)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6,"name":"Joe Heck","email":"heckj@mac.com","username":"heckj"},"change_message_id":"ac57d8605a84ad18099184e52ea63a0c86eb469e","unresolved":false,"context_lines":[{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Change-Id: Ib48c1493c88318382be0e578b6fc1ba483be912a"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Bug 890411"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Re-introduce the changes back into the KSL branch so we have a way to mitigate"},{"line_number":17,"context_line":"riskis with tenant role conflicts."}],"source_content_type":"text/x-gerrit-commit-message","patch_set":1,"id":"AAAAHH%2F%2F9b0%3D","line":14,"updated":"2012-05-02 15:32:13.000000000","message":"I think your commit message got a little overexcited. There should be a single Change-Id in this - not 3. Need to get that fixed so that it doesn\u0027t wreck the infrastructure...\n\nThe last one \"Ice41fb2ee9ec218d8ad...\" is the correct one to keep in the commit message.","commit_id":"ed6b052868935f2940281d1f84c723195ccd3c9c"}],"doc/source/api_curl_examples.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":246,"context_line":"        }"},{"line_number":247,"context_line":"    }"},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"GET /tokens/{token_id}?serviceId\u003d{service IDs}"},{"line_number":250,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":".. note::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fzg%3D","line":249,"updated":"2012-05-04 18:20:30.000000000","message":"Do we have a convention for describing a set a little more formally? {service_id_list} ? I would also assume the list is comma delimited, although the examples do not illustrate it either way.","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"e68b39a97afdf96cef36a9b6979d509764c6aca5","unresolved":false,"context_lines":[{"line_number":251,"context_line":""},{"line_number":252,"context_line":".. note::"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"    This call refers to a token known to be valid, ``887665443383838`` in this case."},{"line_number":255,"context_line":"    Service ID ``1`` is known to be valid as well."},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"Validate a token with optional service role filtering::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2F94%3D","line":254,"updated":"2012-05-04 13:05:47.000000000","message":"I think it would be best to use a UUID token in the example here instead of the integer one above... would make the example more realistic.","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":251,"context_line":""},{"line_number":252,"context_line":".. note::"},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"    This call refers to a token known to be valid, ``887665443383838`` in this case."},{"line_number":255,"context_line":"    Service ID ``1`` is known to be valid as well."},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"Validate a token with optional service role filtering::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fzk%3D","line":254,"in_reply_to":"AAAAHX%2F%2F%2F94%3D","updated":"2012-05-04 18:20:30.000000000","message":"+1, although integers are still used pretty heavily throughout these examples :-/","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":254,"context_line":"    This call refers to a token known to be valid, ``887665443383838`` in this case."},{"line_number":255,"context_line":"    Service ID ``1`` is known to be valid as well."},{"line_number":256,"context_line":""},{"line_number":257,"context_line":"Validate a token with optional service role filtering::"},{"line_number":258,"context_line":""},{"line_number":259,"context_line":"    $ curl -H \"X-Auth-Token:999888777666\" http://localhost:35357/v2.0/tokens/887665443383838?serviceId\u003d1"},{"line_number":260,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FzU%3D","line":257,"updated":"2012-05-04 18:20:30.000000000","message":"This should explain what \"service role filtering\" is/does.","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":301,"context_line":"    Content-Type: None"},{"line_number":302,"context_line":"    Date: Tue, 08 Nov 2011 23:07:44 GMT"},{"line_number":303,"context_line":""},{"line_number":304,"context_line":"HEAD /tokens/{token_id}?serviceId\u003d{service IDs}"},{"line_number":305,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":306,"context_line":""},{"line_number":307,"context_line":"Validate token with optionally service role filtering."}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fzc%3D","line":304,"updated":"2012-05-04 18:20:30.000000000","message":"Same as above","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":304,"context_line":"HEAD /tokens/{token_id}?serviceId\u003d{service IDs}"},{"line_number":305,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":306,"context_line":""},{"line_number":307,"context_line":"Validate token with optionally service role filtering."},{"line_number":308,"context_line":""},{"line_number":309,"context_line":"This is a high-performance variant of the GET call documented above, which"},{"line_number":310,"context_line":"by definition, returns no response body::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FzY%3D","line":307,"updated":"2012-05-04 18:20:30.000000000","message":"I wouldn\u0027t bother duplicating this paragraph (also, this version has a grammar diff).","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"48878c84b28932cad5fcc45ce346d70bd419d1aa","unresolved":false,"context_lines":[{"line_number":246,"context_line":"        }"},{"line_number":247,"context_line":"    }"},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"GET /tokens/{token_id}?serviceId\u003d{service_id_list}}"},{"line_number":250,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":251,"context_line":""},{"line_number":252,"context_line":".. note::"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAAHX%2F%2F4%2BI%3D","line":249,"updated":"2012-05-22 21:37:19.000000000","message":"extra curly brace on the end","commit_id":"bd6c25c60fd3677eca76683732a341cc02070018"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"48878c84b28932cad5fcc45ce346d70bd419d1aa","unresolved":false,"context_lines":[{"line_number":259,"context_line":""},{"line_number":260,"context_line":"    $ curl -H \"X-Auth-Token:999888777666\" http://localhost:35357/v2.0/tokens/887665443383838?serviceId\u003d1,2"},{"line_number":261,"context_line":""},{"line_number":262,"context_line":"If the token is valid and there\u0027s at least one role matches the given service ID\u0027s, returns::"},{"line_number":263,"context_line":""},{"line_number":264,"context_line":"    {"},{"line_number":265,"context_line":"        \"access\":{"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAAHX%2F%2F4%2BA%3D","line":262,"updated":"2012-05-22 21:37:19.000000000","message":"If the token is valid and at least one role matches a provided service ID,","commit_id":"bd6c25c60fd3677eca76683732a341cc02070018"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"48878c84b28932cad5fcc45ce346d70bd419d1aa","unresolved":false,"context_lines":[{"line_number":310,"context_line":"    $ curl -I -H \"X-Auth-Token:999888777666\" http://localhost:35357/v2.0/tokens/887665443383838?serviceId\u003d1,2"},{"line_number":311,"context_line":""},{"line_number":312,"context_line":"... which returns ``200``, indicating the token is valid and at least"},{"line_number":313,"context_line":"one service-specific role matches the given service ID\u0027s::"},{"line_number":314,"context_line":""},{"line_number":315,"context_line":"    HTTP/1.1 200 OK"},{"line_number":316,"context_line":"    Content-Length: 0"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAAHX%2F%2F498%3D","line":313,"updated":"2012-05-22 21:37:19.000000000","message":"matches a provided service ID","commit_id":"bd6c25c60fd3677eca76683732a341cc02070018"}],"doc/source/architecture.