)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"25133a5930d9c4df37680372f8e5de793fccbdc6","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Add documentation on how to configure federation in keystone"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Co-Authored-By: Steve Martinelli \u003cstevemar@ca.ibm.com\u003e"},{"line_number":12,"context_line":"Co-Authored-By: Marek Denis \u003cmarek.denis@cern.ch\u003e"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Ia7e5a67d762921a81ef4a7d16c682e5db1c3ba6c"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"AAAAXH%2F%2FdPc%3D","line":11,"updated":"2014-04-21 16:10:36.000000000","message":"remove since Steve is the author.","commit_id":"9bac24a3b0676ce83b1f2b9949efc61db3a8831c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6a5c3eb917e4c9e135e1e2d4f70dbc77be44d85e","unresolved":false,"context_lines":[{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Add documentation on how to configure federation in keystone"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Co-Authored-By: Steve Martinelli \u003cstevemar@ca.ibm.com\u003e"},{"line_number":12,"context_line":"Co-Authored-By: Marek Denis \u003cmarek.denis@cern.ch\u003e"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Ia7e5a67d762921a81ef4a7d16c682e5db1c3ba6c"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"AAAAXH%2F%2FdNA%3D","line":11,"in_reply_to":"AAAAXH%2F%2FdPc%3D","updated":"2014-04-21 16:17:11.000000000","message":"Isn\u0027t Marek the author (line 2)?\nI\u0027d prefer he get authorship. I\u0027ll remove line 12.","commit_id":"9bac24a3b0676ce83b1f2b9949efc61db3a8831c"},{"author":{"_account_id":6486,"name":"Brant Knudson","email":"blk@acm.org","username":"blk-u"},"change_message_id":"25133a5930d9c4df37680372f8e5de793fccbdc6","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Co-Authored-By: Steve Martinelli \u003cstevemar@ca.ibm.com\u003e"},{"line_number":12,"context_line":"Co-Authored-By: Marek Denis \u003cmarek.denis@cern.ch\u003e"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Ia7e5a67d762921a81ef4a7d16c682e5db1c3ba6c"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"AAAAXH%2F%2FdPU%3D","line":13,"updated":"2014-04-21 16:10:36.000000000","message":"Add a DocImpact tag.","commit_id":"9bac24a3b0676ce83b1f2b9949efc61db3a8831c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6a5c3eb917e4c9e135e1e2d4f70dbc77be44d85e","unresolved":false,"context_lines":[{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Co-Authored-By: Steve Martinelli \u003cstevemar@ca.ibm.com\u003e"},{"line_number":12,"context_line":"Co-Authored-By: Marek Denis \u003cmarek.denis@cern.ch\u003e"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Change-Id: Ia7e5a67d762921a81ef4a7d16c682e5db1c3ba6c"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"AAAAXH%2F%2FdNk%3D","line":13,"in_reply_to":"AAAAXH%2F%2FdPU%3D","updated":"2014-04-21 16:17:11.000000000","message":"++","commit_id":"9bac24a3b0676ce83b1f2b9949efc61db3a8831c"}],"doc/source/configure_federation.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"681d7012f4d5e21711e3f74c008a6cbcc1f8eab4","unresolved":false,"context_lines":[{"line_number":67,"context_line":""},{"line_number":68,"context_line":"Federate Keystone (SP) and an external IdP. Refer to `TestShib"},{"line_number":69,"context_line":"\u003chttp://www.testshib.org/install.html\u003e`_"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Enable the ``OS-FEDERATION`` extension"},{"line_number":72,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":73,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"AAAAXH%2F%2FdYI%3D","line":70,"updated":"2014-04-21 16:01:05.000000000","message":"Lines 78-98 should actually be in this sections. \n\nAnd the next section should just point to the link \u0027extensions/federation-configuration.html\u0027","commit_id":"86747e1cb900526e38cb6fda9a9ac992cb6c5175"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"bb84a3bc27670d9fe48b2c369387dd2a857aa5f4","unresolved":false,"context_lines":[{"line_number":29,"context_line":"This approach to federation supports Keystone as a Service Provider, consuming"},{"line_number":30,"context_line":"SAML assertions issued by an external Identity Provider."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Federated users do not need to be mirrored in the Keystone identity backend"},{"line_number":33,"context_line":"(for example, using the SQL driver). The external Identity Provider is"},{"line_number":34,"context_line":"responsible for authenticating users, and communicates the result of"},{"line_number":35,"context_line":"authentication to Keystone using SAML assertions. Keystone then maps the SAML"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FS7U%3D","line":32,"updated":"2014-04-22 17:32:50.000000000","message":"do not need is a little misleading.  Isn\u0027t it a little  stronger than that. Basically federated users are not mirrored in the Keystone identity backend due to....   Do not need makes it sound like they could be optionally mirrored which I dont think is the case","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7343f93912f7bb315f695b3c8ccc0c20dbc6efba","unresolved":false,"context_lines":[{"line_number":29,"context_line":"This approach to federation supports Keystone as a Service Provider, consuming"},{"line_number":30,"context_line":"SAML assertions issued by an external Identity Provider."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"Federated users do not need to be mirrored in the Keystone identity backend"},{"line_number":33,"context_line":"(for example, using the SQL driver). The external Identity Provider is"},{"line_number":34,"context_line":"responsible for authenticating users, and communicates the result of"},{"line_number":35,"context_line":"authentication to Keystone using SAML assertions. Keystone then maps the SAML"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FLT8%3D","line":32,"in_reply_to":"AAAAXH%2F%2FS7U%3D","updated":"2014-04-23 15:37:35.000000000","message":"re-wrote to \u0027are not mirrored in the Keystone identity backend\u0027","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"bb84a3bc27670d9fe48b2c369387dd2a857aa5f4","unresolved":false,"context_lines":[{"line_number":32,"context_line":"Federated users do not need to be mirrored in the Keystone identity backend"},{"line_number":33,"context_line":"(for example, using the SQL driver). The external Identity Provider is"},{"line_number":34,"context_line":"responsible for authenticating users, and communicates the result of"},{"line_number":35,"context_line":"authentication to Keystone using SAML assertions. Keystone then maps the SAML"},{"line_number":36,"context_line":"assertions to Keystone user groups, and assignments created in Keystone."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"To enable federation, you\u0027ll need to:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FS6c%3D","line":35,"updated":"2014-04-22 17:32:50.000000000","message":"I would add a sentence describing what SAML assertions typically contain in them before mentioning that Keystone maps them","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7343f93912f7bb315f695b3c8ccc0c20dbc6efba","unresolved":false,"context_lines":[{"line_number":32,"context_line":"Federated users do not need to be mirrored in the Keystone identity backend"},{"line_number":33,"context_line":"(for example, using the SQL driver). The external Identity Provider is"},{"line_number":34,"context_line":"responsible for authenticating users, and communicates the result of"},{"line_number":35,"context_line":"authentication to Keystone using SAML assertions. Keystone then maps the SAML"},{"line_number":36,"context_line":"assertions to Keystone user groups, and assignments created in Keystone."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"To enable federation, you\u0027ll need to:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FLTc%3D","line":35,"in_reply_to":"AAAAXH%2F%2FS6c%3D","updated":"2014-04-23 15:37:35.000000000","message":"they are defined on line 24","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"bb84a3bc27670d9fe48b2c369387dd2a857aa5f4","unresolved":false,"context_lines":[{"line_number":55,"context_line":"    $ apt-get libapache2-mod-shib2"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Additionally, ensure the keystone virtual host is enabled and the ``ssl`` and"},{"line_number":58,"context_line":"``shib2`` modules::"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    $ a2ensite wsgi-keystone.conf"},{"line_number":61,"context_line":"    $ a2enmod ssl"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FS5w%3D","line":58,"updated":"2014-04-22 17:32:50.000000000","message":"whata re you doing with the ssl and shib2?  Ensuring they are enabled as well?  This is a little unclear","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c9f664f8af4281f1612c45b5590584bc84bf9de0","unresolved":false,"context_lines":[{"line_number":55,"context_line":"    $ apt-get libapache2-mod-shib2"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Additionally, ensure the keystone virtual host is enabled and the ``ssl`` and"},{"line_number":58,"context_line":"``shib2`` modules::"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"    $ a2ensite wsgi-keystone.conf"},{"line_number":61,"context_line":"    $ a2enmod ssl"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FNkc%3D","line":58,"in_reply_to":"AAAAXH%2F%2FS5w%3D","updated":"2014-04-23 15:41:34.000000000","message":"Yes, it\u0027s here to outline that ssl and shibd2 modules should be enabled.","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"bb84a3bc27670d9fe48b2c369387dd2a857aa5f4","unresolved":false,"context_lines":[{"line_number":68,"context_line":"Federate Keystone (SP) and an external IdP. Refer to `TestShib"},{"line_number":69,"context_line":"\u003chttp://www.testshib.org/install.html\u003e`_"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Once you have your Keystone virtual host ready, then it\u0027s time to configure"},{"line_number":72,"context_line":"Shibboleth and upload your Metadata to the Identity Provider."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"If new certificates are required, they can be easily created by executing::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FS5g%3D","line":71,"updated":"2014-04-22 17:32:50.000000000","message":"it\u0027s then as opposed then it\u0027s","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7343f93912f7bb315f695b3c8ccc0c20dbc6efba","unresolved":false,"context_lines":[{"line_number":68,"context_line":"Federate Keystone (SP) and an external IdP. Refer to `TestShib"},{"line_number":69,"context_line":"\u003chttp://www.testshib.org/install.html\u003e`_"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Once you have your Keystone virtual host ready, then it\u0027s time to configure"},{"line_number":72,"context_line":"Shibboleth and upload your Metadata to the Identity Provider."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"If new certificates are required, they can be easily created by executing::"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FLR4%3D","line":71,"in_reply_to":"AAAAXH%2F%2FS5g%3D","updated":"2014-04-23 15:37:35.000000000","message":"Done","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c9f664f8af4281f1612c45b5590584bc84bf9de0","unresolved":false,"context_lines":[{"line_number":69,"context_line":"\u003chttp://www.testshib.org/install.html\u003e`_"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Once you have your Keystone virtual host ready, then it\u0027s time to configure"},{"line_number":72,"context_line":"Shibboleth and upload your Metadata to the Identity Provider."},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"If new certificates are required, they can be easily created by executing::"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FNlA%3D","line":72,"updated":"2014-04-23 15:41:34.000000000","message":"Add link with suggested reading (https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataForSP) and example, that typically such Metadata file can be fetched from https://service.example.org/Shibboleth.sso/Metadata","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c9f664f8af4281f1612c45b5590584bc84bf9de0","unresolved":false,"context_lines":[{"line_number":82,"context_line":"how to upload your SP\u0027s metadata into their system. This can be achieved by"},{"line_number":83,"context_line":"executing::"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"    wget --no-check-certificate -O \u003cname of the file\u003e"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Next, upload your metadata file to `testshib.org \u003chttp://testshib.org/\u003e`_ and"},{"line_number":88,"context_line":"you should be able to get a customized ``shibboleth2.xml`` file. Save it as"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FNvg%3D","line":85,"updated":"2014-04-23 15:41:34.000000000","message":"add something like https://service.example.org/Shibboleth.sso/Metadata, otherwise wget command is invalid.","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c9f664f8af4281f1612c45b5590584bc84bf9de0","unresolved":false,"context_lines":[{"line_number":84,"context_line":""},{"line_number":85,"context_line":"    wget --no-check-certificate -O \u003cname of the file\u003e"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Next, upload your metadata file to `testshib.org \u003chttp://testshib.org/\u003e`_ and"},{"line_number":88,"context_line":"you should be able to get a customized ``shibboleth2.xml`` file. Save it as"},{"line_number":89,"context_line":"``/etc/shibboleth/shibboleth2.xml``."},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FNuU%3D","line":87,"updated":"2014-04-23 15:41:34.000000000","message":"I would generalize it here - write something like: \u0027upload your service provider\u0027s metadata file to federated Identity Provider\u0027 and maybe mention a link with shibboleth\u0027s IdP reading, as one existing software on the market. In my initial doc I wrote about testshib, because it was more like a tutorial/blog post not a \u0027generic\u0027 documentation.","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"bb84a3bc27670d9fe48b2c369387dd2a857aa5f4","unresolved":false,"context_lines":[{"line_number":104,"context_line":"configure the ``OS-FEDERATION`` extension."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"1. Add local Keystone groups and roles"},{"line_number":107,"context_line":"2. Add a federated identity provider, attribute mapping rules, protocols"},{"line_number":108,"context_line":"3. Authenticate externally and generated an unscoped token in Keystone"},{"line_number":109,"context_line":"4. Determine accessible resources"},{"line_number":110,"context_line":"5. Get a scoped token"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FS2s%3D","line":107,"updated":"2014-04-22 17:32:50.000000000","message":"rules, and protocols as shown below","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"7343f93912f7bb315f695b3c8ccc0c20dbc6efba","unresolved":false,"context_lines":[{"line_number":104,"context_line":"configure the ``OS-FEDERATION`` extension."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"1. Add local Keystone groups and roles"},{"line_number":107,"context_line":"2. Add a federated identity provider, attribute mapping rules, protocols"},{"line_number":108,"context_line":"3. Authenticate externally and generated an unscoped token in Keystone"},{"line_number":109,"context_line":"4. Determine accessible resources"},{"line_number":110,"context_line":"5. Get a scoped token"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FLR8%3D","line":107,"in_reply_to":"AAAAXH%2F%2FS2s%3D","updated":"2014-04-23 15:37:35.000000000","message":"changed this line to match that of the title below","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c9f664f8af4281f1612c45b5590584bc84bf9de0","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"Thus, it is required to create the necessary Identity Service groups that"},{"line_number":121,"context_line":"correspond to the Identity Provider\u0027s groups; additionally, these groups should"},{"line_number":122,"context_line":"be assigned roles on one or more projects or domains."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"You may be interested in more information on `group management"},{"line_number":125,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#create-group-post-groups\u003e`_"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FNsk%3D","line":122,"updated":"2014-04-23 15:41:34.000000000","message":"\"should be assigned TO roles [...]\" ?","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c9f664f8af4281f1612c45b5590584bc84bf9de0","unresolved":false,"context_lines":[{"line_number":157,"context_line":"Add a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":158,"context_line":"An Identity Provider can have a single mapping specified per protocol."},{"line_number":159,"context_line":"A mapping is simply a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"More information on mapping can be found `here"},{"line_number":162,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#create-a-mapping-put-os-federationmappingsmapping_id\u003e`__."