)]}'
{"etc/keystone.conf.sample":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"73142699133133587e66ef0a72b90f5b9eb12323","unresolved":false,"context_lines":[{"line_number":790,"context_line":"#"},{"line_number":791,"context_line":""},{"line_number":792,"context_line":"# URL for connecting to the LDAP server. (string value)"},{"line_number":793,"context_line":"#url\u003dldap://keystone"},{"line_number":794,"context_line":""},{"line_number":795,"context_line":"# User BindDN to query the LDAP server. (string value)"},{"line_number":796,"context_line":"#user\u003d\u003cNone\u003e"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"7adec928_2c8f1177","line":793,"updated":"2014-05-21 02:52:48.000000000","message":"what is this change for?","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e681ae3882bff302e98ab528966ca33331b3a22c","unresolved":false,"context_lines":[{"line_number":790,"context_line":"#"},{"line_number":791,"context_line":""},{"line_number":792,"context_line":"# URL for connecting to the LDAP server. (string value)"},{"line_number":793,"context_line":"#url\u003dldap://keystone"},{"line_number":794,"context_line":""},{"line_number":795,"context_line":"# User BindDN to query the LDAP server. (string value)"},{"line_number":796,"context_line":"#user\u003d\u003cNone\u003e"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"7adec928_8cd74523","line":793,"in_reply_to":"7adec928_2c8f1177","updated":"2014-05-21 03:09:36.000000000","message":"i suspect it\u0027s an artifact from running tox -e sample_config","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"73142699133133587e66ef0a72b90f5b9eb12323","unresolved":false,"context_lines":[{"line_number":1110,"context_line":"#access_token_duration\u003d86400"},{"line_number":1111,"context_line":""},{"line_number":1112,"context_line":""},{"line_number":1113,"context_line":"[oidc]"},{"line_number":1114,"context_line":""},{"line_number":1115,"context_line":"#"},{"line_number":1116,"context_line":"# Options defined in keystone.auth.plugins.oidc"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"7adec928_0cd97583","line":1113,"updated":"2014-05-21 02:52:48.000000000","message":"oidc doesn\u0027t seem intuitive","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e681ae3882bff302e98ab528966ca33331b3a22c","unresolved":false,"context_lines":[{"line_number":1110,"context_line":"#access_token_duration\u003d86400"},{"line_number":1111,"context_line":""},{"line_number":1112,"context_line":""},{"line_number":1113,"context_line":"[oidc]"},{"line_number":1114,"context_line":""},{"line_number":1115,"context_line":"#"},{"line_number":1116,"context_line":"# Options defined in keystone.auth.plugins.oidc"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"7adec928_0ce33506","line":1113,"in_reply_to":"7adec928_0cd97583","updated":"2014-05-21 03:09:36.000000000","message":"[openidconnect] ?","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"73142699133133587e66ef0a72b90f5b9eb12323","unresolved":false,"context_lines":[{"line_number":1120,"context_line":"#auth_url\u003dhttps://localhost:8020/oidc/v10/providers/OP/authorize"},{"line_number":1121,"context_line":""},{"line_number":1122,"context_line":"# Redirect URL for replying party (string value)"},{"line_number":1123,"context_line":"#redirect_url\u003dhttp://localhost:5000/v3/auth/redirect"},{"line_number":1124,"context_line":""},{"line_number":1125,"context_line":"# Key used to identify group section in an OpenID Connect"},{"line_number":1126,"context_line":"# Claim (string value)"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"7adec928_0c92559f","line":1123,"updated":"2014-05-21 02:52:48.000000000","message":"that a new API? Why port 5000?","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e681ae3882bff302e98ab528966ca33331b3a22c","unresolved":false,"context_lines":[{"line_number":1120,"context_line":"#auth_url\u003dhttps://localhost:8020/oidc/v10/providers/OP/authorize"},{"line_number":1121,"context_line":""},{"line_number":1122,"context_line":"# Redirect URL for replying party (string value)"},{"line_number":1123,"context_line":"#redirect_url\u003dhttp://localhost:5000/v3/auth/redirect"},{"line_number":1124,"context_line":""},{"line_number":1125,"context_line":"# Key used to identify group section in an OpenID Connect"},{"line_number":1126,"context_line":"# Claim (string value)"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"7adec928_6cb919ec","line":1123,"in_reply_to":"7adec928_0c92559f","updated":"2014-05-21 03:09:36.000000000","message":"Yes, it would be a new API. But, it wouldn\u0027t do much.\nPort 5000 because that\u0027s what keystone listens on by default? \n\nI\u0027m still not 100% clear on what purpose the redirect has (aside from the OpenID Connect spec requiring it).","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"73142699133133587e66ef0a72b90f5b9eb12323","unresolved":false,"context_lines":[{"line_number":1253,"context_line":""},{"line_number":1254,"context_line":"# SSL certificate subject (auto generated certificate)."},{"line_number":1255,"context_line":"# (string value)"},{"line_number":1256,"context_line":"#cert_subject\u003d/C\u003dUS/ST\u003dUnset/L\u003dUnset/O\u003dUnset/CN\u003dkeystone"},{"line_number":1257,"context_line":""},{"line_number":1258,"context_line":""},{"line_number":1259,"context_line":"[stats]"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"7adec928_ac7b217a","line":1256,"updated":"2014-05-21 02:52:48.000000000","message":"why change to keystone? for https, cn has the match the host IP/FQHN. Will this change break devstack? Unless we have an DNS entry for keystone somewhere.","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e681ae3882bff302e98ab528966ca33331b3a22c","unresolved":false,"context_lines":[{"line_number":1253,"context_line":""},{"line_number":1254,"context_line":"# SSL certificate subject (auto generated certificate)."