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0bcfea2f3c294caccbee873f13b114a7ea1e3b8e","unresolved":false,"context_lines":[{"line_number":169,"context_line":""},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"LDAP Backend"},{"line_number":172,"context_line":"-----------------"},{"line_number":173,"context_line":"The LDAP backend stored Users and Tenents in separate Subtrees.  Roles are recorded"},{"line_number":174,"context_line":"as entries under the Tenants."},{"line_number":175,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAHH%2F%2F89U%3D","line":172,"updated":"2012-05-03 17:11:00.000000000","message":"Fixed this myself in https://review.openstack.org/#/c/7070","commit_id":"e5f1544990e5e92cb5cb18d7be27f5fd0940d694"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0bcfea2f3c294caccbee873f13b114a7ea1e3b8e","unresolved":false,"context_lines":[{"line_number":196,"context_line":"functionality."},{"line_number":197,"context_line":""},{"line_number":198,"context_line":"Roles"},{"line_number":199,"context_line":"----------"},{"line_number":200,"context_line":"Keystone supports both service agnostic and service specific roles. Roles in"},{"line_number":201,"context_line":"Keystone are uniquely identified by the combination of role names and optional"},{"line_number":202,"context_line":"service IDs."}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAHH%2F%2F89o%3D","line":199,"updated":"2012-05-03 17:11:00.000000000","message":"Hyphens should be the same length as the subtitle.","commit_id":"e5f1544990e5e92cb5cb18d7be27f5fd0940d694"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0bcfea2f3c294caccbee873f13b114a7ea1e3b8e","unresolved":false,"context_lines":[{"line_number":205,"context_line":"all services. A role can be granted to a user for a given tenant. For example,"},{"line_number":206,"context_line":"user “Joe” has “Admin” role for tenant “XYZ”. However, this also means “Joe” is"},{"line_number":207,"context_line":"“Admin” for all the services for tenant “XYZ”. In some deployments this is"},{"line_number":208,"context_line":"considered security vulnerability. See Bug 890411 "},{"line_number":209,"context_line":"(https://bugs.launchpad.net/keystone/+bug/890411) for more details. This problem"},{"line_number":210,"context_line":"can be mitigated by the use of service roles. In other words, roles defined for"},{"line_number":211,"context_line":"a specific service. With the service roles, we can effectively isolate the"}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAHH%2F%2F89s%3D","line":208,"updated":"2012-05-03 17:11:00.000000000","message":"Trailing whitespace; don\u0027t reference bugs in docs (and if you did, it should be an actual link).","commit_id":"e5f1544990e5e92cb5cb18d7be27f5fd0940d694"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0bcfea2f3c294caccbee873f13b114a7ea1e3b8e","unresolved":false,"context_lines":[{"line_number":210,"context_line":"can be mitigated by the use of service roles. In other words, roles defined for"},{"line_number":211,"context_line":"a specific service. With the service roles, we can effectively isolate the"},{"line_number":212,"context_line":"capabilities to the service level. For example, user “Joe” has “Admin” role for"},{"line_number":213,"context_line":"“Nova” service for tenant “XYZ”. “Joe” is no longer “Admin” for Swift, Glance,"},{"line_number":214,"context_line":"or Quantum service for tenant “XYZ”."},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"During token validation, Keystone clients may ask Keystone to filter the roles"}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAHH%2F%2F884%3D","line":213,"updated":"2012-05-03 17:11:00.000000000","message":"This paragraph is flooded with smart quotes from a word processor. Please replace them all with standard double quotation marks.","commit_id":"e5f1544990e5e92cb5cb18d7be27f5fd0940d694"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0bcfea2f3c294caccbee873f13b114a7ea1e3b8e","unresolved":false,"context_lines":[{"line_number":217,"context_line":"to be returned by optionally including “serviceId” query string, in the same"},{"line_number":218,"context_line":"manner as tenant validation by optionally including the “belongsTo” query string."},{"line_number":219,"context_line":"“serviceId” may consists of one or more service IDs separated by a comma (,)."},{"line_number":220,"context_line":"For example,"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"GET /v2.0/tokens/abc123?belongsTo\u003dXYZ\u0026serviceId\u003d123,456"},{"line_number":223,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAHH%2F%2F89Q%3D","line":220,"updated":"2012-05-03 17:11:00.000000000","message":"For example::","commit_id":"e5f1544990e5e92cb5cb18d7be27f5fd0940d694"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0bcfea2f3c294caccbee873f13b114a7ea1e3b8e","unresolved":false,"context_lines":[{"line_number":219,"context_line":"“serviceId” may consists of one or more service IDs separated by a comma (,)."},{"line_number":220,"context_line":"For example,"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"GET /v2.0/tokens/abc123?belongsTo\u003dXYZ\u0026serviceId\u003d123,456"},{"line_number":223,"context_line":""},{"line_number":224,"context_line":"If serviceId is present and if there are no roles match the given service IDs,"},{"line_number":225,"context_line":"token validation would failed."}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAHH%2F%2F89M%3D","line":222,"updated":"2012-05-03 17:11:00.000000000","message":"indent the example 4 spaces","commit_id":"e5f1544990e5e92cb5cb18d7be27f5fd0940d694"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0bcfea2f3c294caccbee873f13b114a7ea1e3b8e","unresolved":false,"context_lines":[{"line_number":224,"context_line":"If serviceId is present and if there are no roles match the given service IDs,"},{"line_number":225,"context_line":"token validation would failed."