)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"9aa5ef8bf00ae57ffc76a70dbb4c528bb685f616","unresolved":false,"context_lines":[{"line_number":10,"context_line":"settings for service tokens."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: I8a518614302e17be6dfc8d88dee5efe27a89edb0"},{"line_number":13,"context_line":"Closes-Bug: #1779889"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"5fc1f717_4e73a64e","line":13,"range":{"start_line":13,"start_character":13,"end_line":13,"end_character":20},"updated":"2019-03-20 15:29:18.000000000","message":"Since this impacts operators, I would signal this with a release note.","commit_id":"f471879b82d08316846e7e4a0ff75c4b3b90dabf"}],"doc/source/admin/manage-services.rst":[{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a1162281773ab748064f8565e990cb43021c5172","unresolved":false,"context_lines":[{"line_number":245,"context_line":"In the above scenarios, the Image service will attach both the user\u0027s token"},{"line_number":246,"context_line":"and its own token (called the service token), as per the diagram below."},{"line_number":247,"context_line":""},{"line_number":248,"context_line":".. code-block:: console"},{"line_number":249,"context_line":""},{"line_number":250,"context_line":"      +----------------+"},{"line_number":251,"context_line":"      |      User      |"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9fdfeff1_74ba30c1","line":248,"updated":"2019-02-02 13:44:01.000000000","message":"This markup is for shell operations. We could use a sphinx plugin to create a proper diagram.","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"a8c4cd4ace869bc0c378bfa16d604bf064e17dd8","unresolved":false,"context_lines":[{"line_number":245,"context_line":"In the above scenarios, the Image service will attach both the user\u0027s token"},{"line_number":246,"context_line":"and its own token (called the service token), as per the diagram below."},{"line_number":247,"context_line":""},{"line_number":248,"context_line":".. code-block:: console"},{"line_number":249,"context_line":""},{"line_number":250,"context_line":"      +----------------+"},{"line_number":251,"context_line":"      |      User      |"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_01310ced","line":248,"in_reply_to":"9fdfeff1_74ba30c1","updated":"2019-03-19 16:11:39.000000000","message":"Will do in follow-up.","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a1162281773ab748064f8565e990cb43021c5172","unresolved":false,"context_lines":[{"line_number":252,"context_line":"      +-------+--------+"},{"line_number":253,"context_line":"              | Access Image Data Request"},{"line_number":254,"context_line":"              | X-AUTH-TOKEN: \u003cend user token\u003e"},{"line_number":255,"context_line":"              | X-SERVICE-TOKEN: None"},{"line_number":256,"context_line":"              |"},{"line_number":257,"context_line":"      +-------v---------+"},{"line_number":258,"context_line":"      |     Glance      |"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9fdfeff1_b4aad86d","line":255,"updated":"2019-02-02 13:44:01.000000000","message":"Does the user client actually send an empty header like this?","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"a8c4cd4ace869bc0c378bfa16d604bf064e17dd8","unresolved":false,"context_lines":[{"line_number":252,"context_line":"      +-------+--------+"},{"line_number":253,"context_line":"              | Access Image Data Request"},{"line_number":254,"context_line":"              | X-AUTH-TOKEN: \u003cend user token\u003e"},{"line_number":255,"context_line":"              | X-SERVICE-TOKEN: None"},{"line_number":256,"context_line":"              |"},{"line_number":257,"context_line":"      +-------v---------+"},{"line_number":258,"context_line":"      |     Glance      |"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_5e8133c3","line":255,"in_reply_to":"9fdfeff1_b4aad86d","updated":"2019-03-19 16:11:39.000000000","message":"Done","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"ebb9174e620c779dabd4f21548824432996560f1","unresolved":false,"context_lines":[{"line_number":266,"context_line":"      +-----------------+"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"When a service receives a service token, it validates that the token has"},{"line_number":270,"context_line":"the appropriate level of authorization for a service user. This is configured"},{"line_number":271,"context_line":"in each individual service configuration, under the section generally named"},{"line_number":272,"context_line":"``[keystone_authtoken]``. Please refer to the service\u0027s documentation if the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bfdaf3ff_49eb49db","line":269,"range":{"start_line":269,"start_character":0,"end_line":269,"end_character":39},"updated":"2019-01-17 15:46:06.000000000","message":"Just wanted to know how a service receives a service token?