},{"line_number":1255,"context_line":"# (string value)"},{"line_number":1256,"context_line":"#cert_subject\u003d/C\u003dUS/ST\u003dUnset/L\u003dUnset/O\u003dUnset/CN\u003dkeystone"},{"line_number":1257,"context_line":""},{"line_number":1258,"context_line":""},{"line_number":1259,"context_line":"[stats]"}],"source_content_type":"application/octet-stream","patch_set":14,"id":"7adec928_cce14d00","line":1256,"in_reply_to":"7adec928_ac7b217a","updated":"2014-05-21 03:09:36.000000000","message":"I never actually intended to change this. i suspect it\u0027s an artifact from running tox -e sample_config","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"}],"keystone/auth/controllers.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"815baaeae685568f9920ee512f086de24da330ec","unresolved":false,"context_lines":[{"line_number":353,"context_line":"        if federation.IDENTITY_PROVIDER in auth_context:"},{"line_number":354,"context_line":"            return"},{"line_number":355,"context_line":""},{"line_number":356,"context_line":"        # Skip scoping when unscoped federated token is being issued"},{"line_number":357,"context_line":"        if \u0027issuer\u0027 in auth_context:"},{"line_number":358,"context_line":"            return"},{"line_number":359,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAWH%2F%2BPa4%3D","line":356,"updated":"2014-03-28 06:23:36.000000000","message":"if we use full federation flow, then we can remove this.","commit_id":"db2caf37c1e607452d4b740f15c75112d32f6fff"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7499c5a47ea2470cb9a094fd8a214e93227bc177","unresolved":false,"context_lines":[{"line_number":353,"context_line":"        if federation.IDENTITY_PROVIDER in auth_context:"},{"line_number":354,"context_line":"            return"},{"line_number":355,"context_line":""},{"line_number":356,"context_line":"        # Skip scoping when unscoped federated token is being issued"},{"line_number":357,"context_line":"        if \u0027issuer\u0027 in auth_context:"},{"line_number":358,"context_line":"            return"},{"line_number":359,"context_line":""}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAWH%2F9Xtw%3D","line":356,"in_reply_to":"AAAAWH%2F%2BPa4%3D","updated":"2014-04-05 03:57:39.000000000","message":"Done","commit_id":"db2caf37c1e607452d4b740f15c75112d32f6fff"}],"keystone/auth/plugins/oidc.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"815baaeae685568f9920ee512f086de24da330ec","unresolved":false,"context_lines":[{"line_number":35,"context_line":"    method \u003d \u0027oidc\u0027"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"    # Constant for OIDC"},{"line_number":38,"context_line":"    KS_REDIRECT \u003d \u0027http://10.0.2.15:5000/\u0027 + \u0027v3/auth/redirect\u0027"},{"line_number":39,"context_line":"    IMPLICIT_RESP_TYPE \u003d \u0027id_token token\u0027"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    def authenticate(self, context, auth_payload, auth_context):"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAWH%2F%2BPeI%3D","line":38,"updated":"2014-03-28 06:23:36.000000000","message":"use CONF.public_url","commit_id":"db2caf37c1e607452d4b740f15c75112d32f6fff"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"815baaeae685568f9920ee512f086de24da330ec","unresolved":false,"context_lines":[{"line_number":38,"context_line":"    KS_REDIRECT \u003d \u0027http://10.0.2.15:5000/\u0027 + \u0027v3/auth/redirect\u0027"},{"line_number":39,"context_line":"    IMPLICIT_RESP_TYPE \u003d \u0027id_token token\u0027"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    def authenticate(self, context, auth_payload, auth_context):"},{"line_number":42,"context_line":"        client_id \u003d auth_payload[\u0027client_id\u0027]"},{"line_number":43,"context_line":"        scope \u003d auth_payload[\u0027scope\u0027]"},{"line_number":44,"context_line":"        mapping_id \u003d auth_payload[\u0027mapping_id\u0027]"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAWH%2F%2BPeY%3D","line":41,"updated":"2014-03-28 06:23:36.000000000","message":"should probably split this up to getting an unscoped/scoped token. this way a user can figure out what projects/domains he/she has access to.\n\ntreat it the same way as saml plugin","commit_id":"db2caf37c1e607452d4b740f15c75112d32f6fff"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7499c5a47ea2470cb9a094fd8a214e93227bc177","unresolved":false,"context_lines":[{"line_number":38,"context_line":"    KS_REDIRECT \u003d \u0027http://10.0.2.15:5000/\u0027 + \u0027v3/auth/redirect\u0027"},{"line_number":39,"context_line":"    IMPLICIT_RESP_TYPE \u003d \u0027id_token token\u0027"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"    def authenticate(self, context, auth_payload, auth_context):"},{"line_number":42,"context_line":"        client_id \u003d auth_payload[\u0027client_id\u0027]"},{"line_number":43,"context_line":"        scope \u003d auth_payload[\u0027scope\u0027]"},{"line_number":44,"context_line":"        mapping_id \u003d auth_payload[\u0027mapping_id\u0027]"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAWH%2F9Xto%3D","line":41,"in_reply_to":"AAAAWH%2F%2BPeY%3D","updated":"2014-04-05 03:57:39.000000000","message":"Done","commit_id":"db2caf37c1e607452d4b740f15c75112d32f6fff"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"815baaeae685568f9920ee512f086de24da330ec","unresolved":false,"context_lines":[{"line_number":43,"context_line":"        scope \u003d auth_payload[\u0027scope\u0027]"},{"line_number":44,"context_line":"        mapping_id \u003d auth_payload[\u0027mapping_id\u0027]"},{"line_number":45,"context_line":"        