},{"line_number":163,"context_line":""}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FNqE%3D","line":160,"updated":"2014-04-23 15:41:34.000000000","message":"also add: Every mapping object must containt a rule that uniquely identifies federated user. This usually can be achieved by direct mapping of a single attrbute from the SAML assertion. Missing such rule results in HTTP 401 Unauthorized error.","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"c9f664f8af4281f1612c45b5590584bc84bf9de0","unresolved":false,"context_lines":[{"line_number":175,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"Unlike other authentication methods in the Identity Service, the user does not"},{"line_number":178,"context_line":"issue an HTTP POST request with authentication data in the request body. To"},{"line_number":179,"context_line":"start federated authentication a user must access the dedicated URL with"},{"line_number":180,"context_line":"Identity Provider\u0027s and Protocol\u0027s identifiers stored within a protected URL."},{"line_number":181,"context_line":"The URL has a format of:"}],"source_content_type":"text/x-rst","patch_set":6,"id":"AAAAXH%2F%2FNpg%3D","line":178,"updated":"2014-04-23 15:41:34.000000000","message":"\u0027an\u0027 or \u0027a\u0027 ?","commit_id":"532dc2b47a0d2c79995232803ab25886eedba62f"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"a85b12b462c9bf70a20cb45eaa9c19d70727c72e","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Enable the Keystone virtual host, for example::"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    $ a2ensite wsgi-keystone.conf"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Enable the ``ssl`` and ``shib2`` modules, for example::"},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAAXH%2F%2FKyA%3D","line":59,"updated":"2014-04-23 15:35:52.000000000","message":"I\u0027d strongly suggest to provide a sample wsgi-keystone.conf file showing how to configure mod_shib to protect the unscoped token URL, as it is not trivial. This should be either done here in the conf, or a specific sample apache conf file for federation should be added in keystone.\nMarek Denis shared a sample config that might need to be adapted a bit : https://github.com/zaccone/keystone-federation/blob/master/etc/apache2/sites-available/wsgi-keystone.conf","commit_id":"687745c175bec31cf1010a433ceb66960267013c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c78289c0fa22995fbb096ef6fe78c6e830f4fa40","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Enable the Keystone virtual host, for example::"},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"    $ a2ensite wsgi-keystone.conf"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Enable the ``ssl`` and ``shib2`` modules, for example::"},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAAXH%2F%2FKtY%3D","line":59,"in_reply_to":"AAAAXH%2F%2FKyA%3D","updated":"2014-04-23 15:40:16.000000000","message":"++, will add this next go-around","commit_id":"687745c175bec31cf1010a433ceb66960267013c"},{"author":{"_account_id":7186,"name":"Matthieu Huin","email":"mhuin@redhat.com","username":"mhu"},"change_message_id":"a85b12b462c9bf70a20cb45eaa9c19d70727c72e","unresolved":false,"context_lines":[{"line_number":120,"context_line":"As mentioned earlier, no new users will be added to the Identity backend, but"},{"line_number":121,"context_line":"the Identity Service requires group-based role assignments to authorize"},{"line_number":122,"context_line":"federated users. The federation mapping function will map the user into local"},{"line_number":123,"context_line":"Identity Service groups objects, and thus to local role assignments."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"Thus, it is required to create the necessary Identity Service groups that"},{"line_number":126,"context_line":"correspond to the Identity Provider\u0027s groups; additionally, these groups should"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAAXH%2F%2FKv0%3D","line":123,"updated":"2014-04-23 15:35:52.000000000","message":"Should probably mention that federated users can also be mapped into existing users ?","commit_id":"687745c175bec31cf1010a433ceb66960267013c"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"e7ccbcaa7abcc69f5303d32a0670c726030be311","unresolved":false,"context_lines":[{"line_number":120,"context_line":"As mentioned earlier, no new users will be added to the Identity backend, but"},{"line_number":121,"context_line":"the Identity Service requires group-based role assignments to authorize"},{"line_number":122,"context_line":"federated users. The federation mapping function will map the user into local"},{"line_number":123,"context_line":"Identity Service groups objects, and thus to local role assignments."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"Thus, it is required to create the necessary Identity Service groups that"},{"line_number":126,"context_line":"correspond to the Identity Provider\u0027s groups; additionally, these groups should"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAAXH%2F%2FKQc%3D","line":123,"in_reply_to":"AAAAXH%2F%2FKr8%3D","updated":"2014-04-23 16:22:15.000000000","message":"++, long story short: with the current code you cannot map to a single existing user.\nSo, even if you have a local user  mhu, use federation and due to some rules ang magic happening behind that a mapping engine spits out user \u003d\u003d mhu it doesn\u0027t mean your federated user is now mhu, with all his roles and settings.","commit_id":"687745c175bec31cf1010a433ceb66960267013c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c78289c0fa22995fbb096ef6fe78c6e830f4fa40","unresolved":false,"context_lines":[{"line_number":120,"context_line":"As mentioned earlier, no new users will be added to the Identity backend, but"},{"line_number":121,"context_line":"the Identity Service requires group-based role assignments to authorize"},{"line_number":122,"context_line":"federated users. The federation mapping function will map the user into local"},{"line_number":123,"context_line":"Identity Service groups objects, and thus to local role assignments."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"Thus, it is required to create the necessary Identity Service groups that"},{"line_number":126,"context_line":"correspond to the Identity Provider\u0027s groups; additionally, these groups should"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAAXH%2F%2FKr8%3D","line":123,"in_reply_to":"AAAAXH%2F%2FKv0%3D","updated":"2014-04-23 15:40:16.000000000","message":"sort of, the federated users information is used to craft an id/name to place in the token for auditing. I should at least mention something like that though.","commit_id":"687745c175bec31cf1010a433ceb66960267013c"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"c78289c0fa22995fbb096ef6fe78c6e830f4fa40","unresolved":false,"context_lines":[{"line_number":130,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#create-group-post-groups\u003e`_"},{"line_number":131,"context_line":"and `role assignments"},{"line_number":132,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#grant-role-to-group-on-project-put-projectsproject_idgroupsgroup_idrolesrole_id\u003e`_,"},{"line_number":133,"context_line":"both of which are exposed to the CLI via `python-openstackclient"},{"line_number":134,"context_line":"\u003chttps://pypi.python.org/pypi/python-openstackclient/\u003e`_."},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Add Identity Provider(s), Mapping(s), and Protocol(s)"}],"source_content_type":"text/x-rst","patch_set":7,"id":"AAAAXH%2F%2FKsc%3D","line":133,"updated":"2014-04-23 15:40:16.000000000","message":"I don\u0027t recall who wrote this (dolphm?) but thanks for the shout out to osclient","commit_id":"687745c175bec31cf1010a433ceb66960267013c"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"1da204e2a47221833535d55209d783a33d5320be","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Federate Keystone (SP) and an external IdP."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Once you have your Keystone virtual host ready, then it\u0027s then time to"},{"line_number":77,"context_line":"configure Shibboleth and upload your Metadata to the Identity Provider."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"If new certificates are required, they can be easily created by executing::"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F9IM%3D","line":76,"updated":"2014-04-25 03:50:34.000000000","message":"Remove the first \"then\".","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3f3557fd3cf6e0d432e34f81b99475700fcc912b","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Federate Keystone (SP) and an external IdP."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"Once you have your Keystone virtual host ready, then it\u0027s then time to"},{"line_number":77,"context_line":"configure Shibboleth and upload your Metadata to the Identity Provider."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"If new certificates are required, they can be easily created by executing::"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F7xU%3D","line":76,"in_reply_to":"AAAAXX%2F%2F9IM%3D","updated":"2014-04-25 08:29:09.000000000","message":"Done","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"1da204e2a47221833535d55209d783a33d5320be","unresolved":false,"context_lines":[{"line_number":155,"context_line":"Identity Provider"},{"line_number":156,"context_line":"~~~~~~~~~~~~~~~~~"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Create an Identity Provider object in Keystone, which represents a trusted"},{"line_number":159,"context_line":"third party service that authenticates end users."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"More information on identity providers can be found `here"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F9E4%3D","line":158,"updated":"2014-04-25 03:50:34.000000000","message":"The Identity Provider created on Keystone should represent the same Identity Provider mentioned on line 90, right? If so, I\u0027d rather use a definite instead of an indefinite article. Or you could make it even clearer: \".. which represents the Identity Provider we will use to authenticate end users.\"","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3f3557fd3cf6e0d432e34f81b99475700fcc912b","unresolved":false,"context_lines":[{"line_number":155,"context_line":"Identity Provider"},{"line_number":156,"context_line":"~~~~~~~~~~~~~~~~~"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Create an Identity Provider object in Keystone, which represents a trusted"},{"line_number":159,"context_line":"third party service that authenticates end users."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"More information on identity providers can be found `here"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F7vA%3D","line":158,"in_reply_to":"AAAAXX%2F%2F9E4%3D","updated":"2014-04-25 08:29:09.000000000","message":"Answering your question: yes. You federate Idps with your Service Provider (Keystone) but you must also make Keystone aware there are Identity Providers along with certain Protocols and Mappings.\nI am, however not changing the articles and will leave it to my native English speaking colleagues.","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"1da204e2a47221833535d55209d783a33d5320be","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"~~~~~~~"},{"line_number":165,"context_line":"Mapping"},{"line_number":166,"context_line":"~~~~~~~"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Add a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":169,"context_line":"An Identity Provider can have a single mapping specified per protocol."}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F9Ag%3D","line":166,"updated":"2014-04-25 03:50:34.000000000","message":"Can one define a Mapping before creating the Protocol? If not, move this after Protocol.","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3f3557fd3cf6e0d432e34f81b99475700fcc912b","unresolved":false,"context_lines":[{"line_number":163,"context_line":""},{"line_number":164,"context_line":"~~~~~~~"},{"line_number":165,"context_line":"Mapping"},{"line_number":166,"context_line":"~~~~~~~"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Add a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":169,"context_line":"An Identity Provider can have a single mapping specified per protocol."}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F7uM%3D","line":166,"in_reply_to":"AAAAXX%2F%2F9Ag%3D","updated":"2014-04-25 08:29:09.000000000","message":"In fact, the Protocol is an object that ties mapping with identity provider, so adding a mapping after a protocol is simply impossible.","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"1da204e2a47221833535d55209d783a33d5320be","unresolved":false,"context_lines":[{"line_number":166,"context_line":"~~~~~~~"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Add a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":169,"context_line":"An Identity Provider can have a single mapping specified per protocol."},{"line_number":170,"context_line":"A mapping is simply a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"More information on mapping can be found `here"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F9C0%3D","line":169,"updated":"2014-04-25 03:50:34.000000000","message":"Just a single mapping? -\u003e can only have a single/can have just a single; At least one mapping? -\u003e should have at least one mapping; Might have no mappings? -\u003e does it make sense to mention?","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3f3557fd3cf6e0d432e34f81b99475700fcc912b","unresolved":false,"context_lines":[{"line_number":166,"context_line":"~~~~~~~"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Add a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":169,"context_line":"An Identity Provider can have a single mapping specified per protocol."},{"line_number":170,"context_line":"A mapping is simply a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"More information on mapping can be found `here"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F7m8%3D","line":169,"in_reply_to":"AAAAXX%2F%2F9C0%3D","updated":"2014-04-25 08:29:09.000000000","message":"changing to \u0027has\u0027 so I think clearly states that IdP will have exactly one mapping per protocol.","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"1da204e2a47221833535d55209d783a33d5320be","unresolved":false,"context_lines":[{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Add a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":169,"context_line":"An Identity Provider can have a single mapping specified per protocol."},{"line_number":170,"context_line":"A mapping is simply a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"More information on mapping can be found `here"},{"line_number":173,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#create-a-mapping-put-os-federationmappingsmapping_id\u003e`__."}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F9B4%3D","line":170,"updated":"2014-04-25 03:50:34.000000000","message":"Define what a mapping is before saying how many of them can/should be specified.","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3f3557fd3cf6e0d432e34f81b99475700fcc912b","unresolved":false,"context_lines":[{"line_number":167,"context_line":""},{"line_number":168,"context_line":"Add a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":169,"context_line":"An Identity Provider can have a single mapping specified per protocol."},{"line_number":170,"context_line":"A mapping is simply a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"More information on mapping can be found `here"},{"line_number":173,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#create-a-mapping-put-os-federationmappingsmapping_id\u003e`__."}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F7ok%3D","line":170,"in_reply_to":"AAAAXX%2F%2F9B4%3D","updated":"2014-04-25 08:29:09.000000000","message":"moved to the beginning of the section.","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"1da204e2a47221833535d55209d783a33d5320be","unresolved":false,"context_lines":[{"line_number":175,"context_line":"~~~~~~~~"},{"line_number":176,"context_line":"Protocol"},{"line_number":177,"context_line":"~~~~~~~~"},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"Contains information that dictates which Mapping rules to use for an incoming"},{"line_number":180,"context_line":"request made by an IdP. An IdP may have multiple supported protocol."},{"line_number":181,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F9A8%3D","line":178,"updated":"2014-04-25 03:50:34.000000000","message":"Ok, it\u0027s a good definition for Protocol, but what should be done?","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3f3557fd3cf6e0d432e34f81b99475700fcc912b","unresolved":false,"context_lines":[{"line_number":175,"context_line":"~~~~~~~~"},{"line_number":176,"context_line":"Protocol"},{"line_number":177,"context_line":"~~~~~~~~"},{"line_number":178,"context_line":""},{"line_number":179,"context_line":"Contains information that dictates which Mapping rules to use for an incoming"},{"line_number":180,"context_line":"request made by an IdP. An IdP may have multiple supported protocol."},{"line_number":181,"context_line":""}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F7mo%3D","line":178,"in_reply_to":"AAAAXX%2F%2F9A8%3D","updated":"2014-04-25 08:29:09.000000000","message":"added some more explanation.","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"1da204e2a47221833535d55209d783a33d5320be","unresolved":false,"context_lines":[{"line_number":183,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#add-a-supported-protocol-and-attribute-mapping-combination-to-an-identity-provider-put-os-federationidentity_providersidp_idprotocolsprotocol_id\u003e`__."