)]}'
{"ansible/group_vars/all.yml":[{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":1099,"context_line":"# telemetry data."},{"line_number":1100,"context_line":"telegraf_enable_docker_input: \"no\""},{"line_number":1101,"context_line":""},{"line_number":1102,"context_line":"############"},{"line_number":1103,"context_line":"# Identity federation configuration"},{"line_number":1104,"context_line":"############"},{"line_number":1105,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_a7edfdb7","line":1102,"updated":"2020-03-06 16:16:49.000000000","message":"Some more # ?","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":1099,"context_line":"# telemetry data."},{"line_number":1100,"context_line":"telegraf_enable_docker_input: \"no\""},{"line_number":1101,"context_line":""},{"line_number":1102,"context_line":"############"},{"line_number":1103,"context_line":"# Identity federation configuration"},{"line_number":1104,"context_line":"############"},{"line_number":1105,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_90d07521","line":1102,"in_reply_to":"1fa4df85_a7edfdb7","updated":"2020-03-19 19:49:21.000000000","message":"Done","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":1101,"context_line":""},{"line_number":1102,"context_line":"############"},{"line_number":1103,"context_line":"# Identity federation configuration"},{"line_number":1104,"context_line":"############"},{"line_number":1105,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1106,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1107,"context_line":"# * name (internal name of the IdP in OpenStack);"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_472e89fb","line":1104,"updated":"2020-03-06 16:16:49.000000000","message":"Dito.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":1101,"context_line":""},{"line_number":1102,"context_line":"############"},{"line_number":1103,"context_line":"# Identity federation configuration"},{"line_number":1104,"context_line":"############"},{"line_number":1105,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1106,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1107,"context_line":"# * name (internal name of the IdP in OpenStack);"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_50c67d6a","line":1104,"in_reply_to":"1fa4df85_472e89fb","updated":"2020-03-19 19:49:21.000000000","message":"Done","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":29100,"name":"Jason Anderson","email":"jasonanderson@uchicago.edu","username":"jasonanderson"},"change_message_id":"7ab54788a94768a168b2aac2e00e0266c91c2c9c","unresolved":false,"context_lines":[{"line_number":1124,"context_line":"#"},{"line_number":1125,"context_line":"# We also need to configure the attribute mapping that is used by IdPs. The configuration of attribute mappings is a list of objects, where each object must have a \u0027name\u0027 (that mapps to the \u0027attribute_mapping\u0027 to the IdP object in the IdPs set), and the \u0027file\u0027 with a full qualified path to a mapping file."},{"line_number":1126,"context_line":"# identity_providers_attribute_mappings:"},{"line_number":1127,"context_line":"#   - {name: \"mappingId1\", file: \"/full/qualified/path/to/mapping/json/file/to/mappingId1\"}"},{"line_number":1128,"context_line":"#   - {name: \"mappingId2\", file: \"/full/qualified/path/to/mapping/json/file/to/mappingId2\"}"},{"line_number":1129,"context_line":"#   - {name: \"mappingId3\", file: \"/full/qualified/path/to/mapping/json/file/to/mappingId3\"}"},{"line_number":1130,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":17,"id":"3f4c43b2_6c3bd5ea","line":1127,"updated":"2020-04-14 23:12:44.000000000","message":"What is the reason for listing these separately from identity_providers, given that each identity_provider can only support one mapping? Placing the mapping information directly in identity_providers could avoid confusion:\n\n  - name: myidp1\n    protocol: openid\n    identifier: https://accounts.google.com\n    public_name: Authenticate via myidp1\n    client_id: myidp1.client.id\n    client_secret: \"{{ myidp1_client_secret }}\"\n    mapping_file: \"{{ node_custom_config }}/keystone/myidp1_mapping.json\"\n    organization_domain_name: \"xyz.com\"\n    certificate_url: \"\"\n    certificate_transformer: \"\"\n    key_id: \"\"\n    key_transformer: \"\"\n\nAlso, I don\u0027t see organization_domain_name used anywhere--is that hiding somewhere?","commit_id":"63353bb54d36cf6e995781ffad4ef0b4f9ed4ec2"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":1139,"context_line":"# Identity federation configuration"},{"line_number":1140,"context_line":"###################################"},{"line_number":1141,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1142,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1143,"context_line":"# * name (internal name of the IdP in OpenStack);"},{"line_number":1144,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1145,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_766732b9","line":1142,"updated":"2020-09-15 15:45:43.000000000","message":"missing organization_domain_name?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":1139,"context_line":"# Identity federation configuration"},{"line_number":1140,"context_line":"###################################"},{"line_number":1141,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1142,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1143,"context_line":"# * name (internal name of the IdP in OpenStack);"},{"line_number":1144,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1145,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_dc5e1d78","line":1142,"in_reply_to":"9f560f44_766732b9","updated":"2020-10-02 19:55:50.000000000","message":"Done","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":1146,"context_line":"# * public_name (the public name that will be shown for users);"},{"line_number":1147,"context_line":"# * attribute_mapping (the attribute mapping to be used for this IdP. This mapping is expected to already exist in OpenStack.);"},{"line_number":1148,"context_line":"# * metadata_folder (folder containing all the identity provider metadata as jsons named as the identifier without the protocol and with \u0027/\u0027 escaped as %2F followed with \u0027.provider\u0027 or \u0027.client\u0027 or \u0027.conf\u0027; e.g. accounts.google.com.provider; PS, all .conf, .provider and .client jsons must be in the folder, even if you dont override any conf in the .conf json, you must leave it as an empty json \u0027{}\u0027);"},{"line_number":1149,"context_line":"# * certificate_file (the path to the Identity Provider certificate file, the file must be named as \u0027certificate-key-id.pem\u0027; e.g. LRVweuT51StjMdsna59jKfB3xw0r8Iz1d1J1HeAbmlw.pem; You can find the key-id in the Identity provider \u0027.well-known/openid-configuration\u0027 jwks_uri as kid);"},{"line_number":1150,"context_line":"#"},{"line_number":1151,"context_line":"# The IdPs meta information are to be presented to Kolla-ansible as the following example:"},{"line_number":1152,"context_line":"# keystone_identity_providers:"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_331b0c1d","line":1149,"updated":"2020-09-15 15:45:43.000000000","message":"Please wrap lines for readability.","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":1146,"context_line":"# * public_name (the public name that will be shown for users);"},{"line_number":1147,"context_line":"# * attribute_mapping (the attribute mapping to be used for this IdP. This mapping is expected to already exist in OpenStack.);"},{"line_number":1148,"context_line":"# * metadata_folder (folder containing all the identity provider metadata as jsons named as the identifier without the protocol and with \u0027/\u0027 escaped as %2F followed with \u0027.provider\u0027 or \u0027.client\u0027 or \u0027.conf\u0027; e.g. accounts.google.com.provider; PS, all .conf, .provider and .client jsons must be in the folder, even if you dont override any conf in the .conf json, you must leave it as an empty json \u0027{}\u0027);"},{"line_number":1149,"context_line":"# * certificate_file (the path to the Identity Provider certificate file, the file must be named as \u0027certificate-key-id.pem\u0027; e.g. LRVweuT51StjMdsna59jKfB3xw0r8Iz1d1J1HeAbmlw.pem; You can find the key-id in the Identity provider \u0027.well-known/openid-configuration\u0027 jwks_uri as kid);"},{"line_number":1150,"context_line":"#"},{"line_number":1151,"context_line":"# The IdPs meta information are to be presented to Kolla-ansible as the following example:"},{"line_number":1152,"context_line":"# keystone_identity_providers:"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_bc636941","line":1149,"in_reply_to":"9f560f44_331b0c1d","updated":"2020-10-02 19:55:50.000000000","message":"Done","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":1150,"context_line":"#"},{"line_number":1151,"context_line":"# The IdPs meta information are to be presented to Kolla-ansible as the following example:"},{"line_number":1152,"context_line":"# keystone_identity_providers:"},{"line_number":1153,"context_line":"#   - {name: \"myidp1\", protocol: \"openid\", identifier: \"https://accounts.google.com\", public_name: \"Authenticate via myidp1\", attribute_mapping: \"mappingId1\", organization_domain_name: \"xyz.com\", metadata_folder: \"path/to/metadata/folder\", certificate_file: \"path/to/certificate/file.pem\"}"},{"line_number":1154,"context_line":"#"},{"line_number":1155,"context_line":"# We also need to configure the attribute mapping that is used by IdPs. The configuration of attribute mappings is a list of objects, where each object must have a \u0027name\u0027 (that mapps to the \u0027attribute_mapping\u0027 to the IdP object in the IdPs set), and the \u0027file\u0027 with a full qualified path to a mapping file."},{"line_number":1156,"context_line":"# keystone_identity_mappings:"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_935138dd","line":1153,"updated":"2020-09-15 15:45:43.000000000","message":"This would be a lot easier to read in this format:\n\n- name: myidp1\n  protocol: openid\n  ...","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":1150,"context_line":"#"},{"line_number":1151,"context_line":"# The IdPs meta information are to be presented to Kolla-ansible as the following example:"},{"line_number":1152,"context_line":"# keystone_identity_providers:"},{"line_number":1153,"context_line":"#   - {name: \"myidp1\", protocol: \"openid\", identifier: \"https://accounts.google.com\", public_name: \"Authenticate via myidp1\", attribute_mapping: \"mappingId1\", organization_domain_name: \"xyz.com\", metadata_folder: \"path/to/metadata/folder\", certificate_file: \"path/to/certificate/file.pem\"}"},{"line_number":1154,"context_line":"#"},{"line_number":1155,"context_line":"# We also need to configure the attribute mapping that is used by IdPs. The configuration of attribute mappings is a list of objects, where each object must have a \u0027name\u0027 (that mapps to the \u0027attribute_mapping\u0027 to the IdP object in the IdPs set), and the \u0027file\u0027 with a full qualified path to a mapping file."},{"line_number":1156,"context_line":"# keystone_identity_mappings:"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_fc5de179","line":1153,"in_reply_to":"9f560f44_935138dd","updated":"2020-10-02 19:55:50.000000000","message":"Done","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":1156,"context_line":"# keystone_identity_mappings:"},{"line_number":1157,"context_line":"#   - {name: \"mappingId1\", file: \"/full/qualified/path/to/mapping/json/file/to/mappingId1\"}"},{"line_number":1158,"context_line":"#   - {name: \"mappingId2\", file: \"/full/qualified/path/to/mapping/json/file/to/mappingId2\"}"},{"line_number":1159,"context_line":"#   - {name: \"mappingId3\", file: \"/full/qualified/path/to/mapping/json/file/to/mappingId3\"}"},{"line_number":1160,"context_line":"keystone_identity_providers: []"},{"line_number":1161,"context_line":"keystone_identity_mappings: []"},{"line_number":1162,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_734e2439","line":1159,"updated":"2020-09-15 15:45:43.000000000","message":"ditto","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":1156,"context_line":"# keystone_identity_mappings:"},{"line_number":1157,"context_line":"#   - {name: \"mappingId1\", file: \"/full/qualified/path/to/mapping/json/file/to/mappingId1\"}"},{"line_number":1158,"context_line":"#   - {name: \"mappingId2\", file: \"/full/qualified/path/to/mapping/json/file/to/mappingId2\"}"},{"line_number":1159,"context_line":"#   - {name: \"mappingId3\", file: \"/full/qualified/path/to/mapping/json/file/to/mappingId3\"}"},{"line_number":1160,"context_line":"keystone_identity_providers: []"},{"line_number":1161,"context_line":"keystone_identity_mappings: []"},{"line_number":1162,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_3c4f59bf","line":1159,"in_reply_to":"9f560f44_734e2439","updated":"2020-10-02 19:55:50.000000000","message":"Done","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":1161,"context_line":"keystone_identity_mappings: []"},{"line_number":1162,"context_line":""},{"line_number":1163,"context_line":"# The identity API version to be used to register IdPs in OpenStack"},{"line_number":1164,"context_line":"identity_api_version: 3"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_53ccc089","line":1164,"range":{"start_line":1164,"start_character":0,"end_line":1164,"end_character":23},"updated":"2020-09-15 15:45:43.000000000","message":"Unless we start using this everywhere, I suggest we just hard code 3.","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":1161,"context_line":"keystone_identity_mappings: []"},{"line_number":1162,"context_line":""},{"line_number":1163,"context_line":"# The identity API version to be used to register IdPs in OpenStack"},{"line_number":1164,"context_line":"identity_api_version: 3"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_fc6e81fe","line":1164,"range":{"start_line":1164,"start_character":0,"end_line":1164,"end_character":23},"in_reply_to":"9f560f44_53ccc089","updated":"2020-10-02 19:55:50.000000000","message":"hmm, this variable is used in many locations, if we hard code this, when a new identity API version is released, we will need to change it again to use the new version of the API instead of just changing the version here.","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":1173,"context_line":"#     identifier: \"https://accounts.google.com\""},{"line_number":1174,"context_line":"#     public_name: \"Authenticate via myidp1\""},{"line_number":1175,"context_line":"#     attribute_mapping: \"mappingId1\""},{"line_number":1176,"context_line":"#     organization_domain_name: \"xyz.com\""},{"line_number":1177,"context_line":"#     metadata_folder: \"path/to/metadata/folder\""},{"line_number":1178,"context_line":"#     certificate_file: \"path/to/certificate/file.pem\""},{"line_number":1179,"context_line":"#"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"9ab7926b_67b39e1e","line":1176,"range":{"start_line":1176,"start_character":6,"end_line":1176,"end_character":30},"updated":"2021-01-06 14:13:26.000000000","message":"I don\u0027t see this referenced anywhere.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":1173,"context_line":"#     identifier: \"https://accounts.google.com\""},{"line_number":1174,"context_line":"#     public_name: \"Authenticate via myidp1\""},{"line_number":1175,"context_line":"#     attribute_mapping: \"mappingId1\""},{"line_number":1176,"context_line":"#     organization_domain_name: \"xyz.com\""},{"line_number":1177,"context_line":"#     metadata_folder: \"path/to/metadata/folder\""},{"line_number":1178,"context_line":"#     certificate_file: \"path/to/certificate/file.pem\""},{"line_number":1179,"context_line":"#"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"e21580d7_a9e9438f","line":1176,"range":{"start_line":1176,"start_character":6,"end_line":1176,"end_character":30},"in_reply_to":"9ab7926b_67b39e1e","updated":"2021-01-06 19:05:13.000000000","message":"I will remove it, it was to be used with a horizon feature to ease the discovery process, I will add it again in the future when the horizon feature get merged","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":1191,"context_line":"keystone_identity_providers: []"},{"line_number":1192,"context_line":"keystone_identity_mappings: []"},{"line_number":1193,"context_line":""},{"line_number":1194,"context_line":"# The identity API version to be used to register IdPs in OpenStack"},{"line_number":1195,"context_line":"identity_api_version: 3"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"a0141dfe_138e50ce","line":1195,"range":{"start_line":1194,"start_character":0,"end_line":1195,"end_character":23},"updated":"2021-01-06 14:13:26.000000000","message":"No need for this. We use v3 everywhere.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":1191,"context_line":"keystone_identity_providers: []"},{"line_number":1192,"context_line":"keystone_identity_mappings: []"},{"line_number":1193,"context_line":""},{"line_number":1194,"context_line":"# The identity API version to be used to register IdPs in OpenStack"},{"line_number":1195,"context_line":"identity_api_version: 3"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"65afe2fd_c84280ed","line":1195,"range":{"start_line":1194,"start_character":0,"end_line":1195,"end_character":23},"in_reply_to":"a0141dfe_138e50ce","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"919f01bd1945ee25ee9b97b6a506e12d51549243","unresolved":true,"context_lines":[{"line_number":1194,"context_line":"#     file: \"/full/qualified/path/to/mapping/json/file/to/mappingId3\""},{"line_number":1195,"context_line":"keystone_identity_providers: []"},{"line_number":1196,"context_line":"keystone_identity_mappings: []"},{"line_number":1197,"context_line":"keystone_federation_oidc_scopes: \"openid email profile\""}],"source_content_type":"text/x-yaml","patch_set":45,"id":"dbe84433_8475e56c","line":1197,"range":{"start_line":1197,"start_character":0,"end_line":1197,"end_character":55},"updated":"2021-01-07 15:11:37.000000000","message":"Can move to keystone role defaults.","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"6ebb5465cfaba397ea4d8e85de627e3b2b0d1848","unresolved":false,"context_lines":[{"line_number":1194,"context_line":"#     file: \"/full/qualified/path/to/mapping/json/file/to/mappingId3\""},{"line_number":1195,"context_line":"keystone_identity_providers: []"},{"line_number":1196,"context_line":"keystone_identity_mappings: []"},{"line_number":1197,"context_line":"keystone_federation_oidc_scopes: \"openid email profile\""}],"source_content_type":"text/x-yaml","patch_set":45,"id":"be8d38eb_8c66c3ba","line":1197,"range":{"start_line":1197,"start_character":0,"end_line":1197,"end_character":55},"in_reply_to":"dbe84433_8475e56c","updated":"2021-01-07 18:58:37.000000000","message":"Done","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":1159,"context_line":"###################################"},{"line_number":1160,"context_line":"# Identity federation configuration"},{"line_number":1161,"context_line":"###################################"},{"line_number":1162,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1163,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1164,"context_line":"# * name (internal name of the IdP in OpenStack);"},{"line_number":1165,"context_line":"# * openstack_domain (the domain in OpenStack that the IdP belongs)"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"b81a934c_57a58ab7","line":1162,"range":{"start_line":1162,"start_character":114,"end_line":1162,"end_character":123},"updated":"2021-02-14 20:31:10.000000000","message":"OpenStack Keystone","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":1159,"context_line":"###################################"},{"line_number":1160,"context_line":"# Identity federation configuration"},{"line_number":1161,"context_line":"###################################"},{"line_number":1162,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1163,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1164,"context_line":"# * name (internal name of the IdP in OpenStack);"},{"line_number":1165,"context_line":"# * openstack_domain (the domain in OpenStack that the IdP belongs)"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"2748805f_eb47cd1c","line":1162,"range":{"start_line":1162,"start_character":114,"end_line":1162,"end_character":123},"in_reply_to":"b81a934c_57a58ab7","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":1161,"context_line":"###################################"},{"line_number":1162,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1163,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1164,"context_line":"# * name (internal name of the IdP in OpenStack);"},{"line_number":1165,"context_line":"# * openstack_domain (the domain in OpenStack that the IdP belongs)"},{"line_number":1166,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1167,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"5f0bf509_2c3eb71c","line":1164,"range":{"start_line":1164,"start_character":38,"end_line":1164,"end_character":47},"updated":"2021-02-14 20:31:10.000000000","message":"Keystone","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":1161,"context_line":"###################################"},{"line_number":1162,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1163,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1164,"context_line":"# * name (internal name of the IdP in OpenStack);"},{"line_number":1165,"context_line":"# * openstack_domain (the domain in OpenStack that the IdP belongs)"},{"line_number":1166,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1167,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"286d7531_e0303818","line":1164,"range":{"start_line":1164,"start_character":38,"end_line":1164,"end_character":47},"in_reply_to":"5f0bf509_2c3eb71c","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":1162,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1163,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1164,"context_line":"# * name (internal name of the IdP in OpenStack);"},{"line_number":1165,"context_line":"# * openstack_domain (the domain in OpenStack that the IdP belongs)"},{"line_number":1166,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1167,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"},{"line_number":1168,"context_line":"# * public_name (the public name that will be shown for users);"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"01a47965_1ff557b1","line":1165,"range":{"start_line":1165,"start_character":59,"end_line":1165,"end_character":66},"updated":"2021-02-14 20:31:10.000000000","message":"\"belongs to\"","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":1162,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1163,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1164,"context_line":"# * name (internal name of the IdP in OpenStack);"},{"line_number":1165,"context_line":"# * openstack_domain (the domain in OpenStack that the IdP belongs)"},{"line_number":1166,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1167,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"},{"line_number":1168,"context_line":"# * public_name (the public name that will be shown for users);"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"b9f2446e_30b2825b","line":1165,"range":{"start_line":1165,"start_character":36,"end_line":1165,"end_character":46},"updated":"2021-02-14 20:31:10.000000000","message":"Keystone","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":1162,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1163,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1164,"context_line":"# * name (internal name of the IdP in OpenStack);"},{"line_number":1165,"context_line":"# * openstack_domain (the domain in OpenStack that the IdP belongs)"},{"line_number":1166,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1167,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"},{"line_number":1168,"context_line":"# * public_name (the public name that will be shown for users);"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"2426ee5d_7a9e80da","line":1165,"range":{"start_line":1165,"start_character":59,"end_line":1165,"end_character":66},"in_reply_to":"01a47965_1ff557b1","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":1162,"context_line":"# Here we configure all of the IdPs meta informations that will be required to implement identity federation with OpenStack."},{"line_number":1163,"context_line":"# We require the administrator to enter the following metadata:"},{"line_number":1164,"context_line":"# * name (internal name of the IdP in OpenStack);"},{"line_number":1165,"context_line":"# * openstack_domain (the domain in OpenStack that the IdP belongs)"},{"line_number":1166,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1167,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"},{"line_number":1168,"context_line":"# * public_name (the public name that will be shown for users);"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"6e154559_62247d81","line":1165,"range":{"start_line":1165,"start_character":36,"end_line":1165,"end_character":46},"in_reply_to":"b9f2446e_30b2825b","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":1165,"context_line":"# * openstack_domain (the domain in OpenStack that the IdP belongs)"},{"line_number":1166,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1167,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"},{"line_number":1168,"context_line":"# * public_name (the public name that will be shown for users);"},{"line_number":1169,"context_line":"# * attribute_mapping (the attribute mapping to be used for this IdP. This mapping is expected to already exist in OpenStack.);"},{"line_number":1170,"context_line":"# * metadata_folder (folder containing all the identity provider metadata as jsons named as the identifier without the protocol"},{"line_number":1171,"context_line":"#   and with \u0027/\u0027 escaped as %2F followed with \u0027.provider\u0027 or \u0027.client\u0027 or \u0027.conf\u0027; e.g. accounts.google.com.provider; PS, all .conf,"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"e1546a99_359ad991","line":1168,"updated":"2021-02-14 20:31:10.000000000","message":"in Horizon","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":1165,"context_line":"# * openstack_domain (the domain in OpenStack that the IdP belongs)"},{"line_number":1166,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1167,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"},{"line_number":1168,"context_line":"# * public_name (the public name that will be shown for users);"},{"line_number":1169,"context_line":"# * attribute_mapping (the attribute mapping to be used for this IdP. This mapping is expected to already exist in OpenStack.);"},{"line_number":1170,"context_line":"# * metadata_folder (folder containing all the identity provider metadata as jsons named as the identifier without the protocol"},{"line_number":1171,"context_line":"#   and with \u0027/\u0027 escaped as %2F followed with \u0027.provider\u0027 or \u0027.client\u0027 or \u0027.conf\u0027; e.g. accounts.google.com.provider; PS, all .conf,"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"dcc8b594_f80deab6","line":1168,"in_reply_to":"e1546a99_359ad991","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":1166,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1167,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"},{"line_number":1168,"context_line":"# * public_name (the public name that will be shown for users);"},{"line_number":1169,"context_line":"# * attribute_mapping (the attribute mapping to be used for this IdP. This mapping is expected to already exist in OpenStack.);"},{"line_number":1170,"context_line":"# * metadata_folder (folder containing all the identity provider metadata as jsons named as the identifier without the protocol"},{"line_number":1171,"context_line":"#   and with \u0027/\u0027 escaped as %2F followed with \u0027.provider\u0027 or \u0027.client\u0027 or \u0027.conf\u0027; e.g. accounts.google.com.provider; PS, all .conf,"},{"line_number":1172,"context_line":"#   .provider and .client jsons must be in the folder, even if you dont override any conf in the .conf json, you must leave it as an empty json \u0027{}\u0027);"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"b95e3048_db9f90cf","line":1169,"range":{"start_line":1169,"start_character":115,"end_line":1169,"end_character":124},"updated":"2021-02-14 20:31:10.000000000","message":"Keystone\n\nAlso, it would make sense to mention keystone_identity_mappings here instead of \"already exists\", no?","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":1166,"context_line":"# * protocol (the federated protocol used by the IdP; e.g. openid or saml);"},{"line_number":1167,"context_line":"# * identifier (the IdP identifier; e.g. https://accounts.google.com);"},{"line_number":1168,"context_line":"# * public_name (the public name that will be shown for users);"},{"line_number":1169,"context_line":"# * attribute_mapping (the attribute mapping to be used for this IdP. This mapping is expected to already exist in OpenStack.);"},{"line_number":1170,"context_line":"# * metadata_folder (folder containing all the identity provider metadata as jsons named as the identifier without the protocol"},{"line_number":1171,"context_line":"#   and with \u0027/\u0027 escaped as %2F followed with \u0027.provider\u0027 or \u0027.client\u0027 or \u0027.conf\u0027; e.g. accounts.google.com.provider; PS, all .conf,"},{"line_number":1172,"context_line":"#   .provider and .client jsons must be in the folder, even if you dont override any conf in the .conf json, you must leave it as an empty json \u0027{}\u0027);"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"2999de3c_bd3a2408","line":1169,"range":{"start_line":1169,"start_character":115,"end_line":1169,"end_character":124},"in_reply_to":"b95e3048_db9f90cf","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":1173,"context_line":"# * certificate_file (the path to the Identity Provider certificate file, the file must be named as \u0027certificate-key-id.pem\u0027;"},{"line_number":1174,"context_line":"#   e.g. LRVweuT51StjMdsna59jKfB3xw0r8Iz1d1J1HeAbmlw.pem; You can find the key-id in the Identity provider \u0027.well-known/openid-configuration\u0027 jwks_uri as kid);"},{"line_number":1175,"context_line":"#"},{"line_number":1176,"context_line":"# The IdPs meta information are to be presented to Kolla-ansible as the following example:"},{"line_number":1177,"context_line":"# keystone_identity_providers:"},{"line_number":1178,"context_line":"#   - name: \"myidp1\""},{"line_number":1179,"context_line":"#     openstack_domain: \"my-domain\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"516930fe_d059661a","line":1176,"range":{"start_line":1176,"start_character":57,"end_line":1176,"end_character":58},"updated":"2021-02-14 20:31:10.000000000","message":"A","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":1173,"context_line":"# * certificate_file (the path to the Identity Provider certificate file, the file must be named as \u0027certificate-key-id.pem\u0027;"},{"line_number":1174,"context_line":"#   e.g. LRVweuT51StjMdsna59jKfB3xw0r8Iz1d1J1HeAbmlw.pem; You can find the key-id in the Identity provider \u0027.well-known/openid-configuration\u0027 jwks_uri as kid);"},{"line_number":1175,"context_line":"#"},{"line_number":1176,"context_line":"# The IdPs meta information are to be presented to Kolla-ansible as the following example:"},{"line_number":1177,"context_line":"# keystone_identity_providers:"},{"line_number":1178,"context_line":"#   - name: \"myidp1\""},{"line_number":1179,"context_line":"#     openstack_domain: \"my-domain\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"eb44adb5_f0dbe1c9","line":1176,"range":{"start_line":1176,"start_character":57,"end_line":1176,"end_character":58},"in_reply_to":"516930fe_d059661a","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"c430f273da453003ffe3caec3059d5ad8eb890a1","unresolved":true,"context_lines":[{"line_number":1173,"context_line":"# * certificate_file (the path to the Identity Provider certificate file, the file must be named as \u0027certificate-key-id.pem\u0027;"},{"line_number":1174,"context_line":"#   e.g. LRVweuT51StjMdsna59jKfB3xw0r8Iz1d1J1HeAbmlw.pem; You can find the key-id in the Identity provider \u0027.well-known/openid-configuration\u0027 jwks_uri as kid);"},{"line_number":1175,"context_line":"#"},{"line_number":1176,"context_line":"# The IdPs meta information are to be presented to Kolla-Ansible as the following example:"},{"line_number":1177,"context_line":"# keystone_identity_providers:"},{"line_number":1178,"context_line":"#   - name: \"myidp1\""},{"line_number":1179,"context_line":"#     openstack_domain: \"my-domain\""}],"source_content_type":"text/x-yaml","patch_set":57,"id":"40a4b63b_108ee85a","line":1176,"range":{"start_line":1176,"start_character":56,"end_line":1176,"end_character":57},"updated":"2021-02-19 15:16:55.000000000","message":"I missed this dash. We should not have it but you can save it for a followup.","commit_id":"f3fbe837081546c5bfa194f1e8c89f5769b96d5a"}],"ansible/roles/haproxy-config/templates/haproxy_single_service_listen.cfg.j2":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":70,"context_line":"            {% else %}"},{"line_number":71,"context_line":"                {% set haproxy_health_check_final \u003d haproxy_health_check %}"},{"line_number":72,"context_line":"            {% endif %}"},{"line_number":73,"context_line":"            {% if service_name \u003d\u003d \u0027keystone\u0027 and haproxy_enable_federation_openid %}"},{"line_number":74,"context_line":"    balance source"},{"line_number":75,"context_line":"            {% endif %}"},{"line_number":76,"context_line":"            {% for host in groups[host_group] %}"},{"line_number":77,"context_line":"                {% set host_name \u003d hostvars[host][\u0027ansible_hostname\u0027] %}"},{"line_number":78,"context_line":"                {% set host_ip \u003d \u0027api\u0027 | kolla_address(host) %}"}],"source_content_type":"text/x-jinja2","patch_set":42,"id":"509f4c94_10779d50","line":75,"range":{"start_line":73,"start_character":0,"end_line":75,"end_character":23},"updated":"2021-01-06 14:13:26.000000000","message":"This should be done in the keystone role via frontend_http_extra (see glance role for an example).","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":70,"context_line":"            {% else %}"},{"line_number":71,"context_line":"                {% set haproxy_health_check_final \u003d haproxy_health_check %}"},{"line_number":72,"context_line":"            {% endif %}"},{"line_number":73,"context_line":"            {% if service_name \u003d\u003d \u0027keystone\u0027 and haproxy_enable_federation_openid %}"},{"line_number":74,"context_line":"    balance source"},{"line_number":75,"context_line":"            {% endif %}"},{"line_number":76,"context_line":"            {% for host in groups[host_group] %}"},{"line_number":77,"context_line":"                {% set host_name \u003d hostvars[host][\u0027ansible_hostname\u0027] %}"},{"line_number":78,"context_line":"                {% set host_ip \u003d \u0027api\u0027 | kolla_address(host) %}"}],"source_content_type":"text/x-jinja2","patch_set":42,"id":"d2a8b556_fd49f047","line":75,"range":{"start_line":73,"start_character":0,"end_line":75,"end_character":23},"in_reply_to":"509f4c94_10779d50","updated":"2021-01-06 19:05:13.000000000","message":"hmm, good to know, thanks.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"}],"ansible/roles/horizon/defaults/main.yml":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"d611b5edbcbda40d3db215154b0a20abfdb153b9","unresolved":true,"context_lines":[{"line_number":154,"context_line":"# In some cases, such as when using OIDC, horizon will need to be configured with Keystone\u0027s public URL."},{"line_number":155,"context_line":"# Therefore, instead of overriding the whole \"horizon_keystone_url\", this change allows an easier integration because"},{"line_number":156,"context_line":"# the Keystone public URL is already defined with variable \"keystone_public_url\"."},{"line_number":157,"context_line":"horizon_use_keystone_internal_url: True"}],"source_content_type":"text/x-yaml","patch_set":54,"id":"44df8747_4eab122f","line":157,"range":{"start_line":157,"start_character":0,"end_line":157,"end_character":33},"updated":"2021-02-10 15:47:09.000000000","message":"it would probably make more sense to have the inverse logic: default to not-public (\"...use...public...\" False by default)","commit_id":"91a903aeae947cb013897413dc18472fe905fd1a"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"4a5c35f5ea4d9f3712209c985cbc6a82bf528aa4","unresolved":true,"context_lines":[{"line_number":154,"context_line":"# In some cases, such as when using OIDC, horizon will need to be configured with Keystone\u0027s public URL."},{"line_number":155,"context_line":"# Therefore, instead of overriding the whole \"horizon_keystone_url\", this change allows an easier integration because"},{"line_number":156,"context_line":"# the Keystone public URL is already defined with variable \"keystone_public_url\"."},{"line_number":157,"context_line":"horizon_use_keystone_internal_url: True"}],"source_content_type":"text/x-yaml","patch_set":54,"id":"bc2699f1_9b4ae88f","line":157,"range":{"start_line":157,"start_character":0,"end_line":157,"end_character":33},"in_reply_to":"44df8747_4eab122f","updated":"2021-02-10 16:33:44.000000000","message":"hmm, ok, no problem, I will change it.\n\nThanks, 😊","commit_id":"91a903aeae947cb013897413dc18472fe905fd1a"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"c847928636724ea893fc7db74dda21172113a932","unresolved":true,"context_lines":[{"line_number":154,"context_line":"# In some cases, such as when using OIDC, horizon will need to be configured with Keystone\u0027s public URL."},{"line_number":155,"context_line":"# Therefore, instead of overriding the whole \"horizon_keystone_url\", this change allows an easier integration because"},{"line_number":156,"context_line":"# the Keystone public URL is already defined with variable \"keystone_public_url\"."},{"line_number":157,"context_line":"horizon_use_keystone_internal_url: True"}],"source_content_type":"text/x-yaml","patch_set":54,"id":"209d3196_f7c6e391","line":157,"range":{"start_line":157,"start_character":0,"end_line":157,"end_character":33},"in_reply_to":"bc2699f1_9b4ae88f","updated":"2021-02-10 19:04:48.000000000","message":"Thanks for such a quick reaction. I will be reviewing this patch more thoroughly later this week (likely weekend) as Mark used his wish points to make us do it (and I agree this patch is worth reviewing).","commit_id":"91a903aeae947cb013897413dc18472fe905fd1a"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":154,"context_line":"# In some cases, such as when using OIDC, horizon will need to be configured with Keystone\u0027s public URL."},{"line_number":155,"context_line":"# Therefore, instead of overriding the whole \"horizon_keystone_url\", this change allows an easier integration because"},{"line_number":156,"context_line":"# the Keystone public URL is already defined with variable \"keystone_public_url\"."},{"line_number":157,"context_line":"horizon_use_keystone_public_url: False"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"49cbbc50_0d5bc178","line":157,"range":{"start_line":157,"start_character":33,"end_line":157,"end_character":38},"updated":"2021-02-14 20:31:10.000000000","message":"would it make sense to default to enable_keystone_federation here... or perhaps the way it\u0027s done with haproxy_enable_federation_openid?","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"e4339dee1a7c0479c99bf33d97d1bfabe73cb7fd","unresolved":true,"context_lines":[{"line_number":154,"context_line":"# In some cases, such as when using OIDC, horizon will need to be configured with Keystone\u0027s public URL."},{"line_number":155,"context_line":"# Therefore, instead of overriding the whole \"horizon_keystone_url\", this change allows an easier integration because"},{"line_number":156,"context_line":"# the Keystone public URL is already defined with variable \"keystone_public_url\"."},{"line_number":157,"context_line":"horizon_use_keystone_public_url: False"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"82932598_60bb1805","line":157,"range":{"start_line":157,"start_character":33,"end_line":157,"end_character":38},"in_reply_to":"323a2602_eec90239","updated":"2021-02-15 11:40:10.000000000","message":"Yeah, I am not sure either.","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"27bcbcc9ac194251ee41e8347c57d199cb3d5e5a","unresolved":true,"context_lines":[{"line_number":154,"context_line":"# In some cases, such as when using OIDC, horizon will need to be configured with Keystone\u0027s public URL."},{"line_number":155,"context_line":"# Therefore, instead of overriding the whole \"horizon_keystone_url\", this change allows an easier integration because"},{"line_number":156,"context_line":"# the Keystone public URL is already defined with variable \"keystone_public_url\"."},{"line_number":157,"context_line":"horizon_use_keystone_public_url: False"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"323a2602_eec90239","line":157,"range":{"start_line":157,"start_character":33,"end_line":157,"end_character":38},"in_reply_to":"49cbbc50_0d5bc178","updated":"2021-02-15 11:30:15.000000000","message":"I may be wrong, but I don\u0027t think the two are completely coupled?","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":true,"context_lines":[{"line_number":154,"context_line":"# In some cases, such as when using OIDC, horizon will need to be configured with Keystone\u0027s public URL."},{"line_number":155,"context_line":"# Therefore, instead of overriding the whole \"horizon_keystone_url\", this change allows an easier integration because"},{"line_number":156,"context_line":"# the Keystone public URL is already defined with variable \"keystone_public_url\"."},{"line_number":157,"context_line":"horizon_use_keystone_public_url: False"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"e44ca766_d8a92f6f","line":157,"range":{"start_line":157,"start_character":33,"end_line":157,"end_character":38},"in_reply_to":"82932598_60bb1805","updated":"2021-02-15 20:09:04.000000000","message":"This change is not completely coupled with federation, we can set this one even if we do not use federation, this one is to facilitate to operator to decide if Horizon will communicate with Keystone via the public or internal URL that are already defined, instead of the operator rewrite the configuration (\"horizon_keystone_url\") that is already defined.","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"}],"ansible/roles/horizon/templates/local_settings.j2":[{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":229,"context_line":"#    (\"saml2\", _(\"Security Assertion Markup Language\")),"},{"line_number":230,"context_line":"#    (\"acme_oidc\", \"ACME - OpenID Connect\"),"},{"line_number":231,"context_line":"#    (\"acme_saml2\", \"ACME - SAML2\"),"},{"line_number":232,"context_line":"#)"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"# A dictionary of specific identity provider and federation protocol"},{"line_number":235,"context_line":"# combinations. From the selected authentication mechanism, the value"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"1fa4df85_e725350a","line":232,"updated":"2020-03-06 16:16:49.000000000","message":"Shouldn\u0027t that be removed then?","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":229,"context_line":"#    (\"saml2\", _(\"Security Assertion Markup Language\")),"},{"line_number":230,"context_line":"#    (\"acme_oidc\", \"ACME - OpenID Connect\"),"},{"line_number":231,"context_line":"#    (\"acme_saml2\", \"ACME - SAML2\"),"},{"line_number":232,"context_line":"#)"},{"line_number":233,"context_line":""},{"line_number":234,"context_line":"# A dictionary of specific identity provider and federation protocol"},{"line_number":235,"context_line":"# combinations. From the selected authentication mechanism, the value"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"1fa4df85_10b9e5ca","line":232,"in_reply_to":"1fa4df85_e725350a","updated":"2020-03-19 19:49:21.000000000","message":"Yes, you are right, removing it.