user_auth \u003d (auth_payload[\u0027user\u0027], auth_payload[\u0027password\u0027])"},{"line_number":46,"context_line":"        #auth_url \u003d CONF.oidc.auth_url"},{"line_number":47,"context_line":"        auth_url \u003d \u0027https://localhost:8020/oidc/v10/providers/OP/authorize\u0027"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"        # Create OIDC params to send to OP"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAWH%2F%2BPc0%3D","line":46,"updated":"2014-03-28 06:23:36.000000000","message":"add these to CONF.config","commit_id":"db2caf37c1e607452d4b740f15c75112d32f6fff"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"2610c9d08e53c037841d927c3d0e9501b36a846e","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        mapping_id \u003d auth_payload[\u0027mapping_id\u0027]"},{"line_number":45,"context_line":"        user_auth \u003d (auth_payload[\u0027user\u0027], auth_payload[\u0027password\u0027])"},{"line_number":46,"context_line":"        #auth_url \u003d CONF.oidc.auth_url"},{"line_number":47,"context_line":"        auth_url \u003d \u0027https://localhost:8020/oidc/v10/providers/OP/authorize\u0027"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"        # Create OIDC params to send to OP"},{"line_number":50,"context_line":"        auth_params \u003d {\u0027client_id\u0027: client_id, \u0027scope\u0027: scope,"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAWH%2F%2BMto%3D","line":47,"updated":"2014-03-28 16:45:58.000000000","message":"what service is this URL pointing at ? I\u0027d like to test your code with my own setup, so I need to know what extra services I need to deploy","commit_id":"db2caf37c1e607452d4b740f15c75112d32f6fff"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7499c5a47ea2470cb9a094fd8a214e93227bc177","unresolved":false,"context_lines":[{"line_number":44,"context_line":"        mapping_id \u003d auth_payload[\u0027mapping_id\u0027]"},{"line_number":45,"context_line":"        user_auth \u003d (auth_payload[\u0027user\u0027], auth_payload[\u0027password\u0027])"},{"line_number":46,"context_line":"        #auth_url \u003d CONF.oidc.auth_url"},{"line_number":47,"context_line":"        auth_url \u003d \u0027https://localhost:8020/oidc/v10/providers/OP/authorize\u0027"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"        # Create OIDC params to send to OP"},{"line_number":50,"context_line":"        auth_params \u003d {\u0027client_id\u0027: client_id, \u0027scope\u0027: scope,"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAWH%2F%2BK1I%3D","line":47,"in_reply_to":"AAAAWH%2F%2BMto%3D","updated":"2014-03-28 16:56:24.000000000","message":"Hey Matthieu, I intend to make that url configurable, but we have it pointing to (in open id connect terms) an authorization endpoint.\n\nYou can see more information here: https://developers.google.com/accounts/docs/OAuth2Login#sendauthrequest\n\nFor Google, it would be: https://accounts.google.com/o/oauth2/auth\n\nTo get things started, I set up my own with, which is why i used the value that you see there.","commit_id":"db2caf37c1e607452d4b740f15c75112d32f6fff"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"815baaeae685568f9920ee512f086de24da330ec","unresolved":false,"context_lines":[{"line_number":92,"context_line":"            # about the mapping and claim structure"},{"line_number":93,"context_line":"            claims[\u0027cn\u0027] \u003d \";\".join([ldap.dn.str2dn(dn)[0][0][1]"},{"line_number":94,"context_line":"                                    for dn in claims[\u0027groupIds\u0027]])"},{"line_number":95,"context_line":"            mapping \u003d self.federation_api.get_mapping(mapping_id)"},{"line_number":96,"context_line":"            rules \u003d jsonutils.loads(mapping[\u0027rules\u0027])"},{"line_number":97,"context_line":"            rule_processor \u003d utils.RuleProcessor(rules)"},{"line_number":98,"context_line":"            mapped_properties \u003d rule_processor.process(claims)"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAWH%2F%2BPds%3D","line":95,"updated":"2014-03-28 06:23:36.000000000","message":"this is just temporary, as it should mimic the saml2 plugin, where the admin must create an idp/protocol, and associate it with a mapping.","commit_id":"db2caf37c1e607452d4b740f15c75112d32f6fff"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"3bae883fa0bfcb6a2bfdfce5a8e8ac30a8f20237","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    def authenticate(self, context, auth_payload, auth_context):"},{"line_number":60,"context_line":"        \"\"\"Authenticate federated user and return an authentication context."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"        :param context: keystone\u0027s request context"},{"line_number":63,"context_line":"        :param auth_payload: the content of the authentication for a"},{"line_number":64,"context_line":"                             given method"},{"line_number":65,"context_line":"        :param auth_context: user authentication context, a dictionary"}],"source_content_type":"text/x-python","patch_set":13,"id":"7adec928_a6ebaa76","line":62,"updated":"2014-05-17 17:06:08.000000000","message":"Keystone*","commit_id":"f1680471bd3b8b2f108ad6640876e349dd93ade5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4e6940a714af0a17802d1ca060b771e82b92b066","unresolved":false,"context_lines":[{"line_number":59,"context_line":"    def authenticate(self, context, auth_payload, auth_context):"},{"line_number":60,"context_line":"        \"\"\"Authenticate federated user and return an authentication context."