},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"Get an unscoped token"},{"line_number":186,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Unlike other authentication methods in the Identity Service, the user does not"},{"line_number":189,"context_line":"issue a HTTP POST request with authentication data in the request body. To"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F8%2BA%3D","line":186,"updated":"2014-04-25 03:50:34.000000000","message":"If we finished configuring in the last step, start a \"Using federation\" section.","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3f3557fd3cf6e0d432e34f81b99475700fcc912b","unresolved":false,"context_lines":[{"line_number":183,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#add-a-supported-protocol-and-attribute-mapping-combination-to-an-identity-provider-put-os-federationidentity_providersidp_idprotocolsprotocol_id\u003e`__."},{"line_number":184,"context_line":""},{"line_number":185,"context_line":"Get an unscoped token"},{"line_number":186,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Unlike other authentication methods in the Identity Service, the user does not"},{"line_number":189,"context_line":"issue a HTTP POST request with authentication data in the request body. To"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F7jw%3D","line":186,"in_reply_to":"AAAAXX%2F%2F8%2BA%3D","updated":"2014-04-25 08:29:09.000000000","message":"Done","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"1da204e2a47221833535d55209d783a33d5320be","unresolved":false,"context_lines":[{"line_number":186,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Unlike other authentication methods in the Identity Service, the user does not"},{"line_number":189,"context_line":"issue a HTTP POST request with authentication data in the request body. To"},{"line_number":190,"context_line":"start federated authentication a user must access the dedicated URL with"},{"line_number":191,"context_line":"Identity Provider\u0027s and Protocol\u0027s identifiers stored within a protected URL."},{"line_number":192,"context_line":"The URL has a format of:"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F8%2FI%3D","line":189,"updated":"2014-04-25 03:50:34.000000000","message":"s/a HTTP/an HTTP/","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3f3557fd3cf6e0d432e34f81b99475700fcc912b","unresolved":false,"context_lines":[{"line_number":186,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"Unlike other authentication methods in the Identity Service, the user does not"},{"line_number":189,"context_line":"issue a HTTP POST request with authentication data in the request body. To"},{"line_number":190,"context_line":"start federated authentication a user must access the dedicated URL with"},{"line_number":191,"context_line":"Identity Provider\u0027s and Protocol\u0027s identifiers stored within a protected URL."},{"line_number":192,"context_line":"The URL has a format of:"}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F7js%3D","line":189,"in_reply_to":"AAAAXX%2F%2F8%2FI%3D","updated":"2014-04-25 08:29:09.000000000","message":"Done","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"1da204e2a47221833535d55209d783a33d5320be","unresolved":false,"context_lines":[{"line_number":199,"context_line":"a token will be returned in XML format."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"In the returned unscoped token, a list of Identity Service groups the user is a"},{"line_number":202,"context_line":"member of will be included."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"More information on getting an unscoped token can be found `here"},{"line_number":205,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#authenticating\u003e`__."}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F8%2Bg%3D","line":202,"updated":"2014-04-25 03:50:34.000000000","message":"s/is a member of/belongs to/","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3f3557fd3cf6e0d432e34f81b99475700fcc912b","unresolved":false,"context_lines":[{"line_number":199,"context_line":"a token will be returned in XML format."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"In the returned unscoped token, a list of Identity Service groups the user is a"},{"line_number":202,"context_line":"member of will be included."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"More information on getting an unscoped token can be found `here"},{"line_number":205,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#authenticating\u003e`__."}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F7f8%3D","line":202,"in_reply_to":"AAAAXX%2F%2F8%2Bg%3D","updated":"2014-04-25 08:29:09.000000000","message":"Done","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"1da204e2a47221833535d55209d783a33d5320be","unresolved":false,"context_lines":[{"line_number":223,"context_line":"project or domain may be specified by either ``id`` or ``name``. An ``id`` is"},{"line_number":224,"context_line":"sufficient to uniquely identify a project or domain."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"More information on getting an unscoped token can be found `here"},{"line_number":227,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-a-scoped-os-federation-token-post-authtokens\u003e`__."}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F9Jw%3D","line":226,"updated":"2014-04-25 03:50:34.000000000","message":"s/an unscoped/a scoped/","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"3f3557fd3cf6e0d432e34f81b99475700fcc912b","unresolved":false,"context_lines":[{"line_number":223,"context_line":"project or domain may be specified by either ``id`` or ``name``. An ``id`` is"},{"line_number":224,"context_line":"sufficient to uniquely identify a project or domain."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"More information on getting an unscoped token can be found `here"},{"line_number":227,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-a-scoped-os-federation-token-post-authtokens\u003e`__."}],"source_content_type":"text/x-rst","patch_set":8,"id":"AAAAXX%2F%2F7e8%3D","line":226,"in_reply_to":"AAAAXX%2F%2F9Jw%3D","updated":"2014-04-25 08:29:09.000000000","message":"Done","commit_id":"9eb54a98b6700d86636e8b8a13cfb35466c688ef"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"efb3c748bb7470250fb98e73399f2a075ff75acb","unresolved":false,"context_lines":[{"line_number":155,"context_line":"Identity Provider"},{"line_number":156,"context_line":"~~~~~~~~~~~~~~~~~"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Create an Identity Provider object in Keystone, which represents a trusted"},{"line_number":159,"context_line":"third party service that authenticates end users."},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"More information on identity providers can be found `here"}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAAXX%2F%2F7bs%3D","line":158,"updated":"2014-04-25 08:32:13.000000000","message":"Copied from the Patchset 8, please comment on the grammar nuances:\n\nGabriel: The Identity Provider created on Keystone should represent the same Identity Provider mentioned on line 90, right? If so, I\u0027d rather use a definite instead of an indefinite article. Or you could make it even clearer: \".. which represents the Identity Provider we will use to authenticate end users.\"\n\nMarek: Answering your question: yes. You federate Idps with your Service Provider (Keystone) but you must also make Keystone aware there are Identity Providers along with certain Protocols and Mappings. I am, however not changing the articles and will leave it to my native English speaking colleagues.","commit_id":"289b85ed080275707311e658105d7cc56cb9fec5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5977acbc9a6d21834cb6b86557de3bb1b479baa4","unresolved":false,"context_lines":[{"line_number":185,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#add-a-supported-protocol-and-attribute-mapping-combination-to-an-identity-provider-put-os-federationidentity_providersidp_idprotocolsprotocol_id\u003e`__ and specify the mapping id"},{"line_number":186,"context_line":"you want to use with the combination of the IdP and Protocol."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":189,"context_line":"Using federation authentication"},{"line_number":190,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":191,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"9ad9bd40_fbe793e2","line":188,"updated":"2014-04-30 21:35:06.000000000","message":"this should probably be wrapped in \u003d\u003d\u003d\u003d\u003d instead of ~~~~~","commit_id":"289b85ed080275707311e658105d7cc56cb9fec5"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"0ff3780f8ed4493009e43b06f95ca4e23e56d344","unresolved":false,"context_lines":[{"line_number":185,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#add-a-supported-protocol-and-attribute-mapping-combination-to-an-identity-provider-put-os-federationidentity_providersidp_idprotocolsprotocol_id\u003e`__ and specify the mapping id"},{"line_number":186,"context_line":"you want to use with the combination of the IdP and Protocol."},{"line_number":187,"context_line":""},{"line_number":188,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":189,"context_line":"Using federation authentication"},{"line_number":190,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":191,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"9ad9bd40_be889923","line":188,"in_reply_to":"9ad9bd40_fbe793e2","updated":"2014-04-30 22:19:54.000000000","message":"that\u0027s fine, but the sections below need to be changed to ---------, otherwise tox -edocs complain.","commit_id":"289b85ed080275707311e658105d7cc56cb9fec5"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"efb3c748bb7470250fb98e73399f2a075ff75acb","unresolved":false,"context_lines":[{"line_number":193,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"Unlike other authentication methods in the Identity Service, the user does not"},{"line_number":196,"context_line":"issue an HTTP POST request with authentication data in the request body. To"},{"line_number":197,"context_line":"start federated authentication a user must access the dedicated URL with"},{"line_number":198,"context_line":"Identity Provider\u0027s and Protocol\u0027s identifiers stored within a protected URL."},{"line_number":199,"context_line":"The URL has a format of:"}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAAXX%2F%2F7bc%3D","line":196,"updated":"2014-04-25 08:32:13.000000000","message":"a or an?","commit_id":"289b85ed080275707311e658105d7cc56cb9fec5"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"f554b012f98cb073acb55ab8f10bf0f0796f2995","unresolved":false,"context_lines":[{"line_number":193,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"Unlike other authentication methods in the Identity Service, the user does not"},{"line_number":196,"context_line":"issue an HTTP POST request with authentication data in the request body. To"},{"line_number":197,"context_line":"start federated authentication a user must access the dedicated URL with"},{"line_number":198,"context_line":"Identity Provider\u0027s and Protocol\u0027s identifiers stored within a protected URL."},{"line_number":199,"context_line":"The URL has a format of:"}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAAXX%2F%2F55I%3D","line":196,"in_reply_to":"AAAAXX%2F%2F6Yw%3D","updated":"2014-04-25 12:05:35.000000000","message":"ok!","commit_id":"289b85ed080275707311e658105d7cc56cb9fec5"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"e1b253f3d6f751a20e4afdf697ef3d93df14770e","unresolved":false,"context_lines":[{"line_number":193,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"Unlike other authentication methods in the Identity Service, the user does not"},{"line_number":196,"context_line":"issue an HTTP POST request with authentication data in the request body. To"},{"line_number":197,"context_line":"start federated authentication a user must access the dedicated URL with"},{"line_number":198,"context_line":"Identity Provider\u0027s and Protocol\u0027s identifiers stored within a protected URL."},{"line_number":199,"context_line":"The URL has a format of:"}],"source_content_type":"text/x-rst","patch_set":9,"id":"AAAAXX%2F%2F6Yw%3D","line":196,"in_reply_to":"AAAAXX%2F%2F7bc%3D","updated":"2014-04-25 11:00:03.000000000","message":"an, because HTTP (aitch tee tee pee) begins with a vowel sound -- see http://en.wikipedia.org/wiki/H#Name_in_English","commit_id":"289b85ed080275707311e658105d7cc56cb9fec5"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"4e6556821caea196ee03d3e9089fb15b636d8990","unresolved":false,"context_lines":[{"line_number":197,"context_line":"~~~~~~~~"},{"line_number":198,"context_line":""},{"line_number":199,"context_line":"Contains information that dictates which Mapping rules to use for an incoming"},{"line_number":200,"context_line":"request made by an IdP. An IdP may have multiple supported protocol."},{"line_number":201,"context_line":""},{"line_number":202,"context_line":"Add `Protocol object"},{"line_number":203,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#add-a-supported-protocol-and-attribute-mapping-combination-to-an-identity-provider-put-os-federationidentity_providersidp_idprotocolsprotocol_id\u003e`__ and specify the mapping id"}],"source_content_type":"text/x-rst","patch_set":12,"id":"9ad9bd40_8cd70b23","line":200,"updated":"2014-05-02 14:00:11.000000000","message":"s/protocol/protocols/","commit_id":"aa02e440b91c3cf1058ad82e03e698cee1d023ab"},{"author":{"_account_id":1228,"name":"Joe Savak","email":"jsavak@gmail.com","username":"jsavak"},"change_message_id":"4e6556821caea196ee03d3e9089fb15b636d8990","unresolved":false,"context_lines":[{"line_number":206,"context_line":"Performing federated authentication"},{"line_number":207,"context_line":"-----------------------------------"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"1. Authenticate externally and generated an unscoped token in Keystone"},{"line_number":210,"context_line":"2. Determine accessible resources"},{"line_number":211,"context_line":"3. Get a scoped token"},{"line_number":212,"context_line":""}],"source_content_type":"text/x-rst","patch_set":12,"id":"9ad9bd40_0ce3fb05","line":209,"updated":"2014-05-02 14:00:11.000000000","message":"s/generated/generate/","commit_id":"aa02e440b91c3cf1058ad82e03e698cee1d023ab"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"a0d610c60160763e0fd73c0dfb31d56e55a49e68","unresolved":false,"context_lines":[{"line_number":44,"context_line":"3. Enable ``OS-FEDERATION`` extension."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Run Keystone under Apache"},{"line_number":47,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Follow the steps outlined at: `Running Keystone in HTTPD`_."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_f83f3ad4","line":47,"updated":"2014-05-05 14:38:01.000000000","message":"Does one also need to run Keystone with v3 policies? If so, I think it is worth mentioning it. I\u0027m trying to deploy a federated devstack and copying keystone/etc/policy.v3cloudsample.json to /etc/keystone/policy.json seems to be a necessary step.","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"34fced328628044486f7ee87ab4ed75bafb297fb","unresolved":false,"context_lines":[{"line_number":44,"context_line":"3. Enable ``OS-FEDERATION`` extension."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Run Keystone under Apache"},{"line_number":47,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Follow the steps outlined at: `Running Keystone in HTTPD`_."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_a3d5821d","line":47,"in_reply_to":"9ad9bd40_18df796a","updated":"2014-05-05 17:28:07.000000000","message":"I\u0027m not saying this is how it resolved my problem -- I actually haven\u0027t even resolved it yet. I was just wondering if the v3 policy file was necessary as federation is under **/v3/**OS-FEDERATION/. That\u0027s why I just left the question and didn\u0027t vote against the patch.","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"b971efae9ac732f89fc51f9f1591f3c52cf6bbbc","unresolved":false,"context_lines":[{"line_number":44,"context_line":"3. Enable ``OS-FEDERATION`` extension."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Run Keystone under Apache"},{"line_number":47,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Follow the steps outlined at: `Running Keystone in HTTPD`_."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_18df796a","line":47,"in_reply_to":"9ad9bd40_9828e987","updated":"2014-05-05 16:40:05.000000000","message":"I think this is still here: https://github.com/openstack/keystone/blob/master/etc/policy.json#L122 and https://github.com/openstack/keystone/blob/master/etc/policy.v3cloudsample.json#L135\n\nI was able to setup a federated Keystone on at least 2 virtual machines  (Ubuntu 12.04) and I don\u0027t recall having to play with policies.","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"f2317c0faf57f587a2213aa22d605897562ad368","unresolved":false,"context_lines":[{"line_number":44,"context_line":"3. Enable ``OS-FEDERATION`` extension."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Run Keystone under Apache"},{"line_number":47,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Follow the steps outlined at: `Running Keystone in HTTPD`_."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_d880acc2","line":47,"in_reply_to":"9ad9bd40_a3d5821d","updated":"2014-05-05 20:10:27.000000000","message":"either policy file should work equally well - none of the extra complexity in v3cloudsample would affect federation (yet) as all the federation related policies are aimed at deployers and default to \"rule:admin_required\"","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"6d8ac96e1cec35ced06d54302cede3e396e2b318","unresolved":false,"context_lines":[{"line_number":44,"context_line":"3. Enable ``OS-FEDERATION`` extension."