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":241,"context_line":"#WEBSSO_IDP_MAPPING \u003d {"},{"line_number":242,"context_line":"#    \"acme_oidc\": (\"acme\", \"oidc\"),"},{"line_number":243,"context_line":"#    \"acme_saml2\": (\"acme\", \"saml2\"),"},{"line_number":244,"context_line":"#}"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"{% if identity_providers is defined and identity_providers | length \u003e 0 %}"},{"line_number":247,"context_line":"WEBSSO_ENABLED \u003d True"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"1fa4df85_a71bbdc7","line":244,"updated":"2020-03-06 16:16:49.000000000","message":"Dito.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":241,"context_line":"#WEBSSO_IDP_MAPPING \u003d {"},{"line_number":242,"context_line":"#    \"acme_oidc\": (\"acme\", \"oidc\"),"},{"line_number":243,"context_line":"#    \"acme_saml2\": (\"acme\", \"saml2\"),"},{"line_number":244,"context_line":"#}"},{"line_number":245,"context_line":""},{"line_number":246,"context_line":"{% if identity_providers is defined and identity_providers | length \u003e 0 %}"},{"line_number":247,"context_line":"WEBSSO_ENABLED \u003d True"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"1fa4df85_30be61b4","line":244,"in_reply_to":"1fa4df85_a71bbdc7","updated":"2020-03-19 19:49:21.000000000","message":"done","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":225,"context_line":"# and federation protocol combination (WEBSSO_IDP_MAPPING)."},{"line_number":226,"context_line":"{% if enable_keystone_federation | bool %}"},{"line_number":227,"context_line":"WEBSSO_ENABLED \u003d True"},{"line_number":228,"context_line":"WEBSSO_KEYSTONE_URL \u003d \"{{ keystone_public_url }}/v3\""},{"line_number":229,"context_line":"WEBSSO_CHOICES \u003d ("},{"line_number":230,"context_line":"    (\"credentials\", _(\"Keystone Credentials\")),"},{"line_number":231,"context_line":"    {% for idp in keystone_identity_providers %}"}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_b38b9c1c","line":228,"range":{"start_line":228,"start_character":26,"end_line":228,"end_character":45},"updated":"2020-09-15 15:45:43.000000000","message":"Not horizon_keystone_url?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":225,"context_line":"# and federation protocol combination (WEBSSO_IDP_MAPPING)."},{"line_number":226,"context_line":"{% if enable_keystone_federation | bool %}"},{"line_number":227,"context_line":"WEBSSO_ENABLED \u003d True"},{"line_number":228,"context_line":"WEBSSO_KEYSTONE_URL \u003d \"{{ keystone_public_url }}/v3\""},{"line_number":229,"context_line":"WEBSSO_CHOICES \u003d ("},{"line_number":230,"context_line":"    (\"credentials\", _(\"Keystone Credentials\")),"},{"line_number":231,"context_line":"    {% for idp in keystone_identity_providers %}"}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_e7fb8e12","line":228,"range":{"start_line":228,"start_character":26,"end_line":228,"end_character":45},"in_reply_to":"9f560f44_b38b9c1c","updated":"2020-10-02 19:55:50.000000000","message":"the WEBSSO is handled by the Apache OIDC auth plugin that is deployed aside the keystone, not the horizon, so we need to use the keystone url here.","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":224,"context_line":"# Note: The last two tuples are sample mapping keys to a identity provider"},{"line_number":225,"context_line":"# and federation protocol combination (WEBSSO_IDP_MAPPING)."},{"line_number":226,"context_line":"{% if enable_keystone_federation | bool %}"},{"line_number":227,"context_line":"WEBSSO_ENABLED \u003d True"},{"line_number":228,"context_line":"WEBSSO_KEYSTONE_URL \u003d \"{{ keystone_public_url }}/v3\""},{"line_number":229,"context_line":"WEBSSO_CHOICES \u003d ("},{"line_number":230,"context_line":"    (\"credentials\", _(\"Keystone Credentials\")),"}],"source_content_type":"text/x-jinja2","patch_set":42,"id":"6728a279_9688fe86","line":227,"range":{"start_line":227,"start_character":0,"end_line":227,"end_character":21},"updated":"2021-01-06 14:13:26.000000000","message":"Should it be moved to L213 to avoid confusion?","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":224,"context_line":"# Note: The last two tuples are sample mapping keys to a identity provider"},{"line_number":225,"context_line":"# and federation protocol combination (WEBSSO_IDP_MAPPING)."},{"line_number":226,"context_line":"{% if enable_keystone_federation | bool %}"},{"line_number":227,"context_line":"WEBSSO_ENABLED \u003d True"},{"line_number":228,"context_line":"WEBSSO_KEYSTONE_URL \u003d \"{{ keystone_public_url }}/v3\""},{"line_number":229,"context_line":"WEBSSO_CHOICES \u003d ("},{"line_number":230,"context_line":"    (\"credentials\", _(\"Keystone Credentials\")),"}],"source_content_type":"text/x-jinja2","patch_set":42,"id":"37051305_e9acd593","line":227,"range":{"start_line":227,"start_character":0,"end_line":227,"end_character":21},"in_reply_to":"6728a279_9688fe86","updated":"2021-01-06 19:05:13.000000000","message":"I will move it, thanks.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":225,"context_line":"# and federation protocol combination (WEBSSO_IDP_MAPPING)."},{"line_number":226,"context_line":"{% if enable_keystone_federation | bool %}"},{"line_number":227,"context_line":"WEBSSO_ENABLED \u003d True"},{"line_number":228,"context_line":"WEBSSO_KEYSTONE_URL \u003d \"{{ keystone_public_url }}/v3\""},{"line_number":229,"context_line":"WEBSSO_CHOICES \u003d ("},{"line_number":230,"context_line":"    (\"credentials\", _(\"Keystone Credentials\")),"},{"line_number":231,"context_line":"    {% for idp in keystone_identity_providers %}"}],"source_content_type":"text/x-jinja2","patch_set":42,"id":"21f99528_f1d6394d","line":228,"range":{"start_line":228,"start_character":26,"end_line":228,"end_character":45},"updated":"2021-01-06 14:13:26.000000000","message":"Should it use horizon_keystone_url?","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":225,"context_line":"# and federation protocol combination (WEBSSO_IDP_MAPPING)."},{"line_number":226,"context_line":"{% if enable_keystone_federation | bool %}"},{"line_number":227,"context_line":"WEBSSO_ENABLED \u003d True"},{"line_number":228,"context_line":"WEBSSO_KEYSTONE_URL \u003d \"{{ keystone_public_url }}/v3\""},{"line_number":229,"context_line":"WEBSSO_CHOICES \u003d ("},{"line_number":230,"context_line":"    (\"credentials\", _(\"Keystone Credentials\")),"},{"line_number":231,"context_line":"    {% for idp in keystone_identity_providers %}"}],"source_content_type":"text/x-jinja2","patch_set":42,"id":"c283ab55_4e8229b5","line":228,"range":{"start_line":228,"start_character":26,"end_line":228,"end_character":45},"in_reply_to":"21f99528_f1d6394d","updated":"2021-01-06 19:05:13.000000000","message":"This property must be an url reachable from the external network, this is the URL that the user will be redirect to start the OIDC authentication process though Keystone and Apache 2 OIDC plugin, so if the horizon uses the internal keystone url, the user will not be able to access it when authenticating.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":242,"context_line":"# NOTE: The value is expected to be a tuple formatted as: (\u003cidp_id\u003e, \u003cprotocol_id\u003e)."},{"line_number":243,"context_line":"WEBSSO_IDP_MAPPING \u003d {"},{"line_number":244,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":245,"context_line":"    \"{{ idp.name }}\": (\"{{ idp.name }}\", \"{{ idp.protocol }}\"),"},{"line_number":246,"context_line":"{% endfor %}"},{"line_number":247,"context_line":"}"},{"line_number":248,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":42,"id":"8d71f75b_c22dbb6a","line":245,"range":{"start_line":245,"start_character":31,"end_line":245,"end_character":35},"updated":"2021-01-06 14:13:26.000000000","message":"I guess we are forcing the Idp ID to be equal to the name here? This is not the case in the example:\n\n\"acme_oidc\": (\"acme\", \"oidc\"),","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":242,"context_line":"# NOTE: The value is expected to be a tuple formatted as: (\u003cidp_id\u003e, \u003cprotocol_id\u003e)."},{"line_number":243,"context_line":"WEBSSO_IDP_MAPPING \u003d {"},{"line_number":244,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":245,"context_line":"    \"{{ idp.name }}\": (\"{{ idp.name }}\", \"{{ idp.protocol }}\"),"},{"line_number":246,"context_line":"{% endfor %}"},{"line_number":247,"context_line":"}"},{"line_number":248,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":42,"id":"c8393d27_74ceb4d6","line":245,"range":{"start_line":245,"start_character":31,"end_line":245,"end_character":35},"in_reply_to":"8d71f75b_c22dbb6a","updated":"2021-01-06 19:05:13.000000000","message":"I will add a new attribute \"id\" on the IdP object.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":242,"context_line":"# NOTE: The value is expected to be a tuple formatted as: (\u003cidp_id\u003e, \u003cprotocol_id\u003e)."},{"line_number":243,"context_line":"WEBSSO_IDP_MAPPING \u003d {"},{"line_number":244,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":245,"context_line":"    \"{{ idp.name }}\": (\"{{ idp.name }}\", \"{{ idp.protocol }}\"),"},{"line_number":246,"context_line":"{% endfor %}"},{"line_number":247,"context_line":"}"},{"line_number":248,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":42,"id":"3c437bbc_289259d5","line":245,"range":{"start_line":245,"start_character":31,"end_line":245,"end_character":35},"in_reply_to":"c8393d27_74ceb4d6","updated":"2021-01-07 10:40:39.000000000","message":"I\u0027ve had a closer look at this. I think the key of this dictionary is purely in horizon, as a way to map items in WEBSSO_CHOICES to items in WEBSSO_IDP_MAPPING. The idp_id part needs to correspond to the name/ID used in keystone. So I suggest we remove the id field from keystone_identity_providers, and do this:\n\nWEBSSO_CHOICES \u003d (\n    (\"credentials\", _(\"Keystone Credentials\")),\n    {% for idp in keystone_identity_providers %}\n    (\"{{ idp.name }}_{{ idp.protocol }}\", \"{{ idp.public_name }}\"),\n    {% endfor %}\n)\n\n# A dictionary of specific identity provider and federation protocol\n# combinations. From the selected authentication mechanism, the value\n# will be looked up as keys in the dictionary. If a match is found,\n# it will redirect the user to a identity provider and federation protocol\n# specific WebSSO endpoint in keystone, otherwise it will use the value\n# as the protocol_id when redirecting to the WebSSO by protocol endpoint.\n# NOTE: The value is expected to be a tuple formatted as: (\u003cidp_id\u003e, \u003cprotocol_id\u003e).\nWEBSSO_IDP_MAPPING \u003d {\n{% for idp in keystone_identity_providers %}\n    \"{{ idp.name }}_{{ idp.protocol }}\": (\"{{ idp.name }}\", \"{{ idp.protocol }}\"),\n{% endfor %}","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":32842,"name":"Marc Schmitt","display_name":"Marc \u0027risson\u0027 Schmitt","email":"ubuntu@risson.space","username":"risson","status":"SRE @goauthentik\nI make packets go woosh"},"change_message_id":"005accab0b0ce8e28c7a1e350e07dd8aad4d7560","unresolved":true,"context_lines":[{"line_number":214,"context_line":"WEBSSO_ENABLED \u003d True"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"# Determines which authentication choice to show as default."},{"line_number":217,"context_line":"#WEBSSO_INITIAL_CHOICE \u003d \"credentials\""},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"# The list of authentication mechanisms which include keystone"},{"line_number":220,"context_line":"# federation protocols and identity provider/federation protocol"}],"source_content_type":"text/x-jinja2","patch_set":56,"id":"1a1a07ea_e77936ac","line":217,"updated":"2021-02-14 13:53:38.000000000","message":"It would be nice to be able to set this to a user provided value.","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":214,"context_line":"WEBSSO_ENABLED \u003d True"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"# Determines which authentication choice to show as default."},{"line_number":217,"context_line":"#WEBSSO_INITIAL_CHOICE \u003d \"credentials\""},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"# The list of authentication mechanisms which include keystone"},{"line_number":220,"context_line":"# federation protocols and identity provider/federation protocol"}],"source_content_type":"text/x-jinja2","patch_set":56,"id":"c2f17320_a544ea79","line":217,"in_reply_to":"18186852_1be77179","updated":"2021-02-15 20:09:04.000000000","message":"Ack","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":214,"context_line":"WEBSSO_ENABLED \u003d True"},{"line_number":215,"context_line":""},{"line_number":216,"context_line":"# Determines which authentication choice to show as default."},{"line_number":217,"context_line":"#WEBSSO_INITIAL_CHOICE \u003d \"credentials\""},{"line_number":218,"context_line":""},{"line_number":219,"context_line":"# The list of authentication mechanisms which include keystone"},{"line_number":220,"context_line":"# federation protocols and identity provider/federation protocol"}],"source_content_type":"text/x-jinja2","patch_set":56,"id":"18186852_1be77179","line":217,"in_reply_to":"1a1a07ea_e77936ac","updated":"2021-02-14 20:31:10.000000000","message":"It is possible with the regular overrides: https://docs.openstack.org/kolla-ansible/latest/reference/shared-services/horizon-guide.html","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"}],"ansible/roles/keystone/defaults/main.yml":[{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":143,"context_line":"      - {\u0027interface\u0027: \u0027public\u0027, \u0027url\u0027: \u0027{{ keystone_public_url }}\u0027}"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"####################"},{"line_number":147,"context_line":"# OpenStack identity federation"},{"line_number":148,"context_line":"####################"},{"line_number":149,"context_line":"# Default SAML remote attribute key"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_477c49eb","line":146,"updated":"2020-03-06 16:16:49.000000000","message":"Some more # ?","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":143,"context_line":"      - {\u0027interface\u0027: \u0027public\u0027, \u0027url\u0027: \u0027{{ keystone_public_url }}\u0027}"},{"line_number":144,"context_line":""},{"line_number":145,"context_line":""},{"line_number":146,"context_line":"####################"},{"line_number":147,"context_line":"# OpenStack identity federation"},{"line_number":148,"context_line":"####################"},{"line_number":149,"context_line":"# Default SAML remote attribute key"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_d0310d5b","line":146,"in_reply_to":"1fa4df85_477c49eb","updated":"2020-03-19 19:49:21.000000000","message":"done","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"####################"},{"line_number":147,"context_line":"# OpenStack identity federation"},{"line_number":148,"context_line":"####################"},{"line_number":149,"context_line":"# Default SAML remote attribute key"},{"line_number":150,"context_line":"remote_id_attribute_saml: \"Shib-Identity-Provider\""},{"line_number":151,"context_line":"# Default OpenID Connect remote attribute key"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_677f05e0","line":148,"updated":"2020-03-06 16:16:49.000000000","message":"Dito.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":145,"context_line":""},{"line_number":146,"context_line":"####################"},{"line_number":147,"context_line":"# OpenStack identity federation"},{"line_number":148,"context_line":"####################"},{"line_number":149,"context_line":"# Default SAML remote attribute key"},{"line_number":150,"context_line":"remote_id_attribute_saml: \"Shib-Identity-Provider\""},{"line_number":151,"context_line":"# Default OpenID Connect remote attribute key"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_903f1524","line":148,"in_reply_to":"1fa4df85_677f05e0","updated":"2020-03-19 19:49:21.000000000","message":"Done","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":29100,"name":"Jason Anderson","email":"jasonanderson@uchicago.edu","username":"jasonanderson"},"change_message_id":"7ab54788a94768a168b2aac2e00e0266c91c2c9c","unresolved":false,"context_lines":[{"line_number":150,"context_line":"remote_id_attribute_saml: \"Shib-Identity-Provider\""},{"line_number":151,"context_line":"# Default OpenID Connect remote attribute key"},{"line_number":152,"context_line":"remote_id_attribute_oidc: \"HTTP_OIDC_ISS\""},{"line_number":153,"context_line":"oidc_crypto_passphrase: \"OIDC_cryptographic_passphrase_that_you_must_change_in_production\""},{"line_number":154,"context_line":"container_keystone_federation_oidc_metadata_folder: \"/etc/apache2/metadata\""},{"line_number":155,"context_line":"container_keystone_federation_oidc_idp_certificate_folder: \"/etc/apache2/cert\""},{"line_number":156,"context_line":"host_keystone_federation_oidc_metadata_folder: \"{{ node_config_directory }}/keystone/metadata\""}],"source_content_type":"text/x-yaml","patch_set":17,"id":"3f4c43b2_c732c2f1","line":153,"updated":"2020-04-14 23:12:44.000000000","message":"In my experience, if this has a valid default value, nobody will change it :)\n\nSuggest removing it here and placing it in the passwords.yml template. That way, users who have generated passwords will have a nice random value, and users who have not will be given an error that this value is undefined.","commit_id":"63353bb54d36cf6e995781ffad4ef0b4f9ed4ec2"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"baf2dbe2d5cb641f3992ad0ea2c23fc818c129dd","unresolved":false,"context_lines":[{"line_number":150,"context_line":"remote_id_attribute_saml: \"Shib-Identity-Provider\""},{"line_number":151,"context_line":"# Default OpenID Connect remote attribute key"},{"line_number":152,"context_line":"remote_id_attribute_oidc: \"HTTP_OIDC_ISS\""},{"line_number":153,"context_line":"oidc_crypto_passphrase: \"OIDC_cryptographic_passphrase_that_you_must_change_in_production\""},{"line_number":154,"context_line":"container_keystone_federation_oidc_metadata_folder: \"/etc/apache2/metadata\""},{"line_number":155,"context_line":"container_keystone_federation_oidc_idp_certificate_folder: \"/etc/apache2/cert\""},{"line_number":156,"context_line":"host_keystone_federation_oidc_metadata_folder: \"{{ node_config_directory }}/keystone/metadata\""}],"source_content_type":"text/x-yaml","patch_set":17,"id":"3f4c43b2_f13687e7","line":153,"in_reply_to":"3f4c43b2_c732c2f1","updated":"2020-04-15 21:39:36.000000000","message":"Nice suggestion, I will apply it, thanks.","commit_id":"63353bb54d36cf6e995781ffad4ef0b4f9ed4ec2"},{"author":{"_account_id":19316,"name":"Eduardo Gonzalez","email":"dabarren@gmail.com","username":"egonzalez90"},"change_message_id":"f8a01f9c77d82dd70dcd5746138797daf64d0739","unresolved":false,"context_lines":[{"line_number":151,"context_line":"# Default OpenID Connect remote attribute key"},{"line_number":152,"context_line":"remote_id_attribute_oidc: \"HTTP_OIDC_ISS\""},{"line_number":153,"context_line":"oidc_crypto_passphrase: \"OIDC_cryptographic_passphrase_that_you_must_change_in_production\""},{"line_number":154,"context_line":"container_keystone_federation_oidc_metadata_folder: \"/etc/apache2/metadata\""},{"line_number":155,"context_line":"container_keystone_federation_oidc_idp_certificate_folder: \"/etc/apache2/cert\""},{"line_number":156,"context_line":"host_keystone_federation_oidc_metadata_folder: \"{{ node_config_directory }}/keystone/metadata\""},{"line_number":157,"context_line":"host_keystone_federation_oidc_idp_certificate_folder: \"{{ node_config_directory }}/keystone/cert\""}],"source_content_type":"text/x-yaml","patch_set":17,"id":"df33271e_1787c8d9","line":154,"range":{"start_line":154,"start_character":58,"end_line":154,"end_character":65},"updated":"2020-04-06 07:36:06.000000000","message":"apache2 folder does not exists on rhel based distros","commit_id":"63353bb54d36cf6e995781ffad4ef0b4f9ed4ec2"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"56e1ece7b64157e873a023576628e6f339148e81","unresolved":false,"context_lines":[{"line_number":151,"context_line":"# Default OpenID Connect remote attribute key"},{"line_number":152,"context_line":"remote_id_attribute_oidc: \"HTTP_OIDC_ISS\""},{"line_number":153,"context_line":"oidc_crypto_passphrase: \"OIDC_cryptographic_passphrase_that_you_must_change_in_production\""},{"line_number":154,"context_line":"container_keystone_federation_oidc_metadata_folder: \"/etc/apache2/metadata\""},{"line_number":155,"context_line":"container_keystone_federation_oidc_idp_certificate_folder: \"/etc/apache2/cert\""},{"line_number":156,"context_line":"host_keystone_federation_oidc_metadata_folder: \"{{ node_config_directory }}/keystone/metadata\""},{"line_number":157,"context_line":"host_keystone_federation_oidc_idp_certificate_folder: \"{{ node_config_directory }}/keystone/cert\""}],"source_content_type":"text/x-yaml","patch_set":17,"id":"df33271e_34059c7b","line":154,"range":{"start_line":154,"start_character":58,"end_line":154,"end_character":65},"in_reply_to":"df33271e_1787c8d9","updated":"2020-04-06 16:57:10.000000000","message":"Hello Eduardo.\n\nCould you check if this new patch solves this problem?","commit_id":"63353bb54d36cf6e995781ffad4ef0b4f9ed4ec2"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"37a6ce3787b95be3b5aacdf3e0e495aefb397d4b","unresolved":false,"context_lines":[{"line_number":163,"context_line":"container_keystone_federation_oidc_metadata_folder: \"{{ \u0027/etc/apache2/metadata\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/metadata\u0027 }}\""},{"line_number":164,"context_line":"container_keystone_federation_oidc_idp_certificate_folder: \"{{ \u0027/etc/apache2/cert\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/cert\u0027 }}\""},{"line_number":165,"context_line":"host_keystone_federation_oidc_metadata_folder: \"{{ node_config_directory }}/keystone/metadata\""},{"line_number":166,"context_line":"host_keystone_federation_oidc_idp_certificate_folder: \"{{ node_config_directory }}/keystone/cert\""},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":169,"context_line":"# horizon_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"}],"source_content_type":"text/x-yaml","patch_set":23,"id":"bf51134e_6f2bb581","line":166,"updated":"2020-06-17 19:18:01.000000000","message":"the above vars should ideally be prefixed with keystone_","commit_id":"0bbcbf4559a9f2365940a9523441b0b877f24e66"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"37a6ce3787b95be3b5aacdf3e0e495aefb397d4b","unresolved":false,"context_lines":[{"line_number":167,"context_line":""},{"line_number":168,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":169,"context_line":"# horizon_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":170,"context_line":"horizon_trusted_dashboards: [\"{{ public_protocol }}://{{kolla_external_fqdn}}/auth/websso/\"]"}],"source_content_type":"text/x-yaml","patch_set":23,"id":"bf51134e_8f28c986","line":170,"updated":"2020-06-17 19:18:01.000000000","message":"feels wrong to have it prefixed \"horizon\", I\u0027d go for using keystone_trusted_dashboards and have the contents empty if horizon is not enabled (as it is then no need to configure this)","commit_id":"0bbcbf4559a9f2365940a9523441b0b877f24e66"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":164,"context_line":"keystone_container_federation_oidc_idp_certificate_folder: \"{{ \u0027/etc/apache2/cert\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/cert\u0027 }}\""},{"line_number":165,"context_line":"keystone_host_federation_oidc_metadata_folder: \"{{ node_config_directory }}/keystone/metadata\""},{"line_number":166,"context_line":"keystone_host_federation_oidc_idp_certificate_folder: \"{{ node_config_directory }}/keystone/cert\""},{"line_number":167,"context_line":"keystone_wsgi_log_level: \"{{ \u0027debug\u0027 if keystone_logging_debug | bool else \u0027info\u0027 }}\""},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":170,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_b6d42a21","line":167,"updated":"2020-09-15 15:45:43.000000000","message":"Logic here is different to normal","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":164,"context_line":"keystone_container_federation_oidc_idp_certificate_folder: \"{{ \u0027/etc/apache2/cert\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/cert\u0027 }}\""},{"line_number":165,"context_line":"keystone_host_federation_oidc_metadata_folder: \"{{ node_config_directory }}/keystone/metadata\""},{"line_number":166,"context_line":"keystone_host_federation_oidc_idp_certificate_folder: \"{{ node_config_directory }}/keystone/cert\""},{"line_number":167,"context_line":"keystone_wsgi_log_level: \"{{ \u0027debug\u0027 if keystone_logging_debug | bool else \u0027info\u0027 }}\""},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":170,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_a7e35634","line":167,"in_reply_to":"9f560f44_b6d42a21","updated":"2020-10-02 19:55:50.000000000","message":"hmm, what do you suggest here to make this logic better?\n\nThis logic is normal to me, but another point of view is very welcome.\n\nthanks. :)","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":168,"context_line":""},{"line_number":169,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":170,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":171,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn)] if enable_horizon | bool else [] }}\""},{"line_number":172,"context_line":"keystone_enable_federation_openid: \"{{ keystone_identity_providers | default([]) | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":173,"context_line":"keystone_enable_federation_saml: \"{{ keystone_identity_providers | default([]) | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027saml\u0027) | list | count \u003e 0 }}\""}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_13afe87d","line":171,"updated":"2020-09-15 15:45:43.000000000","message":"Possibly need to add horizon_public_endpoint, similar to horizon_internal_endpoint.","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":169,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":170,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":171,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn)] if enable_horizon | bool else [] }}\""},{"line_number":172,"context_line":"keystone_enable_federation_openid: \"{{ keystone_identity_providers | default([]) | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":173,"context_line":"keystone_enable_federation_saml: \"{{ keystone_identity_providers | default([]) | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027saml\u0027) | list | count \u003e 0 }}\""}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_f3e874b4","line":172,"range":{"start_line":172,"start_character":67,"end_line":172,"end_character":80},"updated":"2020-09-15 15:45:43.000000000","message":"shouldn\u0027t be required as a default is defined.","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":169,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":170,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":171,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn)] if enable_horizon | bool else [] }}\""},{"line_number":172,"context_line":"keystone_enable_federation_openid: \"{{ keystone_identity_providers | default([]) | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":173,"context_line":"keystone_enable_federation_saml: \"{{ keystone_identity_providers | default([]) | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027saml\u0027) | list | count \u003e 0 }}\""}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_47f23ae5","line":172,"range":{"start_line":172,"start_character":67,"end_line":172,"end_character":80},"in_reply_to":"9f560f44_f3e874b4","updated":"2020-10-02 19:55:50.000000000","message":"you are right, nice catch.","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":170,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":171,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn)] if enable_horizon | bool else [] }}\""},{"line_number":172,"context_line":"keystone_enable_federation_openid: \"{{ keystone_identity_providers | default([]) | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":173,"context_line":"keystone_enable_federation_saml: \"{{ keystone_identity_providers | default([]) | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027saml\u0027) | list | count \u003e 0 }}\""}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_13e408e0","line":173,"range":{"start_line":173,"start_character":65,"end_line":173,"end_character":78},"updated":"2020-09-15 15:45:43.000000000","message":"ditto","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":170,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":171,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn)] if enable_horizon | bool else [] }}\""},{"line_number":172,"context_line":"keystone_enable_federation_openid: \"{{ keystone_identity_providers | default([]) | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":173,"context_line":"keystone_enable_federation_saml: \"{{ keystone_identity_providers | default([]) | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027saml\u0027) | list | count \u003e 0 }}\""}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_87fc52b6","line":173,"range":{"start_line":173,"start_character":65,"end_line":173,"end_character":78},"in_reply_to":"9f560f44_13e408e0","updated":"2020-10-02 19:55:50.000000000","message":"Done","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":156,"context_line":"###############################"},{"line_number":157,"context_line":"# OpenStack identity federation"},{"line_number":158,"context_line":"###############################"},{"line_number":159,"context_line":"# Default SAML remote attribute key"},{"line_number":160,"context_line":"keystone_remote_id_attribute_saml: \"Shib-Identity-Provider\""},{"line_number":161,"context_line":"# Default OpenID Connect remote attribute key"},{"line_number":162,"context_line":"keystone_remote_id_attribute_oidc: \"HTTP_OIDC_ISS\""},{"line_number":163,"context_line":"keystone_container_federation_oidc_metadata_folder: \"{{ \u0027/etc/apache2/metadata\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/metadata\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"ec9166b4_605bee08","line":160,"range":{"start_line":159,"start_character":0,"end_line":160,"end_character":59},"updated":"2021-01-06 14:13:26.000000000","message":"Not used","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":156,"context_line":"###############################"},{"line_number":157,"context_line":"# OpenStack identity federation"},{"line_number":158,"context_line":"###############################"},{"line_number":159,"context_line":"# Default SAML remote attribute key"},{"line_number":160,"context_line":"keystone_remote_id_attribute_saml: \"Shib-Identity-Provider\""},{"line_number":161,"context_line":"# Default OpenID Connect remote attribute key"},{"line_number":162,"context_line":"keystone_remote_id_attribute_oidc: \"HTTP_OIDC_ISS\""},{"line_number":163,"context_line":"keystone_container_federation_oidc_metadata_folder: \"{{ \u0027/etc/apache2/metadata\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/metadata\u0027 }}\""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"6d8f517f_fe2c6178","line":160,"range":{"start_line":159,"start_character":0,"end_line":160,"end_character":59},"in_reply_to":"ec9166b4_605bee08","updated":"2021-01-06 19:05:13.000000000","message":"yes, this should be added in the saml patch, I will remove it.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":162,"context_line":"keystone_remote_id_attribute_oidc: \"HTTP_OIDC_ISS\""},{"line_number":163,"context_line":"keystone_container_federation_oidc_metadata_folder: \"{{ \u0027/etc/apache2/metadata\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/metadata\u0027 }}\""},{"line_number":164,"context_line":"keystone_container_federation_oidc_idp_certificate_folder: \"{{ \u0027/etc/apache2/cert\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/cert\u0027 }}\""},{"line_number":165,"context_line":"keystone_host_federation_oidc_metadata_folder: \"{{ node_config_directory }}/keystone/metadata\""},{"line_number":166,"context_line":"keystone_host_federation_oidc_idp_certificate_folder: \"{{ node_config_directory }}/keystone/cert\""},{"line_number":167,"context_line":"keystone_wsgi_log_level: \"{{ \u0027debug\u0027 if keystone_logging_debug | bool else \u0027info\u0027 }}\""},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."}],"source_content_type":"text/x-yaml","patch_set":42,"id":"7f893f8a_0af35466","line":166,"range":{"start_line":165,"start_character":0,"end_line":166,"end_character":97},"updated":"2021-01-06 14:13:26.000000000","message":"These directories don\u0027t seem to be specific to openid. Does the variable name need to be more general?\n\nAlso, should the paths include federation and/or openid? e.g. keystone/federation/{metadata,cert}?","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":162,"context_line":"keystone_remote_id_attribute_oidc: \"HTTP_OIDC_ISS\""},{"line_number":163,"context_line":"keystone_container_federation_oidc_metadata_folder: \"{{ \u0027/etc/apache2/metadata\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/metadata\u0027 }}\""},{"line_number":164,"context_line":"keystone_container_federation_oidc_idp_certificate_folder: \"{{ \u0027/etc/apache2/cert\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/cert\u0027 }}\""},{"line_number":165,"context_line":"keystone_host_federation_oidc_metadata_folder: \"{{ node_config_directory }}/keystone/metadata\""},{"line_number":166,"context_line":"keystone_host_federation_oidc_idp_certificate_folder: \"{{ node_config_directory }}/keystone/cert\""},{"line_number":167,"context_line":"keystone_wsgi_log_level: \"{{ \u0027debug\u0027 if keystone_logging_debug | bool else \u0027info\u0027 }}\""},{"line_number":168,"context_line":""},{"line_number":169,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."}],"source_content_type":"text/x-yaml","patch_set":42,"id":"0516255d_0af34775","line":166,"range":{"start_line":165,"start_character":0,"end_line":166,"end_character":97},"in_reply_to":"7f893f8a_0af35466","updated":"2021-01-06 19:05:13.000000000","message":"nice, I will add both federation and openid (so we can also create in future a folder to saml)","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":169,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":170,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":171,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn), \u0027%s/auth/websso/\u0027 % (horizon_public_endpoint)] if enable_horizon | bool else [] }}\""},{"line_number":172,"context_line":"keystone_enable_federation_openid: \"{{ keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":173,"context_line":"keystone_enable_federation_saml: \"{{ keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027saml\u0027) | list | count \u003e 0 }}\""},{"line_number":174,"context_line":"keystone_should_remove_attribute_mappings: False"},{"line_number":175,"context_line":"keystone_should_remove_identity_providers: False"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"396e3189_5baf8035","line":172,"range":{"start_line":172,"start_character":0,"end_line":172,"end_character":33},"updated":"2021-01-06 14:13:26.000000000","message":"Should depend on enable_keystone_federation as well?","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":169,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":170,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":171,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn), \u0027%s/auth/websso/\u0027 % (horizon_public_endpoint)] if enable_horizon | bool else [] }}\""},{"line_number":172,"context_line":"keystone_enable_federation_openid: \"{{ keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":173,"context_line":"keystone_enable_federation_saml: \"{{ keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027saml\u0027) | list | count \u003e 0 }}\""},{"line_number":174,"context_line":"keystone_should_remove_attribute_mappings: False"},{"line_number":175,"context_line":"keystone_should_remove_identity_providers: False"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"d3fdf3b8_3f9c316e","line":172,"range":{"start_line":172,"start_character":0,"end_line":172,"end_character":33},"in_reply_to":"396e3189_5baf8035","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":170,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":171,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn), \u0027%s/auth/websso/\u0027 % (horizon_public_endpoint)] if enable_horizon | bool else [] }}\""},{"line_number":172,"context_line":"keystone_enable_federation_openid: \"{{ keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":173,"context_line":"keystone_enable_federation_saml: \"{{ keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027saml\u0027) | list | count \u003e 0 }}\""},{"line_number":174,"context_line":"keystone_should_remove_attribute_mappings: False"},{"line_number":175,"context_line":"keystone_should_remove_identity_providers: False"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"e32dfb15_7fa48209","line":173,"range":{"start_line":173,"start_character":0,"end_line":173,"end_character":129},"updated":"2021-01-06 14:13:26.000000000","message":"Not used","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":170,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":171,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn), \u0027%s/auth/websso/\u0027 % (horizon_public_endpoint)] if enable_horizon | bool else [] }}\""},{"line_number":172,"context_line":"keystone_enable_federation_openid: \"{{ keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":173,"context_line":"keystone_enable_federation_saml: \"{{ keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027saml\u0027) | list | count \u003e 0 }}\""},{"line_number":174,"context_line":"keystone_should_remove_attribute_mappings: False"},{"line_number":175,"context_line":"keystone_should_remove_identity_providers: False"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"849034eb_2740b441","line":173,"range":{"start_line":173,"start_character":0,"end_line":173,"end_character":129},"in_reply_to":"e32dfb15_7fa48209","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":27,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":28,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":29,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":30,"context_line":"        frontend_http_extra:"},{"line_number":31,"context_line":"          - \"balance source\""},{"line_number":32,"context_line":"      keystone_admin:"},{"line_number":33,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":34,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"afad0aba_2d78e612","line":31,"range":{"start_line":30,"start_character":0,"end_line":31,"end_character":28},"updated":"2021-01-07 10:40:39.000000000","message":"I think Michal pointed out that source might not be optimal. And if we\u0027re not using federation then no stickiness is necessary. Should we at least make this configurable?","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"919f01bd1945ee25ee9b97b6a506e12d51549243","unresolved":false,"context_lines":[{"line_number":27,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":28,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":29,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":30,"context_line":"        frontend_http_extra:"},{"line_number":31,"context_line":"          - \"balance source\""},{"line_number":32,"context_line":"      keystone_admin:"},{"line_number":33,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":34,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"b4aa1de1_1457ef67","line":31,"range":{"start_line":30,"start_character":0,"end_line":31,"end_character":28},"in_reply_to":"15ceb8eb_cb96bb39","updated":"2021-01-07 15:11:37.000000000","message":"There shouldn\u0027t be.","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":27,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":28,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":29,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":30,"context_line":"        frontend_http_extra:"},{"line_number":31,"context_line":"          - \"balance source\""},{"line_number":32,"context_line":"      keystone_admin:"},{"line_number":33,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":34,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"15ceb8eb_cb96bb39","line":31,"range":{"start_line":30,"start_character":0,"end_line":31,"end_character":28},"in_reply_to":"afad0aba_2d78e612","updated":"2021-01-07 14:30:07.000000000","message":"I created an optional list that will be empty if the keystone is not enabling federation, is there any problem if the \"frontend_http_extra\" receive an empty list?","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":36,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":37,"context_line":"        port: \"{{ keystone_admin_port }}\""},{"line_number":38,"context_line":"        listen_port: \"{{ keystone_admin_listen_port }}\""},{"line_number":39,"context_line":"        frontend_http_extra:"},{"line_number":40,"context_line":"          - \"balance source\""},{"line_number":41,"context_line":"  keystone-ssh:"},{"line_number":42,"context_line":"    container_name: \"keystone_ssh\""},{"line_number":43,"context_line":"    group: \"keystone\""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"ae0b74df_1800a853","line":40,"range":{"start_line":39,"start_character":8,"end_line":40,"end_character":28},"updated":"2021-01-07 10:40:39.000000000","message":"Not used by admin endpoint.","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":36,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":37,"context_line":"        port: \"{{ keystone_admin_port }}\""},{"line_number":38,"context_line":"        listen_port: \"{{ keystone_admin_listen_port }}\""},{"line_number":39,"context_line":"        frontend_http_extra:"},{"line_number":40,"context_line":"          - \"balance source\""},{"line_number":41,"context_line":"  keystone-ssh:"},{"line_number":42,"context_line":"    container_name: \"keystone_ssh\""},{"line_number":43,"context_line":"    group: \"keystone\""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"a700625c_9852783d","line":40,"range":{"start_line":39,"start_character":8,"end_line":40,"end_character":28},"in_reply_to":"ae0b74df_1800a853","updated":"2021-01-07 14:30:07.000000000","message":"ok, thanks","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":195,"context_line":"keystone_container_federation_oidc_idp_certificate_folder: \"{{ \u0027/etc/apache2/cert\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/cert\u0027 }}\""},{"line_number":196,"context_line":"keystone_host_federation_oidc_metadata_folder: \"{{ node_config_directory }}/keystone/federation/oidc/metadata\""},{"line_number":197,"context_line":"keystone_host_federation_oidc_idp_certificate_folder: \"{{ node_config_directory }}/keystone/federation/oidc/cert\""},{"line_number":198,"context_line":"keystone_wsgi_log_level: \"{{ \u0027debug\u0027 if keystone_logging_debug | bool else \u0027info\u0027 }}\""},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":201,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"eda2f4ac_a36ec01c","line":198,"range":{"start_line":198,"start_character":0,"end_line":198,"end_character":85},"updated":"2021-01-07 10:40:39.000000000","message":"Unused","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":195,"context_line":"keystone_container_federation_oidc_idp_certificate_folder: \"{{ \u0027/etc/apache2/cert\u0027 if kolla_base_distro in [\u0027debian\u0027, \u0027ubuntu\u0027] else \u0027/etc/httpd/cert\u0027 }}\""},{"line_number":196,"context_line":"keystone_host_federation_oidc_metadata_folder: \"{{ node_config_directory }}/keystone/federation/oidc/metadata\""},{"line_number":197,"context_line":"keystone_host_federation_oidc_idp_certificate_folder: \"{{ node_config_directory }}/keystone/federation/oidc/cert\""},{"line_number":198,"context_line":"keystone_wsgi_log_level: \"{{ \u0027debug\u0027 if keystone_logging_debug | bool else \u0027info\u0027 }}\""},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":201,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"baf71809_8802621e","line":198,"range":{"start_line":198,"start_character":0,"end_line":198,"end_character":85},"in_reply_to":"eda2f4ac_a36ec01c","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":200,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":201,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":202,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn), \u0027%s/auth/websso/\u0027 % (horizon_public_endpoint)] if enable_horizon | bool else [] }}\""},{"line_number":203,"context_line":"keystone_enable_federation_openid: \"{{ enable_keystone_federation and keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":204,"context_line":"keystone_should_remove_attribute_mappings: False"},{"line_number":205,"context_line":"keystone_should_remove_identity_providers: False"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"48265090_1b3370b3","line":203,"range":{"start_line":203,"start_character":39,"end_line":203,"end_character":65},"updated":"2021-01-07 10:40:39.000000000","message":"| bool","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":200,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":201,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":202,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn), \u0027%s/auth/websso/\u0027 % (horizon_public_endpoint)] if enable_horizon | bool else [] }}\""},{"line_number":203,"context_line":"keystone_enable_federation_openid: \"{{ enable_keystone_federation and keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":204,"context_line":"keystone_should_remove_attribute_mappings: False"},{"line_number":205,"context_line":"keystone_should_remove_identity_providers: False"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"d3b8b2cd_4e859775","line":203,"range":{"start_line":203,"start_character":39,"end_line":203,"end_character":65},"in_reply_to":"48265090_1b3370b3","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":32398,"name":"Gaël THEROND","display_name":"Fl1nt","email":"gael.therond@bitswalk.com","username":"Fl1nt"},"change_message_id":"c894df60e961b5fc52ed68772ef505c8d32b3375","unresolved":true,"context_lines":[{"line_number":194,"context_line":""},{"line_number":195,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":196,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":197,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn), \u0027%s/auth/websso/\u0027 % (horizon_public_endpoint)] if enable_horizon | bool else [] }}\""},{"line_number":198,"context_line":"keystone_enable_federation_openid: \"{{ enable_keystone_federation | bool and keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":199,"context_line":"keystone_should_remove_attribute_mappings: False"},{"line_number":200,"context_line":"keystone_should_remove_identity_providers: False"}],"source_content_type":"text/x-yaml","patch_set":45,"id":"ca5886a1_088d34fe","line":197,"updated":"2021-01-07 18:43:06.000000000","message":"Where does the horizon_public_endpoint variable is coming from?","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8f8f78fdef163eff1b87f44461c8084dd407534b","unresolved":true,"context_lines":[{"line_number":194,"context_line":""},{"line_number":195,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":196,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":197,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn), \u0027%s/auth/websso/\u0027 % (horizon_public_endpoint)] if enable_horizon | bool else [] }}\""},{"line_number":198,"context_line":"keystone_enable_federation_openid: \"{{ enable_keystone_federation | bool and keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""},{"line_number":199,"context_line":"keystone_should_remove_attribute_mappings: False"},{"line_number":200,"context_line":"keystone_should_remove_identity_providers: False"}],"source_content_type":"text/x-yaml","patch_set":45,"id":"2052d4db_8a7dea10","line":197,"in_reply_to":"ca5886a1_088d34fe","updated":"2021-01-08 19:42:40.000000000","message":"https://review.opendev.org/c/openstack/kolla-ansible/+/695432/45/ansible/group_vars/all.yml#1012","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":32842,"name":"Marc Schmitt","display_name":"Marc \u0027risson\u0027 Schmitt","email":"ubuntu@risson.space","username":"risson","status":"SRE @goauthentik\nI make packets go woosh"},"change_message_id":"f2cdad5b477face194c2e7e4b8dc01b68deaad60","unresolved":true,"context_lines":[{"line_number":18,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":19,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":20,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":21,"context_line":"        frontend_http_extra: \"{{ [\u0027balance source\u0027] if enable_keystone_federation | bool else [] }}\""},{"line_number":22,"context_line":"      keystone_external:"},{"line_number":23,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":24,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"70fb8c31_3c84172d","line":21,"updated":"2021-02-14 13:51:54.000000000","message":"This should be `backend_http_extra`, as, according to HAProxy\u0027s documentation[1], the `balance` keyword is only available for defaults, listen and backend sections.