},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"        :param context: keystone\u0027s request context"},{"line_number":63,"context_line":"        :param auth_payload: the content of the authentication for a"},{"line_number":64,"context_line":"                             given method"},{"line_number":65,"context_line":"        :param auth_context: user authentication context, a dictionary"}],"source_content_type":"text/x-python","patch_set":13,"id":"7adec928_b3246a0f","line":62,"in_reply_to":"7adec928_a6ebaa76","updated":"2014-05-20 19:54:53.000000000","message":"Done","commit_id":"f1680471bd3b8b2f108ad6640876e349dd93ade5"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"e87f580805c5a06092fcd98f7e887ec2a941340f","unresolved":false,"context_lines":[{"line_number":93,"context_line":"        ldap_key \u003d CONF.oidc.ldap_group_key"},{"line_number":94,"context_line":"        claim_key \u003d CONF.oidc.claim_group_key"},{"line_number":95,"context_line":"        assertion \u003d dict()"},{"line_number":96,"context_line":"        assertion[ldap_key] \u003d \";\".join([ldap.dn.str2dn(dn)[0][0][1]"},{"line_number":97,"context_line":"                                        for dn in claims[claim_key]])"},{"line_number":98,"context_line":"        mapped_properties \u003d rule_processor.process(assertion)"},{"line_number":99,"context_line":"        utils.validate_groups(mapped_properties[\u0027group_ids\u0027], mapping[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":13,"id":"7adec928_d8cbeb6f","line":96,"updated":"2014-05-20 03:07:48.000000000","message":"LDAP seems like a very specific implementation.  We were looking into Facebook support, and I suspect that is going to look very different, but we can probably start with this and then move on.","commit_id":"f1680471bd3b8b2f108ad6640876e349dd93ade5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"4e6940a714af0a17802d1ca060b771e82b92b066","unresolved":false,"context_lines":[{"line_number":93,"context_line":"        ldap_key \u003d CONF.oidc.ldap_group_key"},{"line_number":94,"context_line":"        claim_key \u003d CONF.oidc.claim_group_key"},{"line_number":95,"context_line":"        assertion \u003d dict()"},{"line_number":96,"context_line":"        assertion[ldap_key] \u003d \";\".join([ldap.dn.str2dn(dn)[0][0][1]"},{"line_number":97,"context_line":"                                        for dn in claims[claim_key]])"},{"line_number":98,"context_line":"        mapped_properties \u003d rule_processor.process(assertion)"},{"line_number":99,"context_line":"        utils.validate_groups(mapped_properties[\u0027group_ids\u0027], mapping[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":13,"id":"7adec928_33785af8","line":96,"in_reply_to":"7adec928_d8cbeb6f","updated":"2014-05-20 19:54:53.000000000","message":"I got rid of all the LDAP specific nonsense","commit_id":"f1680471bd3b8b2f108ad6640876e349dd93ade5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"f4b53b224ca6304458414eb9f549300d633ab6ab","unresolved":false,"context_lines":[{"line_number":93,"context_line":"        ldap_key \u003d CONF.oidc.ldap_group_key"},{"line_number":94,"context_line":"        claim_key \u003d CONF.oidc.claim_group_key"},{"line_number":95,"context_line":"        assertion \u003d dict()"},{"line_number":96,"context_line":"        assertion[ldap_key] \u003d \";\".join([ldap.dn.str2dn(dn)[0][0][1]"},{"line_number":97,"context_line":"                                        for dn in claims[claim_key]])"},{"line_number":98,"context_line":"        mapped_properties \u003d rule_processor.process(assertion)"},{"line_number":99,"context_line":"        utils.validate_groups(mapped_properties[\u0027group_ids\u0027], mapping[\u0027id\u0027],"}],"source_content_type":"text/x-python","patch_set":13,"id":"7adec928_dbce8559","line":96,"in_reply_to":"7adec928_d8cbeb6f","updated":"2014-05-20 05:07:46.000000000","message":"You\u0027re totally right.\n\nOn the last day at the summit, I was actually walking dstanek through the code, and realized that I was only doing this because the mapping I was using was flawed. \n\nIn the mapping that I was using, I was looking for just the dn. But, if I had created the mapping correctly (using the fully qualified cn), then I could handle the returned data as if it\u0027s just a list of unique groupIDs. \n\nI\u0027ll update the code soon.","commit_id":"f1680471bd3b8b2f108ad6640876e349dd93ade5"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"de5fc9bb44244d379ab8831877a6c7fde9fb73ff","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"        claim_key \u003d CONF.oidc.claim_group_key"},{"line_number":104,"context_line":"        assertion \u003d dict()"},{"line_number":105,"context_line":"        assertion[\u0027REMOTE_GROUP\u0027] \u003d \";\".join(claims[claim_key])"},{"line_number":106,"context_line":"        mapped_properties \u003d rule_processor.process(assertion)"},{"line_number":107,"context_line":"        utils.validate_groups(mapped_properties[\u0027group_ids\u0027], mapping[\u0027id\u0027],"},{"line_number":108,"context_line":"                              self.identity_api)"}],"source_content_type":"text/x-python","patch_set":16,"id":"1ae5cdf2_3076843f","line":105,"updated":"2014-05-30 09:02:39.000000000","message":"I am guessing this is a list of groups the user is a member of, created from the openid claim. Why should we assume that such claim will contain a list of groups?","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bbd8d6d496eb48cc509f143eebe8968d26784452","unresolved":false,"context_lines":[{"line_number":114,"context_line":"            federation.PROTOCOL: protocol"},{"line_number":115,"context_line":"        }"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    def _perform_handshake(self, auth_payload):"},{"line_number":118,"context_line":"        client_id \u003d auth_payload[\u0027client_id\u0027]"},{"line_number":119,"context_line":"        