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Run Keystone under Apache"},{"line_number":47,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Follow the steps outlined at: `Running Keystone in HTTPD`_."},{"line_number":50,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_9828e987","line":47,"in_reply_to":"9ad9bd40_f83f3ad4","updated":"2014-05-05 16:32:36.000000000","message":"Do you recall what was in /etc/keystone/policy.json previously? It could have just been a matter of not having the latest entries.\n\nBoth keystone.etc.policy.json and keystone.etc.policy.v3cloudsample.json that live in the master branch have entries for idps, mappings and protocols. \n\nIf these entries are not in /etc/keystone/policy.json I could see how things could be bad.\n\nWhat were the errors you saw? Just 401 Unauthorized? \nI believe that updating the policy file should be documented but in a more general spot (not this file), since this doc is extension specific.","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"ca6f1ba619f37361ecc2e78f9efe09aa68ee2b69","unresolved":false,"context_lines":[{"line_number":203,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#add-a-supported-protocol-and-attribute-mapping-combination-to-an-identity-provider-put-os-federationidentity_providersidp_idprotocolsprotocol_id\u003e`__ and specify the mapping id"},{"line_number":204,"context_line":"you want to use with the combination of the IdP and Protocol."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Performing federated authentication"},{"line_number":207,"context_line":"-----------------------------------"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"1. Authenticate externally and generate an unscoped token in Keystone"}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_d030a1ea","line":206,"updated":"2014-05-04 22:42:06.000000000","message":"This section is begging for a concrete example, even a simple one.  The instructions in this section are written in an abstract way and I can see how a keystone core could absorb all this material and configure this properly. But an operator with limited familiarity to this would in my opinion struggle to feel confident that they could read this and understand enough to configure it.  Either this needs to add a concrete example or point to another document with a concrete example if you feel that such an example is not appropriate in this document.","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"f2317c0faf57f587a2213aa22d605897562ad368","unresolved":false,"context_lines":[{"line_number":203,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#add-a-supported-protocol-and-attribute-mapping-combination-to-an-identity-provider-put-os-federationidentity_providersidp_idprotocolsprotocol_id\u003e`__ and specify the mapping id"},{"line_number":204,"context_line":"you want to use with the combination of the IdP and Protocol."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Performing federated authentication"},{"line_number":207,"context_line":"-----------------------------------"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"1. Authenticate externally and generate an unscoped token in Keystone"}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_f8e650af","line":206,"in_reply_to":"9ad9bd40_d030a1ea","updated":"2014-05-05 20:10:27.000000000","message":"Maybe the title should be changed from \"Performing\" to \"Testing\"? We don\u0027t have client tooling in place (yet) to provide trivial examples here... we could provide curl examples in the mean time, I suppose?","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"776f543964926ddd59a87815f0c958918ad75949","unresolved":false,"context_lines":[{"line_number":203,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#add-a-supported-protocol-and-attribute-mapping-combination-to-an-identity-provider-put-os-federationidentity_providersidp_idprotocolsprotocol_id\u003e`__ and specify the mapping id"},{"line_number":204,"context_line":"you want to use with the combination of the IdP and Protocol."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"Performing federated authentication"},{"line_number":207,"context_line":"-----------------------------------"},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"1. Authenticate externally and generate an unscoped token in Keystone"}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_9b2a9e8e","line":206,"in_reply_to":"9ad9bd40_f8e650af","updated":"2014-05-05 21:00:28.000000000","message":"curl would work for me.  That would certainly be concrete","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"18752072a47112d017bc6b42df6005e57fafd37c","unresolved":false,"context_lines":[{"line_number":231,"context_line":""},{"line_number":232,"context_line":"More information on getting an unscoped token can be found `here"},{"line_number":233,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#authenticating\u003e`__."},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"Determine accessible resources"},{"line_number":236,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":237,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_0e456e16","line":234,"updated":"2014-05-05 21:09:51.000000000","message":"I think maybe, a note should be made about this one, as it\u0027s a protected apache URL\n\n~~~~~~\n\nExample cURL\n\n~~~~~~\n\n  curl -X GET -D - http://localhost:5000/v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ee3986ab7daad9ad5cbecced718fb5fd996334fa","unresolved":false,"context_lines":[{"line_number":231,"context_line":""},{"line_number":232,"context_line":"More information on getting an unscoped token can be found `here"},{"line_number":233,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#authenticating\u003e`__."},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"Determine accessible resources"},{"line_number":236,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":237,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_cea1af95","line":234,"in_reply_to":"9ad9bd40_0e456e16","updated":"2014-05-06 15:02:06.000000000","message":"++","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"18752072a47112d017bc6b42df6005e57fafd37c","unresolved":false,"context_lines":[{"line_number":243,"context_line":""},{"line_number":244,"context_line":"More information on listing resources can be found `here"},{"line_number":245,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#listing-projects-and-domains\u003e`__."},{"line_number":246,"context_line":""},{"line_number":247,"context_line":"Get a scoped token"},{"line_number":248,"context_line":"~~~~~~~~~~~~~~~~~~"},{"line_number":249,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_ae6002a6","line":246,"updated":"2014-05-05 21:09:51.000000000","message":"~~~~~~\n\nExample cURL\n\n~~~~~~\n\n  curl -X GET http://localhost:5000/v3/OS-FEDERATION/projects","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ee3986ab7daad9ad5cbecced718fb5fd996334fa","unresolved":false,"context_lines":[{"line_number":243,"context_line":""},{"line_number":244,"context_line":"More information on listing resources can be found `here"},{"line_number":245,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#listing-projects-and-domains\u003e`__."},{"line_number":246,"context_line":""},{"line_number":247,"context_line":"Get a scoped token"},{"line_number":248,"context_line":"~~~~~~~~~~~~~~~~~~"},{"line_number":249,"context_line":""}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_ee9cb36c","line":246,"in_reply_to":"9ad9bd40_ae6002a6","updated":"2014-05-06 15:02:06.000000000","message":"++","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"18752072a47112d017bc6b42df6005e57fafd37c","unresolved":false,"context_lines":[{"line_number":252,"context_line":"sufficient to uniquely identify a project or domain."},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"More information on getting a scoped token can be found `here"},{"line_number":255,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-a-scoped-os-federation-token-post-authtokens\u003e`__."}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_6e6a7a82","line":255,"updated":"2014-05-05 21:09:51.000000000","message":"~~~~~~\n\nExample cURL\n\n~~~~~~\n\n  curl -X POST -H \"Content-Type: application/json\" -d \u0027{\"auth\":{\"identity\":{\"methods\":[\"saml2\"],\"saml2\":{\"id\":\"\u003cunscoped_token_id\u003e\"}},\"scope\":{\"project\":{\"domain\": {\"name\": \"Default\"},\"name\":\"service\"}}}}\u0027 -D - http://localhost:5000/v3/auth/tokens","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"ee3986ab7daad9ad5cbecced718fb5fd996334fa","unresolved":false,"context_lines":[{"line_number":252,"context_line":"sufficient to uniquely identify a project or domain."},{"line_number":253,"context_line":""},{"line_number":254,"context_line":"More information on getting a scoped token can be found `here"},{"line_number":255,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-a-scoped-os-federation-token-post-authtokens\u003e`__."}],"source_content_type":"text/x-rst","patch_set":13,"id":"9ad9bd40_aecb8b51","line":255,"in_reply_to":"9ad9bd40_6e6a7a82","updated":"2014-05-06 15:02:06.000000000","message":"++","commit_id":"cc3848d04ed916603bca759b8e5265f9b2031826"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"615b219cf12bbb0056688dbd765df6fef33a6e02","unresolved":false,"context_lines":[{"line_number":33,"context_line":"(for example, using the SQL driver). The external Identity Provider is"},{"line_number":34,"context_line":"responsible for authenticating users, and communicates the result of"},{"line_number":35,"context_line":"authentication to Keystone using SAML assertions. Keystone then maps the SAML"},{"line_number":36,"context_line":"assertions to Keystone user groups, and assignments created in Keystone."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"To enable federation, you\u0027ll need to:"},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_f452c2dc","line":36,"updated":"2014-05-06 16:03:20.000000000","message":"is comma between \u0027groups\u0027 and \u0027assignment\u0027 required?","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e652945891c8355e66db923f9078c40c906b0d8c","unresolved":false,"context_lines":[{"line_number":33,"context_line":"(for example, using the SQL driver). The external Identity Provider is"},{"line_number":34,"context_line":"responsible for authenticating users, and communicates the result of"},{"line_number":35,"context_line":"authentication to Keystone using SAML assertions. Keystone then maps the SAML"},{"line_number":36,"context_line":"assertions to Keystone user groups, and assignments created in Keystone."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"To enable federation, you\u0027ll need to:"},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_d4cf7e54","line":36,"in_reply_to":"9ad9bd40_14ec86f2","updated":"2014-05-06 16:14:16.000000000","message":"Done","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"cc3d88408dba44e41f64a00116c1242a06396c8b","unresolved":false,"context_lines":[{"line_number":33,"context_line":"(for example, using the SQL driver). The external Identity Provider is"},{"line_number":34,"context_line":"responsible for authenticating users, and communicates the result of"},{"line_number":35,"context_line":"authentication to Keystone using SAML assertions. Keystone then maps the SAML"},{"line_number":36,"context_line":"assertions to Keystone user groups, and assignments created in Keystone."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"To enable federation, you\u0027ll need to:"},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_14ec86f2","line":36,"in_reply_to":"9ad9bd40_f452c2dc","updated":"2014-05-06 16:06:38.000000000","message":"no","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e652945891c8355e66db923f9078c40c906b0d8c","unresolved":false,"context_lines":[{"line_number":53,"context_line":"You\u0027ll also need to install `Shibboleth \u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/Home\u003e`_, for"},{"line_number":54,"context_line":"example::"},{"line_number":55,"context_line":""},{"line_number":56,"context_line":"    $ apt-get libapache2-mod-shib2"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"Configure your Keystone virtual host and adjust the config to properly handle SAML2 workflow:"},{"line_number":59,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_d424de0e","line":56,"updated":"2014-05-06 16:14:16.000000000","message":"added code:block here and a few other spots too","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"cc3d88408dba44e41f64a00116c1242a06396c8b","unresolved":false,"context_lines":[{"line_number":118,"context_line":"to your requirements if needed. For more information see"},{"line_number":119,"context_line":"`attributes documentation \u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute\u003e`_"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Once you are done, restart your shibboleth daemon::"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"    $ service shibd restart"},{"line_number":124,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_149ac66d","line":121,"updated":"2014-05-06 16:06:38.000000000","message":"could change the double colon to a single, and then prefix the code snippet with\n\n  .. code-block:: bash","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e652945891c8355e66db923f9078c40c906b0d8c","unresolved":false,"context_lines":[{"line_number":118,"context_line":"to your requirements if needed. For more information see"},{"line_number":119,"context_line":"`attributes documentation \u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute\u003e`_"},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Once you are done, restart your shibboleth daemon::"},{"line_number":122,"context_line":""},{"line_number":123,"context_line":"    $ service shibd restart"},{"line_number":124,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_540b6e8d","line":121,"in_reply_to":"9ad9bd40_149ac66d","updated":"2014-05-06 16:14:16.000000000","message":"Done","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"cc3d88408dba44e41f64a00116c1242a06396c8b","unresolved":false,"context_lines":[{"line_number":241,"context_line":"to the URL would be redirected to the Identity Provider, to start the"},{"line_number":242,"context_line":"SAML authentication procedure."},{"line_number":243,"context_line":""},{"line_number":244,"context_line":".. code-block:: python"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"    curl -X GET -D - http://localhost:5000/v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth"},{"line_number":247,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_54a8ce8c","line":244,"updated":"2014-05-06 16:06:38.000000000","message":"^","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e652945891c8355e66db923f9078c40c906b0d8c","unresolved":false,"context_lines":[{"line_number":241,"context_line":"to the URL would be redirected to the Identity Provider, to start the"},{"line_number":242,"context_line":"SAML authentication procedure."