},{"line_number":226,"context_line":""},{"line_number":227,"context_line":"To create a service role definition,"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"POST /v2.0/OS-KSADM/roles"},{"line_number":230,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAHH%2F%2F89I%3D","line":227,"updated":"2012-05-03 17:11:00.000000000","message":"... definition::\n\nthen indent the example 4 spaces","commit_id":"e5f1544990e5e92cb5cb18d7be27f5fd0940d694"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0bcfea2f3c294caccbee873f13b114a7ea1e3b8e","unresolved":false,"context_lines":[{"line_number":237,"context_line":""},{"line_number":238,"context_line":"To list all roles,"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"GET /v2.0/OS-KSADM/roles"},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"To list the service roles for one or more services,"},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAHH%2F%2F89E%3D","line":240,"updated":"2012-05-03 17:11:00.000000000","message":"Same as above","commit_id":"e5f1544990e5e92cb5cb18d7be27f5fd0940d694"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"0bcfea2f3c294caccbee873f13b114a7ea1e3b8e","unresolved":false,"context_lines":[{"line_number":241,"context_line":""},{"line_number":242,"context_line":"To list the service roles for one or more services,"},{"line_number":243,"context_line":""},{"line_number":244,"context_line":"GET /v2.0/OS-KSADM/roles?serviceId\u003d123,456"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"----------------"},{"line_number":247,"context_line":"Approach to CRUD"}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAHH%2F%2F888%3D","line":244,"updated":"2012-05-03 17:11:00.000000000","message":"Same as above","commit_id":"e5f1544990e5e92cb5cb18d7be27f5fd0940d694"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":203,"context_line":"Roles"},{"line_number":204,"context_line":"-----"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Keystone supports both service agnostic and service specific roles. Roles in"},{"line_number":207,"context_line":"Keystone are uniquely identified by the combination of role names and optional"},{"line_number":208,"context_line":"service IDs."},{"line_number":209,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FzM%3D","line":206,"updated":"2012-05-04 18:20:30.000000000","message":"service-agnostic and service-specific","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":207,"context_line":"Keystone are uniquely identified by the combination of role names and optional"},{"line_number":208,"context_line":"service IDs."},{"line_number":209,"context_line":""},{"line_number":210,"context_line":"By default, roles in Keystone are service agnostic, which means they span"},{"line_number":211,"context_line":"all services. A role can be granted to a user for a given tenant. For example,"},{"line_number":212,"context_line":"user ``Joe`` has ``Admin`` role for tenant ``XYZ``. However, this also means"},{"line_number":213,"context_line":"``Joe`` is ``Admin`` for all the services for tenant “XYZ”. In some deployments"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FzA%3D","line":210,"updated":"2012-05-04 18:20:30.000000000","message":"service-agnostic","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":210,"context_line":"By default, roles in Keystone are service agnostic, which means they span"},{"line_number":211,"context_line":"all services. A role can be granted to a user for a given tenant. For example,"},{"line_number":212,"context_line":"user ``Joe`` has ``Admin`` role for tenant ``XYZ``. However, this also means"},{"line_number":213,"context_line":"``Joe`` is ``Admin`` for all the services for tenant “XYZ”. In some deployments"},{"line_number":214,"context_line":"this is considered security vulnerability. See `Bug 890411 "},{"line_number":215,"context_line":"\u003chttps://bugs.launchpad.net/keystone/+bug/890411\u003e`_ "},{"line_number":216,"context_line":"for more details. This problem"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fy8%3D","line":213,"updated":"2012-05-04 18:20:30.000000000","message":"smart quotes remain, please find/replace them all","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":211,"context_line":"all services. A role can be granted to a user for a given tenant. For example,"},{"line_number":212,"context_line":"user ``Joe`` has ``Admin`` role for tenant ``XYZ``. However, this also means"},{"line_number":213,"context_line":"``Joe`` is ``Admin`` for all the services for tenant “XYZ”. In some deployments"},{"line_number":214,"context_line":"this is considered security vulnerability. See `Bug 890411 "},{"line_number":215,"context_line":"\u003chttps://bugs.launchpad.net/keystone/+bug/890411\u003e`_ "},{"line_number":216,"context_line":"for more details. This problem"},{"line_number":217,"context_line":"can be mitigated by the use of service roles. In other words, roles defined for"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fy4%3D","line":214,"updated":"2012-05-04 18:20:30.000000000","message":"Still not a fan of linking to bugs from docs. Instead, explain briefly why end-users would consider this a \"vulnerability\" and why they should use this feature.","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"e68b39a97afdf96cef36a9b6979d509764c6aca5","unresolved":false,"context_lines":[{"line_number":211,"context_line":"all services. A role can be granted to a user for a given tenant. For example,"},{"line_number":212,"context_line":"user ``Joe`` has ``Admin`` role for tenant ``XYZ``. However, this also means"},{"line_number":213,"context_line":"``Joe`` is ``Admin`` for all the services for tenant “XYZ”. In some deployments"},{"line_number":214,"context_line":"this is considered security vulnerability. See `Bug 890411 "},{"line_number":215,"context_line":"\u003chttps://bugs.launchpad.net/keystone/+bug/890411\u003e`_ "},{"line_number":216,"context_line":"for more details. This problem"},{"line_number":217,"context_line":"can be mitigated by the use of service roles. In other words, roles defined for"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2F9o%3D","line":214,"updated":"2012-05-04 13:05:47.000000000","message":"s/considered security/considered a security/","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"e68b39a97afdf96cef36a9b6979d509764c6aca5","unresolved":false,"context_lines":[{"line_number":212,"context_line":"user ``Joe`` has ``Admin`` role for tenant ``XYZ``. However, this also means"},{"line_number":213,"context_line":"``Joe`` is ``Admin`` for all the services for tenant “XYZ”. In some deployments"},{"line_number":214,"context_line":"this is considered security vulnerability. See `Bug 890411 "},{"line_number":215,"context_line":"\u003chttps://bugs.launchpad.net/keystone/+bug/890411\u003e`_ "},{"line_number":216,"context_line":"for more details. This problem"},{"line_number":217,"context_line":"can be