scope \u003d auth_payload[\u0027scope\u0027]"},{"line_number":120,"context_line":"        user_auth \u003d (auth_payload[\u0027user\u0027], auth_payload[\u0027password\u0027])"}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_fcfcac40","line":117,"updated":"2014-05-29 07:49:49.000000000","message":"some docstring with more detailed explanation could be useful.","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46d6c8d39864a9fdc9560ea67c1b7dfa56719f61","unresolved":false,"context_lines":[{"line_number":114,"context_line":"            federation.PROTOCOL: protocol"},{"line_number":115,"context_line":"        }"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"    def _perform_handshake(self, auth_payload):"},{"line_number":118,"context_line":"        client_id \u003d auth_payload[\u0027client_id\u0027]"},{"line_number":119,"context_line":"        scope \u003d auth_payload[\u0027scope\u0027]"},{"line_number":120,"context_line":"        user_auth \u003d (auth_payload[\u0027user\u0027], auth_payload[\u0027password\u0027])"}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_b8ff82a9","line":117,"in_reply_to":"3ae8d1ca_fcfcac40","updated":"2014-05-29 16:28:06.000000000","message":"I can add more detail","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bbd8d6d496eb48cc509f143eebe8968d26784452","unresolved":false,"context_lines":[{"line_number":117,"context_line":"    def _perform_handshake(self, auth_payload):"},{"line_number":118,"context_line":"        client_id \u003d auth_payload[\u0027client_id\u0027]"},{"line_number":119,"context_line":"        scope \u003d auth_payload[\u0027scope\u0027]"},{"line_number":120,"context_line":"        user_auth \u003d (auth_payload[\u0027user\u0027], auth_payload[\u0027password\u0027])"},{"line_number":121,"context_line":"        auth_url \u003d CONF.oidc.auth_url"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"        # Create OIDC params to send to OpendID Connect Provider"}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_1c8f98cd","line":120,"updated":"2014-05-29 07:49:49.000000000","message":"So what credentials should be sent here? My Google ones? I don\u0027t really think it\u0027s a good idea to send my Google credentials to any service other than Google...\nI think in classic openid such credentials are sent only between a client and openid server (provider).","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46d6c8d39864a9fdc9560ea67c1b7dfa56719f61","unresolved":false,"context_lines":[{"line_number":117,"context_line":"    def _perform_handshake(self, auth_payload):"},{"line_number":118,"context_line":"        client_id \u003d auth_payload[\u0027client_id\u0027]"},{"line_number":119,"context_line":"        scope \u003d auth_payload[\u0027scope\u0027]"},{"line_number":120,"context_line":"        user_auth \u003d (auth_payload[\u0027user\u0027], auth_payload[\u0027password\u0027])"},{"line_number":121,"context_line":"        auth_url \u003d CONF.oidc.auth_url"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"        # Create OIDC params to send to OpendID Connect Provider"}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_981ba61a","line":120,"in_reply_to":"3ae8d1ca_1c8f98cd","updated":"2014-05-29 16:28:06.000000000","message":"I remember reading somewhere that this was OK to do if you\u0027re doing implicit authorization... let me dig it up. Can\u0027t find it in the spec atm.","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"005e41c53f0a66a3aeaeedbd0f7c515cb62d0c2f","unresolved":false,"context_lines":[{"line_number":117,"context_line":"    def _perform_handshake(self, auth_payload):"},{"line_number":118,"context_line":"        client_id \u003d auth_payload[\u0027client_id\u0027]"},{"line_number":119,"context_line":"        scope \u003d auth_payload[\u0027scope\u0027]"},{"line_number":120,"context_line":"        user_auth \u003d (auth_payload[\u0027user\u0027], auth_payload[\u0027password\u0027])"},{"line_number":121,"context_line":"        auth_url \u003d CONF.oidc.auth_url"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"        # Create OIDC params to send to OpendID Connect Provider"}],"source_content_type":"text/x-python","patch_set":16,"id":"1ae5cdf2_0d5b3355","line":120,"in_reply_to":"3ae8d1ca_981ba61a","updated":"2014-05-30 08:57:00.000000000","message":"Please, do. I think it\u0027s extremely important to clarify on this.\nOtherwise we will get tons of compaints from security teams.\n\nAlso, since openid itself doesn\u0027t specify that user should authenticate via http basicauth I can easily imagine an idp enforcing x509 authn.","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bbd8d6d496eb48cc509f143eebe8968d26784452","unresolved":false,"context_lines":[{"line_number":128,"context_line":"                       \u0027response_type\u0027: self.IMPLICIT_RESP_TYPE,"},{"line_number":129,"context_line":"                       \u0027redirect_uri\u0027: CONF.oidc.redirect_url}"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"        r \u003d requests.get(auth_url, params\u003dauth_params, auth\u003duser_auth,"},{"line_number":132,"context_line":"                         verify\u003dFalse, allow_redirects\u003dTrue)"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if r.status_code \u003d\u003d 204 and r.history[0].status_code \u003d\u003d 302:"}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_fcf2ec98","line":131,"updated":"2014-05-29 07:49:49.000000000","message":"By setting auth\u003duser_auth you assume the Http Basic Auth method will be used.