},{"line_number":243,"context_line":""},{"line_number":244,"context_line":".. code-block:: python"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"    curl -X GET -D - http://localhost:5000/v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth"},{"line_number":247,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_342d0aff","line":244,"in_reply_to":"9ad9bd40_54a8ce8c","updated":"2014-05-06 16:14:16.000000000","message":"Done","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"cc3d88408dba44e41f64a00116c1242a06396c8b","unresolved":false,"context_lines":[{"line_number":243,"context_line":""},{"line_number":244,"context_line":".. code-block:: python"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"    curl -X GET -D - http://localhost:5000/v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"Determine accessible resources"},{"line_number":249,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_d493fe58","line":246,"updated":"2014-05-06 16:06:38.000000000","message":"prefix commands with $","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e652945891c8355e66db923f9078c40c906b0d8c","unresolved":false,"context_lines":[{"line_number":243,"context_line":""},{"line_number":244,"context_line":".. code-block:: python"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"    curl -X GET -D - http://localhost:5000/v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth"},{"line_number":247,"context_line":""},{"line_number":248,"context_line":"Determine accessible resources"},{"line_number":249,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_9401766c","line":246,"in_reply_to":"9ad9bd40_d493fe58","updated":"2014-05-06 16:14:16.000000000","message":"Done","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"cc3d88408dba44e41f64a00116c1242a06396c8b","unresolved":false,"context_lines":[{"line_number":261,"context_line":"Example cURL"},{"line_number":262,"context_line":"~~~~~~~~~~~~"},{"line_number":263,"context_line":""},{"line_number":264,"context_line":".. code-block:: python"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"    curl -X GET http://localhost:5000/v3/OS-FEDERATION/projects"},{"line_number":267,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_d4ccde8b","line":264,"updated":"2014-05-06 16:06:38.000000000","message":".. code-block:: bash\n\n(or shell)","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e652945891c8355e66db923f9078c40c906b0d8c","unresolved":false,"context_lines":[{"line_number":261,"context_line":"Example cURL"},{"line_number":262,"context_line":"~~~~~~~~~~~~"},{"line_number":263,"context_line":""},{"line_number":264,"context_line":".. code-block:: python"},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"    curl -X GET http://localhost:5000/v3/OS-FEDERATION/projects"},{"line_number":267,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_f4ef22af","line":264,"in_reply_to":"9ad9bd40_d4ccde8b","updated":"2014-05-06 16:14:16.000000000","message":"Done","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"cc3d88408dba44e41f64a00116c1242a06396c8b","unresolved":false,"context_lines":[{"line_number":267,"context_line":""},{"line_number":268,"context_line":"or"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":".. code-block:: python"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    curl -X GET http://localhost:5000/v3/OS-FEDERATION/domains"},{"line_number":273,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_14c3a657","line":270,"updated":"2014-05-06 16:06:38.000000000","message":"^","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e652945891c8355e66db923f9078c40c906b0d8c","unresolved":false,"context_lines":[{"line_number":267,"context_line":""},{"line_number":268,"context_line":"or"},{"line_number":269,"context_line":""},{"line_number":270,"context_line":".. code-block:: python"},{"line_number":271,"context_line":""},{"line_number":272,"context_line":"    curl -X GET http://localhost:5000/v3/OS-FEDERATION/domains"},{"line_number":273,"context_line":""}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_b4f91a82","line":270,"in_reply_to":"9ad9bd40_14c3a657","updated":"2014-05-06 16:14:16.000000000","message":"Done","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"cc3d88408dba44e41f64a00116c1242a06396c8b","unresolved":false,"context_lines":[{"line_number":285,"context_line":"Example cURL"},{"line_number":286,"context_line":"~~~~~~~~~~~~"},{"line_number":287,"context_line":""},{"line_number":288,"context_line":".. code-block:: python"},{"line_number":289,"context_line":""},{"line_number":290,"context_line":"    curl -X POST -H \"Content-Type: application/json\" -d \u0027{\"auth\":{\"identity\":{\"methods\":[\"saml2\"],\"saml2\":{\"id\":\"\u003cunscoped_token_id\u003e\"}},\"scope\":{\"project\":{\"domain\": {\"name\": \"Default\"},\"name\":\"service\"}}}}\u0027 -D - http://localhost:5000/v3/auth/tokens"}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_34a34ab3","line":288,"updated":"2014-05-06 16:06:38.000000000","message":"^","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e652945891c8355e66db923f9078c40c906b0d8c","unresolved":false,"context_lines":[{"line_number":285,"context_line":"Example cURL"},{"line_number":286,"context_line":"~~~~~~~~~~~~"},{"line_number":287,"context_line":""},{"line_number":288,"context_line":".. code-block:: python"},{"line_number":289,"context_line":""},{"line_number":290,"context_line":"    curl -X POST -H \"Content-Type: application/json\" -d \u0027{\"auth\":{\"identity\":{\"methods\":[\"saml2\"],\"saml2\":{\"id\":\"\u003cunscoped_token_id\u003e\"}},\"scope\":{\"project\":{\"domain\": {\"name\": \"Default\"},\"name\":\"service\"}}}}\u0027 -D - http://localhost:5000/v3/auth/tokens"}],"source_content_type":"text/x-rst","patch_set":14,"id":"9ad9bd40_d4f69e8e","line":288,"in_reply_to":"9ad9bd40_34a34ab3","updated":"2014-05-06 16:14:16.000000000","message":"Done","commit_id":"228d703300ad6ed54cbe8ffe2af6cceb72282065"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":15,"id":"7adec928_e688e0c8","updated":"2014-05-08 04:03:26.000000000","message":"Examples in this file appear to be ubuntu specific (a2ensite, etc) suggest being clear about that.","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":32,"context_line":"Federated users are not mirrored in the Keystone identity backend"},{"line_number":33,"context_line":"(for example, using the SQL driver). The external Identity Provider is"},{"line_number":34,"context_line":"responsible for authenticating users, and communicates the result of"},{"line_number":35,"context_line":"authentication to Keystone using SAML assertions. Keystone then maps the SAML"},{"line_number":36,"context_line":"assertions to Keystone user groups and assignments created in Keystone."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"To enable federation, you\u0027ll need to:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_c6eda48d","line":35,"updated":"2014-05-08 04:03:26.000000000","message":"suggest removing \"then\" from \"keystone then maps the SAML...\"","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"31f70ee40a6afc162e57b2a60b26c9eb7bf3fe83","unresolved":false,"context_lines":[{"line_number":32,"context_line":"Federated users are not mirrored in the Keystone identity backend"},{"line_number":33,"context_line":"(for example, using the SQL driver). The external Identity Provider is"},{"line_number":34,"context_line":"responsible for authenticating users, and communicates the result of"},{"line_number":35,"context_line":"authentication to Keystone using SAML assertions. Keystone then maps the SAML"},{"line_number":36,"context_line":"assertions to Keystone user groups and assignments created in Keystone."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"To enable federation, you\u0027ll need to:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_3d49f2d0","line":35,"in_reply_to":"7adec928_c6eda48d","updated":"2014-05-08 12:09:25.000000000","message":"Done","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Federate Keystone (SP) and an external IdP."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Once you have your Keystone virtual host ready, it\u0027s then time to"},{"line_number":106,"context_line":"configure Shibboleth and upload your Metadata to the Identity Provider."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"If new certificates are required, they can be easily created by executing:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_e6af002a","line":105,"updated":"2014-05-08 04:03:26.000000000","message":"Might be better to use apache config terminology \"vhost\" instead of \"virtual host\" (yeah I know \"virtual host\" is the long-form name).","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"31f70ee40a6afc162e57b2a60b26c9eb7bf3fe83","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Federate Keystone (SP) and an external IdP."},{"line_number":104,"context_line":""},{"line_number":105,"context_line":"Once you have your Keystone virtual host ready, it\u0027s then time to"},{"line_number":106,"context_line":"configure Shibboleth and upload your Metadata to the Identity Provider."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"If new certificates are required, they can be easily created by executing:"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_bd0c2296","line":105,"in_reply_to":"7adec928_e6af002a","updated":"2014-05-08 12:09:25.000000000","message":"used both :-)","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":160,"context_line":"federated users. The federation mapping function will map the user into local"},{"line_number":161,"context_line":"Identity Service groups objects, and thus to local role assignments."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"Thus, it is required to create the necessary Identity Service groups that"},{"line_number":164,"context_line":"correspond to the Identity Provider\u0027s groups; additionally, these groups should"},{"line_number":165,"context_line":"be assigned roles on one or more projects or domains."},{"line_number":166,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_8668fcf6","line":163,"updated":"2014-05-08 04:03:26.000000000","message":"Suggest removing Thus here or the Thus on line 161 (requires minor rephrasing)","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"31f70ee40a6afc162e57b2a60b26c9eb7bf3fe83","unresolved":false,"context_lines":[{"line_number":160,"context_line":"federated users. The federation mapping function will map the user into local"},{"line_number":161,"context_line":"Identity Service groups objects, and thus to local role assignments."},{"line_number":162,"context_line":""},{"line_number":163,"context_line":"Thus, it is required to create the necessary Identity Service groups that"},{"line_number":164,"context_line":"correspond to the Identity Provider\u0027s groups; additionally, these groups should"},{"line_number":165,"context_line":"be assigned roles on one or more projects or domains."},{"line_number":166,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_fd25ca0a","line":163,"in_reply_to":"7adec928_8668fcf6","updated":"2014-05-08 12:09:25.000000000","message":"changed to: The federation mapping function will map the user into local\nIdentity Service groups objects, and *hence* to local role assignments.","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":181,"context_line":"* Protocol"},{"line_number":182,"context_line":""},{"line_number":183,"context_line":"More information on ``OS-FEDERATION`` can be found `here"},{"line_number":184,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md\u003e`__."},{"line_number":185,"context_line":""},{"line_number":186,"context_line":"~~~~~~~~~~~~~~~~~"},{"line_number":187,"context_line":"Identity Provider"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_a120829c","line":184,"updated":"2014-05-08 04:03:26.000000000","message":"see comment on 272\n\napplies to all other github.com links.","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":191,"context_line":"Provider we will use to authenticate end users."},{"line_number":192,"context_line":""},{"line_number":193,"context_line":"More information on identity providers can be found `here"},{"line_number":194,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#register-an-identity-provider-put-os-federationidentity_providersidp_id\u003e`__."},{"line_number":195,"context_line":""},{"line_number":196,"context_line":"~~~~~~~"},{"line_number":197,"context_line":"Mapping"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_812b8681","line":194,"updated":"2014-05-08 04:03:26.000000000","message":"see comment on 272","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":196,"context_line":"~~~~~~~"},{"line_number":197,"context_line":"Mapping"},{"line_number":198,"context_line":"~~~~~~~"},{"line_number":199,"context_line":"A mapping is simply a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"Mapping adds a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":202,"context_line":"An Identity Provider has exactly one mapping specified per protocol."}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_2681e88f","line":199,"updated":"2014-05-08 04:03:26.000000000","message":"remove \"simply\"","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"31f70ee40a6afc162e57b2a60b26c9eb7bf3fe83","unresolved":false,"context_lines":[{"line_number":196,"context_line":"~~~~~~~"},{"line_number":197,"context_line":"Mapping"},{"line_number":198,"context_line":"~~~~~~~"},{"line_number":199,"context_line":"A mapping is simply a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"Mapping adds a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":202,"context_line":"An Identity Provider has exactly one mapping specified per protocol."}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_1d235606","line":199,"in_reply_to":"7adec928_2681e88f","updated":"2014-05-08 12:09:25.000000000","message":"Done","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":198,"context_line":"~~~~~~~"},{"line_number":199,"context_line":"A mapping is simply a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":200,"context_line":""},{"line_number":201,"context_line":"Mapping adds a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":202,"context_line":"An Identity Provider has exactly one mapping specified per protocol."},{"line_number":203,"context_line":""},{"line_number":204,"context_line":"Mapping objects can be used multiple times by different combinations of Identity Provider and Protocol."}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_e65d404a","line":201,"updated":"2014-05-08 04:03:26.000000000","message":"You might combine this sentence with the first sentence on line 198. (not sure if it would be a bit clearer or not)","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":204,"context_line":"Mapping objects can be used multiple times by different combinations of Identity Provider and Protocol."},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"More information on mapping can be found `here"},{"line_number":207,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#create-a-mapping-put-os-federationmappingsmapping_id\u003e`__."},{"line_number":208,"context_line":""},{"line_number":209,"context_line":"~~~~~~~~"},{"line_number":210,"context_line":"Protocol"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_61267abc","line":207,"updated":"2014-05-08 04:03:26.000000000","message":"see comment on 272","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":210,"context_line":"Protocol"},{"line_number":211,"context_line":"~~~~~~~~"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"Contains information that dictates which Mapping rules to use for an incoming"},{"line_number":214,"context_line":"request made by an IdP. An IdP may have multiple supported protocols."},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Add `Protocol object"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_065b0c55","line":213,"updated":"2014-05-08 04:03:26.000000000","message":"This sentence is inconsistent with the ones above defining \"mapping\". Suggest starting with \"A protocol\" or eliminate \"A mapping\" above. [This is a sentence fragment]","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"31f70ee40a6afc162e57b2a60b26c9eb7bf3fe83","unresolved":false,"context_lines":[{"line_number":210,"context_line":"Protocol"},{"line_number":211,"context_line":"~~~~~~~~"},{"line_number":212,"context_line":""},{"line_number":213,"context_line":"Contains information that dictates which Mapping rules to use for an incoming"},{"line_number":214,"context_line":"request made by an IdP. An IdP may have multiple supported protocols."},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Add `Protocol object"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_1dad1632","line":213,"in_reply_to":"7adec928_065b0c55","updated":"2014-05-08 12:09:25.000000000","message":"Done","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":214,"context_line":"request made by an IdP. An IdP may have multiple supported protocols."},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"Add `Protocol object"},{"line_number":217,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#add-a-supported-protocol-and-attribute-mapping-combination-to-an-identity-provider-put-os-federationidentity_providersidp_idprotocolsprotocol_id\u003e`__ and specify the mapping id"},{"line_number":218,"context_line":"you want to use with the combination of the IdP and Protocol."},{"line_number":219,"context_line":""},{"line_number":220,"context_line":"Performing federated authentication"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_0110564d","line":217,"updated":"2014-05-08 04:03:26.000000000","message":"see comment on 272","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":244,"context_line":"belongs to will be included."},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"More information on getting an unscoped token can be found `here"},{"line_number":247,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#authenticating\u003e`__."},{"line_number":248,"context_line":""},{"line_number":249,"context_line":"~~~~~~~~~~~~"},{"line_number":250,"context_line":"Example cURL"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_c10e6e34","line":247,"updated":"2014-05-08 04:03:26.000000000","message":"see comment on 272","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":269,"context_line":"* List domains a federated user can access: ``GET /OS-FEDERATION/domains``"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"More information on listing resources can be found `here"},{"line_number":272,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#listing-projects-and-domains\u003e`__."},{"line_number":273,"context_line":""},{"line_number":274,"context_line":"~~~~~~~~~~~~"},{"line_number":275,"context_line":"Example cURL"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_4603540f","line":272,"updated":"2014-05-08 04:03:26.000000000","message":"Do we want to link to github? is there a more \"official\" openstack.org based location to link to?","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c8e966dd24b5c28cc776d5f7b67079a49f97e4ea","unresolved":false,"context_lines":[{"line_number":293,"context_line":"sufficient to uniquely identify a project or domain."},{"line_number":294,"context_line":""},{"line_number":295,"context_line":"More information on getting a scoped token can be found `here"},{"line_number":296,"context_line":"\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#request-a-scoped-os-federation-token-post-authtokens\u003e`__."},{"line_number":297,"context_line":""},{"line_number":298,"context_line":"~~~~~~~~~~~~"},{"line_number":299,"context_line":"Example cURL"}],"source_content_type":"text/x-rst","patch_set":15,"id":"7adec928_a109622e","line":296,"updated":"2014-05-08 04:03:26.000000000","message":"same comment as on 272","commit_id":"760c785402fce9052e8069136114e06364033f15"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"6ec64a4c5ee5806cfc713c0d3047e759ec6f8e9b","unresolved":false,"context_lines":[{"line_number":43,"context_line":"   module), which handles the SAML2 handshake."},{"line_number":44,"context_line":"3. Enable ``OS-FEDERATION`` extension."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Run Keystone under Apache"},{"line_number":47,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Follow the steps outlined at: `Running Keystone in HTTPD`_."