)]}'
{"specs/kilo/keystone-sp-adfs-idp.rst":[{"author":{"_account_id":425,"name":"Darren Birkett","email":"darren.birkett@gmail.com","username":"darren-birkett"},"change_message_id":"1e79ed1b285f1ba2e38a23c3f203239121c9ea5b","unresolved":false,"context_lines":[{"line_number":22,"context_line":""},{"line_number":23,"context_line":"* As a RPC Customer User, in order to maintain a smaller number of identities, I"},{"line_number":24,"context_line":"  should be able to authenticate to my RPC v11.2+ OpenStack cloud (Cloud) using"},{"line_number":25,"context_line":"  my Active Directory (AD) credentials"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* As a RPC Customer Admin, in order to maintain one identity system, I should be"},{"line_number":28,"context_line":"  able to create a trust relationship between my Active Directory with"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_65646eb8","line":25,"updated":"2015-06-24 11:36:20.000000000","message":"can these be more generalised to remove RPC specifics and versions, so that they can apply to the osad project in isolation?","commit_id":"5cc8a160fb00a70a93d4022c21e4d3b416edd8f5"},{"author":{"_account_id":425,"name":"Darren Birkett","email":"darren.birkett@gmail.com","username":"darren-birkett"},"change_message_id":"1e79ed1b285f1ba2e38a23c3f203239121c9ea5b","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"* As a RPC Customer Admin, in order to maintain one identity system, I should be"},{"line_number":28,"context_line":"  able to create a trust relationship between my Active Directory with"},{"line_number":29,"context_line":"  Federation Services (ADFS) service and my Cloud"},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Proposed change"},{"line_number":32,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_055562c0","line":29,"updated":"2015-06-24 11:36:20.000000000","message":"same","commit_id":"5cc8a160fb00a70a93d4022c21e4d3b416edd8f5"},{"author":{"_account_id":425,"name":"Darren Birkett","email":"darren.birkett@gmail.com","username":"darren-birkett"},"change_message_id":"1e79ed1b285f1ba2e38a23c3f203239121c9ea5b","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Enable Keystone Federation extension and provide configuration such that"},{"line_number":35,"context_line":"enabling federation from ADFS as an Identity Provider  is seamless for deployers"},{"line_number":36,"context_line":"and requires no data plane downtime."},{"line_number":37,"context_line":""},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"Alternatives"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_c5cf7a7d","line":36,"updated":"2015-06-24 11:36:20.000000000","message":"as of kilo, I believe the extension is no longer needed. Also (nit) whitespace after Provider","commit_id":"5cc8a160fb00a70a93d4022c21e4d3b416edd8f5"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"64be75b10272aa39215d6f41d15c28e4c5ae45e6","unresolved":false,"context_lines":[{"line_number":78,"context_line":""},{"line_number":79,"context_line":"Dependencies"},{"line_number":80,"context_line":"------------"},{"line_number":81,"context_line":"TBD"},{"line_number":82,"context_line":""},{"line_number":83,"context_line":""},{"line_number":84,"context_line":"Implementation"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_47e732e4","line":81,"updated":"2015-06-23 07:38:01.000000000","message":"AFAIK this would also depend on mod_shib","commit_id":"5cc8a160fb00a70a93d4022c21e4d3b416edd8f5"},{"author":{"_account_id":425,"name":"Darren Birkett","email":"darren.birkett@gmail.com","username":"darren-birkett"},"change_message_id":"1e79ed1b285f1ba2e38a23c3f203239121c9ea5b","unresolved":false,"context_lines":[{"line_number":91,"context_line":"throwing it out there to see who picks it up?"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"If more than one person is working on the implementation, please designate the"},{"line_number":94,"context_line":"primary author and contact."