\nI don\u0027t think this is a right assumption unless openid spec specifies that. If it does, please paste a link for that spec.","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"005e41c53f0a66a3aeaeedbd0f7c515cb62d0c2f","unresolved":false,"context_lines":[{"line_number":128,"context_line":"                       \u0027response_type\u0027: self.IMPLICIT_RESP_TYPE,"},{"line_number":129,"context_line":"                       \u0027redirect_uri\u0027: CONF.oidc.redirect_url}"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"        r \u003d requests.get(auth_url, params\u003dauth_params, auth\u003duser_auth,"},{"line_number":132,"context_line":"                         verify\u003dFalse, allow_redirects\u003dTrue)"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if r.status_code \u003d\u003d 204 and r.history[0].status_code \u003d\u003d 302:"}],"source_content_type":"text/x-python","patch_set":16,"id":"1ae5cdf2_9052f811","line":131,"in_reply_to":"3ae8d1ca_f8a58ab5","updated":"2014-05-30 08:57:00.000000000","message":"I suspect the story is just like in SAML world - it\u0027s up to IdP (or however you call it in openid) admins how their users will authenticate - it can be basicauth, x509 certificate, and almost everything. I think what we should do is to let Keystone use many authn methods, by creating a pluggable mechanism. This is how I want to make it work for SAML in python-keystoneclient (and I strongly believe this part for openid should also be moved to keystoneclient).","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46d6c8d39864a9fdc9560ea67c1b7dfa56719f61","unresolved":false,"context_lines":[{"line_number":128,"context_line":"                       \u0027response_type\u0027: self.IMPLICIT_RESP_TYPE,"},{"line_number":129,"context_line":"                       \u0027redirect_uri\u0027: CONF.oidc.redirect_url}"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"        r \u003d requests.get(auth_url, params\u003dauth_params, auth\u003duser_auth,"},{"line_number":132,"context_line":"                         verify\u003dFalse, allow_redirects\u003dTrue)"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if r.status_code \u003d\u003d 204 and r.history[0].status_code \u003d\u003d 302:"}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_f8a58ab5","line":131,"in_reply_to":"3ae8d1ca_fcf2ec98","updated":"2014-05-29 16:28:06.000000000","message":"Yeah, I\u0027m re-reading the spec now and it says that the auth method used is out of the scope of the spec. So I\u0027m wondering what about other auth methods (session cookie or token)...","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"bbd8d6d496eb48cc509f143eebe8968d26784452","unresolved":false,"context_lines":[{"line_number":129,"context_line":"                       \u0027redirect_uri\u0027: CONF.oidc.redirect_url}"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"        r \u003d requests.get(auth_url, params\u003dauth_params, auth\u003duser_auth,"},{"line_number":132,"context_line":"                         verify\u003dFalse, allow_redirects\u003dTrue)"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if r.status_code \u003d\u003d 204 and r.history[0].status_code \u003d\u003d 302:"},{"line_number":135,"context_line":"            data \u003d parse.parse_qs(parse.urlparse(r.url).fragment)"}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_77f435f2","line":132,"updated":"2014-05-29 07:49:49.000000000","message":"openid requires to send the critical data over TLS and not veryfing ssl certificates doesn\u0027t meet the openid requirements?","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"005e41c53f0a66a3aeaeedbd0f7c515cb62d0c2f","unresolved":false,"context_lines":[{"line_number":129,"context_line":"                       \u0027redirect_uri\u0027: CONF.oidc.redirect_url}"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"        r \u003d requests.get(auth_url, params\u003dauth_params, auth\u003duser_auth,"},{"line_number":132,"context_line":"                         verify\u003dFalse, allow_redirects\u003dTrue)"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if r.status_code \u003d\u003d 204 and r.history[0].status_code \u003d\u003d 302:"},{"line_number":135,"context_line":"            data \u003d parse.parse_qs(parse.urlparse(r.url).fragment)"}],"source_content_type":"text/x-python","patch_set":16,"id":"1ae5cdf2_f067bce8","line":132,"in_reply_to":"3ae8d1ca_3881b24a","updated":"2014-05-30 08:57:00.000000000","message":"understood, just wanted to keep the heads up that it should not be merged in this shape. We can leave it for *now*, but maybe some NOTE(), FIXME() could be added?","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"46d6c8d39864a9fdc9560ea67c1b7dfa56719f61","unresolved":false,"context_lines":[{"line_number":129,"context_line":"                       \u0027redirect_uri\u0027: CONF.oidc.redirect_url}"},{"line_number":130,"context_line":""},{"line_number":131,"context_line":"        r \u003d requests.get(auth_url, params\u003dauth_params, auth\u003duser_auth,"},{"line_number":132,"context_line":"                         verify\u003dFalse, allow_redirects\u003dTrue)"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if r.status_code \u003d\u003d 204 and r.history[0].status_code \u003d\u003d 302:"},{"line_number":135,"context_line":"            data \u003d parse.parse_qs(parse.urlparse(r.url).fragment)"}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_3881b24a","line":132,"in_reply_to":"3ae8d1ca_77f435f2","updated":"2014-05-29 16:28:06.000000000","message":"you\u0027re right, it must be checked.