\nIs it like configuring \"[keystone_authtoken]\" in service conf file and keystone will assign a service token containing the appropriate roles? Does that token has any expiration time?","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"0870f84a882b468d2e822de8a7aa3a1211a14e21","unresolved":false,"context_lines":[{"line_number":266,"context_line":"      +-----------------+"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"When a service receives a service token, it validates that the token has"},{"line_number":270,"context_line":"the appropriate level of authorization for a service user. This is configured"},{"line_number":271,"context_line":"in each individual service configuration, under the section generally named"},{"line_number":272,"context_line":"``[keystone_authtoken]``. Please refer to the service\u0027s documentation if the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9fdfeff1_d9f56758","line":269,"range":{"start_line":269,"start_character":0,"end_line":269,"end_character":39},"in_reply_to":"9fdfeff1_416c279b","updated":"2019-02-01 06:20:28.000000000","message":"ok. Got the point. Thanks for the clarification.","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"b160937d92ce707c0ab353bf674aab2feeb774d6","unresolved":false,"context_lines":[{"line_number":266,"context_line":"      +-----------------+"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"When a service receives a service token, it validates that the token has"},{"line_number":270,"context_line":"the appropriate level of authorization for a service user. This is configured"},{"line_number":271,"context_line":"in each individual service configuration, under the section generally named"},{"line_number":272,"context_line":"``[keystone_authtoken]``. Please refer to the service\u0027s documentation if the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9fdfeff1_416c279b","line":269,"range":{"start_line":269,"start_character":0,"end_line":269,"end_character":39},"in_reply_to":"9fdfeff1_74e339da","updated":"2019-01-31 21:42:36.000000000","message":"\u003e OK . Thanks lance. As in the above paragraph it is said that the\n \u003e service will attach both the tokens, the user\u0027s token and its own.\n \u003e So does that conclude that each service is having an separate token\n \u003e ?\n\nKind of, yes. It\u0027s not that each service has their own token, but credentials they use to authenticate for tokens they can use to interact with other services in the deployment.\n\nFor example, if nova needs something in glance or cinder, nova can generate a token (e.g., a service token) to call the appropriate glance or cinder API for that information. In that example, nova would be using a service token to make a request to another service. Typically, it\u0027s common to see service users created when installing a new service (this is the service user) [0].\n\nService credentials are set in each service\u0027s configuration file so they can programmatically grab tokens when they need to and use various openstack clients.\n\n[0] https://docs.openstack.org/nova/latest/install/controller-install-ubuntu.html (step 3)","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":27621,"name":"Vishakha Agarwal","email":"agarwalvishakha18@gmail.com","username":"Vishakha"},"change_message_id":"799c947e3cafdec14b6841b27d18f93e2d16ded0","unresolved":false,"context_lines":[{"line_number":266,"context_line":"      +-----------------+"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"When a service receives a service token, it validates that the token has"},{"line_number":270,"context_line":"the appropriate level of authorization for a service user. This is configured"},{"line_number":271,"context_line":"in each individual service configuration, under the section generally named"},{"line_number":272,"context_line":"``[keystone_authtoken]``. Please refer to the service\u0027s documentation if the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9fdfeff1_74e339da","line":269,"range":{"start_line":269,"start_character":0,"end_line":269,"end_character":39},"in_reply_to":"9fdfeff1_c0e4ac0f","updated":"2019-01-31 08:55:56.000000000","message":"OK . Thanks lance. As in the above paragraph it is said that the service will attach both the tokens, the user\u0027s token and its own. So does that conclude that each service is having an separate token ?","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"a8c4cd4ace869bc0c378bfa16d604bf064e17dd8","unresolved":false,"context_lines":[{"line_number":266,"context_line":"      +-----------------+"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"When a service receives a service token, it validates that the token has"},{"line_number":270,"context_line":"the appropriate level