\n\n[1] http://cbonte.github.io/haproxy-dconv/2.4/configuration.html#4.1","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"27bcbcc9ac194251ee41e8347c57d199cb3d5e5a","unresolved":true,"context_lines":[{"line_number":18,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":19,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":20,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":21,"context_line":"        frontend_http_extra: \"{{ [\u0027balance source\u0027] if enable_keystone_federation | bool else [] }}\""},{"line_number":22,"context_line":"      keystone_external:"},{"line_number":23,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":24,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"748f6eff_1cc030b0","line":21,"in_reply_to":"0efca671_bd27e599","updated":"2021-02-15 11:30:15.000000000","message":"I think this seems to be the main point of contention in the review. Perhaps we could discuss it at the IRC meeting this week? I\u0027ve added it to the agenda, please let us know if you can\u0027t make it.\n\nhttps://wiki.openstack.org/wiki/Meetings/Kolla#Weekly_Kolla_team_meeting","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":18,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":19,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":20,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":21,"context_line":"        frontend_http_extra: \"{{ [\u0027balance source\u0027] if enable_keystone_federation | bool else [] }}\""},{"line_number":22,"context_line":"      keystone_external:"},{"line_number":23,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":24,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"0efca671_bd27e599","line":21,"in_reply_to":"70fb8c31_3c84172d","updated":"2021-02-14 20:31:10.000000000","message":"Seconded.\nAlso, I don\u0027t really follow why we need to \u0027balance source\u0027 keystone in such a case.","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":true,"context_lines":[{"line_number":18,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":19,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":20,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":21,"context_line":"        frontend_http_extra: \"{{ [\u0027balance source\u0027] if enable_keystone_federation | bool else [] }}\""},{"line_number":22,"context_line":"      keystone_external:"},{"line_number":23,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":24,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"d7043b92_5cd8e557","line":21,"in_reply_to":"748f6eff_1cc030b0","updated":"2021-02-15 20:09:04.000000000","message":"We need sticky sessions when using Federation cause when the mod WSGI OIDC in apache2 starts the authentication process, redirecting the user to the IdP and then retrieving the token from IdP and redirecting the user back to the Apache2 WSGI to validate the token and state/nonce, if the IdP response is not handled by the same host that started the authentication process, an Invalid state error is raised by the WSGI in Apache2 as the host has not generated any state/nonce","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":32842,"name":"Marc Schmitt","display_name":"Marc \u0027risson\u0027 Schmitt","email":"ubuntu@risson.space","username":"risson","status":"SRE @goauthentik\nI make packets go woosh"},"change_message_id":"f2cdad5b477face194c2e7e4b8dc01b68deaad60","unresolved":true,"context_lines":[{"line_number":26,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":27,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":28,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":29,"context_line":"        frontend_http_extra: \"{{ [\u0027balance source\u0027] if enable_keystone_federation | bool else [] }}\""},{"line_number":30,"context_line":"      keystone_admin:"},{"line_number":31,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":32,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"5161aa8a_29a87650","line":29,"updated":"2021-02-14 13:51:54.000000000","message":"Same as above, it should be `backend_http_extra`.","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":26,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":27,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":28,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":29,"context_line":"        frontend_http_extra: \"{{ [\u0027balance source\u0027] if enable_keystone_federation | bool else [] }}\""},{"line_number":30,"context_line":"      keystone_admin:"},{"line_number":31,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":32,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"1ef38add_b017a3d0","line":29,"in_reply_to":"5161aa8a_29a87650","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":194,"context_line":"keystone_host_federation_oidc_idp_certificate_folder: \"{{ node_config_directory }}/keystone/federation/oidc/cert\""},{"line_number":195,"context_line":"keystone_host_federation_oidc_attribute_mappings_folder: \"{{ node_config_directory }}/keystone/federation/oidc/attribute_maps\""},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":198,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":199,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn), \u0027%s/auth/websso/\u0027 % (horizon_public_endpoint)] if enable_horizon | bool else [] }}\""},{"line_number":200,"context_line":"keystone_enable_federation_openid: \"{{ enable_keystone_federation | bool and keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"b066d705_6e6316ac","line":197,"range":{"start_line":197,"start_character":2,"end_line":197,"end_character":19},"updated":"2021-02-14 20:31:10.000000000","message":"\"These variables are\"","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":194,"context_line":"keystone_host_federation_oidc_idp_certificate_folder: \"{{ node_config_directory }}/keystone/federation/oidc/cert\""},{"line_number":195,"context_line":"keystone_host_federation_oidc_attribute_mappings_folder: \"{{ node_config_directory }}/keystone/federation/oidc/attribute_maps\""},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"# This variables is used to define multiple trusted Horizon dashboards."},{"line_number":198,"context_line":"# keystone_trusted_dashboards: [\u0027\u003chttps://dashboardServerOne/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerTwo/auth/websso/\u003e\u0027, \u0027\u003chttps://dashboardServerN/auth/websso/\u003e\u0027]"},{"line_number":199,"context_line":"keystone_trusted_dashboards: \"{{ [\u0027%s://%s/auth/websso/\u0027 % (public_protocol, kolla_external_fqdn), \u0027%s/auth/websso/\u0027 % (horizon_public_endpoint)] if enable_horizon | bool else [] }}\""},{"line_number":200,"context_line":"keystone_enable_federation_openid: \"{{ enable_keystone_federation | bool and keystone_identity_providers | selectattr(\u0027protocol\u0027,\u0027equalto\u0027,\u0027openid\u0027) | list | count \u003e 0 }}\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"76cada36_87a49d1d","line":197,"range":{"start_line":197,"start_character":2,"end_line":197,"end_character":19},"in_reply_to":"b066d705_6e6316ac","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":32398,"name":"Gaël THEROND","display_name":"Fl1nt","email":"gael.therond@bitswalk.com","username":"Fl1nt"},"change_message_id":"f042b4feaa59d6c197bf99bbecc893b52fedc3ce","unresolved":true,"context_lines":[{"line_number":18,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":19,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":20,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":21,"context_line":"        backend_http_extra: \"{{ [\u0027balance source\u0027] if enable_keystone_federation | bool else [] }}\""},{"line_number":22,"context_line":"      keystone_external:"},{"line_number":23,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":24,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":57,"id":"c25bb20e_34f1cc30","line":21,"updated":"2021-02-15 20:44:31.000000000","message":"This part of making connections to keystone sticky is only required for external URLs as you can\u0027t get no-interactive connections from Openstack cli or sdk with oidc the way you could get it with ECP SAML2 (To my knowledge).\n\nThe only available scenario is if your internal network isn’t a vrf or a private non-routable network and so your admins/operators use that network to directly connect internally to the internal network the way services do it, which is a security concerns if not an issue.","commit_id":"f3fbe837081546c5bfa194f1e8c89f5769b96d5a"},{"author":{"_account_id":32398,"name":"Gaël THEROND","display_name":"Fl1nt","email":"gael.therond@bitswalk.com","username":"Fl1nt"},"change_message_id":"4da81393f4d6031c38084f8b280f80c665fd33b9","unresolved":true,"context_lines":[{"line_number":18,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":19,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":20,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":21,"context_line":"        backend_http_extra: \"{{ [\u0027balance source\u0027] if enable_keystone_federation | bool else [] }}\""},{"line_number":22,"context_line":"      keystone_external:"},{"line_number":23,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":24,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":57,"id":"91aef347_73c0f90f","line":21,"in_reply_to":"c25bb20e_34f1cc30","updated":"2021-02-15 20:47:51.000000000","message":"I obviously meant for « internal » usage. Sorry for the mistake.","commit_id":"f3fbe837081546c5bfa194f1e8c89f5769b96d5a"},{"author":{"_account_id":32398,"name":"Gaël THEROND","display_name":"Fl1nt","email":"gael.therond@bitswalk.com","username":"Fl1nt"},"change_message_id":"f042b4feaa59d6c197bf99bbecc893b52fedc3ce","unresolved":true,"context_lines":[{"line_number":26,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":27,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":28,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":29,"context_line":"        backend_http_extra: \"{{ [\u0027balance source\u0027] if enable_keystone_federation | bool else [] }}\""},{"line_number":30,"context_line":"      keystone_admin:"},{"line_number":31,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":32,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":57,"id":"ffa79d04_7207ba29","line":29,"updated":"2021-02-15 20:44:31.000000000","message":"As stated upper on previous patchset, balance source is performing full sticky sessions, meaning that if your node is down your user won’t be able to authenticate as HAProxy will consider the cookie as invalidating the eventual redirect to the remaining node. Additionally if your customer IP change (lease expiration etc, which us highly probable for client side desktop/laptop/phone) the session won’t be valid anymore and you’ll have to login again.\n\nIt would be better to use roundrobin or leastconn with a session cookie, that would let HAProxy to appropriately let you contact the correct backend if the node you were connecting from died or if the lease of your client expired.\n\nAdditionally, there is an optional extra option that can be used to be more deterministic on the way HAproxy is handling the backend chosen for your session which is: hash-type that can be set to many options such as consistent / map-based / sdbm, etc (see haproxy doc about that).\nWe use consistent on our side but that could be something up to the operators to choose.","commit_id":"f3fbe837081546c5bfa194f1e8c89f5769b96d5a"},{"author":{"_account_id":32398,"name":"Gaël THEROND","display_name":"Fl1nt","email":"gael.therond@bitswalk.com","username":"Fl1nt"},"change_message_id":"ba10b9877d48f4ce103801b00f83dbd56575e593","unresolved":true,"context_lines":[{"line_number":26,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":27,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":28,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":29,"context_line":"        backend_http_extra: \"{{ [\u0027balance source\u0027] if enable_keystone_federation | bool else [] }}\""},{"line_number":30,"context_line":"      keystone_admin:"},{"line_number":31,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":32,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":57,"id":"743a8434_801ecdbe","line":29,"in_reply_to":"2bd46333_f2f5e2d6","updated":"2021-02-16 12:03:22.000000000","message":"Good point! Yes it should be too.","commit_id":"f3fbe837081546c5bfa194f1e8c89f5769b96d5a"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"541f87be6f1f89f0fa77ece6d616507bb61e9621","unresolved":true,"context_lines":[{"line_number":26,"context_line":"        tls_backend: \"{{ keystone_enable_tls_backend }}\""},{"line_number":27,"context_line":"        port: \"{{ keystone_public_port }}\""},{"line_number":28,"context_line":"        listen_port: \"{{ keystone_public_listen_port }}\""},{"line_number":29,"context_line":"        backend_http_extra: \"{{ [\u0027balance source\u0027] if enable_keystone_federation | bool else [] }}\""},{"line_number":30,"context_line":"      keystone_admin:"},{"line_number":31,"context_line":"        enabled: \"{{ enable_keystone }}\""},{"line_number":32,"context_line":"        mode: \"http\""}],"source_content_type":"text/x-yaml","patch_set":57,"id":"2bd46333_f2f5e2d6","line":29,"in_reply_to":"ffa79d04_7207ba29","updated":"2021-02-16 11:14:50.000000000","message":"We use balance source without session cookie for horizon. Should that be changed as well?","commit_id":"f3fbe837081546c5bfa194f1e8c89f5769b96d5a"}],"ansible/roles/keystone/tasks/config-federation-oidc.yml":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"- name: Remove OpenID certificate and metadata files"},{"line_number":3,"context_line":"  vars:"},{"line_number":4,"context_line":"    keystone: \"{{ keystone_services[\u0027keystone\u0027] }}\""},{"line_number":5,"context_line":"  file:"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"456ea0e2_0004e091","line":2,"updated":"2021-01-07 10:40:39.000000000","message":"become: true","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"- name: Remove OpenID certificate and metadata files"},{"line_number":3,"context_line":"  vars:"},{"line_number":4,"context_line":"    keystone: \"{{ keystone_services[\u0027keystone\u0027] }}\""},{"line_number":5,"context_line":"  file:"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"ba37ee52_af79d248","line":2,"in_reply_to":"456ea0e2_0004e091","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":11,"context_line":"    - \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":12,"context_line":"    - \"{{ keystone_host_federation_oidc_idp_certificate_folder }}\""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"- name: Create OpenID configuration directories"},{"line_number":15,"context_line":"  file:"},{"line_number":16,"context_line":"    dest: \"{{ item }}\""},{"line_number":17,"context_line":"    state: \"directory\""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"74f81ea3_4f60a3d8","line":14,"updated":"2021-01-07 10:40:39.000000000","message":"Needed on every task:\n\n  vars:\n    keystone: \"{{ keystone_services[\u0027keystone\u0027] }}\"","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    - \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":12,"context_line":"    - \"{{ keystone_host_federation_oidc_idp_certificate_folder }}\""},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"- name: Create OpenID configuration directories"},{"line_number":15,"context_line":"  file:"},{"line_number":16,"context_line":"    dest: \"{{ item }}\""},{"line_number":17,"context_line":"    state: \"directory\""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"ed6b5159_b4dfc11b","line":14,"in_reply_to":"74f81ea3_4f60a3d8","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":21,"context_line":"    - \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":22,"context_line":"    - \"{{ keystone_host_federation_oidc_idp_certificate_folder }}\""},{"line_number":23,"context_line":"  when:"},{"line_number":24,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":25,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"- name: Copying OpenID Identity Providers metadata"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"90cb0927_25312288","line":24,"range":{"start_line":24,"start_character":0,"end_line":24,"end_character":46},"updated":"2021-01-07 10:40:39.000000000","message":"Not required anywhere in this file, due to conditional include.","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d8729d3bd89fbbfc17e79a90cfe7a837bd220c20","unresolved":true,"context_lines":[{"line_number":58,"context_line":"  become: true"},{"line_number":59,"context_line":"  copy:"},{"line_number":60,"context_line":"    src: \"{{ item.file }}\""},{"line_number":61,"context_line":"    dest: \"{{ keystone_host_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":62,"context_line":"    mode: \"0660\""},{"line_number":63,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":64,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"e6745ff1_d1de5392","line":61,"range":{"start_line":61,"start_character":70,"end_line":61,"end_character":74},"updated":"2021-01-08 15:30:46.000000000","message":"missing /","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d8729d3bd89fbbfc17e79a90cfe7a837bd220c20","unresolved":true,"context_lines":[{"line_number":58,"context_line":"  become: true"},{"line_number":59,"context_line":"  copy:"},{"line_number":60,"context_line":"    src: \"{{ item.file }}\""},{"line_number":61,"context_line":"    dest: \"{{ keystone_host_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":62,"context_line":"    mode: \"0660\""},{"line_number":63,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":64,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"7e6ca573_99514638","line":61,"range":{"start_line":61,"start_character":75,"end_line":61,"end_character":84},"updated":"2021-01-08 15:30:46.000000000","message":"| basename","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8f8f78fdef163eff1b87f44461c8084dd407534b","unresolved":false,"context_lines":[{"line_number":58,"context_line":"  become: true"},{"line_number":59,"context_line":"  copy:"},{"line_number":60,"context_line":"    src: \"{{ item.file }}\""},{"line_number":61,"context_line":"    dest: \"{{ keystone_host_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":62,"context_line":"    mode: \"0660\""},{"line_number":63,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":64,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"507de5a7_9be9b327","line":61,"range":{"start_line":61,"start_character":75,"end_line":61,"end_character":84},"in_reply_to":"7e6ca573_99514638","updated":"2021-01-08 19:42:40.000000000","message":"Done","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8f8f78fdef163eff1b87f44461c8084dd407534b","unresolved":false,"context_lines":[{"line_number":58,"context_line":"  become: true"},{"line_number":59,"context_line":"  copy:"},{"line_number":60,"context_line":"    src: \"{{ item.file }}\""},{"line_number":61,"context_line":"    dest: \"{{ keystone_host_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":62,"context_line":"    mode: \"0660\""},{"line_number":63,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":64,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"d31f62a4_c53216d5","line":61,"range":{"start_line":61,"start_character":70,"end_line":61,"end_character":74},"in_reply_to":"e6745ff1_d1de5392","updated":"2021-01-08 19:42:40.000000000","message":"Done","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":78,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"- name: Setting the certificates variable"},{"line_number":81,"context_line":"  become: true"},{"line_number":82,"context_line":"  vars:"},{"line_number":83,"context_line":"    keystone: \"{{ keystone_services[\u0027keystone\u0027] }}\""},{"line_number":84,"context_line":"  set_fact:"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"85f1f0c5_c725548d","line":81,"range":{"start_line":81,"start_character":2,"end_line":81,"end_character":14},"updated":"2021-02-14 20:31:10.000000000","message":"no need","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":78,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"- name: Setting the certificates variable"},{"line_number":81,"context_line":"  become: true"},{"line_number":82,"context_line":"  vars:"},{"line_number":83,"context_line":"    keystone: \"{{ keystone_services[\u0027keystone\u0027] }}\""},{"line_number":84,"context_line":"  set_fact:"}],"source_content_type":"text/x-yaml","patch_set":56,"id":"59fa51f6_0247cb5a","line":81,"range":{"start_line":81,"start_character":2,"end_line":81,"end_character":14},"in_reply_to":"85f1f0c5_c725548d","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"}],"ansible/roles/keystone/tasks/config.yml":[{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":14,"context_line":"  set_fact:"},{"line_number":15,"context_line":"    should_use_saml: \"{{ keystone_federated_protocol_saml_enabled is defined and keystone_federated_protocol_saml_enabled }}\""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"#############################################################################################################################################"},{"line_number":18,"context_line":"# Variable used to control the cleanup of attribute mappings that are in OpenStack, but not in Kolla-Ansible configuration files"},{"line_number":19,"context_line":"# For security reasons the default is set to False"},{"line_number":20,"context_line":"#############################################################################################################################################"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_c7583989","line":17,"updated":"2020-03-06 16:16:49.000000000","message":"The # are not needed here.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":14,"context_line":"  set_fact:"},{"line_number":15,"context_line":"    should_use_saml: \"{{ keystone_federated_protocol_saml_enabled is defined and keystone_federated_protocol_saml_enabled }}\""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"#############################################################################################################################################"},{"line_number":18,"context_line":"# Variable used to control the cleanup of attribute mappings that are in OpenStack, but not in Kolla-Ansible configuration files"},{"line_number":19,"context_line":"# For security reasons the default is set to False"},{"line_number":20,"context_line":"#############################################################################################################################################"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_107a45f0","line":17,"in_reply_to":"1fa4df85_c7583989","updated":"2020-03-19 19:49:21.000000000","message":"ok","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":15,"context_line":"    should_use_saml: \"{{ keystone_federated_protocol_saml_enabled is defined and keystone_federated_protocol_saml_enabled }}\""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"#############################################################################################################################################"},{"line_number":18,"context_line":"# Variable used to control the cleanup of attribute mappings that are in OpenStack, but not in Kolla-Ansible configuration files"},{"line_number":19,"context_line":"# For security reasons the default is set to False"},{"line_number":20,"context_line":"#############################################################################################################################################"},{"line_number":21,"context_line":"- set_fact: should_remove_attribute_mappings\u003dFalse"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_a7709d09","line":18,"updated":"2020-03-06 16:16:49.000000000","message":"we use the \"NOTE(xyz): bla\" format everywhere else.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":15,"context_line":"    should_use_saml: \"{{ keystone_federated_protocol_saml_enabled is defined and keystone_federated_protocol_saml_enabled }}\""},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"#############################################################################################################################################"},{"line_number":18,"context_line":"# Variable used to control the cleanup of attribute mappings that are in OpenStack, but not in Kolla-Ansible configuration files"},{"line_number":19,"context_line":"# For security reasons the default is set to False"},{"line_number":20,"context_line":"#############################################################################################################################################"},{"line_number":21,"context_line":"- set_fact: should_remove_attribute_mappings\u003dFalse"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_30c421f5","line":18,"in_reply_to":"1fa4df85_a7709d09","updated":"2020-03-19 19:49:21.000000000","message":"nice, thx","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":22,"context_line":"  when: should_remove_attribute_mappings is not defined"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"#############################################################################################################################################"},{"line_number":25,"context_line":"# Variable used to control the cleanup of identity providers that are integrated with OpenStack, but not in Kolla-Ansible configuration files"},{"line_number":26,"context_line":"# For security reasons the default is set to False"},{"line_number":27,"context_line":"#############################################################################################################################################"},{"line_number":28,"context_line":"- set_fact: should_remove_identity_providers\u003dFalse"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_47652945","line":25,"updated":"2020-03-06 16:16:49.000000000","message":"Dito.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":22,"context_line":"  when: should_remove_attribute_mappings is not defined"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"#############################################################################################################################################"},{"line_number":25,"context_line":"# Variable used to control the cleanup of identity providers that are integrated with OpenStack, but not in Kolla-Ansible configuration files"},{"line_number":26,"context_line":"# For security reasons the default is set to False"},{"line_number":27,"context_line":"#############################################################################################################################################"},{"line_number":28,"context_line":"- set_fact: should_remove_identity_providers\u003dFalse"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_f0b9a978","line":25,"in_reply_to":"1fa4df85_47652945","updated":"2020-03-19 19:49:21.000000000","message":"done","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":55,"context_line":"  notify:"},{"line_number":56,"context_line":"    - Restart {{ item.key }} container"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"- name: Remove all OpenID metadata and certificate files"},{"line_number":59,"context_line":"  file:"},{"line_number":60,"context_line":"    state: absent"},{"line_number":61,"context_line":"    path: \"{{ item }}\""},{"line_number":62,"context_line":"  with_items:"},{"line_number":63,"context_line":"    - \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":64,"context_line":"    - \"{{ keystone_host_federation_oidc_idp_certificate_folder }}\""},{"line_number":65,"context_line":"  when:"},{"line_number":66,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":67,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"- name: Create OpenID configuration directories"},{"line_number":70,"context_line":"  file:"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_96eda6f2","line":67,"range":{"start_line":58,"start_character":0,"end_line":67,"end_character":50},"updated":"2020-09-15 15:45:43.000000000","message":":( not idempotent","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":55,"context_line":"  notify:"},{"line_number":56,"context_line":"    - Restart {{ item.key }} container"},{"line_number":57,"context_line":""},{"line_number":58,"context_line":"- name: Remove all OpenID metadata and certificate files"},{"line_number":59,"context_line":"  file:"},{"line_number":60,"context_line":"    state: absent"},{"line_number":61,"context_line":"    path: \"{{ item }}\""},{"line_number":62,"context_line":"  with_items:"},{"line_number":63,"context_line":"    - \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":64,"context_line":"    - \"{{ keystone_host_federation_oidc_idp_certificate_folder }}\""},{"line_number":65,"context_line":"  when:"},{"line_number":66,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":67,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"- name: Create OpenID configuration directories"},{"line_number":70,"context_line":"  file:"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_fc6938f8","line":67,"range":{"start_line":58,"start_character":0,"end_line":67,"end_character":50},"in_reply_to":"9f560f44_96eda6f2","updated":"2020-10-02 19:55:50.000000000","message":"yea, I see","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    src: \"{{ item.metadata_folder }}/\""},{"line_number":86,"context_line":"    dest: \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":87,"context_line":"    mode: \"0660\""},{"line_number":88,"context_line":"  with_items: \"{{ identity_providers }}\""},{"line_number":89,"context_line":"  when:"},{"line_number":90,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":91,"context_line":"    - inventory_hostname in groups[keystone.group]"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_d6b8bee9","line":88,"range":{"start_line":88,"start_character":18,"end_line":88,"end_character":36},"updated":"2020-09-15 15:45:43.000000000","message":"keystone_","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":85,"context_line":"    src: \"{{ item.metadata_folder }}/\""},{"line_number":86,"context_line":"    dest: \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":87,"context_line":"    mode: \"0660\""},{"line_number":88,"context_line":"  with_items: \"{{ identity_providers }}\""},{"line_number":89,"context_line":"  when:"},{"line_number":90,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":91,"context_line":"    - inventory_hostname in groups[keystone.group]"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_bc48608a","line":88,"range":{"start_line":88,"start_character":18,"end_line":88,"end_character":36},"in_reply_to":"9f560f44_d6b8bee9","updated":"2020-10-02 19:55:50.000000000","message":"nice catch.","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":60,"context_line":"    state: absent"},{"line_number":61,"context_line":"    path: \"{{ keystone_host_federation_oidc_idp_certificate_folder }}\""},{"line_number":62,"context_line":"  when:"},{"line_number":63,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":64,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":65,"context_line":"    - keystone_host_federation_oidc_idp_certificate_folder is defined"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"83326acd_3f898655","line":63,"range":{"start_line":63,"start_character":4,"end_line":63,"end_character":46},"updated":"2021-01-06 14:13:26.000000000","message":"If you remove this line it will clean up when disabled.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":60,"context_line":"    state: absent"},{"line_number":61,"context_line":"    path: \"{{ keystone_host_federation_oidc_idp_certificate_folder }}\""},{"line_number":62,"context_line":"  when:"},{"line_number":63,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":64,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":65,"context_line":"    - keystone_host_federation_oidc_idp_certificate_folder is defined"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"3a4e35b5_ea860a76","line":63,"range":{"start_line":63,"start_character":4,"end_line":63,"end_character":46},"in_reply_to":"83326acd_3f898655","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":61,"context_line":"    path: \"{{ keystone_host_federation_oidc_idp_certificate_folder }}\""},{"line_number":62,"context_line":"  when:"},{"line_number":63,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":64,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":65,"context_line":"    - keystone_host_federation_oidc_idp_certificate_folder is defined"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"- name: Remove OpenID metadata files"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"41c91b4f_335d2bfa","line":64,"range":{"start_line":64,"start_character":35,"end_line":64,"end_character":49},"updated":"2021-01-06 14:13:26.000000000","message":"This is undefined","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":61,"context_line":"    path: \"{{ keystone_host_federation_oidc_idp_certificate_folder }}\""},{"line_number":62,"context_line":"  when:"},{"line_number":63,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":64,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":65,"context_line":"    - keystone_host_federation_oidc_idp_certificate_folder is defined"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"- name: Remove OpenID metadata files"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"a3e89aac_18f98ae9","line":64,"range":{"start_line":64,"start_character":35,"end_line":64,"end_character":49},"in_reply_to":"41c91b4f_335d2bfa","updated":"2021-01-06 19:05:13.000000000","message":"I didnt see that, thanks.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":62,"context_line":"  when:"},{"line_number":63,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":64,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":65,"context_line":"    - keystone_host_federation_oidc_idp_certificate_folder is defined"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"- name: Remove OpenID metadata files"},{"line_number":68,"context_line":"  file:"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"24b21d54_04ac0e6a","line":65,"range":{"start_line":65,"start_character":6,"end_line":65,"end_character":69},"updated":"2021-01-06 14:13:26.000000000","message":"Always true","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":62,"context_line":"  when:"},{"line_number":63,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":64,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":65,"context_line":"    - keystone_host_federation_oidc_idp_certificate_folder is defined"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"- name: Remove OpenID metadata files"},{"line_number":68,"context_line":"  file:"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"bf3de87e_0787df43","line":65,"range":{"start_line":65,"start_character":6,"end_line":65,"end_character":69},"in_reply_to":"24b21d54_04ac0e6a","updated":"2021-01-06 19:05:13.000000000","message":"I will remove it. thanks","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":69,"context_line":"    state: absent"},{"line_number":70,"context_line":"    path: \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":71,"context_line":"  when:"},{"line_number":72,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":73,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":74,"context_line":"    - keystone_host_federation_oidc_metadata_folder is defined"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"388a746b_87c25568","line":72,"range":{"start_line":72,"start_character":4,"end_line":72,"end_character":46},"updated":"2021-01-06 14:13:26.000000000","message":"ditto","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":69,"context_line":"    state: absent"},{"line_number":70,"context_line":"    path: \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":71,"context_line":"  when:"},{"line_number":72,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":73,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":74,"context_line":"    - keystone_host_federation_oidc_metadata_folder is defined"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"6f2e2074_af29a963","line":72,"range":{"start_line":72,"start_character":4,"end_line":72,"end_character":46},"in_reply_to":"388a746b_87c25568","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":70,"context_line":"    path: \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":71,"context_line":"  when:"},{"line_number":72,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":73,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":74,"context_line":"    - keystone_host_federation_oidc_metadata_folder is defined"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"- name: Create OpenID configuration directories"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"03d2d267_8743028e","line":73,"range":{"start_line":73,"start_character":35,"end_line":73,"end_character":49},"updated":"2021-01-06 14:13:26.000000000","message":"undefined","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":70,"context_line":"    path: \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":71,"context_line":"  when:"},{"line_number":72,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":73,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":74,"context_line":"    - keystone_host_federation_oidc_metadata_folder is defined"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"- name: Create OpenID configuration directories"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"6690c7f2_d31df82b","line":73,"range":{"start_line":73,"start_character":35,"end_line":73,"end_character":49},"in_reply_to":"03d2d267_8743028e","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":71,"context_line":"  when:"},{"line_number":72,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":73,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":74,"context_line":"    - keystone_host_federation_oidc_metadata_folder is defined"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"- name: Create OpenID configuration directories"},{"line_number":77,"context_line":"  file:"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"cd8e1149_e502ecfa","line":74,"range":{"start_line":74,"start_character":6,"end_line":74,"end_character":62},"updated":"2021-01-06 14:13:26.000000000","message":"Always true","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":71,"context_line":"  when:"},{"line_number":72,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":73,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":74,"context_line":"    - keystone_host_federation_oidc_metadata_folder is defined"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"- name: Create OpenID configuration directories"},{"line_number":77,"context_line":"  file:"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"3a4d48f1_4c9b3d00","line":74,"range":{"start_line":74,"start_character":6,"end_line":74,"end_character":62},"in_reply_to":"cd8e1149_e502ecfa","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":79,"context_line":"    state: \"directory\""},{"line_number":80,"context_line":"    mode: \"0770\""},{"line_number":81,"context_line":"  become: true"},{"line_number":82,"context_line":"  with_items:"},{"line_number":83,"context_line":"    - \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":84,"context_line":"    - \"{{ keystone_host_federation_oidc_idp_certificate_folder }}\""},{"line_number":85,"context_line":"  when:"},{"line_number":86,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":87,"context_line":"    - inventory_hostname in groups[keystone.group]"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"a9ce94cb_cd6d1c62","line":84,"range":{"start_line":82,"start_character":0,"end_line":84,"end_character":66},"updated":"2021-01-06 14:13:26.000000000","message":"Suggest using a similar loop when removing the directories.