mitigated by the use of service roles. In other words, roles defined for"},{"line_number":218,"context_line":"a specific service. With the service roles, we can effectively isolate the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2F90%3D","line":215,"updated":"2012-05-04 13:05:47.000000000","message":"Teeny nit: some whitespace on end of above two lines...","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"e68b39a97afdf96cef36a9b6979d509764c6aca5","unresolved":false,"context_lines":[{"line_number":214,"context_line":"this is considered security vulnerability. See `Bug 890411 "},{"line_number":215,"context_line":"\u003chttps://bugs.launchpad.net/keystone/+bug/890411\u003e`_ "},{"line_number":216,"context_line":"for more details. This problem"},{"line_number":217,"context_line":"can be mitigated by the use of service roles. In other words, roles defined for"},{"line_number":218,"context_line":"a specific service. With the service roles, we can effectively isolate the"},{"line_number":219,"context_line":"capabilities to the service level. For example, user ``Joe`` has ``Admin``"},{"line_number":220,"context_line":"role for ``Nova`` service for tenant ``XYZ``. ``Joe`` is no longer ``Admin``"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2F9k%3D","line":217,"updated":"2012-05-04 13:05:47.000000000","message":"To keep with the semantics of the first sentence of the previous paragraph, I would say \"service-specific roles\" here instead of \"service roles\"","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":214,"context_line":"this is considered security vulnerability. See `Bug 890411 "},{"line_number":215,"context_line":"\u003chttps://bugs.launchpad.net/keystone/+bug/890411\u003e`_ "},{"line_number":216,"context_line":"for more details. This problem"},{"line_number":217,"context_line":"can be mitigated by the use of service roles. In other words, roles defined for"},{"line_number":218,"context_line":"a specific service. With the service roles, we can effectively isolate the"},{"line_number":219,"context_line":"capabilities to the service level. For example, user ``Joe`` has ``Admin``"},{"line_number":220,"context_line":"role for ``Nova`` service for tenant ``XYZ``. ``Joe`` is no longer ``Admin``"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FzQ%3D","line":217,"in_reply_to":"AAAAHX%2F%2F%2F9k%3D","updated":"2012-05-04 18:20:30.000000000","message":"Jay\u0027s suggestion makes more sense to me, and would apply to the curl examples page as well","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":216,"context_line":"for more details. This problem"},{"line_number":217,"context_line":"can be mitigated by the use of service roles. In other words, roles defined for"},{"line_number":218,"context_line":"a specific service. With the service roles, we can effectively isolate the"},{"line_number":219,"context_line":"capabilities to the service level. For example, user ``Joe`` has ``Admin``"},{"line_number":220,"context_line":"role for ``Nova`` service for tenant ``XYZ``. ``Joe`` is no longer ``Admin``"},{"line_number":221,"context_line":"for Swift, Glance, or Quantum service for tenant ``XYZ``."},{"line_number":222,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fy0%3D","line":219,"updated":"2012-05-04 18:20:30.000000000","message":"Capabilities as in the RBAC sense, or are we still talking about roles?","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fa96c496ddfb1ab7d181340f6d7fbf60ee1c22ce","unresolved":false,"context_lines":[{"line_number":216,"context_line":"for more details. This problem"},{"line_number":217,"context_line":"can be mitigated by the use of service roles. In other words, roles defined for"},{"line_number":218,"context_line":"a specific service. With the service roles, we can effectively isolate the"},{"line_number":219,"context_line":"capabilities to the service level. For example, user ``Joe`` has ``Admin``"},{"line_number":220,"context_line":"role for ``Nova`` service for tenant ``XYZ``. ``Joe`` is no longer ``Admin``"},{"line_number":221,"context_line":"for Swift, Glance, or Quantum service for tenant ``XYZ``."},{"line_number":222,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fp4%3D","line":219,"in_reply_to":"AAAAHX%2F%2F%2Fy0%3D","updated":"2012-05-05 00:20:23.000000000","message":"I\u0027ll take out \"capabilities\" to avoid RBAC confusion as words are very important in Keystone. (Please don\u0027t ask me to change all occurrences of \"tenant\" to \"project\". :))","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":222,"context_line":""},{"line_number":223,"context_line":"During token validation, Keystone clients may ask Keystone to filter the roles"},{"line_number":224,"context_line":"to be returned by optionally including ``serviceId`` query string, in the same"},{"line_number":225,"context_line":"manner as tenant validation by optionally including the ``belongsTo`` query string."},{"line_number":226,"context_line":"``serviceId`` may consists of one or more service IDs separated by a comma."},{"line_number":227,"context_line":"For example::"},{"line_number":228,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fyw%3D","line":225,"updated":"2012-05-04 18:20:30.000000000","message":"putting this in parens would improve the readability\n\n    (by optionally including the ``belongsTo`` query string)","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":223,"context_line":"During token validation, Keystone clients may ask Keystone to filter the roles"},{"line_number":224,"context_line":"to be returned by optionally including ``serviceId`` query string, in the same"},{"line_number":225,"context_line":"manner as tenant validation by optionally including the ``belongsTo`` query string."},{"line_number":226,"context_line":"``serviceId`` may consists of one or more service IDs separated by a comma."},{"line_number":227,"context_line":"For example::"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"    GET /v2.0/tokens/abc123?belongsTo\u003dXYZ\u0026serviceId\u003d123,456"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fys%3D","line":226,"updated":"2012-05-04 18:20:30.000000000","message":"A few changes:\n\n    may consist of one or more comma-delimited service ID\u0027s.","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":228,"context_line":""},{"line_number":229,"context_line":"    GET /v2.0/tokens/abc123?belongsTo\u003dXYZ\u0026serviceId\u003d123,456"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"If ``serviceId`` is present and if there are no roles match the given service IDs,"},{"line_number":232,"context_line":"token validation would failed."