}],"source_content_type":"text/x-rst","patch_set":16,"id":"7adec928_a50084ab","line":46,"updated":"2014-05-08 12:51:29.000000000","message":"Rename this \"configuring Apache HTTPD for mod_shibboleth\" and add a line before and saying that, while there are many ways to perform Federation, mod_shibolleth is the only one yet documented.","commit_id":"1fcef8218c3029031b637aaf5bd892e517085cbc"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"eb0d4c6c5900fc3a1e2b949f694903b692543cba","unresolved":false,"context_lines":[{"line_number":43,"context_line":"   module), which handles the SAML2 handshake."},{"line_number":44,"context_line":"3. Enable ``OS-FEDERATION`` extension."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Run Keystone under Apache"},{"line_number":47,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Follow the steps outlined at: `Running Keystone in HTTPD`_."}],"source_content_type":"text/x-rst","patch_set":16,"id":"7adec928_a51de4bf","line":46,"in_reply_to":"7adec928_a50084ab","updated":"2014-05-08 13:18:49.000000000","message":"Done","commit_id":"1fcef8218c3029031b637aaf5bd892e517085cbc"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"6ec64a4c5ee5806cfc713c0d3047e759ec6f8e9b","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"    $ service apache2 restart"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Setup Shibboleth (``mod_shib``)"},{"line_number":101,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Federate Keystone (SP) and an external IdP."}],"source_content_type":"text/x-rst","patch_set":16,"id":"7adec928_e5d8cc55","line":100,"updated":"2014-05-08 12:51:29.000000000","message":"This really started up above...","commit_id":"1fcef8218c3029031b637aaf5bd892e517085cbc"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"eb0d4c6c5900fc3a1e2b949f694903b692543cba","unresolved":false,"context_lines":[{"line_number":97,"context_line":""},{"line_number":98,"context_line":"    $ service apache2 restart"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"Setup Shibboleth (``mod_shib``)"},{"line_number":101,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Federate Keystone (SP) and an external IdP."}],"source_content_type":"text/x-rst","patch_set":16,"id":"7adec928_456d0032","line":100,"in_reply_to":"7adec928_e5d8cc55","updated":"2014-05-08 13:18:49.000000000","message":"yes, here we are configuring shibd daemon (mod_shib doesn\u0027t do all the job, it requires shibd daemon to be running).","commit_id":"1fcef8218c3029031b637aaf5bd892e517085cbc"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"21b8f505f242f22046d290a99d183a3f86dc12d0","unresolved":false,"context_lines":[{"line_number":302,"context_line":"~~~~~~~"},{"line_number":303,"context_line":"Mapping"},{"line_number":304,"context_line":"~~~~~~~"},{"line_number":305,"context_line":"A mapping is a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":306,"context_line":""},{"line_number":307,"context_line":"Mapping adds a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":308,"context_line":"An Identity Provider has exactly one mapping specified per protocol."}],"source_content_type":"text/x-rst","patch_set":16,"id":"7adec928_c2602638","line":305,"updated":"2014-05-08 12:10:23.000000000","message":"Leftover from previous patch:\n\nmorgainfainberg: You might combine this sentence with the first sentence on line 198. (not sure if it would be a bit clearer or not)","commit_id":"1fcef8218c3029031b637aaf5bd892e517085cbc"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"62fbf02099ef86eb8c9eb5f5fcf7e01ee93a25fe","unresolved":false,"context_lines":[{"line_number":33,"context_line":"(for example, using the SQL driver). The external Identity Provider is"},{"line_number":34,"context_line":"responsible for authenticating users, and communicates the result of"},{"line_number":35,"context_line":"authentication to Keystone using SAML assertions. Keystone maps the SAML"},{"line_number":36,"context_line":"assertions to Keystone user groups and assignments created in Keystone."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"To enable federation, you\u0027ll need to:"},{"line_number":39,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"7adec928_363bcc3b","line":36,"updated":"2014-05-08 14:58:20.000000000","message":"I think we should add a sentence here stating that the steps here are performed on a Ubuntu machine.","commit_id":"99ffbc8d8a40a545ee3627c6647d4de9cbf1b942"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"62fbf02099ef86eb8c9eb5f5fcf7e01ee93a25fe","unresolved":false,"context_lines":[{"line_number":130,"context_line":"file. You are advised to examine `Shibboleth Service Provider Configuration documentation \u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/Configuration\u003e`_"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"An example of your ``/etc/shibboleth2/shibboleth2.xml`` may look like"},{"line_number":133,"context_line":"(please use this example as a reference, do not blindly copy paste when running"},{"line_number":134,"context_line":"production service)::"},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"    \u003c!--"}],"source_content_type":"text/x-rst","patch_set":18,"id":"7adec928_76f55482","line":133,"updated":"2014-05-08 14:58:20.000000000","message":"haha, i think we can reword this to sound a bit less sassy. \n\n\u0027The example shown below is for reference only, not to be used in a production environment\u0027","commit_id":"99ffbc8d8a40a545ee3627c6647d4de9cbf1b942"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"899816271f6f718795374dec1c5378c3398bed71","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        ShibRequestSetting requireSession 1"},{"line_number":79,"context_line":"        AuthType shibboleth"},{"line_number":80,"context_line":"        ShibRequireSession On"},{"line_number":81,"context_line":"        ShibRequireAll On"},{"line_number":82,"context_line":"        ShibExportAssertion Off"},{"line_number":83,"context_line":"        Require valid-user"},{"line_number":84,"context_line":"    \u003c/LocationMatch\u003e"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7adec928_394563b3","line":81,"updated":"2014-05-09 17:34:53.000000000","message":"How should one deal with it on Apache 2.4+?\n\nFrom: https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig\n\n\"\"\"\nShibRequireAll On|Off [...]\n\n**Not supported on Apache 2.4+: This command is subsumed by Apache 2.4\u0027s own support for controlling authorization rule composition.**\n\"\"\"\n\nI think you should at least make clear that it won\u0027t work on those versions of Apache.","commit_id":"b74426627642e3f89f5effeee3b02af447ce8642"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"235d2d823926a1094ebb4ce1ca96ef8568c661ba","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        ShibRequestSetting requireSession 1"},{"line_number":79,"context_line":"        AuthType shibboleth"},{"line_number":80,"context_line":"        ShibRequireSession On"},{"line_number":81,"context_line":"        ShibRequireAll On"},{"line_number":82,"context_line":"        ShibExportAssertion Off"},{"line_number":83,"context_line":"        Require valid-user"},{"line_number":84,"context_line":"    \u003c/LocationMatch\u003e"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7adec928_9c6e6500","line":81,"in_reply_to":"7adec928_394563b3","updated":"2014-05-09 18:27:14.000000000","message":"I can add a note to line 37 and 38, stating what apache version was used.","commit_id":"b74426627642e3f89f5effeee3b02af447ce8642"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"873b4c0d43dfc2789bc649ba53e2964bf31232bc","unresolved":false,"context_lines":[{"line_number":78,"context_line":"        ShibRequestSetting requireSession 1"},{"line_number":79,"context_line":"        AuthType shibboleth"},{"line_number":80,"context_line":"        ShibRequireSession On"},{"line_number":81,"context_line":"        ShibRequireAll On"},{"line_number":82,"context_line":"        ShibExportAssertion Off"},{"line_number":83,"context_line":"        Require valid-user"},{"line_number":84,"context_line":"    \u003c/LocationMatch\u003e"}],"source_content_type":"text/x-rst","patch_set":19,"id":"7adec928_5f4e8f70","line":81,"in_reply_to":"7adec928_9c6e6500","updated":"2014-05-09 18:34:36.000000000","message":"Based on IRC conversation this can be a followup-patch.","commit_id":"b74426627642e3f89f5effeee3b02af447ce8642"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"05fbc6842587f3d03114f3bddd0416e24fa88cd9","unresolved":false,"context_lines":[{"line_number":41,"context_line":"To enable federation, you\u0027ll need to:"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"1. Run Keystone under Apache, rather than using ``keystone-all``."},{"line_number":44,"context_line":"2. Setup `Shibboleth \u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/Home\u003e`_"},{"line_number":45,"context_line":"   (using ``mod_shib``, an Apache"},{"line_number":46,"context_line":"   module), which handles the SAML2 handshake."},{"line_number":47,"context_line":"3. Enable ``OS-FEDERATION`` extension."}],"source_content_type":"text/x-rst","patch_set":20,"id":"7adec928_4aeecbb5","line":44,"updated":"2014-05-09 19:40:36.000000000","message":"\"Configure apache to use a Federation Capable  Authentication method.\"","commit_id":"6ca231e156b4ff8c7548cd48e8f6a268038739ad"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"05fbc6842587f3d03114f3bddd0416e24fa88cd9","unresolved":false,"context_lines":[{"line_number":103,"context_line":""},{"line_number":104,"context_line":"    $ service apache2 restart"},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Setup Shibboleth (``shibd``)"},{"line_number":107,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"Federate Keystone (SP) and an external IdP."}],"source_content_type":"text/x-rst","patch_set":20,"id":"7adec928_ea26b715","line":106,"updated":"2014-05-09 19:40:36.000000000","message":"Please extract this whole section into a stand along document:  shibboleth.rst  and then just refer to that here.","commit_id":"6ca231e156b4ff8c7548cd48e8f6a268038739ad"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"05fbc6842587f3d03114f3bddd0416e24fa88cd9","unresolved":false,"context_lines":[{"line_number":250,"context_line":""},{"line_number":251,"context_line":"    $ service shibd restart"},{"line_number":252,"context_line":""},{"line_number":253,"context_line":"Enable the ``OS-FEDERATION`` extension"},{"line_number":254,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":255,"context_line":""},{"line_number":256,"context_line":"Follow the steps outlined at: `Enabling Federation Extension`_."}],"source_content_type":"text/x-rst","patch_set":20,"id":"7adec928_2a217ffb","line":253,"updated":"2014-05-09 19:40:36.000000000","message":"From this point on, things should stay in this document.","commit_id":"6ca231e156b4ff8c7548cd48e8f6a268038739ad"},{"author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"change_message_id":"05fbc6842587f3d03114f3bddd0416e24fa88cd9","unresolved":false,"context_lines":[{"line_number":371,"context_line":""},{"line_number":372,"context_line":".. code-block:: bash"},{"line_number":373,"context_line":""},{"line_number":374,"context_line":"    $ curl -X GET -D - http://localhost:5000/v3/OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth"},{"line_number":375,"context_line":""},{"line_number":376,"context_line":"Determine accessible resources"},{"line_number":377,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":20,"id":"7adec928_6a61c738","line":374,"updated":"2014-05-09 19:40:36.000000000","message":"I\u0027m explicitly not asking you to remove 5000 from here, but in the future, when we move to HTTPD default, we should clean up these URLs to reflect everything running on HTTPS standard port of 443","commit_id":"6ca231e156b4ff8c7548cd48e8f6a268038739ad"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"50044337a9a98516ef24469372afd8c180f44859","unresolved":false,"context_lines":[{"line_number":36,"context_line":"assertions to Keystone user groups and assignments created in Keystone."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"The following configuration steps were performed on a machine running"},{"line_number":39,"context_line":"Ubuntu 12.04 and Apache 2.2.22."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"To enable federation, you\u0027ll need to:"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-rst","patch_set":22,"id":"7adec928_81f5f5cc","line":39,"updated":"2014-05-13 13:48:49.000000000","message":"Is there a link to this doc? If so maybe we should include it here. Or is it the link on line 52?","commit_id":"9bef43d05a29af051e279e08c446a831cf8c4d2a"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"50044337a9a98516ef24469372afd8c180f44859","unresolved":false,"context_lines":[{"line_number":168,"context_line":"~~~~~~~"},{"line_number":169,"context_line":"Mapping"},{"line_number":170,"context_line":"~~~~~~~"},{"line_number":171,"context_line":"A mapping is a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Mapping adds a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":174,"context_line":"An Identity Provider has exactly one mapping specified per protocol."}],"source_content_type":"text/x-rst","patch_set":22,"id":"7adec928_61cb8953","line":171,"updated":"2014-05-13 13:48:49.000000000","message":"The following Identity API objects support mapping: \n        - Groups\n        - Users\n\nOr something along those lines","commit_id":"9bef43d05a29af051e279e08c446a831cf8c4d2a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5e426668c364dffe772f3761a0671a7e80d2c06d","unresolved":false,"context_lines":[{"line_number":168,"context_line":"~~~~~~~"},{"line_number":169,"context_line":"Mapping"},{"line_number":170,"context_line":"~~~~~~~"},{"line_number":171,"context_line":"A mapping is a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":172,"context_line":""},{"line_number":173,"context_line":"Mapping adds a set of rules to map federation protocol attributes to Identity API objects."},{"line_number":174,"context_line":"An Identity Provider has exactly one mapping specified per protocol."}],"source_content_type":"text/x-rst","patch_set":22,"id":"7adec928_f762fbab","line":171,"in_reply_to":"7adec928_61cb8953","updated":"2014-05-13 15:04:46.000000000","message":"Done","commit_id":"9bef43d05a29af051e279e08c446a831cf8c4d2a"}],"doc/source/configurefederation.rst":[{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"f9dc6363bb33bbc1f9e21c22e587fefba47f7eeb","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":"      Copyright 2014 OpenStack, Foundation"},{"line_number":3,"context_line":"      All Rights Reserved."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2FhI0%3D","line":2,"updated":"2014-04-20 18:31:39.000000000","message":"Should it be included here, since I think we don\u0027t work for them (well, for sure I don\u0027t)","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":1,"context_line":".."},{"line_number":2,"context_line":"      Copyright 2014 OpenStack, Foundation"},{"line_number":3,"context_line":"      All Rights Reserved."},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe6g%3D","line":2,"in_reply_to":"AAAAXH%2F%2FhI0%3D","updated":"2014-04-21 15:14:08.000000000","message":"++ should be removed","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":21,"context_line":"Definitions"},{"line_number":22,"context_line":"-----------"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* Service Provider (SP) - providing a service to an end-user"},{"line_number":25,"context_line":"* Identity Provider (IdP) - server that stores information about users and groups"},{"line_number":26,"context_line":"* SAML assertion - sent from an IdP, contains information about a user"},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe4k%3D","line":24,"updated":"2014-04-21 15:14:08.000000000","message":"s/providing/provides/","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":22,"context_line":"-----------"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"* Service Provider (SP) - providing a service to an end-user"},{"line_number":25,"context_line":"* Identity Provider (IdP) - server that stores information about users and groups"},{"line_number":26,"context_line":"* SAML assertion - sent from an IdP, contains information about a user"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe4c%3D","line":25,"updated":"2014-04-21 15:14:08.000000000","message":"s/server/service/","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":25,"context_line":"* Identity Provider (IdP) - server that stores information about users and groups"},{"line_number":26,"context_line":"* SAML assertion - sent from an IdP, contains information about a user"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Approach to Federation"},{"line_number":30,"context_line":"---------------------------------"},{"line_number":31,"context_line":"Support the use case where Keystone serves as a Service Provider, and an"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe6k%3D","line":28,"updated":"2014-04-21 15:14:08.000000000","message":"extraneous whitespace","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Approach to Federation"},{"line_number":30,"context_line":"---------------------------------"},{"line_number":31,"context_line":"Support the use case where Keystone serves as a Service Provider, and an"},{"line_number":32,"context_line":"external Identity Provider can send SAML assertions, once a user is "},{"line_number":33,"context_line":"authenticated."