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    state: \"directory\""},{"line_number":80,"context_line":"    mode: \"0770\""},{"line_number":81,"context_line":"  become: true"},{"line_number":82,"context_line":"  with_items:"},{"line_number":83,"context_line":"    - \"{{ keystone_host_federation_oidc_metadata_folder }}\""},{"line_number":84,"context_line":"    - \"{{ keystone_host_federation_oidc_idp_certificate_folder }}\""},{"line_number":85,"context_line":"  when:"},{"line_number":86,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":87,"context_line":"    - inventory_hostname in groups[keystone.group]"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"72b40d45_f85b98b5","line":84,"range":{"start_line":82,"start_character":0,"end_line":84,"end_character":66},"in_reply_to":"a9ce94cb_cd6d1c62","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":86,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":87,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"- name: Copying Identity Providers metadata"},{"line_number":90,"context_line":"  become: true"},{"line_number":91,"context_line":"  copy:"},{"line_number":92,"context_line":"    src: \"{{ item.metadata_folder }}/\""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"12021846_34fe9a17","line":89,"updated":"2021-01-06 14:13:26.000000000","message":"openid","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":86,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":87,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"- name: Copying Identity Providers metadata"},{"line_number":90,"context_line":"  become: true"},{"line_number":91,"context_line":"  copy:"},{"line_number":92,"context_line":"    src: \"{{ item.metadata_folder }}/\""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"4e26bac9_5ab67157","line":89,"in_reply_to":"12021846_34fe9a17","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":95,"context_line":"  with_items: \"{{ keystone_identity_providers }}\""},{"line_number":96,"context_line":"  when:"},{"line_number":97,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":98,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"- name: Copying Identity Providers certificate"},{"line_number":101,"context_line":"  become: true"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"0065ac3b_ddb79436","line":98,"updated":"2021-01-06 14:13:26.000000000","message":"Does this also need to be conditional on item.protocol \u003d\u003d \u0027openid\u0027?","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":95,"context_line":"  with_items: \"{{ keystone_identity_providers }}\""},{"line_number":96,"context_line":"  when:"},{"line_number":97,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":98,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"- name: Copying Identity Providers certificate"},{"line_number":101,"context_line":"  become: true"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"3d810a25_c581884d","line":98,"in_reply_to":"0065ac3b_ddb79436","updated":"2021-01-06 19:05:13.000000000","message":"yes, you are correct, if there are many providers using different protocols, this is important, thanks.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":97,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":98,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"- name: Copying Identity Providers certificate"},{"line_number":101,"context_line":"  become: true"},{"line_number":102,"context_line":"  copy:"},{"line_number":103,"context_line":"    src: \"{{ item.certificate_file }}\""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"b3f0cf75_5ceeed31","line":100,"updated":"2021-01-06 14:13:26.000000000","message":"openid","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":97,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":98,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"- name: Copying Identity Providers certificate"},{"line_number":101,"context_line":"  become: true"},{"line_number":102,"context_line":"  copy:"},{"line_number":103,"context_line":"    src: \"{{ item.certificate_file }}\""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"2d4cad9a_6f6717a6","line":100,"in_reply_to":"b3f0cf75_5ceeed31","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":106,"context_line":"  with_items: \"{{ keystone_identity_providers }}\""},{"line_number":107,"context_line":"  when:"},{"line_number":108,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":109,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"- name: Setting the certificates files variable"},{"line_number":112,"context_line":"  find:"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"07a219ae_9f161f52","line":109,"updated":"2021-01-06 14:13:26.000000000","message":"ditto","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":106,"context_line":"  with_items: \"{{ keystone_identity_providers }}\""},{"line_number":107,"context_line":"  when:"},{"line_number":108,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":109,"context_line":"    - inventory_hostname in groups[keystone.group]"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"- name: Setting the certificates files variable"},{"line_number":112,"context_line":"  find:"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"0d3bcadd_ed9d7b96","line":109,"in_reply_to":"07a219ae_9f161f52","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"- name: Setting the certificates variable"},{"line_number":121,"context_line":"  set_fact:"},{"line_number":122,"context_line":"    certificate_key_ids: \"{{ certificates_path.files | map(attribute\u003d\u0027path\u0027) | map(\u0027regex_replace\u0027, \u0027^.*/(.*)\\\\.pem$\u0027, \u0027\\\\1#\u0027 + keystone_container_federation_oidc_idp_certificate_folder + \u0027/\\\\1.pem\u0027) | list }}\"  # noqa 204"},{"line_number":123,"context_line":"  when:"},{"line_number":124,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":125,"context_line":"    - inventory_hostname in groups[keystone.group]"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"ec3e1476_409b92c1","line":122,"range":{"start_line":122,"start_character":4,"end_line":122,"end_character":23},"updated":"2021-01-06 14:13:26.000000000","message":"keystone_federation_openid_certificate_key_ids?","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":119,"context_line":""},{"line_number":120,"context_line":"- name: Setting the certificates variable"},{"line_number":121,"context_line":"  set_fact:"},{"line_number":122,"context_line":"    certificate_key_ids: \"{{ certificates_path.files | map(attribute\u003d\u0027path\u0027) | map(\u0027regex_replace\u0027, \u0027^.*/(.*)\\\\.pem$\u0027, \u0027\\\\1#\u0027 + keystone_container_federation_oidc_idp_certificate_folder + \u0027/\\\\1.pem\u0027) | list }}\"  # noqa 204"},{"line_number":123,"context_line":"  when:"},{"line_number":124,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":125,"context_line":"    - inventory_hostname in groups[keystone.group]"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"5b356a08_44373fd0","line":122,"range":{"start_line":122,"start_character":4,"end_line":122,"end_character":23},"in_reply_to":"ec3e1476_409b92c1","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":312,"context_line":"    - keystone_ssh.enabled | bool"},{"line_number":313,"context_line":"  notify:"},{"line_number":314,"context_line":"    - Restart keystone-ssh container"},{"line_number":315,"context_line":""},{"line_number":316,"context_line":"- import_tasks: check-containers.yml"},{"line_number":317,"context_line":"  when: kolla_action !\u003d \"config\""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"20f11028_8b95fb81","line":315,"updated":"2021-01-06 14:13:26.000000000","message":"Please move to here, after the more general config. I would suggest putting all of the federation config in a new tasks file and conditionally including it.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":312,"context_line":"    - keystone_ssh.enabled | bool"},{"line_number":313,"context_line":"  notify:"},{"line_number":314,"context_line":"    - Restart keystone-ssh container"},{"line_number":315,"context_line":""},{"line_number":316,"context_line":"- import_tasks: check-containers.yml"},{"line_number":317,"context_line":"  when: kolla_action !\u003d \"config\""}],"source_content_type":"text/x-yaml","patch_set":42,"id":"5a38e815_d77df82c","line":315,"in_reply_to":"20f11028_8b95fb81","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"919f01bd1945ee25ee9b97b6a506e12d51549243","unresolved":true,"context_lines":[{"line_number":191,"context_line":"    - check_keystone_paste_ini.stat.exists"},{"line_number":192,"context_line":"  notify:"},{"line_number":193,"context_line":"    - Restart keystone container"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"- name: Generate the required cron jobs for the node"},{"line_number":196,"context_line":"  command: \u003e"},{"line_number":197,"context_line":"    {{ ansible_playbook_python }} {{ role_path }}/files/fernet_rotate_cron_generator.py"}],"source_content_type":"text/x-yaml","patch_set":45,"id":"064154c2_35758c96","line":194,"updated":"2021-01-07 15:11:37.000000000","message":"Please move the include to here. Typically we start with general config, then become more specific.","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"6ebb5465cfaba397ea4d8e85de627e3b2b0d1848","unresolved":false,"context_lines":[{"line_number":191,"context_line":"    - check_keystone_paste_ini.stat.exists"},{"line_number":192,"context_line":"  notify:"},{"line_number":193,"context_line":"    - Restart keystone container"},{"line_number":194,"context_line":""},{"line_number":195,"context_line":"- name: Generate the required cron jobs for the node"},{"line_number":196,"context_line":"  command: \u003e"},{"line_number":197,"context_line":"    {{ ansible_playbook_python }} {{ role_path }}/files/fernet_rotate_cron_generator.py"}],"source_content_type":"text/x-yaml","patch_set":45,"id":"1fe54ff7_d480d0cc","line":194,"in_reply_to":"064154c2_35758c96","updated":"2021-01-07 18:58:37.000000000","message":"Done","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"}],"ansible/roles/keystone/tasks/deploy.yml":[{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":16,"id":"1fa4df85_07d091c8","line":22,"updated":"2020-03-06 16:16:49.000000000","message":"when: identity_providers is defined ?","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":16,"id":"1fa4df85_4b19f077","line":22,"in_reply_to":"1fa4df85_07d091c8","updated":"2020-03-19 19:49:21.000000000","message":"nice check, thanks","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":29100,"name":"Jason Anderson","email":"jasonanderson@uchicago.edu","username":"jasonanderson"},"change_message_id":"a0ecc72e555d0b89acd70bd22c0a4d787d82511c","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"- import_tasks: check.yml"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"- import_tasks: register_identity_providers.yml"},{"line_number":22,"context_line":"  when:"},{"line_number":23,"context_line":"    - enable_keystone_federation | bool"}],"source_content_type":"text/x-yaml","patch_set":33,"id":"9f560f44_3bc68d9b","line":21,"updated":"2020-09-10 17:16:54.000000000","message":"This will only update identity providers and, more importantly, mappings, if you run with the \u0027deploy\u0027 task. I updated a mapping and ran a \u0027reconfigure\u0027 and expected that the mapping would get updated, but it was not. Should we make this run as part of the config task?","commit_id":"e4e657fd3d3fc28b883d5479ea474848a47f7b92"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"a4f9dc35feeabcac8ec957515f06a7660894a241","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"- import_tasks: check.yml"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"- import_tasks: register_identity_providers.yml"},{"line_number":22,"context_line":"  when:"},{"line_number":23,"context_line":"    - enable_keystone_federation | bool"}],"source_content_type":"text/x-yaml","patch_set":33,"id":"9f560f44_762bfc93","line":21,"in_reply_to":"9f560f44_3bc68d9b","updated":"2020-09-10 18:46:28.000000000","message":"Hi Jason, I do not get what you mean with that. The \u0027reconfigure\u0027 task is importing the \u0027deploy\u0027 task, so it should work for both, or am I missing something?","commit_id":"e4e657fd3d3fc28b883d5479ea474848a47f7b92"},{"author":{"_account_id":29100,"name":"Jason Anderson","email":"jasonanderson@uchicago.edu","username":"jasonanderson"},"change_message_id":"af34cfb93ccaea8c942fccb1ee3935520b038b29","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"- import_tasks: check.yml"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"- import_tasks: register_identity_providers.yml"},{"line_number":22,"context_line":"  when:"},{"line_number":23,"context_line":"    - enable_keystone_federation | bool"}],"source_content_type":"text/x-yaml","patch_set":33,"id":"9f560f44_2ae478df","line":21,"in_reply_to":"9f560f44_762bfc93","updated":"2020-09-10 19:07:30.000000000","message":"Ah, of course, you are right. In my testing, I now realize I was using the \u0027upgrade\u0027 task, not \u0027reconfigure\u0027. You are absolutely right that deploy \u003d\u003d reconfigure for the most part. Nevermind then!","commit_id":"e4e657fd3d3fc28b883d5479ea474848a47f7b92"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"- import_tasks: check.yml"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"- import_tasks: register_identity_providers.yml"},{"line_number":22,"context_line":"  when:"},{"line_number":23,"context_line":"    - enable_keystone_federation | bool"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_76a612ae","line":21,"range":{"start_line":21,"start_character":2,"end_line":21,"end_character":14},"updated":"2020-09-15 15:45:43.000000000","message":"better to use include_tasks here, since it\u0027s conditional","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"- import_tasks: check.yml"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"- import_tasks: register_identity_providers.yml"},{"line_number":22,"context_line":"  when:"},{"line_number":23,"context_line":"    - enable_keystone_federation | bool"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_7c56c82c","line":21,"range":{"start_line":21,"start_character":2,"end_line":21,"end_character":14},"in_reply_to":"9f560f44_76a612ae","updated":"2020-10-02 19:55:50.000000000","message":"done","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"- include_tasks: config-federation-oidc.yml"},{"line_number":3,"context_line":"  when:"},{"line_number":4,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"- import_tasks: config.yml"},{"line_number":7,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"2bf725c8_c726ebc0","line":4,"range":{"start_line":2,"start_character":0,"end_line":4,"end_character":46},"updated":"2021-01-07 10:40:39.000000000","message":"Move to config.yml.","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"- include_tasks: config-federation-oidc.yml"},{"line_number":3,"context_line":"  when:"},{"line_number":4,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"- import_tasks: config.yml"},{"line_number":7,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"1cd540c3_2957a1b2","line":4,"range":{"start_line":2,"start_character":0,"end_line":4,"end_character":46},"in_reply_to":"2bf725c8_c726ebc0","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"}],"ansible/roles/keystone/tasks/register_identity_providers.yml":[{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"02df8aa86e1c71f2daa354becad5e2ad5c861d3d","unresolved":false,"context_lines":[{"line_number":34,"context_line":"  with_items: \"{{configured_attribute_mappings.split(\u0027,\u0027)}}\""},{"line_number":35,"context_line":"  when: identity_providers_attribute_mappings is defined and should_remove_attribute_mappings and item not in identity_providers_attribute_mappings_names.split(\u0027,\u0027)"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":38,"context_line":"  local_action: shell openstack --os-auth-url\u003d{{ openstack_auth.auth_url }} --os-password\u003d{{ openstack_auth.password }} --os-username\u003d{{ openstack_auth.username }} --os-project-name\u003d{{ openstack_auth.project_name }} --os-identity-api-version\u003d{{ identity_api_version }} mapping create --rules \"{{item.file}}\" \"{{item.name}}\""},{"line_number":39,"context_line":"  run_once: True"},{"line_number":40,"context_line":"  when: identity_providers_attribute_mappings is defined and (identity_providers_attribute_mappings is not none) and (identity_providers_attribute_mappings | length \u003e 0) and item.name not in configured_attribute_mappings.split(\u0027,\u0027) "}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3fa7e38b_d27d511c","line":37,"updated":"2019-11-21 17:02:09.000000000","message":"I think that you should use \"delegate_to\", instead of \"local_action\"","commit_id":"b9f91a6c16039d3b2e69d48634858ed749feb2c0"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"6c37201e03cdd38b384cc4d363578d0023bf7949","unresolved":false,"context_lines":[{"line_number":34,"context_line":"  with_items: \"{{configured_attribute_mappings.split(\u0027,\u0027)}}\""},{"line_number":35,"context_line":"  when: identity_providers_attribute_mappings is defined and should_remove_attribute_mappings and item not in identity_providers_attribute_mappings_names.split(\u0027,\u0027)"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":38,"context_line":"  local_action: shell openstack --os-auth-url\u003d{{ openstack_auth.auth_url }} --os-password\u003d{{ openstack_auth.password }} --os-username\u003d{{ openstack_auth.username }} --os-project-name\u003d{{ openstack_auth.project_name }} --os-identity-api-version\u003d{{ identity_api_version }} mapping create --rules \"{{item.file}}\" \"{{item.name}}\""},{"line_number":39,"context_line":"  run_once: True"},{"line_number":40,"context_line":"  when: identity_providers_attribute_mappings is defined and (identity_providers_attribute_mappings is not none) and (identity_providers_attribute_mappings | length \u003e 0) and item.name not in configured_attribute_mappings.split(\u0027,\u0027) "}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3fa7e38b_0e2bbaea","line":37,"in_reply_to":"3fa7e38b_d27d511c","updated":"2019-11-22 12:27:11.000000000","message":"Done","commit_id":"b9f91a6c16039d3b2e69d48634858ed749feb2c0"},{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"02df8aa86e1c71f2daa354becad5e2ad5c861d3d","unresolved":false,"context_lines":[{"line_number":41,"context_line":"  with_items: \"{{identity_providers_attribute_mappings}}\""},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"- name: Update attribute mappings in OpenStack"},{"line_number":44,"context_line":"  local_action: shell openstack --os-auth-url\u003d{{ openstack_auth.auth_url }} --os-password\u003d{{ openstack_auth.password }} --os-username\u003d{{ openstack_auth.username }} --os-project-name\u003d{{ openstack_auth.project_name }} --os-identity-api-version\u003d{{ identity_api_version }} mapping set --rules \"{{item.file}}\" \"{{item.name}}\""},{"line_number":45,"context_line":"  run_once: True"},{"line_number":46,"context_line":"  when: identity_providers_attribute_mappings is defined and identity_providers_attribute_mappings is not none and (identity_providers_attribute_mappings | length \u003e 0) and item.name in configured_attribute_mappings.split(\u0027,\u0027) "},{"line_number":47,"context_line":"  with_items: \"{{identity_providers_attribute_mappings}}\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3fa7e38b_b2a3f59a","line":44,"updated":"2019-11-21 17:02:09.000000000","message":"Same here. It seems that using \"delegate_to\" is the accepted standard nowadays","commit_id":"b9f91a6c16039d3b2e69d48634858ed749feb2c0"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"6c37201e03cdd38b384cc4d363578d0023bf7949","unresolved":false,"context_lines":[{"line_number":41,"context_line":"  with_items: \"{{identity_providers_attribute_mappings}}\""},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"- name: Update attribute mappings in OpenStack"},{"line_number":44,"context_line":"  local_action: shell openstack --os-auth-url\u003d{{ openstack_auth.auth_url }} --os-password\u003d{{ openstack_auth.password }} --os-username\u003d{{ openstack_auth.username }} --os-project-name\u003d{{ openstack_auth.project_name }} --os-identity-api-version\u003d{{ identity_api_version }} mapping set --rules \"{{item.file}}\" \"{{item.name}}\""},{"line_number":45,"context_line":"  run_once: True"},{"line_number":46,"context_line":"  when: identity_providers_attribute_mappings is defined and identity_providers_attribute_mappings is not none and (identity_providers_attribute_mappings | length \u003e 0) and item.name in configured_attribute_mappings.split(\u0027,\u0027) "},{"line_number":47,"context_line":"  with_items: \"{{identity_providers_attribute_mappings}}\""}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3fa7e38b_2e2eb6f9","line":44,"in_reply_to":"3fa7e38b_b2a3f59a","updated":"2019-11-22 12:27:11.000000000","message":"Done","commit_id":"b9f91a6c16039d3b2e69d48634858ed749feb2c0"},{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"02df8aa86e1c71f2daa354becad5e2ad5c861d3d","unresolved":false,"context_lines":[{"line_number":120,"context_line":"###########################################################################################################"},{"line_number":121,"context_line":"# We must allow this task to \"fail\" because the OpenStack CLI is returning RC\u003d1 for sucessful executions. #"},{"line_number":122,"context_line":"###########################################################################################################"},{"line_number":123,"context_line":"- name: Update attribute mappings for each Identity Provider. (We expect the mappings to be configured by the operator)."},{"line_number":124,"context_line":"  shell: \u003e"},{"line_number":125,"context_line":"    docker exec -t keystone openstack \\"},{"line_number":126,"context_line":"    --os-auth-url\u003d{{ openstack_auth.auth_url }} \\"}],"source_content_type":"text/x-yaml","patch_set":2,"id":"3fa7e38b_32ff0567","line":123,"updated":"2019-11-21 17:02:09.000000000","message":"We should open a bug report for this one (if there is none)","commit_id":"b9f91a6c16039d3b2e69d48634858ed749feb2c0"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":139,"context_line":"  with_items: \"{{identity_providers}}\""},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"###########################################################################################################"},{"line_number":142,"context_line":"# We must allow this task to \"fail\" because the OpenStack CLI is returning RC\u003d1 for sucessful executions. #"},{"line_number":143,"context_line":"###########################################################################################################"},{"line_number":144,"context_line":"- name: Update attribute mappings for each Identity Provider. (We expect the mappings to be configured by the operator)."},{"line_number":145,"context_line":"  shell: \u003e"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_47f3e974","line":142,"updated":"2020-03-06 16:16:49.000000000","message":"NOTE(xyz): ...","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":139,"context_line":"  with_items: \"{{identity_providers}}\""},{"line_number":140,"context_line":""},{"line_number":141,"context_line":"###########################################################################################################"},{"line_number":142,"context_line":"# We must allow this task to \"fail\" because the OpenStack CLI is returning RC\u003d1 for sucessful executions. #"},{"line_number":143,"context_line":"###########################################################################################################"},{"line_number":144,"context_line":"- name: Update attribute mappings for each Identity Provider. (We expect the mappings to be configured by the operator)."},{"line_number":145,"context_line":"  shell: \u003e"}],"source_content_type":"text/x-yaml","patch_set":16,"id":"1fa4df85_4b47b04d","line":142,"in_reply_to":"1fa4df85_47f3e974","updated":"2020-03-19 19:49:21.000000000","message":"done","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"- name: List configured attribute mappings (that can be used by IdPs)"},{"line_number":3,"context_line":"  command: \u003e"},{"line_number":4,"context_line":"    docker exec -t keystone openstack \\"},{"line_number":5,"context_line":"      --os-auth-url\u003d{{ openstack_auth.auth_url }} \\"},{"line_number":6,"context_line":"      --os-password\u003d{{ openstack_auth.password }} \\"},{"line_number":7,"context_line":"      --os-username\u003d{{ openstack_auth.username }} \\"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_d6271e1e","line":4,"range":{"start_line":4,"start_character":38,"end_line":4,"end_character":39},"updated":"2020-09-15 15:45:43.000000000","message":"No need for backslashes with YAML \u003e","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"- name: List configured attribute mappings (that can be used by IdPs)"},{"line_number":3,"context_line":"  command: \u003e"},{"line_number":4,"context_line":"    docker exec -t keystone openstack \\"},{"line_number":5,"context_line":"      --os-auth-url\u003d{{ openstack_auth.auth_url }} \\"},{"line_number":6,"context_line":"      --os-password\u003d{{ openstack_auth.password }} \\"},{"line_number":7,"context_line":"      --os-username\u003d{{ openstack_auth.username }} \\"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_d77d2f6e","line":4,"range":{"start_line":4,"start_character":38,"end_line":4,"end_character":39},"in_reply_to":"9f560f44_d6271e1e","updated":"2020-10-02 19:55:50.000000000","message":"good to know, thanks","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":6,"context_line":"      --os-password\u003d{{ openstack_auth.password }} \\"},{"line_number":7,"context_line":"      --os-username\u003d{{ openstack_auth.username }} \\"},{"line_number":8,"context_line":"      --os-project-name\u003d{{ openstack_auth.project_name }} \\"},{"line_number":9,"context_line":"      --os-identity-api-version\u003d{{ identity_api_version }} \\"},{"line_number":10,"context_line":"    mapping list -c ID --format value"},{"line_number":11,"context_line":"  run_once: True"},{"line_number":12,"context_line":"  become: True"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_b68b8a1c","line":9,"updated":"2020-09-15 15:45:43.000000000","message":"do we need region, interface and CA certificate?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":7,"context_line":"      --os-username\u003d{{ openstack_auth.username }} \\"},{"line_number":8,"context_line":"      --os-project-name\u003d{{ openstack_auth.project_name }} \\"},{"line_number":9,"context_line":"      --os-identity-api-version\u003d{{ identity_api_version }} \\"},{"line_number":10,"context_line":"    mapping list -c ID --format value"},{"line_number":11,"context_line":"  run_once: True"},{"line_number":12,"context_line":"  become: True"},{"line_number":13,"context_line":"  register: existing_mappings_register"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_368e5a32","line":10,"range":{"start_line":10,"start_character":32,"end_line":10,"end_character":37},"updated":"2020-09-15 15:45:43.000000000","message":"json could be easier to work with, but don\u0027t mind either way","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"- name: Register existing mappings"},{"line_number":16,"context_line":"  set_fact:"},{"line_number":17,"context_line":"    existing_mappings: \"{{ existing_mappings_register.stdout.split(\u0027\\n\u0027) | map(\u0027trim\u0027) | list }}\""},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"- name: Remove unmanaged attribute mappings"},{"line_number":20,"context_line":"  command: \u003e"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_f69a2260","line":17,"range":{"start_line":17,"start_character":54,"end_line":17,"end_character":72},"updated":"2020-09-15 15:45:43.000000000","message":".stdout_lines?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":14,"context_line":""},{"line_number":15,"context_line":"- name: Register existing mappings"},{"line_number":16,"context_line":"  set_fact:"},{"line_number":17,"context_line":"    existing_mappings: \"{{ existing_mappings_register.stdout.split(\u0027\\n\u0027) | map(\u0027trim\u0027) | list }}\""},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"- name: Remove unmanaged attribute mappings"},{"line_number":20,"context_line":"  command: \u003e"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_57de3f6a","line":17,"range":{"start_line":17,"start_character":54,"end_line":17,"end_character":72},"in_reply_to":"9f560f44_f69a2260","updated":"2020-10-02 19:55:50.000000000","message":"nice","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  when:"},{"line_number":32,"context_line":"    - enable_keystone_federation | bool"},{"line_number":33,"context_line":"    - item not in (keystone_identity_mappings | map(attribute\u003d\u0027name\u0027) | list)"},{"line_number":34,"context_line":"    - should_remove_attribute_mappings | default(False)"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":37,"context_line":"  command: \u003e"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_d6ec3e94","line":34,"range":{"start_line":34,"start_character":39,"end_line":34,"end_character":55},"updated":"2020-09-15 15:45:43.000000000","message":"better to add to defaults?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  when:"},{"line_number":32,"context_line":"    - enable_keystone_federation | bool"},{"line_number":33,"context_line":"    - item not in (keystone_identity_mappings | map(attribute\u003d\u0027name\u0027) | list)"},{"line_number":34,"context_line":"    - should_remove_attribute_mappings | default(False)"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":37,"context_line":"  command: \u003e"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_d68b9e14","line":34,"range":{"start_line":34,"start_character":6,"end_line":34,"end_character":38},"updated":"2020-09-15 15:45:43.000000000","message":"keystone_?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":31,"context_line":"  when:"},{"line_number":32,"context_line":"    - enable_keystone_federation | bool"},{"line_number":33,"context_line":"    - item not in (keystone_identity_mappings | map(attribute\u003d\u0027name\u0027) | list)"},{"line_number":34,"context_line":"    - should_remove_attribute_mappings | default(False)"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":37,"context_line":"  command: \u003e"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_37474b21","line":34,"range":{"start_line":34,"start_character":6,"end_line":34,"end_character":38},"in_reply_to":"9f560f44_d68b9e14","updated":"2020-10-02 19:55:50.000000000","message":"yes, I agree","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":99,"context_line":"  when:"},{"line_number":100,"context_line":"    - enable_keystone_federation | bool"},{"line_number":101,"context_line":"    - item not in (keystone_identity_providers | map(attribute\u003d\u0027name\u0027) | list)"},{"line_number":102,"context_line":"    - should_remove_identity_providers | default(False)"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"- name: Register Identity Providers in OpenStack"},{"line_number":105,"context_line":"  command: \u003e"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_56d78ec1","line":102,"range":{"start_line":102,"start_character":6,"end_line":102,"end_character":38},"updated":"2020-09-15 15:45:43.000000000","message":"keystone_","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":172,"context_line":"    --mapping {{ item.attribute_mapping }} \\"},{"line_number":173,"context_line":"    {{ item.protocol }}"},{"line_number":174,"context_line":"  run_once: True"},{"line_number":175,"context_line":"  # NOTE(pem): We must allow this task to \"fail\" because the OpenStack CLI is"},{"line_number":176,"context_line":"  # returning RC\u003d1 for sucessful executions."},{"line_number":177,"context_line":"  ignore_errors: yes"},{"line_number":178,"context_line":"  become: true"},{"line_number":179,"context_line":"  when:"},{"line_number":180,"context_line":"    - enable_keystone_federation | bool"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_16b5167f","line":177,"range":{"start_line":175,"start_character":0,"end_line":177,"end_character":20},"updated":"2020-09-15 15:45:43.000000000","message":"It looks a bit cleaner in ansible output if you use failed_when: result.rc not in [0, 1]","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":172,"context_line":"    --mapping {{ item.attribute_mapping }} \\"},{"line_number":173,"context_line":"    {{ item.protocol }}"},{"line_number":174,"context_line":"  run_once: True"},{"line_number":175,"context_line":"  # NOTE(pem): We must allow this task to \"fail\" because the OpenStack CLI is"},{"line_number":176,"context_line":"  # returning RC\u003d1 for sucessful executions."},{"line_number":177,"context_line":"  ignore_errors: yes"},{"line_number":178,"context_line":"  become: true"},{"line_number":179,"context_line":"  when:"},{"line_number":180,"context_line":"    - enable_keystone_federation | bool"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_d7b52fef","line":177,"range":{"start_line":175,"start_character":0,"end_line":177,"end_character":20},"in_reply_to":"9f560f44_16b5167f","updated":"2020-10-02 19:55:50.000000000","message":"great suggestion, thanks :)","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"- name: List configured attribute mappings (that can be used by IdPs)"},{"line_number":3,"context_line":"  command: \u003e"},{"line_number":4,"context_line":"    docker exec -t keystone openstack"},{"line_number":5,"context_line":"      --os-auth-url\u003d{{ openstack_auth.auth_url }}"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"2a006c37_cf1492cc","line":2,"updated":"2021-01-06 14:13:26.000000000","message":"We might be able to use these when we have ansible 2.10: \n\nhttps://docs.ansible.com/ansible/2.10/collections/openstack/cloud/federation_mapping_module.html\nhttps://docs.ansible.com/ansible/2.10/collections/openstack/cloud/federation_idp_module.html\n\nThat could be a future improvement.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":6,"context_line":"      --os-password\u003d{{ openstack_auth.password }}"},{"line_number":7,"context_line":"      --os-username\u003d{{ openstack_auth.username }}"},{"line_number":8,"context_line":"      --os-project-name\u003d{{ openstack_auth.project_name }}"},{"line_number":9,"context_line":"      --os-identity-api-version\u003d{{ identity_api_version }}"},{"line_number":10,"context_line":"    mapping list -c ID --format value"},{"line_number":11,"context_line":"  run_once: True"},{"line_number":12,"context_line":"  become: True"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"0a5fc34a_52373063","line":9,"updated":"2021-01-06 14:13:26.000000000","message":"I expect all of these need a region, interface, and CA certificate to be specified, plus possibly a domain.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":6,"context_line":"      --os-password\u003d{{ openstack_auth.password }}"},{"line_number":7,"context_line":"      --os-username\u003d{{ openstack_auth.username }}"},{"line_number":8,"context_line":"      --os-project-name\u003d{{ openstack_auth.project_name }}"},{"line_number":9,"context_line":"      --os-identity-api-version\u003d{{ identity_api_version }}"},{"line_number":10,"context_line":"    mapping list -c ID --format value"},{"line_number":11,"context_line":"  run_once: True"},{"line_number":12,"context_line":"  become: True"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"e097cd98_edbff830","line":9,"in_reply_to":"0a5fc34a_52373063","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":48,"context_line":"    - enable_keystone_federation | bool"},{"line_number":49,"context_line":"    - item.name not in existing_mappings"},{"line_number":50,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":51,"context_line":"  delegate_to: localhost"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"- name: Update existing attribute mappings in OpenStack"},{"line_number":54,"context_line":"  command: \u003e"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"d9cbd446_387ac080","line":51,"range":{"start_line":51,"start_character":2,"end_line":51,"end_character":24},"updated":"2021-01-06 14:13:26.000000000","message":"Not required","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":48,"context_line":"    - enable_keystone_federation | bool"},{"line_number":49,"context_line":"    - item.name not in existing_mappings"},{"line_number":50,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":51,"context_line":"  delegate_to: localhost"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"- name: Update existing attribute mappings in OpenStack"},{"line_number":54,"context_line":"  command: \u003e"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"1ed601a3_0fd6fe07","line":51,"range":{"start_line":51,"start_character":2,"end_line":51,"end_character":24},"in_reply_to":"d9cbd446_387ac080","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":65,"context_line":"    - enable_keystone_federation | bool"},{"line_number":66,"context_line":"    - item.name in existing_mappings"},{"line_number":67,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":68,"context_line":"  delegate_to: localhost"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"- name: List configured IdPs"},{"line_number":71,"context_line":"  command: \u003e"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"98398b73_0816f27c","line":68,"range":{"start_line":68,"start_character":1,"end_line":68,"end_character":24},"updated":"2021-01-06 14:13:26.000000000","message":"Not required","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    - enable_keystone_federation | bool"},{"line_number":66,"context_line":"    - item.name in existing_mappings"},{"line_number":67,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":68,"context_line":"  delegate_to: localhost"},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"- name: List configured IdPs"},{"line_number":71,"context_line":"  command: \u003e"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"7f447f65_034023a4","line":68,"range":{"start_line":68,"start_character":1,"end_line":68,"end_character":24},"in_reply_to":"98398b73_0816f27c","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":112,"context_line":"    identity provider create"},{"line_number":113,"context_line":"    --description \"{{ item.public_name }}\""},{"line_number":114,"context_line":"    --remote-id \"{{ item.identifier }}\""},{"line_number":115,"context_line":"    --domain \"{{ item.name }}\""},{"line_number":116,"context_line":"    {{ item.name }}"},{"line_number":117,"context_line":"  run_once: True"},{"line_number":118,"context_line":"  become: true"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"29e1988c_3fc6d975","line":115,"range":{"start_line":115,"start_character":4,"end_line":115,"end_character":30},"updated":"2021-01-06 14:13:26.000000000","message":"Is this an openstack domain? Does it make sense to be the same as the name?","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":112,"context_line":"    identity provider create"},{"line_number":113,"context_line":"    --description \"{{ item.public_name }}\""},{"line_number":114,"context_line":"    --remote-id \"{{ item.identifier }}\""},{"line_number":115,"context_line":"    --domain \"{{ item.name }}\""},{"line_number":116,"context_line":"    {{ item.name }}"},{"line_number":117,"context_line":"  run_once: True"},{"line_number":118,"context_line":"  become: true"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"88d9844f_8b1c5ecd","line":115,"range":{"start_line":115,"start_character":4,"end_line":115,"end_character":30},"in_reply_to":"29e1988c_3fc6d975","updated":"2021-01-06 19:05:13.000000000","message":"yes it is, I will create a new property to handle this one.