},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"To create a service role definition::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fyk%3D","line":231,"updated":"2012-05-04 18:20:30.000000000","message":"Worth being a bit more verbose here, IMO:\n\n    If the ``serviceId` paramater is present","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"e68b39a97afdf96cef36a9b6979d509764c6aca5","unresolved":false,"context_lines":[{"line_number":228,"context_line":""},{"line_number":229,"context_line":"    GET /v2.0/tokens/abc123?belongsTo\u003dXYZ\u0026serviceId\u003d123,456"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"If ``serviceId`` is present and if there are no roles match the given service IDs,"},{"line_number":232,"context_line":"token validation would failed."},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"To create a service role definition::"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2F9g%3D","line":231,"updated":"2012-05-04 13:05:47.000000000","message":"s/no roles match/no roles matching/","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"e68b39a97afdf96cef36a9b6979d509764c6aca5","unresolved":false,"context_lines":[{"line_number":229,"context_line":"    GET /v2.0/tokens/abc123?belongsTo\u003dXYZ\u0026serviceId\u003d123,456"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"If ``serviceId`` is present and if there are no roles match the given service IDs,"},{"line_number":232,"context_line":"token validation would failed."},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"To create a service role definition::"},{"line_number":235,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2F9c%3D","line":232,"updated":"2012-05-04 13:05:47.000000000","message":"s/would failed/would return a 404/\n\nIs 404 correct?","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fa96c496ddfb1ab7d181340f6d7fbf60ee1c22ce","unresolved":false,"context_lines":[{"line_number":229,"context_line":"    GET /v2.0/tokens/abc123?belongsTo\u003dXYZ\u0026serviceId\u003d123,456"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"If ``serviceId`` is present and if there are no roles match the given service IDs,"},{"line_number":232,"context_line":"token validation would failed."},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"To create a service role definition::"},{"line_number":235,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fp0%3D","line":232,"in_reply_to":"AAAAHX%2F%2F%2F4Y%3D","updated":"2012-05-05 00:20:23.000000000","message":"401 that is.","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":154,"name":"Liem Nguyen","email":"liem.m.nguyen@hp.com","username":"liemmn"},"change_message_id":"0e2d0a3708031fb48c726dd07a231153402ae4ec","unresolved":false,"context_lines":[{"line_number":229,"context_line":"    GET /v2.0/tokens/abc123?belongsTo\u003dXYZ\u0026serviceId\u003d123,456"},{"line_number":230,"context_line":""},{"line_number":231,"context_line":"If ``serviceId`` is present and if there are no roles match the given service IDs,"},{"line_number":232,"context_line":"token validation would failed."},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"To create a service role definition::"},{"line_number":235,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2F4Y%3D","line":232,"in_reply_to":"AAAAHX%2F%2F%2F9c%3D","updated":"2012-05-04 15:45:30.000000000","message":"We should return a 401 (unauthorized)","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":248,"context_line":""},{"line_number":249,"context_line":"To list the service roles for one or more services::"},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"    GET /v2.0/OS-KSADM/roles?serviceId\u003d123,456"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"----------------"},{"line_number":254,"context_line":"Approach to CRUD"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fyc%3D","line":251,"updated":"2012-05-04 18:20:30.000000000","message":"Ignoring extension prefixes, I would assume this call would simply be:\n\n    GET /services/{service_id}/roles\n\ni.e. I don\u0027t see the use case for a comma delimited list here.","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fa96c496ddfb1ab7d181340f6d7fbf60ee1c22ce","unresolved":false,"context_lines":[{"line_number":248,"context_line":""},{"line_number":249,"context_line":"To list the service roles for one or more services::"},{"line_number":250,"context_line":""},{"line_number":251,"context_line":"    GET /v2.0/OS-KSADM/roles?serviceId\u003d123,456"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"----------------"},{"line_number":254,"context_line":"Approach to CRUD"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fps%3D","line":251,"in_reply_to":"AAAAHX%2F%2F%2Fyc%3D","updated":"2012-05-05 00:20:23.000000000","message":"Yes. I would like to see this core API in Folsom.","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"}],"doc/source/configuration.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":533,"context_line":"Roles"},{"line_number":534,"context_line":"-----"},{"line_number":535,"context_line":""},{"line_number":536,"context_line":"Keystone supports both service agnostic and service specific roles. Roles in"},{"line_number":537,"context_line":"Keystone are uniquely identified by the combination of role names and optional service IDs."},{"line_number":538,"context_line":""},{"line_number":539,"context_line":"``role-create``"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FyY%3D","line":536,"updated":"2012-05-04 18:20:30.000000000","message":"service-agnostic, service-specific","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"}],"doc/source/configuringservices.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":119,"context_line":"                           --user\u003d[uuid of the service account] \\"},{"line_number":120,"context_line":"                           --role\u003d[uuid of the Admin role]"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Notice the Admin role, specified above, is service agnostic. Which means user"},{"line_number":123,"context_line":"is Admin for all services for the given tenant. i.e. user is Admin for Nova,"},{"line_number":124,"context_line":"EC2, Glance, Swift, etc. If you want Admin to be service specific"},{"line_number":125,"context_line":"(i.e. Admin for Nova only), you will need to define service specific roles"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FyU%3D","line":122,"updated":"2012-05-04 18:20:30.000000000","message":"service-agnostic\n\ns/Which/This implies the user is recognized as Admin by/","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":120,"context_line":"                           --role\u003d[uuid of the Admin role]"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"Notice the Admin role, specified above, is service agnostic. Which means user"},{"line_number":123,"context_line":"is Admin for all services for the given tenant. i.e. user is Admin for Nova,"},{"line_number":124,"context_line":"EC2, Glance, Swift, etc. If you want Admin to be service specific"},{"line_number":125,"context_line":"(i.e. Admin for Nova only), you will need to define service specific roles"},{"line_number":126,"context_line":"and grant them accordingly. See `Defining Service Roles`_ for more"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FyQ%3D","line":123,"updated":"2012-05-04 18:20:30.000000000","message":"given tenant (i.e. user [...] Swift, etc).","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":122,"context_line":"Notice the Admin role, specified above, is service agnostic. Which means user"},{"line_number":123,"context_line":"is Admin for all services for the given tenant. i.e. user is Admin for Nova,"},{"line_number":124,"context_line":"EC2, Glance, Swift, etc. If you want Admin to be service specific"},{"line_number":125,"context_line":"(i.e. Admin for Nova only), you will need to define service specific roles"},{"line_number":126,"context_line":"and grant them accordingly. See `Defining Service Roles`_ for more"},{"line_number":127,"context_line":"details."