\n\nI had it set to false for my own purposes.","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"2faf9c70a63ef01fd77582d7ccb88ae634524eee","unresolved":false,"context_lines":[{"line_number":131,"context_line":"        r \u003d requests.get(auth_url, params\u003dauth_params, auth\u003duser_auth,"},{"line_number":132,"context_line":"                         verify\u003dFalse, allow_redirects\u003dTrue)"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"        if r.status_code \u003d\u003d 204 and r.history[0].status_code \u003d\u003d 302:"},{"line_number":135,"context_line":"            data \u003d parse.parse_qs(parse.urlparse(r.url).fragment)"},{"line_number":136,"context_line":"            id_token \u003d data[\u0027id_token\u0027][0]"},{"line_number":137,"context_line":"            access_token \u003d data[\u0027access_token\u0027][0]"}],"source_content_type":"text/x-python","patch_set":16,"id":"1ae5cdf2_4c2ff4a1","line":134,"updated":"2014-05-30 14:04:06.000000000","message":"Did you have to do something specific to use history here?  \n\nI\u0027m trying this locally but I don\u0027t seem to have any of the previous responses.","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"}],"keystone/auth/routers.py":[{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"73142699133133587e66ef0a72b90f5b9eb12323","unresolved":false,"context_lines":[{"line_number":34,"context_line":"                   controller\u003dauth_controller,"},{"line_number":35,"context_line":"                   action\u003d\u0027validate_token\u0027,"},{"line_number":36,"context_line":"                   conditions\u003ddict(method\u003d[\u0027GET\u0027]))"},{"line_number":37,"context_line":"    mapper.connect(\u0027/auth/redirect\u0027,"},{"line_number":38,"context_line":"                   controller\u003dauth_controller,"},{"line_number":39,"context_line":"                   action\u003d\u0027redirect\u0027,"},{"line_number":40,"context_line":"                   conditions\u003ddict(method\u003d[\u0027GET\u0027]))"}],"source_content_type":"text/x-python","patch_set":14,"id":"7adec928_cca94de1","line":37,"updated":"2014-05-21 02:52:48.000000000","message":"is there a spec change for this new API?","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e681ae3882bff302e98ab528966ca33331b3a22c","unresolved":false,"context_lines":[{"line_number":34,"context_line":"                   controller\u003dauth_controller,"},{"line_number":35,"context_line":"                   action\u003d\u0027validate_token\u0027,"},{"line_number":36,"context_line":"                   conditions\u003ddict(method\u003d[\u0027GET\u0027]))"},{"line_number":37,"context_line":"    mapper.connect(\u0027/auth/redirect\u0027,"},{"line_number":38,"context_line":"                   controller\u003dauth_controller,"},{"line_number":39,"context_line":"                   action\u003d\u0027redirect\u0027,"},{"line_number":40,"context_line":"                   conditions\u003ddict(method\u003d[\u0027GET\u0027]))"}],"source_content_type":"text/x-python","patch_set":14,"id":"7adec928_ccb86de8","line":37,"in_reply_to":"7adec928_cca94de1","updated":"2014-05-21 03:09:36.000000000","message":"I can add this, but it might be easier if I added it to the OS-FEDERATION extension instead. Rather than mucking around with a core API","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"}],"keystone/contrib/federation/controllers.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"34d324be1dd63d745717e9d868cea93dc225a626","unresolved":false,"context_lines":[{"line_number":230,"context_line":""},{"line_number":231,"context_line":"class Auth(auth_controllers.Auth):"},{"line_number":232,"context_line":""},{"line_number":233,"context_line":"    def federated_authentication(self, context, identity_provider, protocol, auth):"},{"line_number":234,"context_line":"        \"\"\"Authenticate from dedicated url endpoint."},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"        Build HTTP request body for federated authentication and inject"}],"source_content_type":"text/x-python","patch_set":14,"id":"7adec928_88fd7871","line":233,"updated":"2014-05-20 20:51:26.000000000","message":"might have to default auth to None.","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"34d324be1dd63d745717e9d868cea93dc225a626","unresolved":false,"context_lines":[{"line_number":247,"context_line":"                    }"},{"line_number":248,"context_line":"                }"},{"line_number":249,"context_line":"            }"},{"line_number":250,"context_line":"        else:"},{"line_number":251,"context_line":"            method_name \u003d auth[\u0027identity\u0027][\u0027methods\u0027][0]"},{"line_number":252,"context_line":"            auth[\u0027identity\u0027][method_name][\u0027identity_provider\u0027] \u003d identity_provider"},{"line_number":253,"context_line":"            auth[\u0027identity\u0027][method_name][\u0027protocol\u0027] \u003d protocol"}],"source_content_type":"text/x-python","patch_set":14,"id":"7adec928_a8395443","line":250,"updated":"2014-05-20 20:51:26.000000000","message":"I am thinking of making this change in a different patch.","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"77c709cfde781ae4525feb7631080adfc11f05ee","unresolved":false,"context_lines":[{"line_number":259,"context_line":"        return self.authenticate_for_token(context, auth\u003dauth)"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"    def redirect(self, context):"},{"line_number":262,"context_line":"        # TODO(stevemar): is there any validation needed here?"},{"line_number":263,"context_line":"        LOG.warning(\"Handling redirect\")"},{"line_number":264,"context_line":""},{"line_number":265,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_2f47ca1e","line":262,"updated":"2014-05-28 19:11:26.000000000","message":"What uses this?","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8661bd89e374a8356d8e918d9040e53f0f179f27","unresolved":false,"context_lines":[{"line_number":259,"context_line":"        return self.authenticate_for_token(context, auth\u003dauth)"},{"line_number":260,"context_line":""},{"line_number":261,"context_line":"    def redirect(self, context):"},{"line_number":262,"context_line":"        # TODO(stevemar): is there any validation needed here?"