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":149,"context_line":"    --os-project-name\u003d{{ openstack_auth.project_name }}"},{"line_number":150,"context_line":"    --os-identity-api-version\u003d{{ identity_api_version }}"},{"line_number":151,"context_line":"    federation protocol create"},{"line_number":152,"context_line":"    --mapping {{ item.attribute_mapping }}"},{"line_number":153,"context_line":"    --identity-provider {{ item.name }}"},{"line_number":154,"context_line":"    {{ item.protocol }}"},{"line_number":155,"context_line":"  run_once: True"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"063d66ce_445127bd","line":152,"range":{"start_line":152,"start_character":22,"end_line":152,"end_character":39},"updated":"2021-01-06 14:13:26.000000000","message":"Would there always be exactly one?","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":149,"context_line":"    --os-project-name\u003d{{ openstack_auth.project_name }}"},{"line_number":150,"context_line":"    --os-identity-api-version\u003d{{ identity_api_version }}"},{"line_number":151,"context_line":"    federation protocol create"},{"line_number":152,"context_line":"    --mapping {{ item.attribute_mapping }}"},{"line_number":153,"context_line":"    --identity-provider {{ item.name }}"},{"line_number":154,"context_line":"    {{ item.protocol }}"},{"line_number":155,"context_line":"  run_once: True"}],"source_content_type":"text/x-yaml","patch_set":42,"id":"a6fbae9c_fb3af6a0","line":152,"range":{"start_line":152,"start_character":22,"end_line":152,"end_character":39},"in_reply_to":"063d66ce_445127bd","updated":"2021-01-06 19:05:13.000000000","message":"yes","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":39,"context_line":"  become: true"},{"line_number":40,"context_line":"  with_items: \"{{ existing_mappings }}\""},{"line_number":41,"context_line":"  when:"},{"line_number":42,"context_line":"    - enable_keystone_federation | bool"},{"line_number":43,"context_line":"    - item not in (keystone_identity_mappings | map(attribute\u003d\u0027name\u0027) | list)"},{"line_number":44,"context_line":"    - keystone_should_remove_attribute_mappings"},{"line_number":45,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"f4040bf1_1af5b560","line":42,"range":{"start_line":42,"start_character":4,"end_line":42,"end_character":39},"updated":"2021-01-07 10:40:39.000000000","message":"Not required on any task in this file due to conditional include.","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  become: true"},{"line_number":40,"context_line":"  with_items: \"{{ existing_mappings }}\""},{"line_number":41,"context_line":"  when:"},{"line_number":42,"context_line":"    - enable_keystone_federation | bool"},{"line_number":43,"context_line":"    - item not in (keystone_identity_mappings | map(attribute\u003d\u0027name\u0027) | list)"},{"line_number":44,"context_line":"    - keystone_should_remove_attribute_mappings"},{"line_number":45,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"52081e6c_3f4624cf","line":42,"range":{"start_line":42,"start_character":4,"end_line":42,"end_character":39},"in_reply_to":"f4040bf1_1af5b560","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":43,"context_line":"    - item not in (keystone_identity_mappings | map(attribute\u003d\u0027name\u0027) | list)"},{"line_number":44,"context_line":"    - keystone_should_remove_attribute_mappings"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":47,"context_line":"  command: \u003e"},{"line_number":48,"context_line":"    openstack --os-auth-url\u003d{{ openstack_auth.auth_url }}"},{"line_number":49,"context_line":"    --os-password\u003d{{ openstack_auth.password }}"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"caf9777d_6c656bb4","line":46,"updated":"2021-01-07 10:40:39.000000000","message":"become: true","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":43,"context_line":"    - item not in (keystone_identity_mappings | map(attribute\u003d\u0027name\u0027) | list)"},{"line_number":44,"context_line":"    - keystone_should_remove_attribute_mappings"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":47,"context_line":"  command: \u003e"},{"line_number":48,"context_line":"    openstack --os-auth-url\u003d{{ openstack_auth.auth_url }}"},{"line_number":49,"context_line":"    --os-password\u003d{{ openstack_auth.password }}"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"5f202b22_f5002509","line":46,"in_reply_to":"caf9777d_6c656bb4","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":64,"context_line":"    - item.name not in existing_mappings"},{"line_number":65,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"- name: Update existing attribute mappings in OpenStack"},{"line_number":68,"context_line":"  command: \u003e"},{"line_number":69,"context_line":"    openstack --os-auth-url\u003d{{ openstack_auth.auth_url }}"},{"line_number":70,"context_line":"    --os-password\u003d{{ openstack_auth.password }}"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"8532403a_ed40f9ad","line":67,"updated":"2021-01-07 10:40:39.000000000","message":"become: true","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":64,"context_line":"    - item.name not in existing_mappings"},{"line_number":65,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"- name: Update existing attribute mappings in OpenStack"},{"line_number":68,"context_line":"  command: \u003e"},{"line_number":69,"context_line":"    openstack --os-auth-url\u003d{{ openstack_auth.auth_url }}"},{"line_number":70,"context_line":"    --os-password\u003d{{ openstack_auth.password }}"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"0a9bf754_26803d97","line":67,"in_reply_to":"8532403a_ed40f9ad","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":85,"context_line":"    - item.name in existing_mappings"},{"line_number":86,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"- name: List configured IdPs"},{"line_number":89,"context_line":"  command: \u003e"},{"line_number":90,"context_line":"    docker exec -t keystone openstack"},{"line_number":91,"context_line":"    --os-auth-url\u003d{{ openstack_auth.auth_url }}"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"845a5d5a_35439204","line":88,"updated":"2021-01-07 10:40:39.000000000","message":"become: true","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":true,"context_lines":[{"line_number":85,"context_line":"    - item.name in existing_mappings"},{"line_number":86,"context_line":"  with_items: \"{{ keystone_identity_mappings }}\""},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"- name: List configured IdPs"},{"line_number":89,"context_line":"  command: \u003e"},{"line_number":90,"context_line":"    docker exec -t keystone openstack"},{"line_number":91,"context_line":"    --os-auth-url\u003d{{ openstack_auth.auth_url }}"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"4777df66_94d10b06","line":88,"in_reply_to":"845a5d5a_35439204","updated":"2021-01-07 14:30:07.000000000","message":"already have this key, I will move it after the key \u0027name\u0027","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":221,"context_line":"    {{ item.protocol }}"},{"line_number":222,"context_line":"  run_once: True"},{"line_number":223,"context_line":"  register: result"},{"line_number":224,"context_line":"  failed_when: result.rc not in [0, 1]"},{"line_number":225,"context_line":"  become: true"},{"line_number":226,"context_line":"  when:"},{"line_number":227,"context_line":"    - enable_keystone_federation | bool"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"abdba9ca_3b883f40","line":224,"range":{"start_line":224,"start_character":36,"end_line":224,"end_character":37},"updated":"2021-01-07 10:40:39.000000000","message":"What does 1 represent? Please add a comment.","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":221,"context_line":"    {{ item.protocol }}"},{"line_number":222,"context_line":"  run_once: True"},{"line_number":223,"context_line":"  register: result"},{"line_number":224,"context_line":"  failed_when: result.rc not in [0, 1]"},{"line_number":225,"context_line":"  become: true"},{"line_number":226,"context_line":"  when:"},{"line_number":227,"context_line":"    - enable_keystone_federation | bool"}],"source_content_type":"text/x-yaml","patch_set":44,"id":"4836c109_83a4f9e7","line":224,"range":{"start_line":224,"start_character":36,"end_line":224,"end_character":37},"in_reply_to":"abdba9ca_3b883f40","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"919f01bd1945ee25ee9b97b6a506e12d51549243","unresolved":true,"context_lines":[{"line_number":45,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":46,"context_line":"  become: true"},{"line_number":47,"context_line":"  command: \u003e"},{"line_number":48,"context_line":"    openstack --os-auth-url\u003d{{ openstack_auth.auth_url }}"},{"line_number":49,"context_line":"    --os-password\u003d{{ openstack_auth.password }}"},{"line_number":50,"context_line":"    --os-username\u003d{{ openstack_auth.username }}"},{"line_number":51,"context_line":"    --os-project-name\u003d{{ openstack_auth.project_name }}"}],"source_content_type":"text/x-yaml","patch_set":45,"id":"55ca0fe9_5021bec9","line":48,"range":{"start_line":48,"start_character":4,"end_line":48,"end_character":13},"updated":"2021-01-07 15:11:37.000000000","message":"Can\u0027t assume that the host has this installed. This is why we use docker exec. The mapping file will need to be accessible in the container.","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8f8f78fdef163eff1b87f44461c8084dd407534b","unresolved":true,"context_lines":[{"line_number":45,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":46,"context_line":"  become: true"},{"line_number":47,"context_line":"  command: \u003e"},{"line_number":48,"context_line":"    openstack --os-auth-url\u003d{{ openstack_auth.auth_url }}"},{"line_number":49,"context_line":"    --os-password\u003d{{ openstack_auth.password }}"},{"line_number":50,"context_line":"    --os-username\u003d{{ openstack_auth.username }}"},{"line_number":51,"context_line":"    --os-project-name\u003d{{ openstack_auth.project_name }}"}],"source_content_type":"text/x-yaml","patch_set":45,"id":"d7e4602c_cdd659a7","line":48,"range":{"start_line":48,"start_character":4,"end_line":48,"end_character":13},"in_reply_to":"0861e1e3_7df75df1","updated":"2021-01-08 19:42:40.000000000","message":"Fl1nt, how can we use this kolla-toolbox?","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":32398,"name":"Gaël THEROND","display_name":"Fl1nt","email":"gael.therond@bitswalk.com","username":"Fl1nt"},"change_message_id":"c60b547b1ed7af143c33707b6c3ab32bacc3aea6","unresolved":true,"context_lines":[{"line_number":45,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":46,"context_line":"  become: true"},{"line_number":47,"context_line":"  command: \u003e"},{"line_number":48,"context_line":"    openstack --os-auth-url\u003d{{ openstack_auth.auth_url }}"},{"line_number":49,"context_line":"    --os-password\u003d{{ openstack_auth.password }}"},{"line_number":50,"context_line":"    --os-username\u003d{{ openstack_auth.username }}"},{"line_number":51,"context_line":"    --os-project-name\u003d{{ openstack_auth.project_name }}"}],"source_content_type":"text/x-yaml","patch_set":45,"id":"3bf127ba_560edecd","line":48,"range":{"start_line":48,"start_character":4,"end_line":48,"end_character":13},"in_reply_to":"55ca0fe9_5021bec9","updated":"2021-01-07 18:46:17.000000000","message":"Can\u0027t we just use the kolla-toolbox?","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"6ebb5465cfaba397ea4d8e85de627e3b2b0d1848","unresolved":true,"context_lines":[{"line_number":45,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":46,"context_line":"  become: true"},{"line_number":47,"context_line":"  command: \u003e"},{"line_number":48,"context_line":"    openstack --os-auth-url\u003d{{ openstack_auth.auth_url }}"},{"line_number":49,"context_line":"    --os-password\u003d{{ openstack_auth.password }}"},{"line_number":50,"context_line":"    --os-username\u003d{{ openstack_auth.username }}"},{"line_number":51,"context_line":"    --os-project-name\u003d{{ openstack_auth.project_name }}"}],"source_content_type":"text/x-yaml","patch_set":45,"id":"0861e1e3_7df75df1","line":48,"range":{"start_line":48,"start_character":4,"end_line":48,"end_character":13},"in_reply_to":"55ca0fe9_5021bec9","updated":"2021-01-07 18:58:37.000000000","message":"Yes, I agree, I will change this","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"919f01bd1945ee25ee9b97b6a506e12d51549243","unresolved":true,"context_lines":[{"line_number":217,"context_line":"    {{ item.protocol }}"},{"line_number":218,"context_line":"  run_once: True"},{"line_number":219,"context_line":"  register: result"},{"line_number":220,"context_line":"  failed_when: result.rc not in [0, 1]  # This command returns RC 1 on success, so we need to add this to avoid fails."},{"line_number":221,"context_line":"  when:"},{"line_number":222,"context_line":"    - item.name in existing_idps"},{"line_number":223,"context_line":"  with_items: \"{{ keystone_identity_providers }}\""}],"source_content_type":"text/x-yaml","patch_set":45,"id":"7a3fd7ac_f54ed8b8","line":220,"updated":"2021-01-07 15:11:37.000000000","message":"Are you sure? That doesn\u0027t sound consistent with normal OSC usage.","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d8729d3bd89fbbfc17e79a90cfe7a837bd220c20","unresolved":true,"context_lines":[{"line_number":57,"context_line":"    --os-region-name {{ openstack_region_name }}"},{"line_number":58,"context_line":"    {% if openstack_cacert !\u003d \u0027\u0027 %}--os-cacert {{ openstack_cacert }}{% endif %}"},{"line_number":59,"context_line":"    mapping create"},{"line_number":60,"context_line":"    --rules \"{{ keystone_container_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":61,"context_line":"    {{ item.name }}"},{"line_number":62,"context_line":"  run_once: True"},{"line_number":63,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"ebf6b29d_a7ea96c6","line":60,"range":{"start_line":60,"start_character":82,"end_line":60,"end_character":91},"updated":"2021-01-08 15:30:46.000000000","message":"basename","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d8729d3bd89fbbfc17e79a90cfe7a837bd220c20","unresolved":true,"context_lines":[{"line_number":57,"context_line":"    --os-region-name {{ openstack_region_name }}"},{"line_number":58,"context_line":"    {% if openstack_cacert !\u003d \u0027\u0027 %}--os-cacert {{ openstack_cacert }}{% endif %}"},{"line_number":59,"context_line":"    mapping create"},{"line_number":60,"context_line":"    --rules \"{{ keystone_container_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":61,"context_line":"    {{ item.name }}"},{"line_number":62,"context_line":"  run_once: True"},{"line_number":63,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"c149f7ac_74ac626c","line":60,"range":{"start_line":60,"start_character":77,"end_line":60,"end_character":81},"updated":"2021-01-08 15:30:46.000000000","message":"missing /","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8f8f78fdef163eff1b87f44461c8084dd407534b","unresolved":false,"context_lines":[{"line_number":57,"context_line":"    --os-region-name {{ openstack_region_name }}"},{"line_number":58,"context_line":"    {% if openstack_cacert !\u003d \u0027\u0027 %}--os-cacert {{ openstack_cacert }}{% endif %}"},{"line_number":59,"context_line":"    mapping create"},{"line_number":60,"context_line":"    --rules \"{{ keystone_container_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":61,"context_line":"    {{ item.name }}"},{"line_number":62,"context_line":"  run_once: True"},{"line_number":63,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"3eb83664_372e75e1","line":60,"range":{"start_line":60,"start_character":77,"end_line":60,"end_character":81},"in_reply_to":"c149f7ac_74ac626c","updated":"2021-01-08 19:42:40.000000000","message":"Done","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8f8f78fdef163eff1b87f44461c8084dd407534b","unresolved":false,"context_lines":[{"line_number":57,"context_line":"    --os-region-name {{ openstack_region_name }}"},{"line_number":58,"context_line":"    {% if openstack_cacert !\u003d \u0027\u0027 %}--os-cacert {{ openstack_cacert }}{% endif %}"},{"line_number":59,"context_line":"    mapping create"},{"line_number":60,"context_line":"    --rules \"{{ keystone_container_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":61,"context_line":"    {{ item.name }}"},{"line_number":62,"context_line":"  run_once: True"},{"line_number":63,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"a9fb0075_628697b7","line":60,"range":{"start_line":60,"start_character":82,"end_line":60,"end_character":91},"in_reply_to":"ebf6b29d_a7ea96c6","updated":"2021-01-08 19:42:40.000000000","message":"Done","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d8729d3bd89fbbfc17e79a90cfe7a837bd220c20","unresolved":true,"context_lines":[{"line_number":79,"context_line":"    --os-region-name {{ openstack_region_name }}"},{"line_number":80,"context_line":"    {% if openstack_cacert !\u003d \u0027\u0027 %}--os-cacert {{ openstack_cacert }}{% endif %}"},{"line_number":81,"context_line":"    mapping set"},{"line_number":82,"context_line":"    --rules \"{{ keystone_container_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":83,"context_line":"    {{ item.name }}"},{"line_number":84,"context_line":"  run_once: True"},{"line_number":85,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"995edea0_574e8abb","line":82,"range":{"start_line":82,"start_character":82,"end_line":82,"end_character":91},"updated":"2021-01-08 15:30:46.000000000","message":"basename","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d8729d3bd89fbbfc17e79a90cfe7a837bd220c20","unresolved":true,"context_lines":[{"line_number":79,"context_line":"    --os-region-name {{ openstack_region_name }}"},{"line_number":80,"context_line":"    {% if openstack_cacert !\u003d \u0027\u0027 %}--os-cacert {{ openstack_cacert }}{% endif %}"},{"line_number":81,"context_line":"    mapping set"},{"line_number":82,"context_line":"    --rules \"{{ keystone_container_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":83,"context_line":"    {{ item.name }}"},{"line_number":84,"context_line":"  run_once: True"},{"line_number":85,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"4d4e369c_c5f6bef3","line":82,"range":{"start_line":82,"start_character":77,"end_line":82,"end_character":81},"updated":"2021-01-08 15:30:46.000000000","message":"missing /","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8f8f78fdef163eff1b87f44461c8084dd407534b","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    --os-region-name {{ openstack_region_name }}"},{"line_number":80,"context_line":"    {% if openstack_cacert !\u003d \u0027\u0027 %}--os-cacert {{ openstack_cacert }}{% endif %}"},{"line_number":81,"context_line":"    mapping set"},{"line_number":82,"context_line":"    --rules \"{{ keystone_container_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":83,"context_line":"    {{ item.name }}"},{"line_number":84,"context_line":"  run_once: True"},{"line_number":85,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"aace7d6a_22ca00b3","line":82,"range":{"start_line":82,"start_character":77,"end_line":82,"end_character":81},"in_reply_to":"4d4e369c_c5f6bef3","updated":"2021-01-08 19:42:40.000000000","message":"Done","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8f8f78fdef163eff1b87f44461c8084dd407534b","unresolved":false,"context_lines":[{"line_number":79,"context_line":"    --os-region-name {{ openstack_region_name }}"},{"line_number":80,"context_line":"    {% if openstack_cacert !\u003d \u0027\u0027 %}--os-cacert {{ openstack_cacert }}{% endif %}"},{"line_number":81,"context_line":"    mapping set"},{"line_number":82,"context_line":"    --rules \"{{ keystone_container_federation_oidc_attribute_mappings_folder }}{{ item.file }}\""},{"line_number":83,"context_line":"    {{ item.name }}"},{"line_number":84,"context_line":"  run_once: True"},{"line_number":85,"context_line":"  when:"}],"source_content_type":"text/x-yaml","patch_set":46,"id":"fdb1fe5c_0a84346a","line":82,"range":{"start_line":82,"start_character":82,"end_line":82,"end_character":91},"in_reply_to":"995edea0_574e8abb","updated":"2021-01-08 19:42:40.000000000","message":"Done","commit_id":"def96895b9cb504b05713b5bc39fcf4ed9ae411e"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"0e3cd90f3f2091de8ee8b733e63ee34265e64ef2","unresolved":true,"context_lines":[{"line_number":12,"context_line":"      --os-user-domain-name {{ openstack_auth.domain_name }}"},{"line_number":13,"context_line":"      --os-region-name {{ openstack_region_name }}"},{"line_number":14,"context_line":"      {% if openstack_cacert !\u003d \u0027\u0027 %}--os-cacert {{ openstack_cacert }}{% endif %}"},{"line_number":15,"context_line":"    mapping list -c ID --format value"},{"line_number":16,"context_line":"  run_once: True"},{"line_number":17,"context_line":"  become: True"},{"line_number":18,"context_line":"  register: existing_mappings_register"}],"source_content_type":"text/x-yaml","patch_set":48,"id":"8d553626_49783bb3","line":15,"updated":"2021-01-12 11:06:47.000000000","message":"Fails here: https://7b20e37606d3074ab147-e71ece6892bc6aab04da3c7d910f2295.ssl.cf5.rackcdn.com/769765/1/check/kolla-ansible-centos8-source/a1d3656/primary/logs/ansible/deploy","commit_id":"25e4e1d8cc3f4fc2007c9405074c17fa6368662d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"f8e097ae703f5645385ce6571f3b7690e56007ee","unresolved":true,"context_lines":[{"line_number":12,"context_line":"      --os-user-domain-name {{ openstack_auth.domain_name }}"},{"line_number":13,"context_line":"      --os-region-name {{ openstack_region_name }}"},{"line_number":14,"context_line":"      {% if openstack_cacert !\u003d \u0027\u0027 %}--os-cacert {{ openstack_cacert }}{% endif %}"},{"line_number":15,"context_line":"    mapping list -c ID --format value"},{"line_number":16,"context_line":"  run_once: True"},{"line_number":17,"context_line":"  become: True"},{"line_number":18,"context_line":"  register: existing_mappings_register"}],"source_content_type":"text/x-yaml","patch_set":48,"id":"af157d83_149d870f","line":15,"in_reply_to":"8d553626_49783bb3","updated":"2021-01-12 12:56:02.000000000","message":"I didn\u0027t get this error because I didn\u0027t configure the openstack_cacert. I set this variable and then I started getting the error, it was a missing \"blank space\", I added this one.\n\nThanks again Mark","commit_id":"25e4e1d8cc3f4fc2007c9405074c17fa6368662d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"6bfd718d9a14b64d48f345618875c0641e3f23dd","unresolved":true,"context_lines":[{"line_number":82,"context_line":"  run_once: True"},{"line_number":83,"context_line":"  when:"},{"line_number":84,"context_line":"    - item.openstack_domain not in existing_domains"},{"line_number":85,"context_line":"  with_items: \"{{ keystone_identity_providers }}\""},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"- name: Register attribute mappings in OpenStack"},{"line_number":88,"context_line":"  become: true"}],"source_content_type":"text/x-yaml","patch_set":50,"id":"fe445de7_f33dcf61","line":85,"updated":"2021-02-02 10:13:27.000000000","message":"Can we use kolla_toolbox with https://docs.ansible.com/ansible/2.9/modules/os_keystone_domain_module.html ?","commit_id":"ab0c09f440e7fa483e82c4c3daebbb8a6e570329"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":232,"context_line":"    {{ item.protocol }}"},{"line_number":233,"context_line":"  run_once: True"},{"line_number":234,"context_line":"  register: result"},{"line_number":235,"context_line":"  failed_when: result.rc not in [0, 1]  # This command returns RC 1 on success, so we need to add this to avoid fails."},{"line_number":236,"context_line":"  when:"},{"line_number":237,"context_line":"    - item.name in existing_idps"},{"line_number":238,"context_line":"  with_items: \"{{ keystone_identity_providers }}\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"d54ec582_8f94a78a","line":235,"range":{"start_line":235,"start_character":42,"end_line":235,"end_character":78},"updated":"2021-02-14 20:31:10.000000000","message":"doh, why","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"c430f273da453003ffe3caec3059d5ad8eb890a1","unresolved":true,"context_lines":[{"line_number":232,"context_line":"    {{ item.protocol }}"},{"line_number":233,"context_line":"  run_once: True"},{"line_number":234,"context_line":"  register: result"},{"line_number":235,"context_line":"  failed_when: result.rc not in [0, 1]  # This command returns RC 1 on success, so we need to add this to avoid fails."},{"line_number":236,"context_line":"  when:"},{"line_number":237,"context_line":"    - item.name in existing_idps"},{"line_number":238,"context_line":"  with_items: \"{{ keystone_identity_providers }}\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"2fba7b6c_3070503d","line":235,"range":{"start_line":235,"start_character":42,"end_line":235,"end_character":78},"in_reply_to":"5a31306c_87b58a14","updated":"2021-02-19 15:16:55.000000000","message":"This should really be fixed upstream.","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":true,"context_lines":[{"line_number":232,"context_line":"    {{ item.protocol }}"},{"line_number":233,"context_line":"  run_once: True"},{"line_number":234,"context_line":"  register: result"},{"line_number":235,"context_line":"  failed_when: result.rc not in [0, 1]  # This command returns RC 1 on success, so we need to add this to avoid fails."},{"line_number":236,"context_line":"  when:"},{"line_number":237,"context_line":"    - item.name in existing_idps"},{"line_number":238,"context_line":"  with_items: \"{{ keystone_identity_providers }}\""}],"source_content_type":"text/x-yaml","patch_set":56,"id":"5a31306c_87b58a14","line":235,"range":{"start_line":235,"start_character":42,"end_line":235,"end_character":78},"in_reply_to":"d54ec582_8f94a78a","updated":"2021-02-15 20:09:04.000000000","message":"I don know why hehe, but it is what happens when using it in the OpenStack CLI, you can try if you want.\n\nroot@test-env:~# openstack federation protocol set --identity-provider idp_test --mapping attribute_mapping_keycloak_idp_test openid\n\u003czip object at 0x7f4530f61c88\u003e\nroot@test-env:~# echo $?\n1\nroot@test-env:~#","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"}],"ansible/roles/keystone/tasks/upgrade.yml":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"- include_tasks: config-federation-oidc.yml"},{"line_number":3,"context_line":"  when:"},{"line_number":4,"context_line":"    - keystone_enable_federation_openid | bool"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"- import_tasks: config.yml"},{"line_number":7,"context_line":""}],"source_content_type":"text/x-yaml","patch_set":44,"id":"3bd65cde_be6efe2c","line":4,"range":{"start_line":2,"start_character":0,"end_line":4,"end_character":46},"updated":"2021-01-07 10:40:39.000000000","message":"config.yml","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"}],"ansible/roles/keystone/templates/create_oidc_idp_metadata_and_certificate_files.py.j2":[{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"02df8aa86e1c71f2daa354becad5e2ad5c861d3d","unresolved":false,"context_lines":[{"line_number":1,"context_line":"import json"},{"line_number":2,"context_line":"import re"},{"line_number":3,"context_line":"import requests"},{"line_number":4,"context_line":"import sys"}],"source_content_type":"text/x-jinja2","patch_set":2,"id":"3fa7e38b_527961f9","line":1,"updated":"2019-11-21 17:02:09.000000000","message":"I think that you are missing the headers here with the license","commit_id":"b9f91a6c16039d3b2e69d48634858ed749feb2c0"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"6c37201e03cdd38b384cc4d363578d0023bf7949","unresolved":false,"context_lines":[{"line_number":1,"context_line":"import json"},{"line_number":2,"context_line":"import re"},{"line_number":3,"context_line":"import requests"},{"line_number":4,"context_line":"import sys"}],"source_content_type":"text/x-jinja2","patch_set":2,"id":"3fa7e38b_aef4e687","line":1,"in_reply_to":"3fa7e38b_527961f9","updated":"2019-11-22 12:27:11.000000000","message":"Done","commit_id":"b9f91a6c16039d3b2e69d48634858ed749feb2c0"},{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"02df8aa86e1c71f2daa354becad5e2ad5c861d3d","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    json_provider \u003d json.dumps(requests.get(json_provider_url).json())"},{"line_number":33,"context_line":"    # This variable is an empty json because we are not overriding any configuration"},{"line_number":34,"context_line":"    # and the apache2 oidc plugin needs an existing config file with a valid json,"},{"line_number":35,"context_line":"    # even this json is empty."},{"line_number":36,"context_line":"    json_conf \u003d {}"},{"line_number":37,"context_line":"    json_client \u003d json.dumps({\u0027client_id\u0027: client_id, \u0027client_secret\u0027: client_secret})"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-jinja2","patch_set":2,"id":"3fa7e38b_320dc58e","line":35,"range":{"start_line":35,"start_character":6,"end_line":35,"end_character":25},"updated":"2019-11-21 17:02:09.000000000","message":"even if this JSON is an empty one.","commit_id":"b9f91a6c16039d3b2e69d48634858ed749feb2c0"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"6c37201e03cdd38b384cc4d363578d0023bf7949","unresolved":false,"context_lines":[{"line_number":32,"context_line":"    json_provider \u003d json.dumps(requests.get(json_provider_url).json())"},{"line_number":33,"context_line":"    # This variable is an empty json because we are not overriding any configuration"},{"line_number":34,"context_line":"    # and the apache2 oidc plugin needs an existing config file with a valid json,"},{"line_number":35,"context_line":"    # even this json is empty."},{"line_number":36,"context_line":"    json_conf \u003d {}"},{"line_number":37,"context_line":"    json_client \u003d json.dumps({\u0027client_id\u0027: client_id, \u0027client_secret\u0027: client_secret})"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-jinja2","patch_set":2,"id":"3fa7e38b_4eef72b0","line":35,"range":{"start_line":35,"start_character":6,"end_line":35,"end_character":25},"in_reply_to":"3fa7e38b_320dc58e","updated":"2019-11-22 12:27:11.000000000","message":"Done","commit_id":"b9f91a6c16039d3b2e69d48634858ed749feb2c0"},{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"fed997ba58e3f8cfc1da0f46f5505369f1d43cda","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":"    json_provider \u003d json.dumps(requests.get(json_provider_url).json())"},{"line_number":48,"context_line":"    # This variable is an empty json because we are not overriding any configuration"},{"line_number":49,"context_line":"    # and the apache2 oidc plugin needs an existing config file with a valid json,"},{"line_number":50,"context_line":"    # even if this JSON is an empty one."},{"line_number":51,"context_line":"    json_conf \u003d {}"},{"line_number":52,"context_line":"    json_client \u003d json.dumps({\u0027client_id\u0027: client_id, \u0027client_secret\u0027: client_secret})"}],"source_content_type":"text/x-jinja2","patch_set":14,"id":"3fa7e38b_d33bdec6","line":49,"range":{"start_line":49,"start_character":22,"end_line":49,"end_character":26},"updated":"2019-11-26 14:06:38.000000000","message":"Nity:\nOIDC","commit_id":"f2e56ae6b099f5d1974b194a9390624019282a03"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"66311ecde01ff0bb743b8db66212ccb46cf66c24","unresolved":false,"context_lines":[{"line_number":46,"context_line":""},{"line_number":47,"context_line":"    json_provider \u003d json.dumps(requests.get(json_provider_url).json())"},{"line_number":48,"context_line":"    # This variable is an empty json because we are not overriding any configuration"},{"line_number":49,"context_line":"    # and the apache2 oidc plugin needs an existing config file with a valid json,"},{"line_number":50,"context_line":"    # even if this JSON is an empty one."},{"line_number":51,"context_line":"    json_conf \u003d {}"},{"line_number":52,"context_line":"    json_client \u003d json.dumps({\u0027client_id\u0027: client_id, \u0027client_secret\u0027: client_secret})"}],"source_content_type":"text/x-jinja2","patch_set":14,"id":"3fa7e38b_d31c3e16","line":49,"range":{"start_line":49,"start_character":22,"end_line":49,"end_character":26},"in_reply_to":"3fa7e38b_d33bdec6","updated":"2019-12-05 13:31:06.000000000","message":"Done","commit_id":"f2e56ae6b099f5d1974b194a9390624019282a03"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# limitations under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"# This module creates a list of cron intervals for a node in a group of nodes"},{"line_number":14,"context_line":"# to ensure each node runs a cron in round robbin style."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"import json"},{"line_number":17,"context_line":"import re"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"1fa4df85_c706f952","line":14,"updated":"2020-03-06 16:16:49.000000000","message":"Is the license header required?","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":11,"context_line":"# limitations under the License."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"# This module creates a list of cron intervals for a node in a group of nodes"},{"line_number":14,"context_line":"# to ensure each node runs a cron in round robbin style."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"import json"},{"line_number":17,"context_line":"import re"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"1fa4df85_0b0698cf","line":14,"in_reply_to":"1fa4df85_c706f952","updated":"2020-03-19 19:49:21.000000000","message":"I do not know if it is required or not, but I think that we should put the license.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"}],"ansible/roles/keystone/templates/keystone.conf.j2":[{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"fed997ba58e3f8cfc1da0f46f5505369f1d43cda","unresolved":false,"context_lines":[{"line_number":74,"context_line":"{% if (keystone_federated_protocol_openid_enabled is defined and keystone_federated_protocol_openid_enabled) or (keystone_federated_protocol_saml_enabled is defined and keystone_federated_protocol_saml_enabled) %}"},{"line_number":75,"context_line":"#Here we configure which dashboards are allowed to use the identity federated plugin"},{"line_number":76,"context_line":"[federation]"},{"line_number":77,"context_line":"#The Keystone handle multiple attributions of the `trusted_dashboard` variable and join them in a list of trusted_dashboards"},{"line_number":78,"context_line":"{% for dashboard in horizon_trusted_dashboards %}"},{"line_number":79,"context_line":"trusted_dashboard \u003d {{ dashboard }}"},{"line_number":80,"context_line":"{% endfor %}"}],"source_content_type":"text/x-jinja2","patch_set":14,"id":"3fa7e38b_53fa8e11","line":77,"range":{"start_line":77,"start_character":1,"end_line":77,"end_character":41},"updated":"2019-11-26 14:06:38.000000000","message":"Nit:\n`Keystone handles multiple declarations of ... and joins them... a list called \"trusted_dashboards\"`","commit_id":"f2e56ae6b099f5d1974b194a9390624019282a03"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"cd293ed258e2231bd2ae77772d70d657a825fa95","unresolved":false,"context_lines":[{"line_number":72,"context_line":"{% endif %}"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"{% if should_use_oidc or should_use_saml %}"},{"line_number":75,"context_line":"#Here we configure which dashboards are allowed to use the identity federated plugin"},{"line_number":76,"context_line":"[federation]"},{"line_number":77,"context_line":"#Keystone handles multiple declarations of the `trusted_dashboard` variable and joins them in a list called \"trusted_dashboards\""},{"line_number":78,"context_line":"{% for dashboard in horizon_trusted_dashboards %}"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"1fa4df85_679b8517","line":75,"updated":"2020-03-06 16:16:49.000000000","message":"Are these comments necessary in the config?","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"07f1786929405b5e93be56f2d930f9b6f3c3b64f","unresolved":false,"context_lines":[{"line_number":72,"context_line":"{% endif %}"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"{% if should_use_oidc or should_use_saml %}"},{"line_number":75,"context_line":"#Here we configure which dashboards are allowed to use the identity federated plugin"},{"line_number":76,"context_line":"[federation]"},{"line_number":77,"context_line":"#Keystone handles multiple declarations of the `trusted_dashboard` variable and joins them in a list called \"trusted_dashboards\""},{"line_number":78,"context_line":"{% for dashboard in horizon_trusted_dashboards %}"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"1fa4df85_abcd0486","line":75,"in_reply_to":"1fa4df85_679b8517","updated":"2020-03-19 19:49:21.000000000","message":"Hmm, I think not, I will remove them","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":29100,"name":"Jason Anderson","email":"jasonanderson@uchicago.edu","username":"jasonanderson"},"change_message_id":"7ce64b9f1eb0232d2f6e9a01402626c6664ce3ed","unresolved":false,"context_lines":[{"line_number":86,"context_line":"remote_id_attribute \u003d {{ keystone_remote_id_attribute_oidc }}"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"[auth]"},{"line_number":89,"context_line":"methods \u003d external,password,token,mapped,openid"},{"line_number":90,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":33,"id":"9f560f44_3bf96dc7","line":89,"updated":"2020-09-10 17:21:45.000000000","message":"We should add application_credential to this list. I think it\u0027s enabled by default, and turning on federation w/ this patch effectively disables using that as an auth method. App creds are actually quite useful in the federated case because existing methods (v3oidcpassword, v3oidcaccesstoken) are comparably difficult to use and communicate to users.","commit_id":"e4e657fd3d3fc28b883d5479ea474848a47f7b92"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"a4f9dc35feeabcac8ec957515f06a7660894a241","unresolved":false,"context_lines":[{"line_number":86,"context_line":"remote_id_attribute \u003d {{ keystone_remote_id_attribute_oidc }}"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"[auth]"},{"line_number":89,"context_line":"methods \u003d external,password,token,mapped,openid"},{"line_number":90,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":33,"id":"9f560f44_2a06381d","line":89,"in_reply_to":"9f560f44_3bf96dc7","updated":"2020-09-10 18:46:28.000000000","message":"Yes, I think that we can put the app credentials here, I do not remember now if there was a reason to not add it here, maybe I just missed this conf. I am adding it now.\n\nThanks Anderson :)","commit_id":"e4e657fd3d3fc28b883d5479ea474848a47f7b92"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"sso_callback_template \u003d /etc/keystone/sso_callback_template.html"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"[mapped]"},{"line_number":83,"context_line":"remote_id_attribute \u003d {{ keystone_remote_id_attribute_saml }}"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"[openid]"}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_f384f4d5","line":82,"range":{"start_line":82,"start_character":1,"end_line":82,"end_character":7},"updated":"2020-09-15 15:45:43.000000000","message":"should this be saml?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":86,"context_line":"remote_id_attribute \u003d {{ keystone_remote_id_attribute_oidc }}"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"[auth]"},{"line_number":89,"context_line":"methods \u003d external,password,token,mapped,openid,application_credential"},{"line_number":90,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_d3ec5094","line":89,"range":{"start_line":89,"start_character":34,"end_line":89,"end_character":40},"updated":"2020-09-15 15:45:43.000000000","message":"Do we need mapped? What about saml?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":86,"context_line":"remote_id_attribute \u003d {{ keystone_remote_id_attribute_oidc }}"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"[auth]"},{"line_number":89,"context_line":"methods \u003d external,password,token,mapped,openid,application_credential"},{"line_number":90,"context_line":"{% endif %}"}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_5352006a","line":89,"range":{"start_line":89,"start_character":10,"end_line":89,"end_character":19},"updated":"2020-09-15 15:45:43.000000000","message":"Docs state to remove external: https://docs.openstack.org/keystone/latest/admin/federation/configure_federation.html#add-the-auth-method","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"}],"ansible/roles/keystone/templates/keystone.json.j2":[{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"fed997ba58e3f8cfc1da0f46f5505369f1d43cda","unresolved":false,"context_lines":[{"line_number":34,"context_line":"            \"dest\": \"/etc/{{ keystone_dir }}/wsgi-keystone.conf\","},{"line_number":35,"context_line":"            \"owner\": \"keystone\","},{"line_number":36,"context_line":"            \"perm\": \"0600\""},{"line_number":37,"context_line":"        }{% if keystone_federated_protocol_openid_enabled is defined and keystone_federated_protocol_openid_enabled %},"},{"line_number":38,"context_line":"        {"},{"line_number":39,"context_line":"            \"source\": \"{{ container_config_directory }}/metadata\","},{"line_number":40,"context_line":"            \"dest\": \"{{ container_keystone_federation_oidc_metadata_folder }}\","}],"source_content_type":"text/x-jinja2","patch_set":14,"id":"3fa7e38b_734d4a70","line":37,"range":{"start_line":37,"start_character":15,"end_line":37,"end_character":115},"updated":"2019-11-26 14:06:38.000000000","message":"What about creating a single variable to represent this check. You use it all over the place.","commit_id":"f2e56ae6b099f5d1974b194a9390624019282a03"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":58,"context_line":"            \"source\": \"{{ container_config_directory }}/metadata\","},{"line_number":59,"context_line":"            \"dest\": \"{{ keystone_container_federation_oidc_metadata_folder }}\","},{"line_number":60,"context_line":"            \"merge\": true,"},{"line_number":61,"context_line":"            \"preserve_properties\": true"},{"line_number":62,"context_line":"        },"},{"line_number":63,"context_line":"        {"},{"line_number":64,"context_line":"            \"source\": \"{{ container_config_directory }}/cert\","}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_b3bf1c5f","line":61,"range":{"start_line":61,"start_character":12,"end_line":61,"end_character":39},"updated":"2020-09-15 15:45:43.000000000","message":"why preserve if we are setting perms below?