},{"line_number":128,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FyM%3D","line":125,"updated":"2012-05-04 18:20:30.000000000","message":"Again, \"\u003crole\u003e for \u003cservice_type\u003e\" sounds like awkward phrasing to me. I\u0027d suggest the same fix as above, I suppose.","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":167,"context_line":"By default, roles in Keystone are service agnostic, which means they span"},{"line_number":168,"context_line":"all services. A role can be granted to a user for a given tenant. For example,"},{"line_number":169,"context_line":"user ``Joe`` has ``Admin`` role for tenant ``XYZ``. However, this also means"},{"line_number":170,"context_line":"``Joe`` is ``Admin`` for all the services for tenant “XYZ”. In some deployments"},{"line_number":171,"context_line":"this is considered security vulnerability. See `Bug 890411 "},{"line_number":172,"context_line":"\u003chttps://bugs.launchpad.net/keystone/+bug/890411\u003e`_"},{"line_number":173,"context_line":"for more details. This problem"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FyA%3D","line":170,"updated":"2012-05-04 18:20:30.000000000","message":"smart quotes","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"e68b39a97afdf96cef36a9b6979d509764c6aca5","unresolved":false,"context_lines":[{"line_number":168,"context_line":"all services. A role can be granted to a user for a given tenant. For example,"},{"line_number":169,"context_line":"user ``Joe`` has ``Admin`` role for tenant ``XYZ``. However, this also means"},{"line_number":170,"context_line":"``Joe`` is ``Admin`` for all the services for tenant “XYZ”. In some deployments"},{"line_number":171,"context_line":"this is considered security vulnerability. See `Bug 890411 "},{"line_number":172,"context_line":"\u003chttps://bugs.launchpad.net/keystone/+bug/890411\u003e`_"},{"line_number":173,"context_line":"for more details. This problem"},{"line_number":174,"context_line":"can be mitigated by the use of service roles. In other words, roles defined for"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2F9Y%3D","line":171,"updated":"2012-05-04 13:05:47.000000000","message":"little whitespace at end...","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":169,"context_line":"user ``Joe`` has ``Admin`` role for tenant ``XYZ``. However, this also means"},{"line_number":170,"context_line":"``Joe`` is ``Admin`` for all the services for tenant “XYZ”. In some deployments"},{"line_number":171,"context_line":"this is considered security vulnerability. See `Bug 890411 "},{"line_number":172,"context_line":"\u003chttps://bugs.launchpad.net/keystone/+bug/890411\u003e`_"},{"line_number":173,"context_line":"for more details. This problem"},{"line_number":174,"context_line":"can be mitigated by the use of service roles. In other words, roles defined for"},{"line_number":175,"context_line":"a specific service. With the service roles, we can effectively isolate the"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FyE%3D","line":172,"updated":"2012-05-04 18:20:30.000000000","message":"Don\u0027t like bugs in docs","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":177,"context_line":"role for ``Nova`` service for tenant ``XYZ``. ``Joe`` is no longer ``Admin``"},{"line_number":178,"context_line":"for Swift, Glance, or Quantum service for tenant ``XYZ``."},{"line_number":179,"context_line":""},{"line_number":180,"context_line":"To create a service role, first you\u0027ll need to know the UUID of the service you"},{"line_number":181,"context_line":"want to create the role for. If you don\u0027t have it handy, you can look it"},{"line_number":182,"context_line":"up quickly with::"},{"line_number":183,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fx8%3D","line":180,"updated":"2012-05-04 18:20:30.000000000","message":"s/first you\u0027ll/you will first/\n\ns/UUID/ID/g -- not everyone implements UUID\u0027s","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":183,"context_line":""},{"line_number":184,"context_line":"    keystone service-list"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"Then create the service role with the UUID of the service::"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"    keystone role-create --name\u003dadmin --service_id\u003d08741d8ed88242ca88d1f61484a0fe3b"},{"line_number":189,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fx4%3D","line":186,"updated":"2012-05-04 18:20:30.000000000","message":"Then, create a service-specific role","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":187,"context_line":""},{"line_number":188,"context_line":"    keystone role-create --name\u003dadmin --service_id\u003d08741d8ed88242ca88d1f61484a0fe3b"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"Once the service roles are created, you can assign them to users, just like"},{"line_number":191,"context_line":"the service agnostic roles."},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"Setting Up Middleware"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fx0%3D","line":190,"updated":"2012-05-04 18:20:30.000000000","message":"Once your service-specific role is created, you can assign it to users just like service-agnostic roles.","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"}],"doc/source/middlewarearchitecture.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":133,"context_line":"    admin_tenant_name \u003d service"},{"line_number":134,"context_line":"    ;Uncomment next line and check ip:port to use memcached to cache tokens"},{"line_number":135,"context_line":"    ;memcache_servers \u003d 127.0.0.1:11211"},{"line_number":136,"context_line":"    ;Uncomment next line and specify the service IDs for service role validation"},{"line_number":137,"context_line":"    ;service_ids \u003d \u003cservice IDs separated by comma (,)\u003e"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Configuration Options"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fxw%3D","line":136,"updated":"2012-05-04 18:20:30.000000000","message":"service-specific role validation","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":169,"context_line":"* ``token_cache_time``: (optional, default 300 seconds) Only valid if"},{"line_number":170,"context_line":"  memcache_servers is defined."