}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe6w%3D","line":30,"updated":"2014-04-21 15:14:08.000000000","message":"missing whitespace, extra hyphens","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"Approach to Federation"},{"line_number":30,"context_line":"---------------------------------"},{"line_number":31,"context_line":"Support the use case where Keystone serves as a Service Provider, and an"},{"line_number":32,"context_line":"external Identity Provider can send SAML assertions, once a user is "},{"line_number":33,"context_line":"authenticated."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe4Y%3D","line":31,"updated":"2014-04-21 15:14:08.000000000","message":"this isn\u0027t actually a complete sentence","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"f9dc6363bb33bbc1f9e21c22e587fefba47f7eeb","unresolved":false,"context_lines":[{"line_number":29,"context_line":"Approach to Federation"},{"line_number":30,"context_line":"---------------------------------"},{"line_number":31,"context_line":"Support the use case where Keystone serves as a Service Provider, and an"},{"line_number":32,"context_line":"external Identity Provider can send SAML assertions, once a user is "},{"line_number":33,"context_line":"authenticated."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"There is no need to add any users to the Keystone backend. For authentication"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2FhMM%3D","line":32,"updated":"2014-04-20 18:31:39.000000000","message":"remove whitespace","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":29,"context_line":"Approach to Federation"},{"line_number":30,"context_line":"---------------------------------"},{"line_number":31,"context_line":"Support the use case where Keystone serves as a Service Provider, and an"},{"line_number":32,"context_line":"external Identity Provider can send SAML assertions, once a user is "},{"line_number":33,"context_line":"authenticated."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"There is no need to add any users to the Keystone backend. For authentication"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe6c%3D","line":32,"in_reply_to":"AAAAXH%2F%2FhMM%3D","updated":"2014-04-21 15:14:08.000000000","message":"++","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"f9dc6363bb33bbc1f9e21c22e587fefba47f7eeb","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"There is no need to add any users to the Keystone backend. For authentication"},{"line_number":36,"context_line":"we will rely on the Identity Provider via SAML assertions. For authorization,"},{"line_number":37,"context_line":"we can only trust assignments created in Keystone.  "},{"line_number":38,"context_line":""},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Prereqs"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2FhMI%3D","line":37,"updated":"2014-04-20 18:31:39.000000000","message":"remove whitespace","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"There is no need to add any users to the Keystone backend. For authentication"},{"line_number":36,"context_line":"we will rely on the Identity Provider via SAML assertions. For authorization,"},{"line_number":37,"context_line":"we can only trust assignments created in Keystone.  "},{"line_number":38,"context_line":""},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Prereqs"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe6Y%3D","line":37,"in_reply_to":"AAAAXH%2F%2FhMI%3D","updated":"2014-04-21 15:14:08.000000000","message":"++","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":37,"context_line":"we can only trust assignments created in Keystone.  "},{"line_number":38,"context_line":""},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Prereqs"},{"line_number":41,"context_line":"-------"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Keystone must be ran under Apache, mod_shib (Apache module) handles the SAML2"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe4U%3D","line":40,"updated":"2014-04-21 15:14:08.000000000","message":"no need to abbreviate section titles like that","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":"1) Run Keystone under Apache"},{"line_number":47,"context_line":"2) Setup mod_shib"},{"line_number":48,"context_line":"3) Enable OS-FEDERATION extension"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"Run Keystone under Apache"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe4I%3D","line":48,"updated":"2014-04-21 15:14:08.000000000","message":"numbered lists with parens like this don\u0027t work in RST - use periods instead\n\n  1.\n  2.\n  3.","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":51,"context_line":"Run Keystone under Apache"},{"line_number":52,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Prereq:"},{"line_number":55,"context_line":"  apt-get apache2"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Follow the steps outlined at: `Running Keystone in HTTPD`_."}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe60%3D","line":54,"updated":"2014-04-21 15:14:08.000000000","message":"double colon","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":58,"context_line":""},{"line_number":59,"context_line":".. _`Running Keystone in HTTPD`: apache-httpd.html"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Additionally, before you starting apache, enable vhost and the shib2 and ssl modules:"},{"line_number":62,"context_line":"* a2ensite wsgi-keystone.conf"},{"line_number":63,"context_line":"* a2enmod ssl"},{"line_number":64,"context_line":"* a2enmod shib2"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe6U%3D","line":61,"updated":"2014-04-21 15:14:08.000000000","message":"start","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"f9dc6363bb33bbc1f9e21c22e587fefba47f7eeb","unresolved":false,"context_lines":[{"line_number":59,"context_line":".. _`Running Keystone in HTTPD`: apache-httpd.html"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"Additionally, before you starting apache, enable vhost and the shib2 and ssl modules:"},{"line_number":62,"context_line":"* a2ensite wsgi-keystone.conf"},{"line_number":63,"context_line":"* a2enmod ssl"},{"line_number":64,"context_line":"* a2enmod shib2"},{"line_number":65,"context_line":"* service apache2 restart"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2FhJA%3D","line":62,"updated":"2014-04-20 18:31:39.000000000","message":"I think you skipped part where I pasted link to examplous vhost configuration with  WSGIScriptAliasMatc directives and so on. I think it\u0027s not included in the apache-httpd.html file.","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":61,"context_line":"Additionally, before you starting apache, enable vhost and the shib2 and ssl modules:"},{"line_number":62,"context_line":"* a2ensite wsgi-keystone.conf"},{"line_number":63,"context_line":"* a2enmod ssl"},{"line_number":64,"context_line":"* a2enmod shib2"},{"line_number":65,"context_line":"* service apache2 restart"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd%2FY%3D","line":64,"updated":"2014-04-21 15:14:08.000000000","message":"i think you\u0027re suggesting people enable shib before it\u0027s installed, below","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":68,"context_line":"Setup mod_shib"},{"line_number":69,"context_line":"~~~~~~~~~~~~~~"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"Prereq:"},{"line_number":72,"context_line":"  apt-get libapache2-mod-shib2"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"Federate Keystone (SP) and an external IdP. Refer to `TestShib \u003chttp://www.testshib.org/install.html\u003e`_"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe6Q%3D","line":71,"updated":"2014-04-21 15:14:08.000000000","message":"double colon","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":81,"context_line":""},{"line_number":82,"context_line":".. _`Enabling Federation Extension`: extensions/federation-configuration.html"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Once you have your Keystone virtual host ready it’s time to configure"},{"line_number":85,"context_line":"Shibboleth and upload your Metadata to the Identity Provider."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"If new certificates are required, they can be easily created by executing:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe6A%3D","line":84,"updated":"2014-04-21 15:14:08.000000000","message":"s/’/\u0027/g","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":84,"context_line":"Once you have your Keystone virtual host ready it’s time to configure"},{"line_number":85,"context_line":"Shibboleth and upload your Metadata to the Identity Provider."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"If new certificates are required, they can be easily created by executing:"},{"line_number":88,"context_line":"shib-keygen -y \u003cnumber of years\u003e"},{"line_number":89,"context_line":"The newly created file will be stored under /etc/shibboleth/sp-key.pem"},{"line_number":90,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe5k%3D","line":87,"updated":"2014-04-21 15:14:08.000000000","message":"double colon","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":85,"context_line":"Shibboleth and upload your Metadata to the Identity Provider."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"If new certificates are required, they can be easily created by executing:"},{"line_number":88,"context_line":"shib-keygen -y \u003cnumber of years\u003e"},{"line_number":89,"context_line":"The newly created file will be stored under /etc/shibboleth/sp-key.pem"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"If you are configuring it against testshib.org, there is a suggested `reading \u003chttps://openstack.local/Shibboleth.sso/Metadata\u003e`_"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe5o%3D","line":88,"updated":"2014-04-21 15:14:08.000000000","message":"add whitespace and indent","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":86,"context_line":""},{"line_number":87,"context_line":"If new certificates are required, they can be easily created by executing:"},{"line_number":88,"context_line":"shib-keygen -y \u003cnumber of years\u003e"},{"line_number":89,"context_line":"The newly created file will be stored under /etc/shibboleth/sp-key.pem"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"If you are configuring it against testshib.org, there is a suggested `reading \u003chttps://openstack.local/Shibboleth.sso/Metadata\u003e`_"},{"line_number":92,"context_line":"on how to upload your SP’s Metadata into their system. This can be achieved"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe5U%3D","line":89,"updated":"2014-04-21 15:14:08.000000000","message":"``double backticks``","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"f9dc6363bb33bbc1f9e21c22e587fefba47f7eeb","unresolved":false,"context_lines":[{"line_number":88,"context_line":"shib-keygen -y \u003cnumber of years\u003e"},{"line_number":89,"context_line":"The newly created file will be stored under /etc/shibboleth/sp-key.pem"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"If you are configuring it against testshib.org, there is a suggested `reading \u003chttps://openstack.local/Shibboleth.sso/Metadata\u003e`_"},{"line_number":92,"context_line":"on how to upload your SP’s Metadata into their system. This can be achieved"},{"line_number":93,"context_line":"by executing:"},{"line_number":94,"context_line":"wget --no-check-certificate -O \u003cname of the file\u003e"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2FhI8%3D","line":91,"updated":"2014-04-20 18:31:39.000000000","message":"I this in docs here we should not mention any names like testshib. I\u0027d rather a place for some tutorial-like doc like the on on the Google drive.","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":89,"context_line":"The newly created file will be stored under /etc/shibboleth/sp-key.pem"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"If you are configuring it against testshib.org, there is a suggested `reading \u003chttps://openstack.local/Shibboleth.sso/Metadata\u003e`_"},{"line_number":92,"context_line":"on how to upload your SP’s Metadata into their system. This can be achieved"},{"line_number":93,"context_line":"by executing:"},{"line_number":94,"context_line":"wget --no-check-certificate -O \u003cname of the file\u003e"},{"line_number":95,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe5M%3D","line":92,"updated":"2014-04-21 15:14:08.000000000","message":"why is Metadata capitalized? That like capitalizing Stuff for no reason","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":90,"context_line":""},{"line_number":91,"context_line":"If you are configuring it against testshib.org, there is a suggested `reading \u003chttps://openstack.local/Shibboleth.sso/Metadata\u003e`_"},{"line_number":92,"context_line":"on how to upload your SP’s Metadata into their system. This can be achieved"},{"line_number":93,"context_line":"by executing:"},{"line_number":94,"context_line":"wget --no-check-certificate -O \u003cname of the file\u003e"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Next, upload your metadata file to testshib.org"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe50%3D","line":93,"updated":"2014-04-21 15:14:08.000000000","message":"double colon","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":91,"context_line":"If you are configuring it against testshib.org, there is a suggested `reading \u003chttps://openstack.local/Shibboleth.sso/Metadata\u003e`_"},{"line_number":92,"context_line":"on how to upload your SP’s Metadata into their system. This can be achieved"},{"line_number":93,"context_line":"by executing:"},{"line_number":94,"context_line":"wget --no-check-certificate -O \u003cname of the file\u003e"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Next, upload your metadata file to testshib.org"},{"line_number":97,"context_line":"You should be able to get customized shibboleth2.xml file, again from"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe5w%3D","line":94,"updated":"2014-04-21 15:14:08.000000000","message":"add whitespace and indent","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":94,"context_line":"wget --no-check-certificate -O \u003cname of the file\u003e"},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Next, upload your metadata file to testshib.org"},{"line_number":97,"context_line":"You should be able to get customized shibboleth2.xml file, again from"},{"line_number":98,"context_line":"testshib.org configuratin site. Save it as `/etc/shibboleth/shibboleth2.xml`"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"ATTENTION: remove `REMOTE_USER` from  `/etc/shibboleth/shibboleth2.x`"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe4o%3D","line":97,"updated":"2014-04-21 15:14:08.000000000","message":"get *a*","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Next, upload your metadata file to testshib.org"},{"line_number":97,"context_line":"You should be able to get customized shibboleth2.xml file, again from"},{"line_number":98,"context_line":"testshib.org configuratin site. Save it as `/etc/shibboleth/shibboleth2.xml`"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"ATTENTION: remove `REMOTE_USER` from  `/etc/shibboleth/shibboleth2.x`"},{"line_number":101,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe5I%3D","line":98,"updated":"2014-04-21 15:14:08.000000000","message":"configuration","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"f9dc6363bb33bbc1f9e21c22e587fefba47f7eeb","unresolved":false,"context_lines":[{"line_number":97,"context_line":"You should be able to get customized shibboleth2.xml file, again from"},{"line_number":98,"context_line":"testshib.org configuratin site. Save it as `/etc/shibboleth/shibboleth2.xml`"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"ATTENTION: remove `REMOTE_USER` from  `/etc/shibboleth/shibboleth2.x`"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Configuring Federation"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2FhL8%3D","line":100,"updated":"2014-04-20 18:31:39.000000000","message":"s/shibboleth2.x/shibboleth2.xml/\n\n+ I will explain WHY this should be removed (for now)","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":97,"context_line":"You should be able to get customized shibboleth2.xml file, again from"},{"line_number":98,"context_line":"testshib.org configuratin site. Save it as `/etc/shibboleth/shibboleth2.xml`"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"ATTENTION: remove `REMOTE_USER` from  `/etc/shibboleth/shibboleth2.x`"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":""},{"line_number":103,"context_line":"Configuring Federation"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fe48%3D","line":100,"in_reply_to":"AAAAXH%2F%2FhL8%3D","updated":"2014-04-21 15:14:08.000000000","message":"i don\u0027t understand who this is \"ATTENTION\" to? is this actually a TODO / FIXME?","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":106,"context_line":"Now that the Identity Provider and Keystone are communicating we can start to"},{"line_number":107,"context_line":"configure the Federation Extension."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"1) Add local Keystone groups and roles"},{"line_number":110,"context_line":"2) Add Identity Provider/Mapping rules/Protocols"},{"line_number":111,"context_line":"3) Get an unscoped token"},{"line_number":112,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd7U%3D","line":109,"updated":"2014-04-21 15:14:08.000000000","message":"use periods for numbered lists\n\n  1.","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":107,"context_line":"configure the Federation Extension."