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":58,"context_line":"            \"source\": \"{{ container_config_directory }}/metadata\","},{"line_number":59,"context_line":"            \"dest\": \"{{ keystone_container_federation_oidc_metadata_folder }}\","},{"line_number":60,"context_line":"            \"merge\": true,"},{"line_number":61,"context_line":"            \"preserve_properties\": true"},{"line_number":62,"context_line":"        },"},{"line_number":63,"context_line":"        {"},{"line_number":64,"context_line":"            \"source\": \"{{ container_config_directory }}/cert\","}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_d16ffa90","line":61,"range":{"start_line":61,"start_character":12,"end_line":61,"end_character":39},"in_reply_to":"9f560f44_b3bf1c5f","updated":"2020-10-02 19:55:50.000000000","message":"removed","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":80,"context_line":"        {"},{"line_number":81,"context_line":"            \"path\": \"{{ keystone_container_federation_oidc_metadata_folder }}\","},{"line_number":82,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":83,"context_line":"            \"perm\": \"0700\","},{"line_number":84,"context_line":"            \"recurse\": true"},{"line_number":85,"context_line":"        },"},{"line_number":86,"context_line":"        {"},{"line_number":87,"context_line":"            \"path\": \"{{ keystone_container_federation_oidc_idp_certificate_folder }}\","}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_3382eca6","line":84,"range":{"start_line":83,"start_character":0,"end_line":84,"end_character":27},"updated":"2020-09-15 15:45:43.000000000","message":"Everything will be +x","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":80,"context_line":"        {"},{"line_number":81,"context_line":"            \"path\": \"{{ keystone_container_federation_oidc_metadata_folder }}\","},{"line_number":82,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":83,"context_line":"            \"perm\": \"0700\","},{"line_number":84,"context_line":"            \"recurse\": true"},{"line_number":85,"context_line":"        },"},{"line_number":86,"context_line":"        {"},{"line_number":87,"context_line":"            \"path\": \"{{ keystone_container_federation_oidc_idp_certificate_folder }}\","}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_b16a467f","line":84,"range":{"start_line":83,"start_character":0,"end_line":84,"end_character":27},"in_reply_to":"9f560f44_3382eca6","updated":"2020-10-02 19:55:50.000000000","message":"\"recurse\" removed","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":86,"context_line":"        {"},{"line_number":87,"context_line":"            \"path\": \"{{ keystone_container_federation_oidc_idp_certificate_folder }}\","},{"line_number":88,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":89,"context_line":"            \"perm\": \"0700\","},{"line_number":90,"context_line":"            \"recurse\": true"},{"line_number":91,"context_line":"        },{% endif %}"},{"line_number":92,"context_line":"        {"},{"line_number":93,"context_line":"            \"path\": \"/etc/keystone/fernet-keys\","}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_d3ba906f","line":90,"range":{"start_line":89,"start_character":0,"end_line":90,"end_character":27},"updated":"2020-09-15 15:45:43.000000000","message":"ditto","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"919f01bd1945ee25ee9b97b6a506e12d51549243","unresolved":true,"context_lines":[{"line_number":64,"context_line":"            \"dest\": \"{{ keystone_container_federation_oidc_idp_certificate_folder }}\","},{"line_number":65,"context_line":"            \"merge\": true"},{"line_number":66,"context_line":"        }"},{"line_number":67,"context_line":"        {% endif %}"},{"line_number":68,"context_line":"    ],"},{"line_number":69,"context_line":"    \"permissions\": ["},{"line_number":70,"context_line":"        {"}],"source_content_type":"text/x-jinja2","patch_set":45,"id":"e7473414_eac69848","line":67,"updated":"2021-01-07 15:11:37.000000000","message":"I needed this when I tried it:\n\ndiff --git a/ansible/roles/keystone/templates/keystone.json.j2 b/ansible/roles/keystone/templates/keystone.json.j2\nindex e52dbd9c6..2dee915eb 100644\n--- a/ansible/roles/keystone/templates/keystone.json.j2\n+++ b/ansible/roles/keystone/templates/keystone.json.j2\n@@ -55,13 +55,17 @@\n         }{% endif %}\n         {% if keystone_enable_federation_openid %},\n         {\n-            \"source\": \"{{ container_config_directory }}/metadata\",\n+            \"source\": \"{{ container_config_directory }}/federation/oidc/metadata\",\n             \"dest\": \"{{ keystone_container_federation_oidc_metadata_folder }}\",\n+            \"owner\": \"{{ apache_user }}:{{ apache_user }}\",\n+            \"perm\": \"0600\",\n             \"merge\": true\n         },\n         {\n-            \"source\": \"{{ container_config_directory }}/cert\",\n+            \"source\": \"{{ container_config_directory }}/federation/oidc/cert\",\n             \"dest\": \"{{ keystone_container_federation_oidc_idp_certificate_folder }}\",\n+            \"owner\": \"{{ apache_user }}:{{ apache_user }}\",\n+            \"perm\": \"0600\",\n             \"merge\": true\n         }\n         {% endif %}","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"6ebb5465cfaba397ea4d8e85de627e3b2b0d1848","unresolved":true,"context_lines":[{"line_number":64,"context_line":"            \"dest\": \"{{ keystone_container_federation_oidc_idp_certificate_folder }}\","},{"line_number":65,"context_line":"            \"merge\": true"},{"line_number":66,"context_line":"        }"},{"line_number":67,"context_line":"        {% endif %}"},{"line_number":68,"context_line":"    ],"},{"line_number":69,"context_line":"    \"permissions\": ["},{"line_number":70,"context_line":"        {"}],"source_content_type":"text/x-jinja2","patch_set":45,"id":"15a8682a_75a23f47","line":67,"in_reply_to":"e7473414_eac69848","updated":"2021-01-07 18:58:37.000000000","message":"hmm, thanks, I will add this","commit_id":"faefbeaa3a13806a0aab4f13964857257ec09c48"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"1aa50610c4c9c3774b2c299ce7bfad2d2584c5cf","unresolved":true,"context_lines":[{"line_number":67,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":68,"context_line":"            \"perm\": \"0600\","},{"line_number":69,"context_line":"            \"merge\": true"},{"line_number":70,"context_line":"        }"},{"line_number":71,"context_line":"        {% endif %}"},{"line_number":72,"context_line":"    ],"},{"line_number":73,"context_line":"    \"permissions\": ["}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"b25d00fc_e3805712","line":70,"range":{"start_line":70,"start_character":0,"end_line":70,"end_character":9},"updated":"2021-01-11 10:33:31.000000000","message":"Need to copy attribute mappings too.","commit_id":"4a86d2165e1b74a3b75b24f8ceb46f4e846fade6"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"ae98a790bbca6211ea5daccf71661af66461d474","unresolved":true,"context_lines":[{"line_number":67,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":68,"context_line":"            \"perm\": \"0600\","},{"line_number":69,"context_line":"            \"merge\": true"},{"line_number":70,"context_line":"        }"},{"line_number":71,"context_line":"        {% endif %}"},{"line_number":72,"context_line":"    ],"},{"line_number":73,"context_line":"    \"permissions\": ["}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"26242bc9_aaf40281","line":70,"range":{"start_line":70,"start_character":0,"end_line":70,"end_character":9},"in_reply_to":"1e17eafb_f3325b97","updated":"2021-01-12 10:23:48.000000000","message":"Well all the config files are bind mounted under /var/lib/kolla/config_files. Normally we copy them into a more appropriate location in the container via this file. I suppose for the mappings it doesn\u0027t matter too much.","commit_id":"4a86d2165e1b74a3b75b24f8ceb46f4e846fade6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"e207f281035b5d7cba3204681a8bae7455fe24d4","unresolved":true,"context_lines":[{"line_number":67,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":68,"context_line":"            \"perm\": \"0600\","},{"line_number":69,"context_line":"            \"merge\": true"},{"line_number":70,"context_line":"        }"},{"line_number":71,"context_line":"        {% endif %}"},{"line_number":72,"context_line":"    ],"},{"line_number":73,"context_line":"    \"permissions\": ["}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"1e17eafb_f3325b97","line":70,"range":{"start_line":70,"start_character":0,"end_line":70,"end_character":9},"in_reply_to":"b25d00fc_e3805712","updated":"2021-01-11 20:31:12.000000000","message":"No need to copy the attribute mapping, they are already in the container, the problem was that the \"keystone_container_federation_oidc_attribute_mappings_folder\" variable was with the wrong path to the mapping folder in the container.","commit_id":"4a86d2165e1b74a3b75b24f8ceb46f4e846fade6"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"1aa50610c4c9c3774b2c299ce7bfad2d2584c5cf","unresolved":true,"context_lines":[{"line_number":88,"context_line":"            \"path\": \"{{ keystone_container_federation_oidc_idp_certificate_folder }}\","},{"line_number":89,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":90,"context_line":"            \"perm\": \"0700\""},{"line_number":91,"context_line":"        },{% endif %}"},{"line_number":92,"context_line":"        {"},{"line_number":93,"context_line":"            \"path\": \"/etc/keystone/fernet-keys\","},{"line_number":94,"context_line":"            \"owner\": \"keystone:keystone\","}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"9e4b5a99_f743a3ca","line":91,"updated":"2021-01-11 10:33:31.000000000","message":"and here.","commit_id":"4a86d2165e1b74a3b75b24f8ceb46f4e846fade6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"e207f281035b5d7cba3204681a8bae7455fe24d4","unresolved":true,"context_lines":[{"line_number":88,"context_line":"            \"path\": \"{{ keystone_container_federation_oidc_idp_certificate_folder }}\","},{"line_number":89,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":90,"context_line":"            \"perm\": \"0700\""},{"line_number":91,"context_line":"        },{% endif %}"},{"line_number":92,"context_line":"        {"},{"line_number":93,"context_line":"            \"path\": \"/etc/keystone/fernet-keys\","},{"line_number":94,"context_line":"            \"owner\": \"keystone:keystone\","}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"467ea633_ff0ea76e","line":91,"in_reply_to":"9e4b5a99_f743a3ca","updated":"2021-01-11 20:31:12.000000000","message":"yes, I needed to grant the keystone permissions to the mapping folder, thanks","commit_id":"4a86d2165e1b74a3b75b24f8ceb46f4e846fade6"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"d9fc84f806764ec36b842ff872edd4ee3b19075c","unresolved":true,"context_lines":[{"line_number":93,"context_line":"            \"path\": \"{{ keystone_container_federation_oidc_attribute_mappings_folder }}\","},{"line_number":94,"context_line":"            \"owner\": \"keystone:keystone\","},{"line_number":95,"context_line":"            \"perm\": \"0700\""},{"line_number":96,"context_line":"        },{% endif %}"},{"line_number":97,"context_line":"        {"},{"line_number":98,"context_line":"            \"path\": \"/etc/keystone/fernet-keys\","},{"line_number":99,"context_line":"            \"owner\": \"keystone:keystone\","}],"source_content_type":"text/x-jinja2","patch_set":52,"id":"eb257c6e_9eda7ba3","line":96,"updated":"2021-02-04 08:52:11.000000000","message":"^ This is the issue","commit_id":"25349cecf9f22e3b60192b65d1bcbb812cb3875e"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"29cdbc1f99c0f73fb776b2ab6b7e8047556f87b3","unresolved":true,"context_lines":[{"line_number":93,"context_line":"            \"path\": \"{{ keystone_container_federation_oidc_attribute_mappings_folder }}\","},{"line_number":94,"context_line":"            \"owner\": \"keystone:keystone\","},{"line_number":95,"context_line":"            \"perm\": \"0700\""},{"line_number":96,"context_line":"        },{% endif %}"},{"line_number":97,"context_line":"        {"},{"line_number":98,"context_line":"            \"path\": \"/etc/keystone/fernet-keys\","},{"line_number":99,"context_line":"            \"owner\": \"keystone:keystone\","}],"source_content_type":"text/x-jinja2","patch_set":52,"id":"3f4e05e7_9c9bad6e","line":96,"in_reply_to":"55b9d914_53d8f19c","updated":"2021-02-04 14:59:04.000000000","message":"Those directories are ok because they are not in /var/lib/kolla/config_files.","commit_id":"25349cecf9f22e3b60192b65d1bcbb812cb3875e"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"40afd26c515ce9cd6b153bcd69f8baaea2fbaed1","unresolved":true,"context_lines":[{"line_number":93,"context_line":"            \"path\": \"{{ keystone_container_federation_oidc_attribute_mappings_folder }}\","},{"line_number":94,"context_line":"            \"owner\": \"keystone:keystone\","},{"line_number":95,"context_line":"            \"perm\": \"0700\""},{"line_number":96,"context_line":"        },{% endif %}"},{"line_number":97,"context_line":"        {"},{"line_number":98,"context_line":"            \"path\": \"/etc/keystone/fernet-keys\","},{"line_number":99,"context_line":"            \"owner\": \"keystone:keystone\","}],"source_content_type":"text/x-jinja2","patch_set":52,"id":"55b9d914_53d8f19c","line":96,"in_reply_to":"eb257c6e_9eda7ba3","updated":"2021-02-04 12:12:03.000000000","message":"ok, I will remove it, but I will define the metadata and certificate folders as executable because the mod OIDC wsgi needs to list the files inside these folders","commit_id":"25349cecf9f22e3b60192b65d1bcbb812cb3875e"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":55,"context_line":"        }{% endif %}"},{"line_number":56,"context_line":"        {% if keystone_enable_federation_openid %},"},{"line_number":57,"context_line":"        {"},{"line_number":58,"context_line":"            \"source\": \"{{ container_config_directory }}/federation/oidc/metadata\","},{"line_number":59,"context_line":"            \"dest\": \"{{ keystone_container_federation_oidc_metadata_folder }}\","},{"line_number":60,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":61,"context_line":"            \"perm\": \"0600\","}],"source_content_type":"text/x-jinja2","patch_set":56,"id":"23c9bbfd_b20c8b18","line":58,"range":{"start_line":58,"start_character":23,"end_line":58,"end_character":80},"updated":"2021-02-14 20:31:10.000000000","message":"should use the _host_ variable that was defined for this purpose","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"27bcbcc9ac194251ee41e8347c57d199cb3d5e5a","unresolved":true,"context_lines":[{"line_number":55,"context_line":"        }{% endif %}"},{"line_number":56,"context_line":"        {% if keystone_enable_federation_openid %},"},{"line_number":57,"context_line":"        {"},{"line_number":58,"context_line":"            \"source\": \"{{ container_config_directory }}/federation/oidc/metadata\","},{"line_number":59,"context_line":"            \"dest\": \"{{ keystone_container_federation_oidc_metadata_folder }}\","},{"line_number":60,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":61,"context_line":"            \"perm\": \"0600\","}],"source_content_type":"text/x-jinja2","patch_set":56,"id":"9a8b33fb_08f1959d","line":58,"range":{"start_line":58,"start_character":23,"end_line":58,"end_character":80},"in_reply_to":"23c9bbfd_b20c8b18","updated":"2021-02-15 11:30:15.000000000","message":"I think it\u0027s not the same due to /etc/kolla/keystone -\u003e /var/lib/kolla/config_files/","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"946349de06e7bed452d8bc7a7075c79b84c26c83","unresolved":false,"context_lines":[{"line_number":55,"context_line":"        }{% endif %}"},{"line_number":56,"context_line":"        {% if keystone_enable_federation_openid %},"},{"line_number":57,"context_line":"        {"},{"line_number":58,"context_line":"            \"source\": \"{{ container_config_directory }}/federation/oidc/metadata\","},{"line_number":59,"context_line":"            \"dest\": \"{{ keystone_container_federation_oidc_metadata_folder }}\","},{"line_number":60,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":61,"context_line":"            \"perm\": \"0600\","}],"source_content_type":"text/x-jinja2","patch_set":56,"id":"85fc8230_f0a194c6","line":58,"range":{"start_line":58,"start_character":23,"end_line":58,"end_character":80},"in_reply_to":"9a8b33fb_08f1959d","updated":"2021-02-15 11:39:00.000000000","message":"Ack, done, /me blind.","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":62,"context_line":"            \"merge\": true"},{"line_number":63,"context_line":"        },"},{"line_number":64,"context_line":"        {"},{"line_number":65,"context_line":"            \"source\": \"{{ container_config_directory }}/federation/oidc/cert\","},{"line_number":66,"context_line":"            \"dest\": \"{{ keystone_container_federation_oidc_idp_certificate_folder }}\","},{"line_number":67,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":68,"context_line":"            \"perm\": \"0600\","}],"source_content_type":"text/x-jinja2","patch_set":56,"id":"1f6bac7b_92e465ff","line":65,"range":{"start_line":65,"start_character":23,"end_line":65,"end_character":76},"updated":"2021-02-14 20:31:10.000000000","message":"ditto","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"946349de06e7bed452d8bc7a7075c79b84c26c83","unresolved":false,"context_lines":[{"line_number":62,"context_line":"            \"merge\": true"},{"line_number":63,"context_line":"        },"},{"line_number":64,"context_line":"        {"},{"line_number":65,"context_line":"            \"source\": \"{{ container_config_directory }}/federation/oidc/cert\","},{"line_number":66,"context_line":"            \"dest\": \"{{ keystone_container_federation_oidc_idp_certificate_folder }}\","},{"line_number":67,"context_line":"            \"owner\": \"{{ apache_user }}:{{ apache_user }}\","},{"line_number":68,"context_line":"            \"perm\": \"0600\","}],"source_content_type":"text/x-jinja2","patch_set":56,"id":"bdb3882b_244a73d2","line":65,"range":{"start_line":65,"start_character":23,"end_line":65,"end_character":76},"in_reply_to":"1f6bac7b_92e465ff","updated":"2021-02-15 11:39:00.000000000","message":"(see above)","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"}],"ansible/roles/keystone/templates/wsgi-keystone.conf.j2":[{"author":{"_account_id":30272,"name":"Keith Plant","email":"kplantjr@gmail.com","username":"kplant"},"change_message_id":"549e9b1b3179ebdee174fd75948fc43fed4d5a5f","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    OIDCCryptoPassphrase {{oidc_crypto_passphrase}}"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"    OIDCRedirectURI {{keystone_public_url}}/redirect_uri"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    \u003cLocation ~ \"/redirect_uri\"\u003e"},{"line_number":54,"context_line":"      AuthType auth-openidc"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"3fa7e38b_1ddd35dd","line":51,"updated":"2020-01-27 18:01:51.000000000","message":"I was not able to get federation with OIDC working with with this redirect uri - is this just a placeholder?\n\nHere are the endpoints I was able to get working:\n\nOIDCRedirectURI {{ keystone_public_url }}/v3/OS-FEDERATION/identity_providers/keycloak/protocols/openid/auth\n\n\u003cLocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/openid/auth\u003e\n        Require valid-user\n        AuthType openid-connect\n\u003c/LocationMatch\u003e\n\n\u003cLocation /v3/auth/OS-FEDERATION/websso/openid\u003e\n        Require valid-user\n        AuthType openid-connect\n\u003c/Location\u003e\n\n\u003cLocationMatch /v3/auth/OS-FEDERATION/identity_providers/.*?/protocols/openid/websso\u003e\n        Require valid-user\n        AuthType openid-connect\n\u003c/LocationMatch\u003e","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aa64cf43698513ece32b2075640cff93153d5de9","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    OIDCCryptoPassphrase {{oidc_crypto_passphrase}}"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"    OIDCRedirectURI {{keystone_public_url}}/redirect_uri"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    \u003cLocation ~ \"/redirect_uri\"\u003e"},{"line_number":54,"context_line":"      AuthType auth-openidc"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"3fa7e38b_e85f394a","line":51,"in_reply_to":"3fa7e38b_1ddd35dd","updated":"2020-01-27 19:06:14.000000000","message":"Hello Keith.\n \nDid you use this configuration with kolla-ansible?\n\nDid you run the kolla-ansible to configure your environment?\n\nI think that the /redirect_uri endpoint is not working because you are not protecting it; did you forget the following configuration?\n\n```\n    \u003cLocation ~ \"/redirect_uri\"\u003e\n      AuthType auth-openidc\n      Require valid-user\n      LogLevel debug\n    \u003c/Location\u003e\n```\n\nIf you do not have the above configuration, it will not work.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"1f41f69a3401dbca8fc9ead22f466cf26bdce157","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    OIDCCryptoPassphrase {{oidc_crypto_passphrase}}"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"    OIDCRedirectURI {{keystone_public_url}}/redirect_uri"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    \u003cLocation ~ \"/redirect_uri\"\u003e"},{"line_number":54,"context_line":"      AuthType auth-openidc"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"3fa7e38b_23dd72dd","line":51,"in_reply_to":"3fa7e38b_234d723b","updated":"2020-01-28 12:23:39.000000000","message":"What do you mean with \"I actually copy and pasted...\"? \n\nI thought you did a checkout from this revision to your local repository and then did the tests using the patched version of Kolla-ansible.\n\nAnother thing, the kolla-ansible creates a wsgi-config file in your apache2 server, could you paste it here? It should be in /etc/apache2/conf-enabled/wsgi-keystone.conf in the keystone container.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30272,"name":"Keith Plant","email":"kplantjr@gmail.com","username":"kplant"},"change_message_id":"d2a22fc884bd0700c32fb353fef4dd2745ae14f1","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    OIDCCryptoPassphrase {{oidc_crypto_passphrase}}"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"    OIDCRedirectURI {{keystone_public_url}}/redirect_uri"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    \u003cLocation ~ \"/redirect_uri\"\u003e"},{"line_number":54,"context_line":"      AuthType auth-openidc"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"3fa7e38b_4bc976a9","line":51,"in_reply_to":"3fa7e38b_23dd72dd","updated":"2020-01-30 12:27:34.000000000","message":"I both tried to cherry pick this patch and manually apply the configs in the patch, on two different occasions. I was unable to get either scenario to work unless I manually edited the locations in wsgi-keystone.conf to what I listed previously.\n\nI will try your locations again when I get some time and report back.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":30272,"name":"Keith Plant","email":"kplantjr@gmail.com","username":"kplant"},"change_message_id":"c89a43e187e955820e53ec36b9b879fa5c194e83","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    OIDCCryptoPassphrase {{oidc_crypto_passphrase}}"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":"    OIDCRedirectURI {{keystone_public_url}}/redirect_uri"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"    \u003cLocation ~ \"/redirect_uri\"\u003e"},{"line_number":54,"context_line":"      AuthType auth-openidc"}],"source_content_type":"text/x-jinja2","patch_set":16,"id":"3fa7e38b_234d723b","line":51,"in_reply_to":"3fa7e38b_e85f394a","updated":"2020-01-27 19:31:11.000000000","message":"I did indeed use kolla-ansible.\n\nAs far as the \"/redirect_uri\" location, yes I actually copy and pasted your locations from wsgi-keystone.conf.j2 into my wsgi-keystone.conf to give it the fairest shot I could.","commit_id":"7c928f96c69836f9b3dd1d4b3966bd14051e6a19"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":20,"context_line":"    CustomLog \"{{ keystone_log_dir }}/apache-access.log\" common"},{"line_number":21,"context_line":"\u003c/IfModule\u003e"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"LogLevel {{ keystone_wsgi_log_level }}"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"\u003cDirectory \"{{ binary_path }}\"\u003e"},{"line_number":26,"context_line":"    \u003cFilesMatch \"^keystone-wsgi-(public|admin)$\"\u003e"}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_d35f304b","line":23,"range":{"start_line":23,"start_character":0,"end_line":23,"end_character":38},"updated":"2020-09-15 15:45:43.000000000","message":"This is inconsistent with other wsgi services","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    \u003cLocation ~ \"/redirect_uri\"\u003e"},{"line_number":66,"context_line":"      Require valid-user"},{"line_number":67,"context_line":"      AuthType openid-connect"},{"line_number":68,"context_line":"      LogLevel {{ keystone_wsgi_log_level }}"},{"line_number":69,"context_line":"    \u003c/Location\u003e"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    {# WebSSO authentication endpoint -#}"}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_33594c5b","line":68,"range":{"start_line":68,"start_character":0,"end_line":68,"end_character":44},"updated":"2020-09-15 15:45:43.000000000","message":"Is this redundant?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    \u003cLocation ~ \"/redirect_uri\"\u003e"},{"line_number":66,"context_line":"      Require valid-user"},{"line_number":67,"context_line":"      AuthType openid-connect"},{"line_number":68,"context_line":"      LogLevel {{ keystone_wsgi_log_level }}"},{"line_number":69,"context_line":"    \u003c/Location\u003e"},{"line_number":70,"context_line":""},{"line_number":71,"context_line":"    {# WebSSO authentication endpoint -#}"}],"source_content_type":"text/x-jinja2","patch_set":34,"id":"9f560f44_91b2a205","line":68,"range":{"start_line":68,"start_character":0,"end_line":68,"end_character":44},"in_reply_to":"9f560f44_33594c5b","updated":"2020-10-02 19:55:50.000000000","message":"yes","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"d95bc7866dfd1ac00fc57bee02e5cd06194db7da","unresolved":false,"context_lines":[{"line_number":70,"context_line":"    \u003c/Location\u003e"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    {# WebSSO authentication endpoint -#}"},{"line_number":73,"context_line":"    \u003cLocationMatch /v3/auth/OS-FEDERATION/identity_providers/.*?/protocols/openid/websso\u003e"},{"line_number":74,"context_line":"      Require valid-user"},{"line_number":75,"context_line":"      AuthType openid-connect"},{"line_number":76,"context_line":"    \u003c/LocationMatch\u003e"}],"source_content_type":"text/x-jinja2","patch_set":37,"id":"9f560f44_3078b929","line":73,"range":{"start_line":73,"start_character":61,"end_line":73,"end_character":64},"updated":"2020-10-07 15:23:28.000000000","message":"What if somebody wants other identity providers using saml2/anything else?","commit_id":"9b04f4165737ca2196d7a17c676c072dff2138fc"},{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"13b4ff4d8507463982e8225070bad3f4874f9d4d","unresolved":false,"context_lines":[{"line_number":70,"context_line":"    \u003c/Location\u003e"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    {# WebSSO authentication endpoint -#}"},{"line_number":73,"context_line":"    \u003cLocationMatch /v3/auth/OS-FEDERATION/identity_providers/.*?/protocols/openid/websso\u003e"},{"line_number":74,"context_line":"      Require valid-user"},{"line_number":75,"context_line":"      AuthType openid-connect"},{"line_number":76,"context_line":"    \u003c/LocationMatch\u003e"}],"source_content_type":"text/x-jinja2","patch_set":37,"id":"9f560f44_b3a333b1","line":73,"range":{"start_line":73,"start_character":61,"end_line":73,"end_character":64},"in_reply_to":"9f560f44_3078b929","updated":"2020-10-07 16:01:22.000000000","message":"So far, this whole implementation is only supporting OpenID Connect. Therefore, we would need to extend this even further to support other federated protocols.\n\nIn the patch description we make it clear that with this patch, we will support OpenID connect in Kolla-ansible. Moreover, the patch is creating the structure that can then be extended to add other protocols. That is why, if we want other federated protocols support, we should introduce them in separated patches.","commit_id":"9b04f4165737ca2196d7a17c676c072dff2138fc"},{"author":{"_account_id":22629,"name":"Michal Nasiadka","email":"mnasiadka@gmail.com","username":"mnasiadka"},"change_message_id":"47ca0666dbab16f830fca6843720ce76f4a675ec","unresolved":false,"context_lines":[{"line_number":70,"context_line":"    \u003c/Location\u003e"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    {# WebSSO authentication endpoint -#}"},{"line_number":73,"context_line":"    \u003cLocationMatch /v3/auth/OS-FEDERATION/identity_providers/.*?/protocols/openid/websso\u003e"},{"line_number":74,"context_line":"      Require valid-user"},{"line_number":75,"context_line":"      AuthType openid-connect"},{"line_number":76,"context_line":"    \u003c/LocationMatch\u003e"}],"source_content_type":"text/x-jinja2","patch_set":37,"id":"9f560f44_06d73f24","line":73,"range":{"start_line":73,"start_character":61,"end_line":73,"end_character":64},"in_reply_to":"9f560f44_b3a333b1","updated":"2020-10-07 16:49:28.000000000","message":"I was just referring to the fact you are matching for .*? - which essentially will match every identity provider. The fact that this patch only supports OIDC doesn\u0027t explain the fact why is it enabling OIDC for ALL identity providers - please narrow It down, so user can choose for which identity providers OIDC should be enabled. No shortcuts please :)","commit_id":"9b04f4165737ca2196d7a17c676c072dff2138fc"},{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"391d8837ba68446af7bd3f52a29d7e617839a198","unresolved":true,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    {# WebSSO authentication endpoint -#}"},{"line_number":73,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":74,"context_line":"    \u003cLocationMatch /v3/auth/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/openid/websso\u003e"},{"line_number":75,"context_line":"      Require valid-user"},{"line_number":76,"context_line":"      AuthType openid-connect"},{"line_number":77,"context_line":"    \u003c/LocationMatch\u003e"}],"source_content_type":"text/x-jinja2","patch_set":41,"id":"99cd8bbc_4189e3a1","line":74,"range":{"start_line":74,"start_character":86,"end_line":74,"end_character":92},"updated":"2020-12-29 16:21:55.000000000","message":"You could you the idp.protocol here right?","commit_id":"3cd9a00eead2c02cceae18e77f5693a0e78015fe"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"058bf8f6cfb243aa8001feb9b87ee5c53d263cf5","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    {# WebSSO authentication endpoint -#}"},{"line_number":73,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":74,"context_line":"    \u003cLocationMatch /v3/auth/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/openid/websso\u003e"},{"line_number":75,"context_line":"      Require valid-user"},{"line_number":76,"context_line":"      AuthType openid-connect"},{"line_number":77,"context_line":"    \u003c/LocationMatch\u003e"}],"source_content_type":"text/x-jinja2","patch_set":41,"id":"768ff9e5_4f0270c7","line":74,"range":{"start_line":74,"start_character":86,"end_line":74,"end_character":92},"in_reply_to":"99cd8bbc_4189e3a1","updated":"2020-12-29 16:58:06.000000000","message":"yes, sure","commit_id":"3cd9a00eead2c02cceae18e77f5693a0e78015fe"},{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"d63b9dbe00748e240dca6f189e591c0866df2c87","unresolved":true,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    {# CLI / API authentication endpoint -#}"},{"line_number":81,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":82,"context_line":"    \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/openid/auth\u003e"},{"line_number":83,"context_line":"      Require valid-user"},{"line_number":84,"context_line":"      {# Note(jasonanderson): `auth-openidc` is a special auth type that can -#}"},{"line_number":85,"context_line":"      {# additionally handle verifying bearer tokens -#}"}],"source_content_type":"text/x-jinja2","patch_set":41,"id":"00304376_5bcc3ad2","line":82,"range":{"start_line":82,"start_character":81,"end_line":82,"end_character":87},"updated":"2020-12-29 16:22:39.000000000","message":"same here.","commit_id":"3cd9a00eead2c02cceae18e77f5693a0e78015fe"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"058bf8f6cfb243aa8001feb9b87ee5c53d263cf5","unresolved":false,"context_lines":[{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    {# CLI / API authentication endpoint -#}"},{"line_number":81,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":82,"context_line":"    \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/openid/auth\u003e"},{"line_number":83,"context_line":"      Require valid-user"},{"line_number":84,"context_line":"      {# Note(jasonanderson): `auth-openidc` is a special auth type that can -#}"},{"line_number":85,"context_line":"      {# additionally handle verifying bearer tokens -#}"}],"source_content_type":"text/x-jinja2","patch_set":41,"id":"e1c28fde_5bb3099f","line":82,"range":{"start_line":82,"start_character":81,"end_line":82,"end_character":87},"in_reply_to":"00304376_5bcc3ad2","updated":"2020-12-29 16:58:06.000000000","message":"Done","commit_id":"3cd9a00eead2c02cceae18e77f5693a0e78015fe"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":21,"context_line":"\u003c/IfModule\u003e"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"{% if keystone_logging_debug | bool %}"},{"line_number":24,"context_line":"LogLevel {{ keystone_wsgi_log_level }}"},{"line_number":25,"context_line":"{% endif %}"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"\u003cDirectory \"{{ binary_path }}\"\u003e"}],"source_content_type":"text/x-jinja2","patch_set":42,"id":"3768a9f2_a82e1759","line":24,"range":{"start_line":24,"start_character":9,"end_line":24,"end_character":38},"updated":"2021-01-06 14:13:26.000000000","message":"Unrelated change.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":56,"context_line":"    OIDCClaimPrefix \"OIDC-\""},{"line_number":57,"context_line":"    OIDCClaimDelimiter \";\""},{"line_number":58,"context_line":"    OIDCResponseType \"id_token\""},{"line_number":59,"context_line":"    OIDCScope \"openid email profile\""},{"line_number":60,"context_line":"    OIDCMetadataDir {{ keystone_container_federation_oidc_metadata_folder }}"},{"line_number":61,"context_line":"{% if keystone_federation_openid_certificate_key_ids | length \u003e 0 %}"},{"line_number":62,"context_line":"    OIDCOAuthVerifyCertFiles {{ keystone_federation_openid_certificate_key_ids | join(\" \") }}"}],"source_content_type":"text/x-jinja2","patch_set":44,"id":"b5a21b93_6ea0cf6f","line":59,"updated":"2021-01-07 10:40:39.000000000","message":"Should this be configurable? I have seen other combinations used.","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":true,"context_lines":[{"line_number":56,"context_line":"    OIDCClaimPrefix \"OIDC-\""},{"line_number":57,"context_line":"    OIDCClaimDelimiter \";\""},{"line_number":58,"context_line":"    OIDCResponseType \"id_token\""},{"line_number":59,"context_line":"    OIDCScope \"openid email profile\""},{"line_number":60,"context_line":"    OIDCMetadataDir {{ keystone_container_federation_oidc_metadata_folder }}"},{"line_number":61,"context_line":"{% if keystone_federation_openid_certificate_key_ids | length \u003e 0 %}"},{"line_number":62,"context_line":"    OIDCOAuthVerifyCertFiles {{ keystone_federation_openid_certificate_key_ids | join(\" \") }}"}],"source_content_type":"text/x-jinja2","patch_set":44,"id":"d6daf22a_a0f7849b","line":59,"in_reply_to":"b5a21b93_6ea0cf6f","updated":"2021-01-07 14:30:07.000000000","message":"Yes, I agree, it will be better if it is configurable, thanks for the suggestion","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":63,"context_line":"{% endif %}"},{"line_number":64,"context_line":"    OIDCCryptoPassphrase {{ keystone_federation_openid_crypto_password }}"},{"line_number":65,"context_line":"    OIDCRedirectURI {{ keystone_public_url }}/redirect_uri"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    \u003cLocation ~ \"/redirect_uri\"\u003e"},{"line_number":68,"context_line":"      Require valid-user"},{"line_number":69,"context_line":"      AuthType openid-connect"}],"source_content_type":"text/x-jinja2","patch_set":44,"id":"46f71169_ade03d0e","line":66,"updated":"2021-01-07 10:40:39.000000000","message":"Just looking at another OIDC setup, I see the following options used:\n\n  OIDCClaimPrefix\n  OIDCResponseType\n  OIDCScope\n  OIDCProviderMetadataURL\n  OIDCOAuthVerifyJwksUri\n  OIDCClientID\n  OIDCClientSecret\n  OIDCCryptoPassphrase\n  OIDCRedirectURI {{ horizon_keystone_url }}/OS-FEDERATION/identity_providers/{{ thg_federation_identity_provider }}/protocols/mapped/auth\n  OIDCRedirectURI {{ horizon_keystone_url }}/auth/OS-FEDERATION/websso/\n  OIDCRedirectURI {{ horizon_keystone_url }}/auth/OS-FEDERATION/identity_providers/{{ thg_federation_identity_provider }}/protocols/mapped/websso/\n  OIDCSessionType client-cookie\n  OIDCCacheType memcache\n  OIDCMemCacheServers\n\nI expect the memcache stuff is optional and could be added later if we wish. And some others will be part of the metadata files, since we are following the multi-provider setup?","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":true,"context_lines":[{"line_number":63,"context_line":"{% endif %}"},{"line_number":64,"context_line":"    OIDCCryptoPassphrase {{ keystone_federation_openid_crypto_password }}"},{"line_number":65,"context_line":"    OIDCRedirectURI {{ keystone_public_url }}/redirect_uri"},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"    \u003cLocation ~ \"/redirect_uri\"\u003e"},{"line_number":68,"context_line":"      Require valid-user"},{"line_number":69,"context_line":"      AuthType openid-connect"}],"source_content_type":"text/x-jinja2","patch_set":44,"id":"3236d7a6_8367c520","line":66,"in_reply_to":"46f71169_ade03d0e","updated":"2021-01-07 14:30:07.000000000","message":"yes, we are following the multiple providers setup","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":69,"context_line":"      AuthType openid-connect"},{"line_number":70,"context_line":"    \u003c/Location\u003e"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    {# WebSSO authentication endpoint -#}"},{"line_number":73,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":74,"context_line":"    \u003cLocationMatch /v3/auth/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/{{ idp.protocol }}/websso\u003e"},{"line_number":75,"context_line":"      Require valid-user"}],"source_content_type":"text/x-jinja2","patch_set":44,"id":"90687ccf_a0e89ecf","line":72,"updated":"2021-01-07 10:40:39.000000000","message":"Keystone docs also have this one:\n\n\u003cLocation /v3/auth/OS-FEDERATION/websso/openid\u003e\n    Require valid-user\n    AuthType openid-connect\n\u003c/Location\u003e","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":69,"context_line":"      AuthType openid-connect"},{"line_number":70,"context_line":"    \u003c/Location\u003e"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    {# WebSSO authentication endpoint -#}"},{"line_number":73,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":74,"context_line":"    \u003cLocationMatch /v3/auth/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/{{ idp.protocol }}/websso\u003e"},{"line_number":75,"context_line":"      Require valid-user"}],"source_content_type":"text/x-jinja2","patch_set":44,"id":"89a1e3b1_d16aac5a","line":72,"in_reply_to":"90687ccf_a0e89ecf","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":70,"context_line":"    \u003c/Location\u003e"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    {# WebSSO authentication endpoint -#}"},{"line_number":73,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":74,"context_line":"    \u003cLocationMatch /v3/auth/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/{{ idp.protocol }}/websso\u003e"},{"line_number":75,"context_line":"      Require valid-user"},{"line_number":76,"context_line":"      AuthType openid-connect"}],"source_content_type":"text/x-jinja2","patch_set":44,"id":"5457696f_0212913d","line":73,"updated":"2021-01-07 10:40:39.000000000","message":"if idp.protocol \u003d\u003d \u0027openid\u0027 ...","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":70,"context_line":"    \u003c/Location\u003e"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"    {# WebSSO authentication endpoint -#}"},{"line_number":73,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":74,"context_line":"    \u003cLocationMatch /v3/auth/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/{{ idp.protocol }}/websso\u003e"},{"line_number":75,"context_line":"      Require valid-user"},{"line_number":76,"context_line":"      AuthType openid-connect"}],"source_content_type":"text/x-jinja2","patch_set":44,"id":"2d2f48f4_a8877e11","line":73,"in_reply_to":"5457696f_0212913d","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":78,"context_line":"{% endfor %}"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    {# CLI / API authentication endpoint -#}"},{"line_number":81,"context_line":"{% for idp in keystone_identity_providers %}"},{"line_number":82,"context_line":"    \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/{{ idp.protocol }}/auth\u003e"},{"line_number":83,"context_line":"      Require valid-user"},{"line_number":84,"context_line":"      {# Note(jasonanderson): `auth-openidc` is a special auth type that can -#}"}],"source_content_type":"text/x-jinja2","patch_set":44,"id":"bbbb3873_c91c79c9","line":81,"updated":"2021-01-07 10:40:39.000000000","message":"if idp.protocol \u003d\u003d \u0027openid\u0027 ...","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"16e91fd6f388f534ed038e3280c4cf8dab399df4","unresolved":true,"context_lines":[{"line_number":56,"context_line":"    OIDCClaimPrefix \"OIDC-\""},{"line_number":57,"context_line":"    OIDCClaimDelimiter \";\""},{"line_number":58,"context_line":"    OIDCResponseType \"id_token\""},{"line_number":59,"context_line":"    OIDCScope {{ keystone_federation_oidc_scopes }}"},{"line_number":60,"context_line":"    OIDCMetadataDir {{ keystone_container_federation_oidc_metadata_folder }}"},{"line_number":61,"context_line":"{% if keystone_federation_openid_certificate_key_ids | length \u003e 0 %}"},{"line_number":62,"context_line":"    OIDCOAuthVerifyCertFiles {{ keystone_federation_openid_certificate_key_ids | join(\" \") }}"}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"4804e147_3b37c46f","line":59,"updated":"2021-01-11 10:40:00.000000000","message":"2021-01-08T20:09:30.172384147Z AH00526: Syntax error on line 46 of /etc/httpd/conf.d/wsgi-keystone.conf:\n2021-01-08T20:09:30.172403474Z OIDCScope takes one argument, Define the OpenID Connect scope that is requested from the OP.\n\nFrom https://2da300dacb0c5a19b6bb-52b16189085d122336ec13394d5e12f1.ssl.cf2.rackcdn.com/769765/1/check/kolla-ansible-centos8-source/aeadc7f/primary/logs/docker_logs/keystone.txt","commit_id":"4a86d2165e1b74a3b75b24f8ceb46f4e846fade6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"e207f281035b5d7cba3204681a8bae7455fe24d4","unresolved":true,"context_lines":[{"line_number":56,"context_line":"    OIDCClaimPrefix \"OIDC-\""},{"line_number":57,"context_line":"    OIDCClaimDelimiter \";\""},{"line_number":58,"context_line":"    OIDCResponseType \"id_token\""},{"line_number":59,"context_line":"    OIDCScope {{ keystone_federation_oidc_scopes }}"},{"line_number":60,"context_line":"    OIDCMetadataDir {{ keystone_container_federation_oidc_metadata_folder }}"},{"line_number":61,"context_line":"{% if keystone_federation_openid_certificate_key_ids | length \u003e 0 %}"},{"line_number":62,"context_line":"    OIDCOAuthVerifyCertFiles {{ keystone_federation_openid_certificate_key_ids | join(\" \") }}"}],"source_content_type":"text/x-jinja2","patch_set":47,"id":"e34d636a_4dbabbe7","line":59,"in_reply_to":"4804e147_3b37c46f","updated":"2021-01-11 20:31:12.000000000","message":"missing quotes, I fixed it, thanks","commit_id":"4a86d2165e1b74a3b75b24f8ceb46f4e846fade6"}],"doc/source/contributor/setup-identity-provider.rst":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"592286ebe0306e73bae702c8ad782c249482c598","unresolved":true,"context_lines":[{"line_number":100,"context_line":"        public_name: \"Authenticate via new_realm\""},{"line_number":101,"context_line":"        attribute_mapping: \"attribute_mapping_keycloak_new_realm\""},{"line_number":102,"context_line":"        metadata_folder: \"/root/inDev/meta-idp\""},{"line_number":103,"context_line":"        certificate_file: \"/root/inDev/certs/LRVweuT51StjMdsna59jKfB3xw0r8Iz1d1J1HeAbmlw.pem\""},{"line_number":104,"context_line":"    keystone_identity_mappings:"},{"line_number":105,"context_line":"      - name: \"attribute_mapping_keycloak_new_realm\""},{"line_number":106,"context_line":"        file: \"/root/inDev/attr_map/attribute_mapping.json\""}],"source_content_type":"text/x-rst","patch_set":44,"id":"84e52613_5cd9af7c","line":103,"updated":"2021-01-07 10:40:39.000000000","message":"add openstack_domain","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"3b2a462a4b8912faca1841a84129a7dbd02d08c2","unresolved":false,"context_lines":[{"line_number":100,"context_line":"        public_name: \"Authenticate via new_realm\""},{"line_number":101,"context_line":"        attribute_mapping: \"attribute_mapping_keycloak_new_realm\""},{"line_number":102,"context_line":"        metadata_folder: \"/root/inDev/meta-idp\""},{"line_number":103,"context_line":"        certificate_file: \"/root/inDev/certs/LRVweuT51StjMdsna59jKfB3xw0r8Iz1d1J1HeAbmlw.pem\""},{"line_number":104,"context_line":"    keystone_identity_mappings:"},{"line_number":105,"context_line":"      - name: \"attribute_mapping_keycloak_new_realm\""},{"line_number":106,"context_line":"        file: \"/root/inDev/attr_map/attribute_mapping.json\""}],"source_content_type":"text/x-rst","patch_set":44,"id":"86777a6d_92a9cf8f","line":103,"in_reply_to":"84e52613_5cd9af7c","updated":"2021-01-07 14:30:07.000000000","message":"Done","commit_id":"e7752fcb1b7f99c6c2e900c0c7e1c01423b6d00d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"46f4d9ece91608dd4c6ee84169ac4f502b6919ee","unresolved":true,"context_lines":[{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when using Federation with OpenStack."