},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"Service Roles Validation"},{"line_number":173,"context_line":"------------------------"},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"Middleware is designed to protect services like Nova, Swift, Glance, etc. During"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fxs%3D","line":172,"updated":"2012-05-04 18:20:30.000000000","message":"Service-Specific Role Validation","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":172,"context_line":"Service Roles Validation"},{"line_number":173,"context_line":"------------------------"},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"Middleware is designed to protect services like Nova, Swift, Glance, etc. During"},{"line_number":176,"context_line":"token validation, it may decide to reject the request if the user does not have"},{"line_number":177,"context_line":"any role for a given service. For instance, assuming Middleware is deployed with"},{"line_number":178,"context_line":"Nova API and there a request for service which would required Nova Admin privilege,"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fxo%3D","line":175,"updated":"2012-05-04 18:20:30.000000000","message":"s/Middleware/The middleware/ -- not *all* middleware ;)","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":174,"context_line":""},{"line_number":175,"context_line":"Middleware is designed to protect services like Nova, Swift, Glance, etc. During"},{"line_number":176,"context_line":"token validation, it may decide to reject the request if the user does not have"},{"line_number":177,"context_line":"any role for a given service. For instance, assuming Middleware is deployed with"},{"line_number":178,"context_line":"Nova API and there a request for service which would required Nova Admin privilege,"},{"line_number":179,"context_line":"there\u0027s no reason to allow the operation to proceed if user does not have any"},{"line_number":180,"context_line":"Nova roles. Middleware may be configured to enable service roles validation."}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fxk%3D","line":177,"updated":"2012-05-04 18:20:30.000000000","message":"s/any role/a role/\n\ns/Middleware is deployed with/the middleware is deployed in front of/","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":175,"context_line":"Middleware is designed to protect services like Nova, Swift, Glance, etc. During"},{"line_number":176,"context_line":"token validation, it may decide to reject the request if the user does not have"},{"line_number":177,"context_line":"any role for a given service. For instance, assuming Middleware is deployed with"},{"line_number":178,"context_line":"Nova API and there a request for service which would required Nova Admin privilege,"},{"line_number":179,"context_line":"there\u0027s no reason to allow the operation to proceed if user does not have any"},{"line_number":180,"context_line":"Nova roles. Middleware may be configured to enable service roles validation."},{"line_number":181,"context_line":"If service IDs are specified, middleware will send them along to Keystone for token"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2Fxc%3D","line":178,"updated":"2012-05-04 18:20:30.000000000","message":"I don\u0027t understand this line at all, starting with \"and there a request.\"","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":177,"context_line":"any role for a given service. For instance, assuming Middleware is deployed with"},{"line_number":178,"context_line":"Nova API and there a request for service which would required Nova Admin privilege,"},{"line_number":179,"context_line":"there\u0027s no reason to allow the operation to proceed if user does not have any"},{"line_number":180,"context_line":"Nova roles. Middleware may be configured to enable service roles validation."},{"line_number":181,"context_line":"If service IDs are specified, middleware will send them along to Keystone for token"},{"line_number":182,"context_line":"validation."},{"line_number":183,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FxY%3D","line":180,"updated":"2012-05-04 18:20:30.000000000","message":"service-specific role validation","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":178,"context_line":"Nova API and there a request for service which would required Nova Admin privilege,"},{"line_number":179,"context_line":"there\u0027s no reason to allow the operation to proceed if user does not have any"},{"line_number":180,"context_line":"Nova roles. Middleware may be configured to enable service roles validation."},{"line_number":181,"context_line":"If service IDs are specified, middleware will send them along to Keystone for token"},{"line_number":182,"context_line":"validation."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"* ``service_ids``: (optonal) service IDs separated by a comma (,)"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FxU%3D","line":181,"updated":"2012-05-04 18:20:30.000000000","message":"If one or more service ID\u0027s","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"051304c3cc02bbe3756b9907a694b15c203afeda","unresolved":false,"context_lines":[{"line_number":181,"context_line":"If service IDs are specified, middleware will send them along to Keystone for token"},{"line_number":182,"context_line":"validation."},{"line_number":183,"context_line":""},{"line_number":184,"context_line":"* ``service_ids``: (optonal) service IDs separated by a comma (,)"},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"Exchanging User Information"},{"line_number":187,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":5,"id":"AAAAHX%2F%2F%2FxQ%3D","line":184,"updated":"2012-05-04 18:20:30.000000000","message":"(optional) comma-delimited list of service ID\u0027s","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"48878c84b28932cad5fcc45ce346d70bd419d1aa","unresolved":false,"context_lines":[{"line_number":134,"context_line":"    ;Uncomment next line and check ip:port to use memcached to cache tokens"},{"line_number":135,"context_line":"    ;memcache_servers \u003d 127.0.0.1:11211"},{"line_number":136,"context_line":"    ;Uncomment next line and specify the service IDs for service-specific role validation"},{"line_number":137,"context_line":"    ;service_ids \u003d \u003ccomma-delimited service ID\u0027s\u003e"},{"line_number":138,"context_line":""},{"line_number":139,"context_line":"Configuration Options"},{"line_number":140,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAAHX%2F%2F49o%3D","line":137,"updated":"2012-05-22 21:37:19.000000000","message":"I think this may answer one of my previous questions -- one middleware deployment may be protecting multiple services which \"trust\" each