},{"line_number":108,"context_line":""},{"line_number":109,"context_line":"1) Add local Keystone groups and roles"},{"line_number":110,"context_line":"2) Add Identity Provider/Mapping rules/Protocols"},{"line_number":111,"context_line":"3) Get an unscoped token"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd7k%3D","line":110,"updated":"2014-04-21 15:14:08.000000000","message":"use commas","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":111,"context_line":"3) Get an unscoped token"},{"line_number":112,"context_line":""},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"Create Keystone groups and grant roles"},{"line_number":115,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"As mentioned earlier, no new users will be added to the Identity backend, but"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd68%3D","line":114,"updated":"2014-04-21 15:14:08.000000000","message":"s/grant/assign/","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":115,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"As mentioned earlier, no new users will be added to the Identity backend, but"},{"line_number":118,"context_line":"the Identity Service requires to perform authorization. The federation mapping"},{"line_number":119,"context_line":"function will map the user to local Identity Service groups objects."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Thus, it is required to create the necessary Identity Service groups, that"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd6s%3D","line":118,"updated":"2014-04-21 15:14:08.000000000","message":"requires what?","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":118,"context_line":"the Identity Service requires to perform authorization. The federation mapping"},{"line_number":119,"context_line":"function will map the user to local Identity Service groups objects."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Thus, it is required to create the necessary Identity Service groups, that"},{"line_number":122,"context_line":"correspond to the Identity Provider\u0027s groups; additionally, these groups should"},{"line_number":123,"context_line":"have roles on an Identity Service resource (project or domain)."},{"line_number":124,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd6I%3D","line":121,"updated":"2014-04-21 15:14:08.000000000","message":"second comma isn\u0027t necessary","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":119,"context_line":"function will map the user to local Identity Service groups objects."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Thus, it is required to create the necessary Identity Service groups, that"},{"line_number":122,"context_line":"correspond to the Identity Provider\u0027s groups; additionally, these groups should"},{"line_number":123,"context_line":"have roles on an Identity Service resource (project or domain)."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"More information on group management can be found here: `\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#create-group-post-groups\u003e`_"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd48%3D","line":122,"updated":"2014-04-21 15:14:08.000000000","message":"\"that correspond to the Identity Provider\u0027s groups\" isn\u0027t really necessary - the groups can be whatever you want, and the correspondence is handled by the mapping","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":120,"context_line":""},{"line_number":121,"context_line":"Thus, it is required to create the necessary Identity Service groups, that"},{"line_number":122,"context_line":"correspond to the Identity Provider\u0027s groups; additionally, these groups should"},{"line_number":123,"context_line":"have roles on an Identity Service resource (project or domain)."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"More information on group management can be found here: `\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#create-group-post-groups\u003e`_"},{"line_number":126,"context_line":"More information on grants can be found here: `\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#grant-role-to-group-on-project-put-projectsproject_idgroupsgroup_idrolesrole_id\u003e`_"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd4s%3D","line":123,"updated":"2014-04-21 15:14:08.000000000","message":"on one or more projects or domains.","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":123,"context_line":"have roles on an Identity Service resource (project or domain)."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"More information on group management can be found here: `\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#create-group-post-groups\u003e`_"},{"line_number":126,"context_line":"More information on grants can be found here: `\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3.md#grant-role-to-group-on-project-put-projectsproject_idgroupsgroup_idrolesrole_id\u003e`_"},{"line_number":127,"context_line":""},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Add Identity Provider/Mapping/Protocols"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd4o%3D","line":126,"updated":"2014-04-21 15:14:08.000000000","message":"role assignments","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":129,"context_line":"Add Identity Provider/Mapping/Protocols"},{"line_number":130,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":131,"context_line":""},{"line_number":132,"context_line":"To fully utilize federation the following entries must be created in the"},{"line_number":133,"context_line":"Identity Service."},{"line_number":134,"context_line":""},{"line_number":135,"context_line":"* Identity Provider"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd3w%3D","line":132,"updated":"2014-04-21 15:14:08.000000000","message":"s/fully//","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":142,"context_line":"Identity Provider"},{"line_number":143,"context_line":"~~~~~~~~~~~~~~~~~"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":"Create an Identity Provider object in Keystone, it represents a trusted third"},{"line_number":146,"context_line":"party service that is trusted by the Identity API to authenticate identities."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"More information on mapping can be found here:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd3c%3D","line":145,"updated":"2014-04-21 15:14:08.000000000","message":"s/it/which/","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":145,"context_line":"Create an Identity Provider object in Keystone, it represents a trusted third"},{"line_number":146,"context_line":"party service that is trusted by the Identity API to authenticate identities."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"More information on mapping can be found here:"},{"line_number":149,"context_line":"https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#register-an-identity-provider-put-os-federationidentity_providersidp_id"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd2o%3D","line":148,"updated":"2014-04-21 15:14:08.000000000","message":"idps","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"f9dc6363bb33bbc1f9e21c22e587fefba47f7eeb","unresolved":false,"context_lines":[{"line_number":157,"context_line":"A mapping is simply a list of rules. The only Identity API objects that will support mapping are: group."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"More information on mapping can be found here: `\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#create-a-mapping-put-os-federationmappingsmapping_id\u003e`_"},{"line_number":160,"context_line":""},{"line_number":161,"context_line":"~~~~~~~~"},{"line_number":162,"context_line":"Protocol"},{"line_number":163,"context_line":"~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2FhLE%3D","line":160,"updated":"2014-04-20 18:31:39.000000000","message":"We must mention here that mapping to rules[local][user][name] name must be present in the rules and preferably mention that usually in the SAML2 assertion THERE IS a parameter that can be used as a unique identifier of (something like domain login name or something like this).","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":165,"context_line":"Contains information that dictates which Mapping rules to use for an incoming"},{"line_number":166,"context_line":"request made by an IdP. An IdP may have multiple supported protocol."},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"More information on mapping can be found here: `\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#add-a-supported-protocol-and-attribute-mapping-combination-to-an-identity-provider-put-os-federationidentity_providersidp_idprotocolsprotocol_id\u003e`_"},{"line_number":169,"context_line":""},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"Get an unscoped token"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd2k%3D","line":168,"updated":"2014-04-21 15:14:08.000000000","message":"protocols","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"f9dc6363bb33bbc1f9e21c22e587fefba47f7eeb","unresolved":false,"context_lines":[{"line_number":188,"context_line":""},{"line_number":189,"context_line":"More information getting an unscoped token can be found here: `\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#authenticating\u003e`_"},{"line_number":190,"context_line":""},{"line_number":191,"context_line":"Determine accessible resources"},{"line_number":192,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":193,"context_line":""},{"line_number":194,"context_line":"By using the previously returned token, the user can issue requests to"}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2FhLA%3D","line":191,"updated":"2014-04-20 18:31:39.000000000","message":"Initially I skipped this, but of course this is crucial!","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"757b280b7ef17554a2f9a1ba902645eebac901d0","unresolved":false,"context_lines":[{"line_number":200,"context_line":"More information listing resources can be found here: `\u003chttps://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md#listing-projects-and-domains\u003e`_"},{"line_number":201,"context_line":""},{"line_number":202,"context_line":""},{"line_number":203,"context_line":"Get a scoped token"},{"line_number":204,"context_line":"~~~~~~~~~~~~~~~~~~"},{"line_number":205,"context_line":""},{"line_number":206,"context_line":"A federated user may request a scoped token, by using the unscoped token."}],"source_content_type":"text/x-rst","patch_set":1,"id":"AAAAXH%2F%2Fd0E%3D","line":203,"updated":"2014-04-21 15:14:08.000000000","message":"this should really just refer to the appropriate section of the v3 api doc, or whatever","commit_id":"f62cddc261e7e54a9731e4ce02197aed71f65393"}],"doc/source/extensions/shibboleth.rst":[{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"3dc7cc4b34d30e66e899c1e0e38f8e651ac9c52c","unresolved":false,"context_lines":[{"line_number":1,"context_line":":orphan:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":".."},{"line_number":4,"context_line":"      Copyright 2014 OpenStack, Foundation"}],"source_content_type":"text/x-rst","patch_set":21,"id":"7adec928_c5872cd6","line":1,"updated":"2014-05-09 20:41:31.000000000","message":"I had to make this file an \u0027orphan\u0027 wrt rst, since he\u0027s just linked and not actually included in any table of contents.\n\nI guess, when we eventually add more examples, we can get create a table of contents somewhere and link more than 1.","commit_id":"8e215e42480e6a99250779136b9c5d402496ab68"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"304db6c41ab10b4fab2b4d3f4f30ffead9ab790a","unresolved":false,"context_lines":[{"line_number":1,"context_line":":orphan:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":".."},{"line_number":4,"context_line":"      Copyright 2014 OpenStack, Foundation"}],"source_content_type":"text/x-rst","patch_set":21,"id":"7adec928_7d619038","line":1,"in_reply_to":"7adec928_c5872cd6","updated":"2014-05-10 00:06:01.000000000","message":"Sounds good.  Thanks for mentioning this!","commit_id":"8e215e42480e6a99250779136b9c5d402496ab68"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"ab0e05566ae24977ff78a5f7aeddbb4a0dd83fa5","unresolved":false,"context_lines":[{"line_number":1,"context_line":":orphan:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":".."},{"line_number":4,"context_line":"      Copyright 2014 OpenStack, Foundation"},{"line_number":5,"context_line":"      All Rights Reserved."},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":21,"id":"7adec928_e7d505ba","line":4,"updated":"2014-05-11 02:45:48.000000000","message":"are we dropping this?","commit_id":"8e215e42480e6a99250779136b9c5d402496ab68"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e59f828d899c8df09f6fce593d03df9c200b5ce9","unresolved":false,"context_lines":[{"line_number":1,"context_line":":orphan:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":".."},{"line_number":4,"context_line":"      Copyright 2014 OpenStack, Foundation"},{"line_number":5,"context_line":"      All Rights Reserved."},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"      Licensed under the Apache License, Version 2.0 (the \"License\"); you may"}],"source_content_type":"text/x-rst","patch_set":21,"id":"7adec928_4f6f99fd","line":4,"in_reply_to":"7adec928_e7d505ba","updated":"2014-05-13 13:24:20.000000000","message":"removed","commit_id":"8e215e42480e6a99250779136b9c5d402496ab68"},{"author":{"_account_id":10917,"name":"Gabriel Bezerra","email":"gabrielb@lsd.ufcg.edu.br","username":"gabriel.bezerra"},"change_message_id":"eea36dc71ec038a2b6fe7081af3a1154f4b2bb37","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"The newly created file will be stored under ``/etc/shibboleth/sp-key.pem``"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"You should fetch your Service Provider\u0027s Metadata file. Typically this can be"},{"line_number":37,"context_line":"achieved by simply fetching a Metadata file, for example:"},{"line_number":38,"context_line":""},{"line_number":39,"context_line":".. code-block:: bash"}],"source_content_type":"text/x-rst","patch_set":21,"id":"7adec928_10b5bb30","line":36,"updated":"2014-05-12 21:44:58.000000000","message":"Isn\u0027t it necessary to restart the service or configure the service provider before getting this file? I could see that my Metadata changed after a service shibd restart.","commit_id":"8e215e42480e6a99250779136b9c5d402496ab68"},{"author":{"_account_id":8978,"name":"Marek Denis","email":"marek.denis+openstack@gmail.com","username":"marek-denis"},"change_message_id":"ab0e05566ae24977ff78a5f7aeddbb4a0dd83fa5","unresolved":false,"context_lines":[{"line_number":162,"context_line":""},{"line_number":163,"context_line":".. code-block:: bash"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"    $ service shibd restart"}],"source_content_type":"text/x-rst","patch_set":21,"id":"7adec928_07dcb1e3","line":165,"updated":"2014-05-11 02:45:48.000000000","message":"suggest adding a comment that restarting apache may be a good practice (I am not 100% sure it\u0027s require, but it\u0027s later to execute extra command rather that spend way more time on looking for bugs that doesn\u0027t exist and the services are not restarted).","commit_id":"8e215e42480e6a99250779136b9c5d402496ab68"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"e59f828d899c8df09f6fce593d03df9c200b5ce9","unresolved":false,"context_lines":[{"line_number":162,"context_line":""},{"line_number":163,"context_line":".. code-block:: bash"},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"    $ service shibd restart"}],"source_content_type":"text/x-rst","patch_set":21,"id":"7adec928_0f4cb19d","line":165,"in_reply_to":"7adec928_07dcb1e3","updated":"2014-05-13 13:24:20.000000000","message":"added a comment","commit_id":"8e215e42480e6a99250779136b9c5d402496ab68"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"50044337a9a98516ef24469372afd8c180f44859","unresolved":false,"context_lines":[{"line_number":152,"context_line":"    \u003c/SPConfig\u003e"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"Examine your attributes map file ``/etc/shibboleth/attributes-map.xml`` and adjust"},{"line_number":155,"context_line":"to your requirements if needed. For more information see"},{"line_number":156,"context_line":"`attributes documentation \u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute\u003e`_"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Once you are done, restart your shibboleth daemon:"}],"source_content_type":"text/x-rst","patch_set":22,"id":"7adec928_a1dcb113","line":155,"updated":"2014-05-13 13:48:49.000000000","message":"(NIT): remove \u0027to\u0027","commit_id":"9bef43d05a29af051e279e08c446a831cf8c4d2a"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"5e426668c364dffe772f3761a0671a7e80d2c06d","unresolved":false,"context_lines":[{"line_number":152,"context_line":"    \u003c/SPConfig\u003e"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"Examine your attributes map file ``/etc/shibboleth/attributes-map.xml`` and adjust"},{"line_number":155,"context_line":"to your requirements if needed. For more information see"},{"line_number":156,"context_line":"`attributes documentation \u003chttps://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAddAttribute\u003e`_"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Once you are done, restart your shibboleth daemon:"}],"source_content_type":"text/x-rst","patch_set":22,"id":"7adec928_776eeb97","line":155,"in_reply_to":"7adec928_a1dcb113","updated":"2014-05-13 15:04:46.000000000","message":"Done","commit_id":"9bef43d05a29af051e279e08c446a831cf8c4d2a"}]}