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Keycloak"},{"line_number":11,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":49,"id":"7f2802c9_153f47d8","line":8,"updated":"2021-01-28 12:20:06.000000000","message":"This could link to the keystone guide.","commit_id":"6d7b2892962d27a8114933aca8696f5d2b96d366"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"fe9f19bc236254ed21c50bfa19e44dd022fb2ec8","unresolved":true,"context_lines":[{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when using Federation with OpenStack."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Keycloak"},{"line_number":11,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":49,"id":"d0b43571_99445de4","line":8,"in_reply_to":"7f2802c9_153f47d8","updated":"2021-02-01 21:07:56.000000000","message":"ok, I will add the link to the OIDC configuration in keystone","commit_id":"6d7b2892962d27a8114933aca8696f5d2b96d366"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"46f4d9ece91608dd4c6ee84169ac4f502b6919ee","unresolved":true,"context_lines":[{"line_number":25,"context_line":"    docker run -p 8080:8080 -e KEYCLOAK_USER\u003dadmin -e KEYCLOAK_PASSWORD\u003dadmin quay.io/keycloak/keycloak:11.0.3"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"This will create a Keycloak instance using docker that has the admin"},{"line_number":28,"context_line":"credentials as admin/admin and listening to port 8080."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"After creating the instance, you will need to log in the Keycloak as"},{"line_number":31,"context_line":"administrator and setup the first Identity Provider."}],"source_content_type":"text/x-rst","patch_set":49,"id":"fd3fecbe_3bba023f","line":28,"updated":"2021-01-28 12:20:06.000000000","message":"Note here that you must access via 127.0.0.1, otherwise it will require HTTPS. Maybe also suggest SSH port forwarding to achieve that.","commit_id":"6d7b2892962d27a8114933aca8696f5d2b96d366"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"6bfd718d9a14b64d48f345618875c0641e3f23dd","unresolved":true,"context_lines":[{"line_number":25,"context_line":"    docker run -p 8080:8080 -e KEYCLOAK_USER\u003dadmin -e KEYCLOAK_PASSWORD\u003dadmin quay.io/keycloak/keycloak:11.0.3"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"This will create a Keycloak instance using docker that has the admin"},{"line_number":28,"context_line":"credentials as admin/admin and listening to port 8080."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"After creating the instance, you will need to log in the Keycloak as"},{"line_number":31,"context_line":"administrator and setup the first Identity Provider."}],"source_content_type":"text/x-rst","patch_set":49,"id":"4aa6d2cc_1bfeaaed","line":28,"in_reply_to":"7a1d052f_227f8b6d","updated":"2021-02-02 10:13:27.000000000","message":"I mean when accessing the keycloak web admin console. If you use an IP address other than 127.0.0.1, keycloak will prevent access. This makes it difficult to use SSH tunnelling to access it. In the end I used X forwarding.","commit_id":"6d7b2892962d27a8114933aca8696f5d2b96d366"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"fe9f19bc236254ed21c50bfa19e44dd022fb2ec8","unresolved":true,"context_lines":[{"line_number":25,"context_line":"    docker run -p 8080:8080 -e KEYCLOAK_USER\u003dadmin -e KEYCLOAK_PASSWORD\u003dadmin quay.io/keycloak/keycloak:11.0.3"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"This will create a Keycloak instance using docker that has the admin"},{"line_number":28,"context_line":"credentials as admin/admin and listening to port 8080."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"After creating the instance, you will need to log in the Keycloak as"},{"line_number":31,"context_line":"administrator and setup the first Identity Provider."}],"source_content_type":"text/x-rst","patch_set":49,"id":"7a1d052f_227f8b6d","line":28,"in_reply_to":"fd3fecbe_3bba023f","updated":"2021-02-01 21:07:56.000000000","message":"hmm, I am not accessing the container via SSH, I use the docker exec command","commit_id":"6d7b2892962d27a8114933aca8696f5d2b96d366"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"46f4d9ece91608dd4c6ee84169ac4f502b6919ee","unresolved":true,"context_lines":[{"line_number":82,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"},{"line_number":83,"context_line":"- certificate_file: This one can be downloaded from http://localhost:8080/auth/admin/master/console/#/realms/new_realm/keys"},{"line_number":84,"context_line":"- metadata_folder:"},{"line_number":85,"context_line":"    - .client:"},{"line_number":86,"context_line":"        - client_id: Access http://localhost:8080/auth/admin/master/console/#/realms/new_realm/clients , and access the client you created for Keystone, copy the Client ID displayed in the page"},{"line_number":87,"context_line":"        - client_secret: In the same page you got the client_id, access the tab"},{"line_number":88,"context_line":"          \"Credentials\" and copy the secret value"}],"source_content_type":"text/x-rst","patch_set":49,"id":"fff4bd03_1f9c1cd8","line":85,"updated":"2021-01-28 12:20:06.000000000","message":"Could be clearer what the file names should be here.","commit_id":"6d7b2892962d27a8114933aca8696f5d2b96d366"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"fe9f19bc236254ed21c50bfa19e44dd022fb2ec8","unresolved":true,"context_lines":[{"line_number":82,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"},{"line_number":83,"context_line":"- certificate_file: This one can be downloaded from http://localhost:8080/auth/admin/master/console/#/realms/new_realm/keys"},{"line_number":84,"context_line":"- metadata_folder:"},{"line_number":85,"context_line":"    - .client:"},{"line_number":86,"context_line":"        - client_id: Access http://localhost:8080/auth/admin/master/console/#/realms/new_realm/clients , and access the client you created for Keystone, copy the Client ID displayed in the page"},{"line_number":87,"context_line":"        - client_secret: In the same page you got the client_id, access the tab"},{"line_number":88,"context_line":"          \"Credentials\" and copy the secret value"}],"source_content_type":"text/x-rst","patch_set":49,"id":"ec2b839e_c1c959e6","line":85,"in_reply_to":"fff4bd03_1f9c1cd8","updated":"2021-02-01 21:07:56.000000000","message":"yes","commit_id":"6d7b2892962d27a8114933aca8696f5d2b96d366"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"46f4d9ece91608dd4c6ee84169ac4f502b6919ee","unresolved":true,"context_lines":[{"line_number":86,"context_line":"        - client_id: Access http://localhost:8080/auth/admin/master/console/#/realms/new_realm/clients , and access the client you created for Keystone, copy the Client ID displayed in the page"},{"line_number":87,"context_line":"        - client_secret: In the same page you got the client_id, access the tab"},{"line_number":88,"context_line":"          \"Credentials\" and copy the secret value"},{"line_number":89,"context_line":"    - .provider: Copy the json from http://localhost:8080/auth/realms/new_realm/.well-known/openid-configuration (the \"new_realm\" is the realm name)"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"After you finished the configuration of the Identity Provider, your main"},{"line_number":92,"context_line":"configuration should be something like the following:"}],"source_content_type":"text/x-rst","patch_set":49,"id":"d2ceb533_cb5335a6","line":89,"updated":"2021-01-28 12:20:06.000000000","message":"I guess .conf should be empty?","commit_id":"6d7b2892962d27a8114933aca8696f5d2b96d366"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"fe9f19bc236254ed21c50bfa19e44dd022fb2ec8","unresolved":true,"context_lines":[{"line_number":86,"context_line":"        - client_id: Access http://localhost:8080/auth/admin/master/console/#/realms/new_realm/clients , and access the client you created for Keystone, copy the Client ID displayed in the page"},{"line_number":87,"context_line":"        - client_secret: In the same page you got the client_id, access the tab"},{"line_number":88,"context_line":"          \"Credentials\" and copy the secret value"},{"line_number":89,"context_line":"    - .provider: Copy the json from http://localhost:8080/auth/realms/new_realm/.well-known/openid-configuration (the \"new_realm\" is the realm name)"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"After you finished the configuration of the Identity Provider, your main"},{"line_number":92,"context_line":"configuration should be something like the following:"}],"source_content_type":"text/x-rst","patch_set":49,"id":"601c423e_17e08e6a","line":89,"in_reply_to":"d2ceb533_cb5335a6","updated":"2021-02-01 21:07:56.000000000","message":"no, the .conf file should be an empty JSON file \u0027{}\u0027, but I will add this one","commit_id":"6d7b2892962d27a8114933aca8696f5d2b96d366"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"08a58a57fde74ee458ea2f7d4c9e825a788f1fc2","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"dae53fa3_21740f89","line":5,"updated":"2021-02-02 19:41:52.000000000","message":"I\u0027m pretty sure I followed these instructions, but can\u0027t get it working. I just get this back:\n\nError:\n\nInvalid Request\n\nDescription:\n\nCould not find valid provider metadata for the selected OpenID Connect provider; contact the administrator","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"ed5ec401384821ae97fa62a03a9bac9a172505b3","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"b16b693f_afabbfcd","line":5,"in_reply_to":"260dd8c7_3ed872e5","updated":"2021-02-03 17:58:24.000000000","message":"hmm, looks like I used the wrong IP for the redirect URI. That allowed me to get to a keycloak login page. I entered my password, then set a new password, but then it said the request had timed out. Now I try again and I get \u0027The request you have made requires authentication.\u0027 from horizon. Arrrgh","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"29cdbc1f99c0f73fb776b2ab6b7e8047556f87b3","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"59f69a28_75459d47","line":5,"in_reply_to":"4f59dbe7_1f6c5dee","updated":"2021-02-04 14:59:04.000000000","message":"I expect this is the reason:\n\n2021-02-04 08:53:50.864684 oidc_metadata_provider_is_valid: requested issuer (https://localhost:8080/auth/realms/new_realm) does not match the \"issuer\" value in the provider metadata file: http://localhost:8080/auth/realms/new_realm","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"09beb1ea55e8d27c0e3e3f05762a7d7f16ceb07e","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"757a5560_ddfd1bcd","line":5,"in_reply_to":"538f02b1_c697e0b7","updated":"2021-02-03 14:31:18.000000000","message":"No link on the page: https://drive.google.com/file/d/1CeYQPtCwTUQIftiBLIu6xtV6vaZ2tJXM/view?usp\u003dsharing","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"145b93f07951377414e1b90128dd7eee55b12652","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"538f02b1_c697e0b7","line":5,"in_reply_to":"58ebfb91_39c0c2e7","updated":"2021-02-03 12:34:49.000000000","message":"Hi Mark, you should see a link in this page to redirect you to the authentication page, the input to enter an IdP domain is to be used only if you do not see the link, but the link should be in the page (the page after selecting the IdP on Horizon).\n\nCould you validate if there is a link in this page?","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"a48370dffd5f78175ffdf4fdaedbf500a44901b7","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"260dd8c7_3ed872e5","line":5,"in_reply_to":"62252939_387afa15","updated":"2021-02-03 17:25:34.000000000","message":"did you configure that redirect_uri (http://192.168.33.2:5000/redirect_uri) on the keycloak realm client that you created for the keystone? Also, your wsgi configuration is missing this configuration:\n\n{% if keystone_federation_openid_certificate_key_ids | length \u003e 0 %}\n    OIDCOAuthVerifyCertFiles {{ keystone_federation_openid_certificate_key_ids | join(\" \") }}\n{% endif %}","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"f35828a6c36fedf119e38fff001b8edb6d80f334","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"d4686ec9_ae5eaf23","line":5,"in_reply_to":"757a5560_ddfd1bcd","updated":"2021-02-03 14:53:20.000000000","message":"It seems that there is no IdP configured in the apache2 mod OIDC, could you share the config in your wsgi-keystone.conf? And also, maybe the keystone error log is showing some error","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"e074b17cd0fc1aab916bdb779c280d27d9c35130","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"62252939_387afa15","line":5,"in_reply_to":"9f78010c_1f11e320","updated":"2021-02-03 16:11:07.000000000","message":"Keycloak logs have:\n\n16:07:02,889 WARN  [org.keycloak.events] (default task-35) type\u003dLOGIN_ERROR, realmId\u003dnew_realm, clientId\u003dfoo-id, userId\u003dnull, ipAddress\u003d172.17.0.1, error\u003dinvalid_redirect_uri, redirect_uri\u003dhttp://192.168.33.2:5000/redirect_uri","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aaf4b24a695bf4d3a6220ecf75aa367ebf86eb04","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"4f59dbe7_1f6c5dee","line":5,"in_reply_to":"b16b693f_afabbfcd","updated":"2021-02-03 19:05:29.000000000","message":"Are you sure that is everything ok with the dir /etc/httpd/metadata inside the keystone container? Are all the files there? the .conf, .provider and .client files, because is very strange that your discovery page is not displaying the IdP link.","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"681292e16ac955854e8f2068e5bceaebb5f5a704","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"58ebfb91_39c0c2e7","line":5,"in_reply_to":"c70780df_9146b758","updated":"2021-02-03 09:42:08.000000000","message":"Yes - select new_realm from the horizon drop down, click sign in. Then enter new_realm.com (I tried lots of other things too), and I get that message.","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"5c436f0efd6c1a000d0b1dd10d30821ea81c628d","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"9f78010c_1f11e320","line":5,"in_reply_to":"d4686ec9_ae5eaf23","updated":"2021-02-03 16:09:48.000000000","message":"Oops, I was checking keystone admin error log but it is actually in the public one. It has this error:\n\noidc_metadata_provider_is_valid: requested issuer (https://localhost:8080/auth/realms/new_realm) does not match the \"issuer\" value in the provider metadata file: http://localhost:8080/auth/realms/new_realm\n\nI tried putting http://localhost:8080/auth/realms/new_realm into the input and it did get me to keycloak, but it says:\n\nWe are sorry...\n\nInvalid parameter: redirect_uri\n\nWSGI config:\n\n\u003cVirtualHost *:5000\u003e\n    WSGIDaemonProcess keystone-public processes\u003d1 threads\u003d1 user\u003dkeystone group\u003dkeystone display-name\u003d%{GROUP}\n    WSGIProcessGroup keystone-public\n    WSGIScriptAlias / /usr/bin/keystone-wsgi-public\n    WSGIApplicationGroup %{GLOBAL}\n    WSGIPassAuthorization On\n    \u003cIfVersion \u003e\u003d 2.4\u003e\n      ErrorLogFormat \"%{cu}t %M\"\n    \u003c/IfVersion\u003e\n    ErrorLog \"/var/log/kolla/keystone/keystone-apache-public-error.log\"\n    LogFormat \"%{X-Forwarded-For}i %l %u %t \\\"%r\\\" %\u003es %b %D \\\"%{Referer}i\\\" \\\"%{User-Agent}i\\\"\" logformat\n    CustomLog \"/var/log/kolla/keystone/keystone-apache-public-access.log\" logformat\n\n\n    OIDCClaimPrefix \"OIDC-\"\n    OIDCClaimDelimiter \";\"\n    OIDCResponseType \"id_token\"\n    OIDCScope \"openid email profile\"\n    OIDCMetadataDir /etc/httpd/metadata\n    OIDCCryptoPassphrase BTB3S4FotVSc8o6jvSRBNcNuY4MVb2jqNXAMll9v\n    OIDCRedirectURI http://192.168.33.2:5000/redirect_uri\n\n    \u003cLocation ~ \"/redirect_uri\"\u003e\n      Require valid-user\n      AuthType openid-connect\n    \u003c/Location\u003e\n\n    \u003cLocation /v3/auth/OS-FEDERATION/websso/openid\u003e\n      Require valid-user\n      AuthType openid-connect\n    \u003c/Location\u003e\n\n    \u003cLocationMatch /v3/auth/OS-FEDERATION/identity_providers/new_realm/protocols/openid/websso\u003e\n      Require valid-user\n      AuthType openid-connect\n    \u003c/LocationMatch\u003e\n\n        \u003cLocationMatch /v3/OS-FEDERATION/identity_providers/new_realm/protocols/openid/auth\u003e\n      Require valid-user\n      AuthType auth-openidc\n    \u003c/LocationMatch\u003e\n\u003c/VirtualHost\u003e","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"change_message_id":"e49f8ea3980039d995904b9139dc445a0d402b3d","unresolved":true,"context_lines":[{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"}],"source_content_type":"text/x-rst","patch_set":51,"id":"c70780df_9146b758","line":5,"in_reply_to":"dae53fa3_21740f89","updated":"2021-02-02 23:37:59.000000000","message":"When is this error happening? After you set everything up? And then you try to login with Horizon?","commit_id":"24de6135697f6d6db34955d2b22374071d7daa55"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":1,"context_line":".. _setup-identity-provider:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"}],"source_content_type":"text/x-rst","patch_set":56,"id":"60d196f2_947069e7","line":4,"updated":"2021-02-14 20:31:10.000000000","message":"Test Identity ...\n\n(or something else suggestive enough to prevent people from considering this a production-ready doc)","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":1,"context_line":".. _setup-identity-provider:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"}],"source_content_type":"text/x-rst","patch_set":56,"id":"70f72612_389c123f","line":4,"in_reply_to":"60d196f2_947069e7","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"},{"line_number":8,"context_line":"Connect protocol to authenticate users when"},{"line_number":9,"context_line":":keystone-doc:`using Federation with OpenStack"},{"line_number":10,"context_line":"\u003c/admin/federation/configure_federation.html\u003e`."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Keycloak"},{"line_number":13,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":56,"id":"d34b9150_2a3f177a","line":10,"range":{"start_line":9,"start_character":0,"end_line":10,"end_character":47},"updated":"2021-02-14 20:31:10.000000000","message":"here we should likely cross-link to this newly-added section in our keystone integration docs","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":12,"context_line":"Keycloak"},{"line_number":13,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Keycloak is a JAVA application that implements an Identity Provider that"},{"line_number":16,"context_line":"handles both OpenID Connect and SAML protocols."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"To setup a Keycloak instance for testing is pretty simple with Docker."}],"source_content_type":"text/x-rst","patch_set":56,"id":"9d5a14f2_7a695684","line":15,"range":{"start_line":15,"start_character":14,"end_line":15,"end_character":19},"updated":"2021-02-14 20:31:10.000000000","message":"Java","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Keycloak"},{"line_number":13,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Keycloak is a JAVA application that implements an Identity Provider that"},{"line_number":16,"context_line":"handles both OpenID Connect and SAML protocols."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"To setup a Keycloak instance for testing is pretty simple with Docker."}],"source_content_type":"text/x-rst","patch_set":56,"id":"7f022185_ace1beed","line":15,"range":{"start_line":15,"start_character":14,"end_line":15,"end_character":19},"in_reply_to":"9d5a14f2_7a695684","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":12,"context_line":"Keycloak"},{"line_number":13,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Keycloak is a JAVA application that implements an Identity Provider that"},{"line_number":16,"context_line":"handles both OpenID Connect and SAML protocols."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"To setup a Keycloak instance for testing is pretty simple with Docker."},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"0d60b98f_4464e571","line":16,"range":{"start_line":15,"start_character":68,"end_line":16,"end_character":7},"updated":"2021-02-14 20:31:10.000000000","message":"handling","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Keycloak"},{"line_number":13,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Keycloak is a JAVA application that implements an Identity Provider that"},{"line_number":16,"context_line":"handles both OpenID Connect and SAML protocols."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"To setup a Keycloak instance for testing is pretty simple with Docker."},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"df22692c_a8c6a50b","line":16,"range":{"start_line":15,"start_character":68,"end_line":16,"end_character":7},"in_reply_to":"0d60b98f_4464e571","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":".. code-block:: console"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"    docker run -p 8080:8080 -p 8443:8443 -e KEYCLOAK_USER\u003dadmin -e KEYCLOAK_PASSWORD\u003dadmin quay.io/keycloak/keycloak:11.0.3"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This will create a Keycloak instance using docker that has the admin"},{"line_number":30,"context_line":"credentials as admin/admin and listening to port 8080."}],"source_content_type":"text/x-rst","patch_set":56,"id":"10547edb_adb398be","line":27,"range":{"start_line":27,"start_character":117,"end_line":27,"end_character":123},"updated":"2021-02-14 20:31:10.000000000","message":"I don\u0027t think we should pin it here so accurately?","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":".. code-block:: console"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"    docker run -p 8080:8080 -p 8443:8443 -e KEYCLOAK_USER\u003dadmin -e KEYCLOAK_PASSWORD\u003dadmin quay.io/keycloak/keycloak:11.0.3"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This will create a Keycloak instance using docker that has the admin"},{"line_number":30,"context_line":"credentials as admin/admin and listening to port 8080."}],"source_content_type":"text/x-rst","patch_set":56,"id":"f3a3d067_d3fb7078","line":27,"range":{"start_line":27,"start_character":117,"end_line":27,"end_character":123},"in_reply_to":"10547edb_adb398be","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"    docker run -p 8080:8080 -p 8443:8443 -e KEYCLOAK_USER\u003dadmin -e KEYCLOAK_PASSWORD\u003dadmin quay.io/keycloak/keycloak:11.0.3"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This will create a Keycloak instance using docker that has the admin"},{"line_number":30,"context_line":"credentials as admin/admin and listening to port 8080."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"After creating the instance, you will need to log in the Keycloak as"}],"source_content_type":"text/x-rst","patch_set":56,"id":"7e693034_53f3848e","line":29,"range":{"start_line":29,"start_character":37,"end_line":29,"end_character":49},"updated":"2021-02-14 20:31:10.000000000","message":"Delete this part. We know it\u0027s docker and suddenly it\u0027s confusing because the subsentence actually refers to Keycloak and not docker.","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"    docker run -p 8080:8080 -p 8443:8443 -e KEYCLOAK_USER\u003dadmin -e KEYCLOAK_PASSWORD\u003dadmin quay.io/keycloak/keycloak:11.0.3"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This will create a Keycloak instance using docker that has the admin"},{"line_number":30,"context_line":"credentials as admin/admin and listening to port 8080."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"After creating the instance, you will need to log in the Keycloak as"}],"source_content_type":"text/x-rst","patch_set":56,"id":"d2009de9_5001864a","line":29,"range":{"start_line":29,"start_character":37,"end_line":29,"end_character":49},"in_reply_to":"7e693034_53f3848e","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":27,"context_line":"    docker run -p 8080:8080 -p 8443:8443 -e KEYCLOAK_USER\u003dadmin -e KEYCLOAK_PASSWORD\u003dadmin quay.io/keycloak/keycloak:11.0.3"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This will create a Keycloak instance using docker that has the admin"},{"line_number":30,"context_line":"credentials as admin/admin and listening to port 8080."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"After creating the instance, you will need to log in the Keycloak as"},{"line_number":33,"context_line":"administrator and setup the first Identity Provider."}],"source_content_type":"text/x-rst","patch_set":56,"id":"122728ef_5a7e7cec","line":30,"range":{"start_line":30,"start_character":31,"end_line":30,"end_character":43},"updated":"2021-02-14 20:31:10.000000000","message":"is listening on","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":27,"context_line":"    docker run -p 8080:8080 -p 8443:8443 -e KEYCLOAK_USER\u003dadmin -e KEYCLOAK_PASSWORD\u003dadmin quay.io/keycloak/keycloak:11.0.3"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"This will create a Keycloak instance using docker that has the admin"},{"line_number":30,"context_line":"credentials as admin/admin and listening to port 8080."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"After creating the instance, you will need to log in the Keycloak as"},{"line_number":33,"context_line":"administrator and setup the first Identity Provider."}],"source_content_type":"text/x-rst","patch_set":56,"id":"f4c265e4_3650c416","line":30,"range":{"start_line":30,"start_character":31,"end_line":30,"end_character":43},"in_reply_to":"122728ef_5a7e7cec","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":29,"context_line":"This will create a Keycloak instance using docker that has the admin"},{"line_number":30,"context_line":"credentials as admin/admin and listening to port 8080."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"After creating the instance, you will need to log in the Keycloak as"},{"line_number":33,"context_line":"administrator and setup the first Identity Provider."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Creating an Identity Provider with Keycloak"}],"source_content_type":"text/x-rst","patch_set":56,"id":"ad2092ba_edd58699","line":32,"range":{"start_line":32,"start_character":50,"end_line":32,"end_character":56},"updated":"2021-02-14 20:31:10.000000000","message":"in to the","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":29,"context_line":"This will create a Keycloak instance using docker that has the admin"},{"line_number":30,"context_line":"credentials as admin/admin and listening to port 8080."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"After creating the instance, you will need to log in the Keycloak as"},{"line_number":33,"context_line":"administrator and setup the first Identity Provider."},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Creating an Identity Provider with Keycloak"}],"source_content_type":"text/x-rst","patch_set":56,"id":"7ffc7cf9_f9d83cf3","line":32,"range":{"start_line":32,"start_character":50,"end_line":32,"end_character":56},"in_reply_to":"ad2092ba_edd58699","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Creating an Identity Provider with Keycloak"},{"line_number":36,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- Access the admin console on http://localhost:8080/auth/ in the Administration Console option."},{"line_number":39,"context_line":"- Authenticate using the credentials defined in the creation step."},{"line_number":40,"context_line":"- Create a new realm in the http://localhost:8080/auth/admin/master/console/#/create/realm page. In this guide, will be used the \u0027new_realm\u0027 realm name."}],"source_content_type":"text/x-rst","patch_set":56,"id":"d9606f51_21649016","line":37,"updated":"2021-02-14 20:31:10.000000000","message":"Add a sentence that the guide below assumes this is run from the same machine (localhost) and users are to substitute the hostname if they run it from elsewhere.","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Creating an Identity Provider with Keycloak"},{"line_number":36,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- Access the admin console on http://localhost:8080/auth/ in the Administration Console option."},{"line_number":39,"context_line":"- Authenticate using the credentials defined in the creation step."},{"line_number":40,"context_line":"- Create a new realm in the http://localhost:8080/auth/admin/master/console/#/create/realm page. In this guide, will be used the \u0027new_realm\u0027 realm name."}],"source_content_type":"text/x-rst","patch_set":56,"id":"e03cb8ab_ce4c41e4","line":37,"in_reply_to":"d9606f51_21649016","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- Access the admin console on http://localhost:8080/auth/ in the Administration Console option."},{"line_number":39,"context_line":"- Authenticate using the credentials defined in the creation step."},{"line_number":40,"context_line":"- Create a new realm in the http://localhost:8080/auth/admin/master/console/#/create/realm page. In this guide, will be used the \u0027new_realm\u0027 realm name."},{"line_number":41,"context_line":"- After creating a realm, you will need to create a client to be used by Keystone; to do it, just access http://localhost:8080/auth/admin/master/console/#/create/client/new_realm  (note that \u0027new_realm\u0027 is the name of the realm, you must replace it by your realm)."},{"line_number":42,"context_line":"- To create a client, you will need to set the client_id (just choose anyone),"},{"line_number":43,"context_line":"  the protocol (must be openid-connect) and the Root Url (you can leave it"}],"source_content_type":"text/x-rst","patch_set":56,"id":"855b5bcc_e51b80bc","line":40,"range":{"start_line":40,"start_character":112,"end_line":40,"end_character":124},"updated":"2021-02-14 20:31:10.000000000","message":"move to the end of the sentence","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"- Access the admin console on http://localhost:8080/auth/ in the Administration Console option."},{"line_number":39,"context_line":"- Authenticate using the credentials defined in the creation step."},{"line_number":40,"context_line":"- Create a new realm in the http://localhost:8080/auth/admin/master/console/#/create/realm page. In this guide, will be used the \u0027new_realm\u0027 realm name."},{"line_number":41,"context_line":"- After creating a realm, you will need to create a client to be used by Keystone; to do it, just access http://localhost:8080/auth/admin/master/console/#/create/client/new_realm  (note that \u0027new_realm\u0027 is the name of the realm, you must replace it by your realm)."},{"line_number":42,"context_line":"- To create a client, you will need to set the client_id (just choose anyone),"},{"line_number":43,"context_line":"  the protocol (must be openid-connect) and the Root Url (you can leave it"}],"source_content_type":"text/x-rst","patch_set":56,"id":"97f0baf4_13ace58f","line":40,"range":{"start_line":40,"start_character":112,"end_line":40,"end_character":124},"in_reply_to":"855b5bcc_e51b80bc","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":48,"context_line":"  - Enable the Implicit flow (this one allows you to use the OpenStack CLI with"},{"line_number":49,"context_line":"    oidcv3 plugin)"},{"line_number":50,"context_line":"  - Set Access Type to confidential"},{"line_number":51,"context_line":"  - Add the Horizon and Keystone URIs to the Valid Redirect URIs, Keystone should be within the \u0027/redirect_uri\u0027 path, for example (https://horizon.com/ and https://keystone.com/redirect_uri)"},{"line_number":52,"context_line":"  - Save the changes"},{"line_number":53,"context_line":"  - Access the client\u0027s Mappers tab to add the user\u0027s attributes that will be"},{"line_number":54,"context_line":"    shared with the client (Keystone):"}],"source_content_type":"text/x-rst","patch_set":56,"id":"d54b6f30_7914507f","line":51,"range":{"start_line":51,"start_character":64,"end_line":51,"end_character":65},"updated":"2021-02-14 20:31:10.000000000","message":".","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":48,"context_line":"  - Enable the Implicit flow (this one allows you to use the OpenStack CLI with"},{"line_number":49,"context_line":"    oidcv3 plugin)"},{"line_number":50,"context_line":"  - Set Access Type to confidential"},{"line_number":51,"context_line":"  - Add the Horizon and Keystone URIs to the Valid Redirect URIs, Keystone should be within the \u0027/redirect_uri\u0027 path, for example (https://horizon.com/ and https://keystone.com/redirect_uri)"},{"line_number":52,"context_line":"  - Save the changes"},{"line_number":53,"context_line":"  - Access the client\u0027s Mappers tab to add the user\u0027s attributes that will be"},{"line_number":54,"context_line":"    shared with the client (Keystone):"}],"source_content_type":"text/x-rst","patch_set":56,"id":"772ef621_77e0a571","line":51,"range":{"start_line":51,"start_character":129,"end_line":51,"end_character":130},"updated":"2021-02-14 20:31:10.000000000","message":"there should probably be a colon here and no parentheses","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  - Enable the Implicit flow (this one allows you to use the OpenStack CLI with"},{"line_number":49,"context_line":"    oidcv3 plugin)"},{"line_number":50,"context_line":"  - Set Access Type to confidential"},{"line_number":51,"context_line":"  - Add the Horizon and Keystone URIs to the Valid Redirect URIs, Keystone should be within the \u0027/redirect_uri\u0027 path, for example (https://horizon.com/ and https://keystone.com/redirect_uri)"},{"line_number":52,"context_line":"  - Save the changes"},{"line_number":53,"context_line":"  - Access the client\u0027s Mappers tab to add the user\u0027s attributes that will be"},{"line_number":54,"context_line":"    shared with the client (Keystone):"}],"source_content_type":"text/x-rst","patch_set":56,"id":"dd67bab9_03eaf724","line":51,"range":{"start_line":51,"start_character":129,"end_line":51,"end_character":130},"in_reply_to":"772ef621_77e0a571","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":48,"context_line":"  - Enable the Implicit flow (this one allows you to use the OpenStack CLI with"},{"line_number":49,"context_line":"    oidcv3 plugin)"},{"line_number":50,"context_line":"  - Set Access Type to confidential"},{"line_number":51,"context_line":"  - Add the Horizon and Keystone URIs to the Valid Redirect URIs, Keystone should be within the \u0027/redirect_uri\u0027 path, for example (https://horizon.com/ and https://keystone.com/redirect_uri)"},{"line_number":52,"context_line":"  - Save the changes"},{"line_number":53,"context_line":"  - Access the client\u0027s Mappers tab to add the user\u0027s attributes that will be"},{"line_number":54,"context_line":"    shared with the client (Keystone):"}],"source_content_type":"text/x-rst","patch_set":56,"id":"4c57e4f6_286432c7","line":51,"range":{"start_line":51,"start_character":64,"end_line":51,"end_character":65},"in_reply_to":"d54b6f30_7914507f","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"- After creating the client, you will need to create a user in that realm to"},{"line_number":66,"context_line":"  log in OpenStack via identity federation"},{"line_number":67,"context_line":"- To create a user, access http://localhost:8080/auth/admin/master/console/#/create/user/new_realm (\u0027new_realm\u0027 is the name of the realm) and fill the form with the user\u0027s data"},{"line_number":68,"context_line":"- After creating the user, you can access the tab \"Credentials\" to set the"},{"line_number":69,"context_line":"  user\u0027s password"},{"line_number":70,"context_line":"- Then, in the tab \"Attributes\", you must set the authorization attributes to"}],"source_content_type":"text/x-rst","patch_set":56,"id":"c2709845_49f54468","line":67,"range":{"start_line":67,"start_character":99,"end_line":67,"end_character":137},"updated":"2021-02-14 20:31:10.000000000","message":"this gets boring, let\u0027s mention it at the top as well; I think devs would be fine clicking through the UI anyhow","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":64,"context_line":""},{"line_number":65,"context_line":"- After creating the client, you will need to create a user in that realm to"},{"line_number":66,"context_line":"  log in OpenStack via identity federation"},{"line_number":67,"context_line":"- To create a user, access http://localhost:8080/auth/admin/master/console/#/create/user/new_realm (\u0027new_realm\u0027 is the name of the realm) and fill the form with the user\u0027s data"},{"line_number":68,"context_line":"- After creating the user, you can access the tab \"Credentials\" to set the"},{"line_number":69,"context_line":"  user\u0027s password"},{"line_number":70,"context_line":"- Then, in the tab \"Attributes\", you must set the authorization attributes to"}],"source_content_type":"text/x-rst","patch_set":56,"id":"16a0329f_48a0c5c6","line":67,"range":{"start_line":67,"start_character":99,"end_line":67,"end_character":137},"in_reply_to":"c2709845_49f54468","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":72,"context_line":"  mapping \u003cattribute_mapping\u003e` in Keystone"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"After you create the Identity provider, you will need to get some data from the"},{"line_number":75,"context_line":"Identity Provider to configure in kolla-ansible"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Configuring Kolla-ansible to use the Identity Provider"},{"line_number":78,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":56,"id":"87bbbf0e_99b3c7a0","line":75,"range":{"start_line":75,"start_character":34,"end_line":75,"end_character":47},"updated":"2021-02-14 20:31:10.000000000","message":"Kolla Ansible.","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":72,"context_line":"  mapping \u003cattribute_mapping\u003e` in Keystone"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"After you create the Identity provider, you will need to get some data from the"},{"line_number":75,"context_line":"Identity Provider to configure in kolla-ansible"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Configuring Kolla-ansible to use the Identity Provider"},{"line_number":78,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":56,"id":"099a06a5_93bd059d","line":75,"range":{"start_line":75,"start_character":34,"end_line":75,"end_character":47},"in_reply_to":"87bbbf0e_99b3c7a0","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":74,"context_line":"After you create the Identity provider, you will need to get some data from the"},{"line_number":75,"context_line":"Identity Provider to configure in kolla-ansible"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Configuring Kolla-ansible to use the Identity Provider"},{"line_number":78,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"This section is about how one can get the data needed in"}],"source_content_type":"text/x-rst","patch_set":56,"id":"43a31ede_6d2aab71","line":77,"range":{"start_line":77,"start_character":12,"end_line":77,"end_character":25},"updated":"2021-02-14 20:31:10.000000000","message":"Kolla Ansible","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":74,"context_line":"After you create the Identity provider, you will need to get some data from the"},{"line_number":75,"context_line":"Identity Provider to configure in kolla-ansible"},{"line_number":76,"context_line":""},{"line_number":77,"context_line":"Configuring Kolla-ansible to use the Identity Provider"},{"line_number":78,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"This section is about how one can get the data needed in"}],"source_content_type":"text/x-rst","patch_set":56,"id":"9e994974_905f701c","line":77,"range":{"start_line":77,"start_character":12,"end_line":77,"end_character":25},"in_reply_to":"43a31ede_6d2aab71","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":78,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"This section is about how one can get the data needed in"},{"line_number":81,"context_line":":ref:`Setup OIDC via Kolla Ansible \u003csetup-oidc-kolla-ansible\u003e`. For more"},{"line_number":82,"context_line":"information on how to configure the metadata_folder, please check the Keystone"},{"line_number":83,"context_line":"multiple identity provider documentation in the"},{"line_number":84,"context_line":":keystone-doc:`Keystone documentation"},{"line_number":85,"context_line":"\u003c/admin/federation/configure_federation.html#configuring-multiple-identity-providers\u003e`."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"- name: The realm name, in that case will be \"new_realm\""},{"line_number":88,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"}],"source_content_type":"text/x-rst","patch_set":56,"id":"053890c6_019fa50c","line":85,"range":{"start_line":81,"start_character":64,"end_line":85,"end_character":87},"updated":"2021-02-14 20:31:10.000000000","message":"this is redundant, let\u0027s keep it in the other page only","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":78,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"This section is about how one can get the data needed in"},{"line_number":81,"context_line":":ref:`Setup OIDC via Kolla Ansible \u003csetup-oidc-kolla-ansible\u003e`. For more"},{"line_number":82,"context_line":"information on how to configure the metadata_folder, please check the Keystone"},{"line_number":83,"context_line":"multiple identity provider documentation in the"},{"line_number":84,"context_line":":keystone-doc:`Keystone documentation"},{"line_number":85,"context_line":"\u003c/admin/federation/configure_federation.html#configuring-multiple-identity-providers\u003e`."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"- name: The realm name, in that case will be \"new_realm\""},{"line_number":88,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"}],"source_content_type":"text/x-rst","patch_set":56,"id":"d8a66f15_da376e9a","line":85,"range":{"start_line":81,"start_character":64,"end_line":85,"end_character":87},"in_reply_to":"053890c6_019fa50c","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":84,"context_line":":keystone-doc:`Keystone documentation"},{"line_number":85,"context_line":"\u003c/admin/federation/configure_federation.html#configuring-multiple-identity-providers\u003e`."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"- name: The realm name, in that case will be \"new_realm\""},{"line_number":88,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"},{"line_number":89,"context_line":"- certificate_file: This one can be downloaded from http://localhost:8080/auth/admin/master/console/#/realms/new_realm/keys"},{"line_number":90,"context_line":"- metadata_folder:"}],"source_content_type":"text/x-rst","patch_set":56,"id":"45fd0df7_ed058334","line":87,"range":{"start_line":87,"start_character":36,"end_line":87,"end_character":37},"updated":"2021-02-14 20:31:10.000000000","message":"it","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":84,"context_line":":keystone-doc:`Keystone documentation"},{"line_number":85,"context_line":"\u003c/admin/federation/configure_federation.html#configuring-multiple-identity-providers\u003e`."