},{"line_number":263,"context_line":"        LOG.warning(\"Handling redirect\")"},{"line_number":264,"context_line":""},{"line_number":265,"context_line":""}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_2ae33806","line":262,"in_reply_to":"3ae8d1ca_2f47ca1e","updated":"2014-05-28 19:36:23.000000000","message":"This is the one part of the spec that I\u0027m unclear about:\n\nThere is more detail here: http://openid.net/specs/openid-connect-implicit-1_0.html#AuthenticationRequest\n\nAnd the OpenID Connect provider I am using, I have to give it a value for redirect.\n\nIt\u0027s part of the request on line 129 in keystone/auth/plugins/oidc.py \n\nI\u0027ve defaulted it to http://localhost:5000/v3/OS-FEDERATION/redirect","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"}],"keystone/contrib/federation/utils.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"34d324be1dd63d745717e9d868cea93dc225a626","unresolved":false,"context_lines":[{"line_number":403,"context_line":"            return False"},{"line_number":404,"context_line":""},{"line_number":405,"context_line":"        if regex:"},{"line_number":406,"context_line":"            for value in values:"},{"line_number":407,"context_line":"                for assertion_value in assertion_values:"},{"line_number":408,"context_line":"                    if re.search(value, assertion_value):"},{"line_number":409,"context_line":"                        return True"}],"source_content_type":"text/x-python","patch_set":14,"id":"7adec928_084888cb","line":406,"updated":"2014-05-20 20:51:26.000000000","message":"this is really a bug in the old regex handler part of the mapping engine","commit_id":"5ee3a7520630a74d747d41faadac76078da8ff9a"}],"keystone/token/providers/common.py":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"815baaeae685568f9920ee512f086de24da330ec","unresolved":false,"context_lines":[{"line_number":492,"context_line":""},{"line_number":493,"context_line":"        return (token_id, token_data)"},{"line_number":494,"context_line":""},{"line_number":495,"context_line":"    def _handle_oidc_tokens(self, auth_context, project_id, domain_id):"},{"line_number":496,"context_line":"        user_id \u003d auth_context[\u0027user_id\u0027]"},{"line_number":497,"context_line":"        issuer \u003d auth_context[\u0027issuer\u0027]"},{"line_number":498,"context_line":"        group_ids \u003d auth_context[\u0027group_ids\u0027]"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAWH%2F%2BPbE%3D","line":495,"updated":"2014-03-28 06:23:36.000000000","message":"might be able to just use the saml2 handler, add in some extra code to add the issuer.","commit_id":"db2caf37c1e607452d4b740f15c75112d32f6fff"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"77c709cfde781ae4525feb7631080adfc11f05ee","unresolved":false,"context_lines":[{"line_number":421,"context_line":""},{"line_number":422,"context_line":"        token_ref \u003d None"},{"line_number":423,"context_line":"        if \u0027saml2\u0027 in method_names or \u0027oidc\u0027 in method_names:"},{"line_number":424,"context_line":"            token_ref \u003d self._handle_saml2_tokens(auth_context, project_id,"},{"line_number":425,"context_line":"                                                  domain_id)"},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"        access_token \u003d None"}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_6f68f287","line":424,"updated":"2014-05-28 19:11:26.000000000","message":"This this method name still correct? _handle_saml2_tokens?","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"8661bd89e374a8356d8e918d9040e53f0f179f27","unresolved":false,"context_lines":[{"line_number":421,"context_line":""},{"line_number":422,"context_line":"        token_ref \u003d None"},{"line_number":423,"context_line":"        if \u0027saml2\u0027 in method_names or \u0027oidc\u0027 in method_names:"},{"line_number":424,"context_line":"            token_ref \u003d self._handle_saml2_tokens(auth_context, project_id,"},{"line_number":425,"context_line":"                                                  domain_id)"},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"        access_token \u003d None"}],"source_content_type":"text/x-python","patch_set":16,"id":"3ae8d1ca_cacbb4a3","line":424,"in_reply_to":"3ae8d1ca_6f68f287","updated":"2014-05-28 19:36:23.000000000","message":"yep, i\u0027m re-using that function, since it\u0027s the same process (scoped to unscoped tokens)\n\nwe should probably rename it to handle_federation_tokens or something like that, if we plan on handling different federation protocols the same way.","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"aab92246c80c8fd1bf19a9c420259a753114bceb","unresolved":false,"context_lines":[{"line_number":421,"context_line":""},{"line_number":422,"context_line":"        token_ref \u003d None"},{"line_number":423,"context_line":"        if \u0027saml2\u0027 in method_names or \u0027oidc\u0027 in method_names:"},{"line_number":424,"context_line":"            token_ref \u003d self._handle_saml2_tokens(auth_context, project_id,"},{"line_number":425,"context_line":"                                                  domain_id)"},{"line_number":426,"context_line":""},{"line_number":427,"context_line":"        access_token \u003d None"}],"source_content_type":"text/x-python","patch_set":16,"id":"1ae5cdf2_36791730","line":424,"in_reply_to":"3ae8d1ca_cacbb4a3","updated":"2014-05-30 12:59:57.000000000","message":"@steve ++","commit_id":"9be8b648fffe0049d5f750c0b90d65a5b4683309"}]}