of authorization for a service user. This is configured"},{"line_number":271,"context_line":"in each individual service configuration, under the section generally named"},{"line_number":272,"context_line":"``[keystone_authtoken]``. Please refer to the service\u0027s documentation if the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_413714e5","line":269,"range":{"start_line":269,"start_character":0,"end_line":269,"end_character":39},"in_reply_to":"9fdfeff1_d9f56758","updated":"2019-03-19 16:11:39.000000000","message":"Done","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f172c20b8f8cec30e1de4c27fcb3c69a4c31aaf5","unresolved":false,"context_lines":[{"line_number":266,"context_line":"      +-----------------+"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":""},{"line_number":269,"context_line":"When a service receives a service token, it validates that the token has"},{"line_number":270,"context_line":"the appropriate level of authorization for a service user. This is configured"},{"line_number":271,"context_line":"in each individual service configuration, under the section generally named"},{"line_number":272,"context_line":"``[keystone_authtoken]``. Please refer to the service\u0027s documentation if the"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9fdfeff1_c0e4ac0f","line":269,"range":{"start_line":269,"start_character":0,"end_line":269,"end_character":39},"in_reply_to":"bfdaf3ff_49eb49db","updated":"2019-01-30 20:50:41.000000000","message":"We could say: \n\n  When a service authenticates for a token,\n\nWe could also add a definition to service tokens, so that it\u0027s apparent that there really isn\u0027t anything special about \"service\" tokens and that they really are just tokens associated to users with a special name.\n\nI think a lot of people trip when they see the term \"service token\" because they expect it to be difference contractually from any other token keystone issues.","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a1162281773ab748064f8565e990cb43021c5172","unresolved":false,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"When a service receives a service token, it validates that the token has"},{"line_number":270,"context_line":"the appropriate level of authorization for a service user. This is configured"},{"line_number":271,"context_line":"in each individual service configuration, under the section generally named"},{"line_number":272,"context_line":"``[keystone_authtoken]``. Please refer to the service\u0027s documentation if the"},{"line_number":273,"context_line":"section is named differently."},{"line_number":274,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"9fdfeff1_54b36ce9","line":271,"range":{"start_line":271,"start_character":60,"end_line":271,"end_character":75},"updated":"2019-02-02 13:44:01.000000000","message":"If it is using keystonemiddleware, it\u0027s always named this. In cases where services have another section with credentials, that is used for something else and is not going through keystonemiddleware and so would not understand service tokens anyway.","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"a8c4cd4ace869bc0c378bfa16d604bf064e17dd8","unresolved":false,"context_lines":[{"line_number":268,"context_line":""},{"line_number":269,"context_line":"When a service receives a service token, it validates that the token has"},{"line_number":270,"context_line":"the appropriate level of authorization for a service user. This is configured"},{"line_number":271,"context_line":"in each individual service configuration, under the section generally named"},{"line_number":272,"context_line":"``[keystone_authtoken]``. Please refer to the service\u0027s documentation if the"},{"line_number":273,"context_line":"section is named differently."},{"line_number":274,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_213a08cd","line":271,"range":{"start_line":271,"start_character":60,"end_line":271,"end_character":75},"in_reply_to":"9fdfeff1_54b36ce9","updated":"2019-03-19 16:11:39.000000000","message":"Done","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a1162281773ab748064f8565e990cb43021c5172","unresolved":false,"context_lines":[{"line_number":272,"context_line":"``[keystone_authtoken]``. Please refer to the service\u0027s documentation if the"},{"line_number":273,"context_line":"section is named differently."},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"If the service token is valid, the operation will be allowed even if the token"},{"line_number":276,"context_line":"has expired."