)]}'
{"doc/source/admin/federation/configure_federation.rst":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f2d061e43a877cce3488e4d12a491f78e82dd21c","unresolved":false,"context_lines":[{"line_number":337,"context_line":".. FIXME(cmurphy): Include examples for OpenID Connect authentication with the CLI"},{"line_number":338,"context_line":""},{"line_number":339,"context_line":"The ``python-openstackclient`` can be used to authenticate a federated user in a"},{"line_number":340,"context_line":"SAML Identity Provider to keystone. The SAML Identity Provider must be"},{"line_number":341,"context_line":"configured to support ECP."},{"line_number":342,"context_line":""},{"line_number":343,"context_line":".. note::"},{"line_number":344,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ffd0ebdf_a94b4385","line":341,"range":{"start_line":340,"start_character":36,"end_line":341,"end_character":26},"updated":"2019-01-03 21:03:30.000000000","message":"Should we keep this if we call it out specifically in a note?","commit_id":"b17a7fb80511eabec0bfc960e1f1ede3a109d1ee"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"61224c1ad277ebee89dcc47333daa621fead941c","unresolved":false,"context_lines":[{"line_number":337,"context_line":".. FIXME(cmurphy): Include examples for OpenID Connect authentication with the CLI"},{"line_number":338,"context_line":""},{"line_number":339,"context_line":"The ``python-openstackclient`` can be used to authenticate a federated user in a"},{"line_number":340,"context_line":"SAML Identity Provider to keystone. The SAML Identity Provider must be"},{"line_number":341,"context_line":"configured to support ECP."},{"line_number":342,"context_line":""},{"line_number":343,"context_line":".. note::"},{"line_number":344,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ffd0ebdf_3b279215","line":341,"range":{"start_line":340,"start_character":36,"end_line":341,"end_character":26},"in_reply_to":"ffd0ebdf_a94b4385","updated":"2019-01-04 09:02:30.000000000","message":"Done","commit_id":"b17a7fb80511eabec0bfc960e1f1ede3a109d1ee"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f2d061e43a877cce3488e4d12a491f78e82dd21c","unresolved":false,"context_lines":[{"line_number":359,"context_line":".. code-block:: console"},{"line_number":360,"context_line":""},{"line_number":361,"context_line":"   $ curl -s https://samltest.id/saml/idp | grep urn:oasis:names:tc:SAML:2.0:bindings:SOAP"},{"line_number":362,"context_line":"        \u003cSingleSignOnService Binding\u003d\"urn:oasis:names:tc:SAML:2.0:bindings:SOAP\" Location\u003d\"https://samltest.id/idp/profile/SAML2/SOAP/ECP\"/\u003e"},{"line_number":363,"context_line":""},{"line_number":364,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":365,"context_line":"Find available scopes"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ffd0ebdf_69455b70","line":362,"updated":"2019-01-03 21:03:30.000000000","message":"Handy","commit_id":"b17a7fb80511eabec0bfc960e1f1ede3a109d1ee"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f2d061e43a877cce3488e4d12a491f78e82dd21c","unresolved":false,"context_lines":[{"line_number":385,"context_line":".. warning::"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"   The CLI does not currently support querying access for the `system scope`_"},{"line_number":388,"context_line":"   although it is possible to assign federated users a role assignment on it."},{"line_number":389,"context_line":""},{"line_number":390,"context_line":".. _system scope: ../tokens-overview.html#system-scoped-tokens"},{"line_number":391,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ffd0ebdf_893f5fd5","line":388,"updated":"2019-01-03 21:03:30.000000000","message":"I\u0027m not sure I understand this bit. Is it specific to federated users?\n\nhttps://pasted.tech/pastes/809c5a9543c7da97a3b1d04c8f3f4e130ba3bad3.raw","commit_id":"b17a7fb80511eabec0bfc960e1f1ede3a109d1ee"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"61224c1ad277ebee89dcc47333daa621fead941c","unresolved":false,"context_lines":[{"line_number":385,"context_line":".. warning::"},{"line_number":386,"context_line":""},{"line_number":387,"context_line":"   The CLI does not currently support querying access for the `system scope`_"},{"line_number":388,"context_line":"   although it is possible to assign federated users a role assignment on it."},{"line_number":389,"context_line":""},{"line_number":390,"context_line":".. _system scope: ../tokens-overview.html#system-scoped-tokens"},{"line_number":391,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"ffd0ebdf_fb758afb","line":388,"in_reply_to":"ffd0ebdf_893f5fd5","updated":"2019-01-04 09:02:30.000000000","message":"I don\u0027t think a non-admin user can use that command to list their own assignments? The CLI exposes GET /v3/OS-FEDERATION/projects and GET /v3/OS-FEDERATION/domains, there\u0027s no such equivalent for system assignments and I don\u0027t think we ever converted the CLI to use the regular /v3/auth/{projects,domains,system}","commit_id":"b17a7fb80511eabec0bfc960e1f1ede3a109d1ee"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f2d061e43a877cce3488e4d12a491f78e82dd21c","unresolved":false,"context_lines":[{"line_number":585,"context_line":""},{"line_number":586,"context_line":".. image:: ../../_static/horizon-login-idp.png"},{"line_number":587,"context_line":"   :height: 175px"},{"line_number":588,"context_line":"   :alt: Horizon dropdown menu for switching between keystone providers"},{"line_number":589,"context_line":""},{"line_number":590,"context_line":".. include:: openidc.rst"},{"line_number":591,"context_line":".. include:: mellon.rst"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ffd0ebdf_0904cf16","line":588,"updated":"2019-01-03 21:03:30.000000000","message":"I\u0027m glad to see these get added/updated.","commit_id":"b17a7fb80511eabec0bfc960e1f1ede3a109d1ee"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"a972486377d24a09ab3afdbc297d76ee267e24dc","unresolved":false,"context_lines":[{"line_number":383,"context_line":""},{"line_number":384,"context_line":".. warning::"},{"line_number":385,"context_line":""},{"line_number":386,"context_line":"   The CLI does not currently support querying for one\u0027s own assignments on a"},{"line_number":387,"context_line":"   `system scope`_ although it is possible to assign federated users a role"},{"line_number":388,"context_line":"   assignment on it."