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"- name: The realm name, in that case will be \"new_realm\""},{"line_number":88,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"},{"line_number":89,"context_line":"- certificate_file: This one can be downloaded from http://localhost:8080/auth/admin/master/console/#/realms/new_realm/keys"},{"line_number":90,"context_line":"- metadata_folder:"}],"source_content_type":"text/x-rst","patch_set":56,"id":"7d0280b8_2303eaae","line":87,"range":{"start_line":87,"start_character":27,"end_line":87,"end_character":32},"updated":"2021-02-14 20:31:10.000000000","message":"this","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":84,"context_line":":keystone-doc:`Keystone documentation"},{"line_number":85,"context_line":"\u003c/admin/federation/configure_federation.html#configuring-multiple-identity-providers\u003e`."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"- name: The realm name, in that case will be \"new_realm\""},{"line_number":88,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"},{"line_number":89,"context_line":"- certificate_file: This one can be downloaded from http://localhost:8080/auth/admin/master/console/#/realms/new_realm/keys"},{"line_number":90,"context_line":"- metadata_folder:"}],"source_content_type":"text/x-rst","patch_set":56,"id":"6fffec54_2136a272","line":87,"range":{"start_line":87,"start_character":36,"end_line":87,"end_character":37},"in_reply_to":"45fd0df7_ed058334","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":84,"context_line":":keystone-doc:`Keystone documentation"},{"line_number":85,"context_line":"\u003c/admin/federation/configure_federation.html#configuring-multiple-identity-providers\u003e`."},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"- name: The realm name, in that case will be \"new_realm\""},{"line_number":88,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"},{"line_number":89,"context_line":"- certificate_file: This one can be downloaded from http://localhost:8080/auth/admin/master/console/#/realms/new_realm/keys"},{"line_number":90,"context_line":"- metadata_folder:"}],"source_content_type":"text/x-rst","patch_set":56,"id":"b0f4d008_f115eeb9","line":87,"range":{"start_line":87,"start_character":27,"end_line":87,"end_character":32},"in_reply_to":"7d0280b8_2303eaae","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":87,"context_line":"- name: The realm name, in that case will be \"new_realm\""},{"line_number":88,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"},{"line_number":89,"context_line":"- certificate_file: This one can be downloaded from http://localhost:8080/auth/admin/master/console/#/realms/new_realm/keys"},{"line_number":90,"context_line":"- metadata_folder:"},{"line_number":91,"context_line":"    - localhost%3A8080%2Fauth%2Frealms%2Fnew_realm.client:"},{"line_number":92,"context_line":"        - client_id: Access http://localhost:8080/auth/admin/master/console/#/realms/new_realm/clients , and access the client you created for Keystone, copy the Client ID displayed in the page"},{"line_number":93,"context_line":"        - client_secret: In the same page you got the client_id, access the tab"}],"source_content_type":"text/x-rst","patch_set":56,"id":"e6d533c4_517e6172","line":90,"range":{"start_line":90,"start_character":17,"end_line":90,"end_character":18},"updated":"2021-02-14 20:31:10.000000000","message":"need to write something beside this colon to avoid bolding","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":87,"context_line":"- name: The realm name, in that case will be \"new_realm\""},{"line_number":88,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"},{"line_number":89,"context_line":"- certificate_file: This one can be downloaded from http://localhost:8080/auth/admin/master/console/#/realms/new_realm/keys"},{"line_number":90,"context_line":"- metadata_folder:"},{"line_number":91,"context_line":"    - localhost%3A8080%2Fauth%2Frealms%2Fnew_realm.client:"},{"line_number":92,"context_line":"        - client_id: Access http://localhost:8080/auth/admin/master/console/#/realms/new_realm/clients , and access the client you created for Keystone, copy the Client ID displayed in the page"},{"line_number":93,"context_line":"        - client_secret: In the same page you got the client_id, access the tab"}],"source_content_type":"text/x-rst","patch_set":56,"id":"bcdb4bf4_bfc8e72d","line":90,"range":{"start_line":90,"start_character":17,"end_line":90,"end_character":18},"in_reply_to":"e6d533c4_517e6172","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":88,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"},{"line_number":89,"context_line":"- certificate_file: This one can be downloaded from http://localhost:8080/auth/admin/master/console/#/realms/new_realm/keys"},{"line_number":90,"context_line":"- metadata_folder:"},{"line_number":91,"context_line":"    - localhost%3A8080%2Fauth%2Frealms%2Fnew_realm.client:"},{"line_number":92,"context_line":"        - client_id: Access http://localhost:8080/auth/admin/master/console/#/realms/new_realm/clients , and access the client you created for Keystone, copy the Client ID displayed in the page"},{"line_number":93,"context_line":"        - client_secret: In the same page you got the client_id, access the tab"},{"line_number":94,"context_line":"          \"Credentials\" and copy the secret value"}],"source_content_type":"text/x-rst","patch_set":56,"id":"ca1fb229_56ba872d","line":91,"range":{"start_line":91,"start_character":57,"end_line":91,"end_character":58},"updated":"2021-02-14 20:31:10.000000000","message":"ditto","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":88,"context_line":"- identifier: http://localhost:8080/auth/realms/new_realm/ (again, the \"new_realm\" is the name of the realm)"},{"line_number":89,"context_line":"- certificate_file: This one can be downloaded from http://localhost:8080/auth/admin/master/console/#/realms/new_realm/keys"},{"line_number":90,"context_line":"- metadata_folder:"},{"line_number":91,"context_line":"    - localhost%3A8080%2Fauth%2Frealms%2Fnew_realm.client:"},{"line_number":92,"context_line":"        - client_id: Access http://localhost:8080/auth/admin/master/console/#/realms/new_realm/clients , and access the client you created for Keystone, copy the Client ID displayed in the page"},{"line_number":93,"context_line":"        - client_secret: In the same page you got the client_id, access the tab"},{"line_number":94,"context_line":"          \"Credentials\" and copy the secret value"}],"source_content_type":"text/x-rst","patch_set":56,"id":"076adf46_29579976","line":91,"range":{"start_line":91,"start_character":57,"end_line":91,"end_character":58},"in_reply_to":"ca1fb229_56ba872d","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":97,"context_line":"      file as an empty json \"{}\""},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"After you finished the configuration of the Identity Provider, your main"},{"line_number":100,"context_line":"configuration should be something like the following:"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":".. code-block::"},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"3745f60c_4915d2fc","line":100,"range":{"start_line":100,"start_character":21,"end_line":100,"end_character":24},"updated":"2021-02-14 20:31:10.000000000","message":"look","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":97,"context_line":"      file as an empty json \"{}\""},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"After you finished the configuration of the Identity Provider, your main"},{"line_number":100,"context_line":"configuration should be something like the following:"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":".. code-block::"},{"line_number":103,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"426f1b88_31b95752","line":100,"range":{"start_line":100,"start_character":21,"end_line":100,"end_character":24},"in_reply_to":"3745f60c_4915d2fc","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":117,"context_line":"Then, after deploying OpenStack, you should be able to log in Horizon"},{"line_number":118,"context_line":"using the \"Authenticate using\" -\u003e \"Authenticate via new_realm\", and writing"},{"line_number":119,"context_line":"\"new_realm.com\" in the \"E-mail or domain name\" field. After that, you will be"},{"line_number":120,"context_line":"redirect to a new page to choose the Identity Provider in Keystone, just click in the link"},{"line_number":121,"context_line":"\"localhost:8080/auth/realms/new_realm\"; this will redirect you to Keycloak (idP) where"},{"line_number":122,"context_line":"you will need to log in with the user that you created, and if the user\u0027s"},{"line_number":123,"context_line":"attributes in Keycloak are ok, the user will be created in OpenStack and you will"}],"source_content_type":"text/x-rst","patch_set":56,"id":"6247b537_2a3b3e2c","line":120,"range":{"start_line":120,"start_character":66,"end_line":120,"end_character":67},"updated":"2021-02-14 20:31:10.000000000","message":". (and start next sentence with a capital letter)","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":117,"context_line":"Then, after deploying OpenStack, you should be able to log in Horizon"},{"line_number":118,"context_line":"using the \"Authenticate using\" -\u003e \"Authenticate via new_realm\", and writing"},{"line_number":119,"context_line":"\"new_realm.com\" in the \"E-mail or domain name\" field. After that, you will be"},{"line_number":120,"context_line":"redirect to a new page to choose the Identity Provider in Keystone, just click in the link"},{"line_number":121,"context_line":"\"localhost:8080/auth/realms/new_realm\"; this will redirect you to Keycloak (idP) where"},{"line_number":122,"context_line":"you will need to log in with the user that you created, and if the user\u0027s"},{"line_number":123,"context_line":"attributes in Keycloak are ok, the user will be created in OpenStack and you will"}],"source_content_type":"text/x-rst","patch_set":56,"id":"7f003ffb_d7d9ebfb","line":120,"range":{"start_line":120,"start_character":0,"end_line":120,"end_character":9},"updated":"2021-02-14 20:31:10.000000000","message":"redirected","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":117,"context_line":"Then, after deploying OpenStack, you should be able to log in Horizon"},{"line_number":118,"context_line":"using the \"Authenticate using\" -\u003e \"Authenticate via new_realm\", and writing"},{"line_number":119,"context_line":"\"new_realm.com\" in the \"E-mail or domain name\" field. After that, you will be"},{"line_number":120,"context_line":"redirect to a new page to choose the Identity Provider in Keystone, just click in the link"},{"line_number":121,"context_line":"\"localhost:8080/auth/realms/new_realm\"; this will redirect you to Keycloak (idP) where"},{"line_number":122,"context_line":"you will need to log in with the user that you created, and if the user\u0027s"},{"line_number":123,"context_line":"attributes in Keycloak are ok, the user will be created in OpenStack and you will"}],"source_content_type":"text/x-rst","patch_set":56,"id":"c00a8c0f_d2db8533","line":120,"range":{"start_line":120,"start_character":66,"end_line":120,"end_character":67},"in_reply_to":"6247b537_2a3b3e2c","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":117,"context_line":"Then, after deploying OpenStack, you should be able to log in Horizon"},{"line_number":118,"context_line":"using the \"Authenticate using\" -\u003e \"Authenticate via new_realm\", and writing"},{"line_number":119,"context_line":"\"new_realm.com\" in the \"E-mail or domain name\" field. After that, you will be"},{"line_number":120,"context_line":"redirect to a new page to choose the Identity Provider in Keystone, just click in the link"},{"line_number":121,"context_line":"\"localhost:8080/auth/realms/new_realm\"; this will redirect you to Keycloak (idP) where"},{"line_number":122,"context_line":"you will need to log in with the user that you created, and if the user\u0027s"},{"line_number":123,"context_line":"attributes in Keycloak are ok, the user will be created in OpenStack and you will"}],"source_content_type":"text/x-rst","patch_set":56,"id":"8b1a2a75_d5ba3801","line":120,"range":{"start_line":120,"start_character":0,"end_line":120,"end_character":9},"in_reply_to":"7f003ffb_d7d9ebfb","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":119,"context_line":"\"new_realm.com\" in the \"E-mail or domain name\" field. After that, you will be"},{"line_number":120,"context_line":"redirect to a new page to choose the Identity Provider in Keystone, just click in the link"},{"line_number":121,"context_line":"\"localhost:8080/auth/realms/new_realm\"; this will redirect you to Keycloak (idP) where"},{"line_number":122,"context_line":"you will need to log in with the user that you created, and if the user\u0027s"},{"line_number":123,"context_line":"attributes in Keycloak are ok, the user will be created in OpenStack and you will"},{"line_number":124,"context_line":"be able to log in Horizon."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"64e45561_a63acaeb","line":122,"range":{"start_line":122,"start_character":54,"end_line":122,"end_character":59},"updated":"2021-02-14 20:31:10.000000000","message":". (and start next sentence with a capital letter)","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":119,"context_line":"\"new_realm.com\" in the \"E-mail or domain name\" field. After that, you will be"},{"line_number":120,"context_line":"redirect to a new page to choose the Identity Provider in Keystone, just click in the link"},{"line_number":121,"context_line":"\"localhost:8080/auth/realms/new_realm\"; this will redirect you to Keycloak (idP) where"},{"line_number":122,"context_line":"you will need to log in with the user that you created, and if the user\u0027s"},{"line_number":123,"context_line":"attributes in Keycloak are ok, the user will be created in OpenStack and you will"},{"line_number":124,"context_line":"be able to log in Horizon."},{"line_number":125,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"c0c291fa_ff65fa2e","line":122,"range":{"start_line":122,"start_character":54,"end_line":122,"end_character":59},"in_reply_to":"64e45561_a63acaeb","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"c430f273da453003ffe3caec3059d5ad8eb890a1","unresolved":true,"context_lines":[{"line_number":82,"context_line":"  mapping \u003cattribute_mapping\u003e` in Keystone"},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"After you create the Identity provider, you will need to get some data from the"},{"line_number":85,"context_line":"Identity Provider to configure in Kolla-Ansible"},{"line_number":86,"context_line":""},{"line_number":87,"context_line":"Configuring Kolla Ansible to use the Identity Provider"},{"line_number":88,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":57,"id":"6288a9e4_a3c80f8a","line":85,"range":{"start_line":85,"start_character":39,"end_line":85,"end_character":40},"updated":"2021-02-19 15:16:55.000000000","message":"dash; for followup","commit_id":"f3fbe837081546c5bfa194f1e8c89f5769b96d5a"}],"doc/source/reference/shared-services/keystone-guide.rst":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"37a6ce3787b95be3b5aacdf3e0e495aefb397d4b","unresolved":false,"context_lines":[{"line_number":60,"context_line":"OpenStack supports both OpenID Connect and SAML protocols to federated"},{"line_number":61,"context_line":"identity, but for now, kolla-ansible is supporting only OpenID Connect."},{"line_number":62,"context_line":"Therefore, if you desire to use SAML in your environment, you will need"},{"line_number":63,"context_line":"to set it up manually or extend Kolla-ansible to also support it."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Setting up OpenID Connect via kolla-ansible"},{"line_number":66,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":23,"id":"bf51134e_741d4872","line":63,"range":{"start_line":63,"start_character":25,"end_line":63,"end_character":64},"updated":"2020-06-17 19:18:01.000000000","message":":D","commit_id":"0bbcbf4559a9f2365940a9523441b0b877f24e66"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Federated identity"},{"line_number":45,"context_line":"------------------"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Keystone allows users to be authenticated via identity federation. This means,"},{"line_number":48,"context_line":"integrating OpenStack Keystone with an identity provider. The use of identity"},{"line_number":49,"context_line":"federation allows users to access OpenStack services without the necessity of"}],"source_content_type":"text/x-rst","patch_set":34,"id":"9f560f44_73010407","line":46,"updated":"2020-09-15 15:45:43.000000000","message":"Always nice to link to the authoritative docs: :keystone-doc:`/admin/federation/configure_federation.html`","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":73,"context_line":""},{"line_number":74,"context_line":".. code-block:: yaml"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"    identity_providers:"},{"line_number":77,"context_line":"      - {"},{"line_number":78,"context_line":"            name: \"myidp1\","},{"line_number":79,"context_line":"            protocol: \"openid\","}],"source_content_type":"text/x-rst","patch_set":34,"id":"9f560f44_5694ae8c","line":76,"range":{"start_line":76,"start_character":4,"end_line":76,"end_character":22},"updated":"2020-09-15 15:45:43.000000000","message":"keystone_identity_providers","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":85,"context_line":"            certificate_file: \"path/to/certificate/file.pem\""},{"line_number":86,"context_line":"        }"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"    identity_providers_attribute_mappings:"},{"line_number":89,"context_line":"      - {"},{"line_number":90,"context_line":"            name: \"mappingId1\","},{"line_number":91,"context_line":"            file: \"/full/qualified/path/to/mapping/json/file/to/mappingId1\""}],"source_content_type":"text/x-rst","patch_set":34,"id":"9f560f44_d680be4c","line":88,"range":{"start_line":88,"start_character":4,"end_line":88,"end_character":41},"updated":"2020-09-15 15:45:43.000000000","message":"keystone_identity_mappings","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":89,"context_line":"      - {"},{"line_number":90,"context_line":"            name: \"mappingId1\","},{"line_number":91,"context_line":"            file: \"/full/qualified/path/to/mapping/json/file/to/mappingId1\""},{"line_number":92,"context_line":"        }"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"Identity providers configurations"},{"line_number":95,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":34,"id":"9f560f44_363adac3","line":92,"updated":"2020-09-15 15:45:43.000000000","message":"Can we include an example of how to use {{ node_config }} or similar to locate these files with your kolla config on localhost? Is there some sensible default we could use?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":121,"context_line":""},{"line_number":122,"context_line":"The attribute mapping to be used for the Identity Provider. This mapping is"},{"line_number":123,"context_line":"expected to already exist in OpenStack or be configured in the"},{"line_number":124,"context_line":"`identity_providers_attribute_mappings` property."},{"line_number":125,"context_line":""},{"line_number":126,"context_line":"organization_domain_name"},{"line_number":127,"context_line":"************************"}],"source_content_type":"text/x-rst","patch_set":34,"id":"9f560f44_768bb267","line":124,"range":{"start_line":124,"start_character":1,"end_line":124,"end_character":38},"updated":"2020-09-15 15:45:43.000000000","message":"keystone_identity_mappings","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":70,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"First, you will need to register the OpenStack (Keystone) in your Identity"},{"line_number":73,"context_line":"provider as a Service Provider."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"After registering Keystone, you will need to add the following entry in your"},{"line_number":76,"context_line":"kolla-ansible globals configuration:"}],"source_content_type":"text/x-rst","patch_set":42,"id":"debebaea_830be73b","line":73,"updated":"2021-01-06 14:13:26.000000000","message":"Maybe add:\n\nThis depends on the Service Provider and is out of scope for this guide.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":72,"context_line":"First, you will need to register the OpenStack (Keystone) in your Identity"},{"line_number":73,"context_line":"provider as a Service Provider."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"After registering Keystone, you will need to add the following entry in your"},{"line_number":76,"context_line":"kolla-ansible globals configuration:"},{"line_number":77,"context_line":""},{"line_number":78,"context_line":".. code-block:: yaml"},{"line_number":79,"context_line":""}],"source_content_type":"text/x-rst","patch_set":42,"id":"077e91cc_9dc88fb3","line":76,"range":{"start_line":75,"start_character":29,"end_line":76,"end_character":36},"updated":"2021-01-06 14:13:26.000000000","message":"make it clear this is an example","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":78,"context_line":".. code-block:: yaml"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"    keystone_identity_providers:"},{"line_number":81,"context_line":"      - {"},{"line_number":82,"context_line":"            name: \"myidp1\","},{"line_number":83,"context_line":"            protocol: \"openid\","},{"line_number":84,"context_line":"            identifier: \"https://accounts.google.com\","},{"line_number":85,"context_line":"            public_name: \"Authenticate via myidp1\","},{"line_number":86,"context_line":"            attribute_mapping: \"mappingId1\","},{"line_number":87,"context_line":"            organization_domain_name: \"xyz.com\","},{"line_number":88,"context_line":"            metadata_folder: \"path/to/metadata/folder\","},{"line_number":89,"context_line":"            certificate_file: \"path/to/certificate/file.pem\""},{"line_number":90,"context_line":"        }"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"    keystone_identity_mappings:"},{"line_number":93,"context_line":"      - {"},{"line_number":94,"context_line":"            name: \"mappingId1\","},{"line_number":95,"context_line":"            file: \"/full/qualified/path/to/mapping/json/file/to/mappingId1\""},{"line_number":96,"context_line":"        }"},{"line_number":97,"context_line":""},{"line_number":98,"context_line":"Identity providers configurations"},{"line_number":99,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":42,"id":"53a018be_fbea70ce","line":96,"range":{"start_line":81,"start_character":0,"end_line":96,"end_character":9},"updated":"2021-01-06 14:13:26.000000000","message":"curlies not required","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":112,"context_line":"identifier"},{"line_number":113,"context_line":"**********"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"The Identity provider URL; e.g. https://accounts.google.com ."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"public_name"},{"line_number":118,"context_line":"***********"}],"source_content_type":"text/x-rst","patch_set":42,"id":"c351a006_d9abfab6","line":115,"range":{"start_line":115,"start_character":0,"end_line":115,"end_character":61},"updated":"2021-01-06 14:13:26.000000000","message":"Keystone supports multiple of these. Would it ever be useful/required?","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":true,"context_lines":[{"line_number":112,"context_line":"identifier"},{"line_number":113,"context_line":"**********"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"The Identity provider URL; e.g. https://accounts.google.com ."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"public_name"},{"line_number":118,"context_line":"***********"}],"source_content_type":"text/x-rst","patch_set":42,"id":"d865f326_93499d3d","line":115,"range":{"start_line":115,"start_character":0,"end_line":115,"end_character":61},"in_reply_to":"c351a006_d9abfab6","updated":"2021-01-06 19:05:13.000000000","message":"Yes, but for now we are supporting only one, but I can change this attribute to add more \"--remote-id\" in the idp creation to handle more identifiers.","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Federated identity"},{"line_number":45,"context_line":"------------------"},{"line_number":46,"context_line":":keystone-doc:`Configuring Keystone for Federation"},{"line_number":47,"context_line":"\u003cadmin/federation/configure_federation.html\u003e`"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Keystone allows users to be authenticated via identity federation. This means,"},{"line_number":50,"context_line":"integrating OpenStack Keystone with an identity provider. The use of identity"}],"source_content_type":"text/x-rst","patch_set":56,"id":"18ca2227_ba9d0fd4","line":47,"range":{"start_line":46,"start_character":0,"end_line":47,"end_character":45},"updated":"2021-02-14 20:31:10.000000000","message":"This should be in a context like \u0027for upstream docs please see ...\u0027 and likely at the end of this first part of the section, not starting it","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Federated identity"},{"line_number":45,"context_line":"------------------"},{"line_number":46,"context_line":":keystone-doc:`Configuring Keystone for Federation"},{"line_number":47,"context_line":"\u003cadmin/federation/configure_federation.html\u003e`"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Keystone allows users to be authenticated via identity federation. This means,"},{"line_number":50,"context_line":"integrating OpenStack Keystone with an identity provider. The use of identity"}],"source_content_type":"text/x-rst","patch_set":56,"id":"7f9e2d5d_8448eb34","line":47,"range":{"start_line":46,"start_character":0,"end_line":47,"end_character":45},"in_reply_to":"18ca2227_ba9d0fd4","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":46,"context_line":":keystone-doc:`Configuring Keystone for Federation"},{"line_number":47,"context_line":"\u003cadmin/federation/configure_federation.html\u003e`"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Keystone allows users to be authenticated via identity federation. This means,"},{"line_number":50,"context_line":"integrating OpenStack Keystone with an identity provider. The use of identity"},{"line_number":51,"context_line":"federation allows users to access OpenStack services without the necessity of"},{"line_number":52,"context_line":"an account in the OpenStack environment per se. The authentication is then"}],"source_content_type":"text/x-rst","patch_set":56,"id":"bf1ed1f9_a79f09f6","line":49,"range":{"start_line":49,"start_character":77,"end_line":49,"end_character":78},"updated":"2021-02-14 20:31:10.000000000","message":"drop it","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":46,"context_line":":keystone-doc:`Configuring Keystone for Federation"},{"line_number":47,"context_line":"\u003cadmin/federation/configure_federation.html\u003e`"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Keystone allows users to be authenticated via identity federation. This means,"},{"line_number":50,"context_line":"integrating OpenStack Keystone with an identity provider. The use of identity"},{"line_number":51,"context_line":"federation allows users to access OpenStack services without the necessity of"},{"line_number":52,"context_line":"an account in the OpenStack environment per se. The authentication is then"}],"source_content_type":"text/x-rst","patch_set":56,"id":"7a2f86b2_ccafb2e8","line":49,"range":{"start_line":49,"start_character":77,"end_line":49,"end_character":78},"in_reply_to":"bf1ed1f9_a79f09f6","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":53,"context_line":"off-loaded to the identity provider of the federation."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"To enable identity federation, you will need to execute a set of configurations"},{"line_number":56,"context_line":"in multiple OpenStack systems. Therefore, it is easier to use Kolla-ansible"},{"line_number":57,"context_line":"to execute this process for operators."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Supported protocols"}],"source_content_type":"text/x-rst","patch_set":56,"id":"7b086c56_5fe1458b","line":56,"range":{"start_line":56,"start_character":62,"end_line":56,"end_character":75},"updated":"2021-02-14 20:31:10.000000000","message":"Kolla Ansible","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":53,"context_line":"off-loaded to the identity provider of the federation."},{"line_number":54,"context_line":""},{"line_number":55,"context_line":"To enable identity federation, you will need to execute a set of configurations"},{"line_number":56,"context_line":"in multiple OpenStack systems. Therefore, it is easier to use Kolla-ansible"},{"line_number":57,"context_line":"to execute this process for operators."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":"Supported protocols"}],"source_content_type":"text/x-rst","patch_set":56,"id":"e42333ef_fd591f15","line":56,"range":{"start_line":56,"start_character":62,"end_line":56,"end_character":75},"in_reply_to":"7b086c56_5fe1458b","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":59,"context_line":"Supported protocols"},{"line_number":60,"context_line":"~~~~~~~~~~~~~~~~~~~"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"OpenStack supports both OpenID Connect and SAML protocols to federated"},{"line_number":63,"context_line":"identity, but for now, kolla-ansible is supporting only OpenID Connect."},{"line_number":64,"context_line":"Therefore, if you desire to use SAML in your environment, you will need"},{"line_number":65,"context_line":"to set it up manually or extend Kolla-ansible to also support it."}],"source_content_type":"text/x-rst","patch_set":56,"id":"9401db22_79d00260","line":62,"range":{"start_line":62,"start_character":58,"end_line":62,"end_character":61},"updated":"2021-02-14 20:31:10.000000000","message":"for","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":59,"context_line":"Supported protocols"},{"line_number":60,"context_line":"~~~~~~~~~~~~~~~~~~~"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"OpenStack supports both OpenID Connect and SAML protocols to federated"},{"line_number":63,"context_line":"identity, but for now, kolla-ansible is supporting only OpenID Connect."},{"line_number":64,"context_line":"Therefore, if you desire to use SAML in your environment, you will need"},{"line_number":65,"context_line":"to set it up manually or extend Kolla-ansible to also support it."}],"source_content_type":"text/x-rst","patch_set":56,"id":"181e88aa_d31ad811","line":62,"range":{"start_line":62,"start_character":58,"end_line":62,"end_character":61},"in_reply_to":"9401db22_79d00260","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":60,"context_line":"~~~~~~~~~~~~~~~~~~~"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"OpenStack supports both OpenID Connect and SAML protocols to federated"},{"line_number":63,"context_line":"identity, but for now, kolla-ansible is supporting only OpenID Connect."},{"line_number":64,"context_line":"Therefore, if you desire to use SAML in your environment, you will need"},{"line_number":65,"context_line":"to set it up manually or extend Kolla-ansible to also support it."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"718ea9c7_3c201161","line":63,"range":{"start_line":63,"start_character":23,"end_line":63,"end_character":36},"updated":"2021-02-14 20:31:10.000000000","message":"Kolla Ansible","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":60,"context_line":"~~~~~~~~~~~~~~~~~~~"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"OpenStack supports both OpenID Connect and SAML protocols to federated"},{"line_number":63,"context_line":"identity, but for now, kolla-ansible is supporting only OpenID Connect."},{"line_number":64,"context_line":"Therefore, if you desire to use SAML in your environment, you will need"},{"line_number":65,"context_line":"to set it up manually or extend Kolla-ansible to also support it."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"6f1def69_b62ac0e4","line":63,"range":{"start_line":63,"start_character":37,"end_line":63,"end_character":50},"updated":"2021-02-14 20:31:10.000000000","message":"supports","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":60,"context_line":"~~~~~~~~~~~~~~~~~~~"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"OpenStack supports both OpenID Connect and SAML protocols to federated"},{"line_number":63,"context_line":"identity, but for now, kolla-ansible is supporting only OpenID Connect."},{"line_number":64,"context_line":"Therefore, if you desire to use SAML in your environment, you will need"},{"line_number":65,"context_line":"to set it up manually or extend Kolla-ansible to also support it."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"24521b60_16c5e6bf","line":63,"range":{"start_line":63,"start_character":37,"end_line":63,"end_character":50},"in_reply_to":"6f1def69_b62ac0e4","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":60,"context_line":"~~~~~~~~~~~~~~~~~~~"},{"line_number":61,"context_line":""},{"line_number":62,"context_line":"OpenStack supports both OpenID Connect and SAML protocols to federated"},{"line_number":63,"context_line":"identity, but for now, kolla-ansible is supporting only OpenID Connect."},{"line_number":64,"context_line":"Therefore, if you desire to use SAML in your environment, you will need"},{"line_number":65,"context_line":"to set it up manually or extend Kolla-ansible to also support it."},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"c2598ead_71a35777","line":63,"range":{"start_line":63,"start_character":23,"end_line":63,"end_character":36},"in_reply_to":"718ea9c7_3c201161","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":62,"context_line":"OpenStack supports both OpenID Connect and SAML protocols to federated"},{"line_number":63,"context_line":"identity, but for now, kolla-ansible is supporting only OpenID Connect."},{"line_number":64,"context_line":"Therefore, if you desire to use SAML in your environment, you will need"},{"line_number":65,"context_line":"to set it up manually or extend Kolla-ansible to also support it."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":".. _setup-oidc-kolla-ansible:"},{"line_number":68,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"e5d315c2_7007a56c","line":65,"range":{"start_line":65,"start_character":32,"end_line":65,"end_character":45},"updated":"2021-02-14 20:31:10.000000000","message":"Kolla Ansible","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":62,"context_line":"OpenStack supports both OpenID Connect and SAML protocols to federated"},{"line_number":63,"context_line":"identity, but for now, kolla-ansible is supporting only OpenID Connect."},{"line_number":64,"context_line":"Therefore, if you desire to use SAML in your environment, you will need"},{"line_number":65,"context_line":"to set it up manually or extend Kolla-ansible to also support it."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":".. _setup-oidc-kolla-ansible:"},{"line_number":68,"context_line":""}],"source_content_type":"text/x-rst","patch_set":56,"id":"672a50a3_9d5cbca9","line":65,"range":{"start_line":65,"start_character":32,"end_line":65,"end_character":45},"in_reply_to":"e5d315c2_7007a56c","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":".. _setup-oidc-kolla-ansible:"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Setting up OpenID Connect via kolla-ansible"},{"line_number":70,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"First, you will need to register the OpenStack (Keystone) in your Identity"}],"source_content_type":"text/x-rst","patch_set":56,"id":"20537ca4_fef8c6c8","line":69,"range":{"start_line":69,"start_character":30,"end_line":69,"end_character":43},"updated":"2021-02-14 20:31:10.000000000","message":"Kolla Ansible","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":66,"context_line":""},{"line_number":67,"context_line":".. _setup-oidc-kolla-ansible:"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Setting up OpenID Connect via kolla-ansible"},{"line_number":70,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"First, you will need to register the OpenStack (Keystone) in your Identity"}],"source_content_type":"text/x-rst","patch_set":56,"id":"8b800d49_c3e296a4","line":69,"range":{"start_line":69,"start_character":30,"end_line":69,"end_character":43},"in_reply_to":"20537ca4_fef8c6c8","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":108,"context_line":"protocol"},{"line_number":109,"context_line":"********"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"The federated protocol used by the IdP; e.g. openid or saml. We only support"},{"line_number":112,"context_line":"OpenID connect right now."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"identifier"}],"source_content_type":"text/x-rst","patch_set":56,"id":"463f1fc9_792636f0","line":111,"range":{"start_line":111,"start_character":64,"end_line":111,"end_character":76},"updated":"2021-02-14 20:31:10.000000000","message":"support only","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":108,"context_line":"protocol"},{"line_number":109,"context_line":"********"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"The federated protocol used by the IdP; e.g. openid or saml. We only support"},{"line_number":112,"context_line":"OpenID connect right now."},{"line_number":113,"context_line":""},{"line_number":114,"context_line":"identifier"}],"source_content_type":"text/x-rst","patch_set":56,"id":"99213205_59507abf","line":111,"range":{"start_line":111,"start_character":64,"end_line":111,"end_character":76},"in_reply_to":"463f1fc9_792636f0","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":119,"context_line":"public_name"},{"line_number":120,"context_line":"***********"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"The Identity provider public name that will be shown for users (to execute the"},{"line_number":123,"context_line":"where are you from the process of federated protocols)."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"attribute_mapping"},{"line_number":126,"context_line":"*****************"}],"source_content_type":"text/x-rst","patch_set":56,"id":"ab563f89_65bb4c48","line":123,"range":{"start_line":122,"start_character":64,"end_line":123,"end_character":53},"updated":"2021-02-14 20:31:10.000000000","message":"What? 😄 This needs some rewording.","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":119,"context_line":"public_name"},{"line_number":120,"context_line":"***********"},{"line_number":121,"context_line":""},{"line_number":122,"context_line":"The Identity provider public name that will be shown for users (to execute the"},{"line_number":123,"context_line":"where are you from the process of federated protocols)."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"attribute_mapping"},{"line_number":126,"context_line":"*****************"}],"source_content_type":"text/x-rst","patch_set":56,"id":"72e52032_89cef8ce","line":123,"range":{"start_line":122,"start_character":64,"end_line":123,"end_character":53},"in_reply_to":"ab563f89_65bb4c48","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"}],"doc/source/user/setup-identity-provider.rst":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"32632efc703911ea95afa18b00352b25a5f6dd4a","unresolved":true,"context_lines":[{"line_number":1,"context_line":".. _setup-identity-provider:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"}],"source_content_type":"text/x-rst","patch_set":42,"id":"60004222_5d09de2c","line":4,"updated":"2021-01-06 14:13:26.000000000","message":"Thanks for writing this up. I\u0027m wondering if it belongs in the contributor guide?","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"aeb0d47d1a163173678cb9752af618a8cd245b98","unresolved":false,"context_lines":[{"line_number":1,"context_line":".. _setup-identity-provider:"},{"line_number":2,"context_line":""},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":"Identity Provider setup"},{"line_number":5,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"This guide shows how to create an Identity Provider that handles the OpenID"}],"source_content_type":"text/x-rst","patch_set":42,"id":"993339f6_810a9984","line":4,"in_reply_to":"60004222_5d09de2c","updated":"2021-01-06 19:05:13.000000000","message":"Done","commit_id":"6141ed34de8f221a523ca83c7c960e81f88f7dbd"}],"etc/kolla/passwords.yml":[{"author":{"_account_id":14826,"name":"Mark Goddard","email":"markgoddard86@gmail.com","username":"mgoddard"},"change_message_id":"efba4243b90f9d3fd883acbfdd17bccda16e5165","unresolved":false,"context_lines":[{"line_number":260,"context_line":"###############################"},{"line_number":261,"context_line":"# OpenStack identity federation"},{"line_number":262,"context_line":"###############################"},{"line_number":263,"context_line":"keystone_federation_openid_crypto_password:"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_36449a19","line":263,"updated":"2020-09-15 15:45:43.000000000","message":"I suppose this is a bit different from usual in that it must be a specific value, rather than generated via kolla? Maybe we need some way to tell genpwd not to generate it?","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"b2ef03f76e8beb811b165a2e6698b8770aafd599","unresolved":false,"context_lines":[{"line_number":260,"context_line":"###############################"},{"line_number":261,"context_line":"# OpenStack identity federation"},{"line_number":262,"context_line":"###############################"},{"line_number":263,"context_line":"keystone_federation_openid_crypto_password:"}],"source_content_type":"text/x-yaml","patch_set":34,"id":"9f560f44_b1a88621","line":263,"in_reply_to":"9f560f44_36449a19","updated":"2020-10-02 19:55:50.000000000","message":"As this password is used to generate a session key (a volatile one) that will be used only to cipher state and sessions on Apache server, nothing persistent, I guess that there is no problem in automatically generate this password.","commit_id":"c143fccff5e5d4d64897b4cf3c07a07b06b4c65d"}],"releasenotes/notes/add-keystone-support-to-openid-connect-859b12492f8347fe.yaml":[{"author":{"_account_id":30491,"name":"Radosław Piliszek","display_name":"Radek","email":"radek@piliszek.it","username":"yoctozepto","status":"self-employed techologist, collaborating mostly with 7bulls.com"},"change_message_id":"6db28ade61ca64f63108fbe9d0668bc2c322cdc2","unresolved":true,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Add support for the OpenID Connect authentication flow in Keystone and"},{"line_number":5,"context_line":"    enables both ID and access token authentication flows."}],"source_content_type":"text/x-yaml","patch_set":56,"id":"a0d10dff_7cff12e7","line":4,"range":{"start_line":4,"start_character":54,"end_line":4,"end_character":59},"updated":"2021-02-14 20:31:10.000000000","message":"protocol","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"},{"author":{"_account_id":30695,"name":"Pedro Henrique Pereira Martins","email":"phpm13@gmail.com","username":"pedrohpmartins"},"change_message_id":"8524c46cc7b547f4d9f019f9e76b44b2a43a2a5a","unresolved":false,"context_lines":[{"line_number":1,"context_line":"---"},{"line_number":2,"context_line":"features:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    Add support for the OpenID Connect authentication flow in Keystone and"},{"line_number":5,"context_line":"    enables both ID and access token authentication flows."}],"source_content_type":"text/x-yaml","patch_set":56,"id":"f394d909_0fd373ac","line":4,"range":{"start_line":4,"start_character":54,"end_line":4,"end_character":59},"in_reply_to":"a0d10dff_7cff12e7","updated":"2021-02-15 20:09:04.000000000","message":"Done","commit_id":"5b9e3a7dd02270490b45ef5888a60b5352d839d6"}]}