other, but which don\u0027t trust services not protected by that same middleware deployment?","commit_id":"bd6c25c60fd3677eca76683732a341cc02070018"}],"keystone/catalog/core.py":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"e68b39a97afdf96cef36a9b6979d509764c6aca5","unresolved":false,"context_lines":[{"line_number":139,"context_line":"        roles_ref \u003d self.identity_api.list_roles(context,"},{"line_number":140,"context_line":"                        service_id\u003dservice_id)"},{"line_number":141,"context_line":"        for role in roles_ref:"},{"line_number":142,"context_line":"            self.identity_api.delete_role(context, role_id\u003drole[\u0027id\u0027])"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    def delete_service(self, context, service_id):"},{"line_number":145,"context_line":"        service_ref \u003d self.catalog_api.get_service(context, service_id)"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAHX%2F%2F%2F9U%3D","line":142,"updated":"2012-05-04 13:05:47.000000000","message":"I would suggest that it might be more efficient to add a delete_roles_for_service() call directly to the identity API instead of calling delete_role() for each role in list_roles(service_id\u003dservice_id)... Would enable the SQL generated (for the SQL backend at least) to be a single DELETE statement instead of many...","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fa96c496ddfb1ab7d181340f6d7fbf60ee1c22ce","unresolved":false,"context_lines":[{"line_number":139,"context_line":"        roles_ref \u003d self.identity_api.list_roles(context,"},{"line_number":140,"context_line":"                        service_id\u003dservice_id)"},{"line_number":141,"context_line":"        for role in roles_ref:"},{"line_number":142,"context_line":"            self.identity_api.delete_role(context, role_id\u003drole[\u0027id\u0027])"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"    def delete_service(self, context, service_id):"},{"line_number":145,"context_line":"        service_ref \u003d self.catalog_api.get_service(context, service_id)"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAHX%2F%2F%2Fo0%3D","line":142,"in_reply_to":"AAAAHX%2F%2F%2F9U%3D","updated":"2012-05-05 00:20:23.000000000","message":"The sql backend seemed to follow the one delete at a time pattern.","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"}],"keystone/identity/backends/kvs.py":[{"author":{"_account_id":1941,"name":"Lin Hua Cheng","email":"os.lcheng@gmail.com","username":"lin-hua-cheng"},"change_message_id":"0c5860b2ac35e2ea2ea279269fc04b088078e928","unresolved":false,"context_lines":[{"line_number":96,"context_line":"    def get_metadata(self, user_id, tenant_id):"},{"line_number":97,"context_line":"        return self.db.get(\u0027metadata-%s-%s\u0027 % (tenant_id, user_id)) or {}"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"    def get_role_by_name_and_service(self, role_name, service_id):"},{"line_number":100,"context_line":"        raise NotImplementedError()"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"    def get_role(self, role_id):"}],"source_content_type":"text/x-python","patch_set":6,"id":"AAAAHX%2F%2F%2B7k%3D","line":99,"updated":"2012-05-08 01:06:54.000000000","message":"Should this method be added to ldap/core.py as well for consistency of Driver interface?","commit_id":"8fb258a223c2e467c9a6899dfaacfb7ccf0b75f2"}],"keystone/identity/backends/sql.py":[{"author":{"_account_id":1091,"name":"Arun Kant","email":"arukant@cisco.com","username":"arunkant-uws"},"change_message_id":"0ca706da1211bedae6f72753e86a81b2b6d38fd9","unresolved":false,"context_lines":[{"line_number":449,"context_line":"        self.db.delete(\u0027metadata-%s-%s\u0027 % (tenant_id, user_id))"},{"line_number":450,"context_line":"        return None"},{"line_number":451,"context_line":""},{"line_number":452,"context_line":"    def _check_duplicate_role(self, role):"},{"line_number":453,"context_line":"        # do the explicit duplicate record check since"},{"line_number":454,"context_line":"        # unique contraint enforcement is only effective if"},{"line_number":455,"context_line":"        # service_id is not null"}],"source_content_type":"text/x-python","patch_set":7,"id":"AAAAHX%2F%2F4O4%3D","line":452,"updated":"2012-05-24 05:43:34.000000000","message":"Are we supposed to get duplicate/conflict exception when updating a role with exact same role name and service id as the one found in database for that provided role id in update call. This could be the case when someone re-submit the same data again in update call. In case of insert, this makes sense but in update, i will expect this to be allowed if we are just updating existing record with its existing data.","commit_id":"bd6c25c60fd3677eca76683732a341cc02070018"}],"keystone/service.py":[{"author":{"_account_id":7,"name":"Jay Pipes","email":"jaypipes@gmail.com","username":"jaypipes"},"change_message_id":"e68b39a97afdf96cef36a9b6979d509764c6aca5","unresolved":false,"context_lines":[{"line_number":397,"context_line":"        roles_ref \u003d self._filter_roles_by_service_id(roles_ref, service_id)"},{"line_number":398,"context_line":"        logging.debug(\u0027ROLES_REF after service_id filtering: %s\u0027, roles_ref)"},{"line_number":399,"context_line":"        if service_id is not None:"},{"line_number":400,"context_line":"            assert len(roles_ref) \u003e 0"},{"line_number":401,"context_line":"        return roles_ref"},{"line_number":402,"context_line":""},{"line_number":403,"context_line":"    def _filter_roles_by_service_id(self, roles_ref, service_id\u003dNone):"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAHX%2F%2F%2F84%3D","line":400,"updated":"2012-05-04 13:05:47.000000000","message":"It seems pretty harsh to just assert here, but looking at the existing code, it looks like that is the pattern used... so no biggie I guess","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"fa96c496ddfb1ab7d181340f6d7fbf60ee1c22ce","unresolved":false,"context_lines":[{"line_number":397,"context_line":"        roles_ref \u003d self._filter_roles_by_service_id(roles_ref, service_id)"},{"line_number":398,"context_line":"        logging.debug(\u0027ROLES_REF after service_id filtering: %s\u0027, roles_ref)"},{"line_number":399,"context_line":"        if service_id is not None:"},{"line_number":400,"context_line":"            assert len(roles_ref) \u003e 0"},{"line_number":401,"context_line":"        return roles_ref"},{"line_number":402,"context_line":""},{"line_number":403,"context_line":"    def _filter_roles_by_service_id(self, roles_ref, service_id\u003dNone):"}],"source_content_type":"text/x-python","patch_set":5,"id":"AAAAHX%2F%2F%2Fo4%3D","line":400,"in_reply_to":"AAAAHX%2F%2F%2F84%3D","updated":"2012-05-05 00:20:23.000000000","message":"I didn\u0027t want to mess with karma. But hey ... :)","commit_id":"952ba141adafa8f5a50b9d48a22fbba61e3d913b"}]}