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"The ``service_token_roles`` option is the list of roles that the service"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9fdfeff1_f4cdc065","line":275,"range":{"start_line":275,"start_character":73,"end_line":275,"end_character":78},"updated":"2019-02-02 13:44:01.000000000","message":"user\u0027s token","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"a8c4cd4ace869bc0c378bfa16d604bf064e17dd8","unresolved":false,"context_lines":[{"line_number":272,"context_line":"``[keystone_authtoken]``. Please refer to the service\u0027s documentation if the"},{"line_number":273,"context_line":"section is named differently."},{"line_number":274,"context_line":""},{"line_number":275,"context_line":"If the service token is valid, the operation will be allowed even if the token"},{"line_number":276,"context_line":"has expired."},{"line_number":277,"context_line":""},{"line_number":278,"context_line":"The ``service_token_roles`` option is the list of roles that the service"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_a126f8b9","line":275,"range":{"start_line":275,"start_character":73,"end_line":275,"end_character":78},"in_reply_to":"9fdfeff1_f4cdc065","updated":"2019-03-19 16:11:39.000000000","message":"Done","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f172c20b8f8cec30e1de4c27fcb3c69a4c31aaf5","unresolved":false,"context_lines":[{"line_number":280,"context_line":"assigned the `admin` role to service users, so set the option to that and set"},{"line_number":281,"context_line":"``service_token_roles_required`` to ``true``."},{"line_number":282,"context_line":""},{"line_number":283,"context_line":".. code-block:: ini"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"    [keystone_authtoken]"},{"line_number":286,"context_line":"    service_token_roles \u003d admin"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9fdfeff1_20d6d829","line":283,"updated":"2019-01-30 20:50:41.000000000","message":"I almost wonder if we should add this to the keystonemiddleware documentation, too. I hate duplicating it, but it seems relevant to have there.","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"a8c4cd4ace869bc0c378bfa16d604bf064e17dd8","unresolved":false,"context_lines":[{"line_number":280,"context_line":"assigned the `admin` role to service users, so set the option to that and set"},{"line_number":281,"context_line":"``service_token_roles_required`` to ``true``."},{"line_number":282,"context_line":""},{"line_number":283,"context_line":".. code-block:: ini"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"    [keystone_authtoken]"},{"line_number":286,"context_line":"    service_token_roles \u003d admin"}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_6107b01a","line":283,"in_reply_to":"9fdfeff1_14c96457","updated":"2019-03-19 16:11:39.000000000","message":"Will do in follow-up.","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a1162281773ab748064f8565e990cb43021c5172","unresolved":false,"context_lines":[{"line_number":280,"context_line":"assigned the `admin` role to service users, so set the option to that and set"},{"line_number":281,"context_line":"``service_token_roles_required`` to ``true``."},{"line_number":282,"context_line":""},{"line_number":283,"context_line":".. code-block:: ini"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"    [keystone_authtoken]"},{"line_number":286,"context_line":"    service_token_roles \u003d admin"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9fdfeff1_14c96457","line":283,"in_reply_to":"9fdfeff1_20d6d829","updated":"2019-02-02 13:44:01.000000000","message":"Either a duplicate or at least a link","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"change_message_id":"a1162281773ab748064f8565e990cb43021c5172","unresolved":false,"context_lines":[{"line_number":288,"context_line":""},{"line_number":289,"context_line":"For more information regarding service tokens, please see the"},{"line_number":290,"context_line":"``keystonemiddleware`` `release notes"},{"line_number":291,"context_line":"\u003chttps://docs.openstack.org/releasenotes/keystonemiddleware/ocata.html\u003e`_."}],"source_content_type":"text/x-rst","patch_set":2,"id":"9fdfeff1_b4c3b837","line":291,"updated":"2019-02-02 13:44:01.000000000","message":"Maybe also the spec?","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"},{"author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"change_message_id":"a8c4cd4ace869bc0c378bfa16d604bf064e17dd8","unresolved":false,"context_lines":[{"line_number":288,"context_line":""},{"line_number":289,"context_line":"For more information regarding service tokens, please see the"},{"line_number":290,"context_line":"``keystonemiddleware`` `release notes"},{"line_number":291,"context_line":"\u003chttps://docs.openstack.org/releasenotes/keystonemiddleware/ocata.html\u003e`_."}],"source_content_type":"text/x-rst","patch_set":2,"id":"5fc1f717_01182c73","line":291,"in_reply_to":"9fdfeff1_b4c3b837","updated":"2019-03-19 16:11:39.000000000","message":"Will do in follow-up.","commit_id":"2ebc24d01fe8886e57665ade4e725800114e89b1"}]}