},{"line_number":389,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ffd0ebdf_4307001e","line":386,"range":{"start_line":386,"start_character":7,"end_line":386,"end_character":10},"updated":"2019-01-04 18:17:58.000000000","message":"This just means that there isn\u0027t a ``openstack federation project list`` equivalent for system scope (e.g., ``openstack federation system list``)?","commit_id":"e8b870fe777a8fdeb649e15784a8f9f92a02a801"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a5f594f917356e561c00ada35871554fff031a7c","unresolved":false,"context_lines":[{"line_number":383,"context_line":""},{"line_number":384,"context_line":".. warning::"},{"line_number":385,"context_line":""},{"line_number":386,"context_line":"   The CLI does not currently support querying for one\u0027s own assignments on a"},{"line_number":387,"context_line":"   `system scope`_ although it is possible to assign federated users a role"},{"line_number":388,"context_line":"   assignment on it."},{"line_number":389,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"dfd5e7cf_f4184076","line":386,"range":{"start_line":386,"start_character":7,"end_line":386,"end_character":10},"in_reply_to":"dfd5e7cf_59a4e508","updated":"2019-01-07 15:29:52.000000000","message":"I think I\u0027d rather not suggest querying the API directly. What if I just remove this warning altogether and we quietly ignore the problem until the bug is resolved?","commit_id":"e8b870fe777a8fdeb649e15784a8f9f92a02a801"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9134be5a39288deeab505d564d41cdcd6cb74bd5","unresolved":false,"context_lines":[{"line_number":383,"context_line":""},{"line_number":384,"context_line":".. warning::"},{"line_number":385,"context_line":""},{"line_number":386,"context_line":"   The CLI does not currently support querying for one\u0027s own assignments on a"},{"line_number":387,"context_line":"   `system scope`_ although it is possible to assign federated users a role"},{"line_number":388,"context_line":"   assignment on it."},{"line_number":389,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"dfd5e7cf_749d3058","line":386,"range":{"start_line":386,"start_character":7,"end_line":386,"end_character":10},"in_reply_to":"dfd5e7cf_f4184076","updated":"2019-01-07 15:52:52.000000000","message":"Works for me.","commit_id":"e8b870fe777a8fdeb649e15784a8f9f92a02a801"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"dccdbeda94a0b85bb439a94bc0b2a81498fcebd2","unresolved":false,"context_lines":[{"line_number":383,"context_line":""},{"line_number":384,"context_line":".. warning::"},{"line_number":385,"context_line":""},{"line_number":386,"context_line":"   The CLI does not currently support querying for one\u0027s own assignments on a"},{"line_number":387,"context_line":"   `system scope`_ although it is possible to assign federated users a role"},{"line_number":388,"context_line":"   assignment on it."},{"line_number":389,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"dfd5e7cf_59a4e508","line":386,"range":{"start_line":386,"start_character":7,"end_line":386,"end_character":10},"in_reply_to":"dfd5e7cf_fa26f816","updated":"2019-01-07 15:01:12.000000000","message":"Hmm - looks like we don\u0027t have this in python-keystoneclient either [0].\n\nMaybe the best we can do for now is just open bugs against ksc and osc until those get implemented. Then we can update this later?\n\nIn the meantime, I\u0027m not sure if we should suggest querying the keystone API directly (GET /v3/auth/system) with a federated token, which might need testing since AFAICT there isn\u0027t a federated system-scoped payload [1].\n\n[0] http://git.openstack.org/cgit/openstack/python-keystoneclient/tree/keystoneclient/v3/auth.py#n25\n[1] https://git.openstack.org/cgit/openstack/keystone/tree/keystone/token/token_formatters.py#n846","commit_id":"e8b870fe777a8fdeb649e15784a8f9f92a02a801"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"6426866edd34911c65929a84847cb07c39287a7c","unresolved":false,"context_lines":[{"line_number":383,"context_line":""},{"line_number":384,"context_line":".. warning::"},{"line_number":385,"context_line":""},{"line_number":386,"context_line":"   The CLI does not currently support querying for one\u0027s own assignments on a"},{"line_number":387,"context_line":"   `system scope`_ although it is possible to assign federated users a role"},{"line_number":388,"context_line":"   assignment on it."},{"line_number":389,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"dfd5e7cf_fa26f816","line":386,"range":{"start_line":386,"start_character":7,"end_line":386,"end_character":10},"in_reply_to":"ffd0ebdf_4307001e","updated":"2019-01-06 17:03:14.000000000","message":"Right. Do you have a suggestion for how I can frame that clearly?","commit_id":"e8b870fe777a8fdeb649e15784a8f9f92a02a801"}]}