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"Primary assignee:"},{"line_number":97,"context_line":"  https://launchpad.net/~jesse-pretorius (odyssey4me)"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_25ad069b","line":94,"updated":"2015-06-24 11:36:20.000000000","message":"this boilerplate text can be removed given you\u0027ve added the assignees","commit_id":"5cc8a160fb00a70a93d4022c21e4d3b416edd8f5"},{"author":{"_account_id":425,"name":"Darren Birkett","email":"darren.birkett@gmail.com","username":"darren-birkett"},"change_message_id":"1e79ed1b285f1ba2e38a23c3f203239121c9ea5b","unresolved":false,"context_lines":[{"line_number":101,"context_line":"  https://blueprints.launchpad.net/~icordasc (sigmavirus24)"},{"line_number":102,"context_line":"  https://blueprints.launchpad.net/~miguelgrinberg (miguelgrinberg)"},{"line_number":103,"context_line":""},{"line_number":104,"context_line":"Please add **IRC nicknames** where applicable."},{"line_number":105,"context_line":""},{"line_number":106,"context_line":"Work items"},{"line_number":107,"context_line":"----------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_c5969a4b","line":104,"updated":"2015-06-24 11:36:20.000000000","message":"same","commit_id":"5cc8a160fb00a70a93d4022c21e4d3b416edd8f5"},{"author":{"_account_id":425,"name":"Darren Birkett","email":"darren.birkett@gmail.com","username":"darren-birkett"},"change_message_id":"1e79ed1b285f1ba2e38a23c3f203239121c9ea5b","unresolved":false,"context_lines":[{"line_number":130,"context_line":"  for this change to be tested within 3rd party testing, gate enhancements,"},{"line_number":131,"context_line":"  etc...?"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"* If the service is not OpenStack specific how can we test the change?"},{"line_number":134,"context_line":""},{"line_number":135,"context_line":""},{"line_number":136,"context_line":"Documentation impact"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_a5703641","line":133,"updated":"2015-06-24 11:36:20.000000000","message":"similar to multi-region spec, this is not something that can be tested in it\u0027s entirety in the gate job, but each commit will need to individually pass the gate and not break non-adfs deployments.","commit_id":"5cc8a160fb00a70a93d4022c21e4d3b416edd8f5"},{"author":{"_account_id":425,"name":"Darren Birkett","email":"darren.birkett@gmail.com","username":"darren-birkett"},"change_message_id":"1e79ed1b285f1ba2e38a23c3f203239121c9ea5b","unresolved":false,"context_lines":[{"line_number":138,"context_line":""},{"line_number":139,"context_line":"What is the impact on the docs team of this change? Some changes might require"},{"line_number":140,"context_line":"donating resources to the docs team to have the documentation updated. Don\u0027t"},{"line_number":141,"context_line":"repeat details discussed above, but please reference them here."},{"line_number":142,"context_line":""},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"References"}],"source_content_type":"text/x-rst","patch_set":3,"id":"fa32b979_259bc667","line":141,"updated":"2015-06-24 11:36:20.000000000","message":"definited doc impact - whole new section on configuring keystone for ADFS, as well as configuring the AD side.","commit_id":"5cc8a160fb00a70a93d4022c21e4d3b416edd8f5"},{"author":{"_account_id":7217,"name":"Hugh Saunders","email":"hugh@wherenow.org","username":"hughsaunders"},"change_message_id":"a1dd90d4b5ccd69c090b258f09ac56f04a8ea0f9","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Security impact"},{"line_number":73,"context_line":"---------------"},{"line_number":74,"context_line":"None"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a41bdd9_092c5f97","line":73,"updated":"2015-07-16 10:50:28.000000000","message":"There are security aspects, but they affect docs more than code: \n\n\n* Security is to some extent delegated to the external IDP (AD).  Therefore Deployers must be confident of the security of their AD before using it for federation.\n\n* Deployers must take time to understand the mapping mechanisms in order to ensure that only the expected users/groups are granted access to openstack resources.","commit_id":"bdc9b42b2883f9e194d63e8e7eeae207367c69d4"},{"author":{"_account_id":6816,"name":"Jesse Pretorius","email":"jesse@odyssey4.me","username":"jesse-pretorius"},"change_message_id":"018f842da0b51d08c8eab1e98bf680b92eb1c104","unresolved":false,"context_lines":[{"line_number":70,"context_line":""},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Security impact"},{"line_number":73,"context_line":"---------------"},{"line_number":74,"context_line":"None"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"9a41bdd9_09a77fbd","line":73,"in_reply_to":"9a41bdd9_092c5f97","updated":"2015-07-16 10:54:40.000000000","message":"Done","commit_id":"bdc9b42b2883f9e194d63e8e7eeae207367c69d4"}]}