line":"backend (i.e. SQL). To enable this option, you must have the following"},{"line_number":1328,"context_line":"``keystone.conf`` options set::"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAATn%2F%2BiLE%3D","line":1325,"updated":"2013-11-25 01:15:30.000000000","message":"change \"directories\" to \"LDAP\" or \"an LDAP directory\"","commit_id":"a9fc0f5512f9658d05faf4f4f4a790e83c7cdb79"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"0d59430942062acfa8d5a06111e3e65ce17baef9","unresolved":false,"context_lines":[{"line_number":1323,"context_line":"directories can be easily integrated as it now enables its identity"},{"line_number":1324,"context_line":"entities (which comprises users, groups, and group memberships) to be"},{"line_number":1325,"context_line":"served out of directories while assignments (which comprises projects, roles,"},{"line_number":1326,"context_line":"role assignments, and domains) are to be served from a different Keystone"},{"line_number":1327,"context_line":"backend (i.e. SQL). To enable this option, you must have the following"},{"line_number":1328,"context_line":"``keystone.conf`` options set::"},{"line_number":1329,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAATn%2F%2BiK8%3D","line":1326,"updated":"2013-11-25 01:15:30.000000000","message":"remove \"to be\" ?","commit_id":"a9fc0f5512f9658d05faf4f4f4a790e83c7cdb79"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"0d59430942062acfa8d5a06111e3e65ce17baef9","unresolved":false,"context_lines":[{"line_number":1324,"context_line":"entities (which comprises users, groups, and group memberships) to be"},{"line_number":1325,"context_line":"served out of directories while assignments (which comprises projects, roles,"},{"line_number":1326,"context_line":"role assignments, and domains) are to be served from a different Keystone"},{"line_number":1327,"context_line":"backend (i.e. SQL). To enable this option, you must have the following"},{"line_number":1328,"context_line":"``keystone.conf`` options set::"},{"line_number":1329,"context_line":""},{"line_number":1330,"context_line":"  [identity]"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAATn%2F%2BiK4%3D","line":1327,"updated":"2013-11-25 01:15:30.000000000","message":"change \"i.e.\" to \"e.g.\"","commit_id":"a9fc0f5512f9658d05faf4f4f4a790e83c7cdb79"}]}