)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e9e9e5b04ec9289a9c97460c0379b5ab06a7462d","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Convert the Identity Management chapter to RST"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Common files converted to RST and directly added to the Cloud Admin Guide (since they are not used elsewhere):"},{"line_number":10,"context_line":"- Identity user management"},{"line_number":11,"context_line":"- Identity service management"},{"line_number":12,"context_line":"- Groups"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"3afb71cf_aa2452c4","line":9,"updated":"2015-06-10 07:43:15.000000000","message":"it\u0027s preferrable not to have such long lines either in commit msg, or in .rst file itself (70 chars max.)","commit_id":"30c9b53a8ca2be3bf9e61eecf9aaec6e31a78686"}],"doc/admin-guide-cloud-rst/source/identity_management.rst":[{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"ec1a96e7424459b5cd510aeb47739534c14e0e1b","unresolved":false,"context_lines":[{"line_number":66,"context_line":"    .. note::"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"       Individual services, such as Compute and the Image service,"},{"line_number":69,"context_line":"       assign meaning to roles. In the Identity Service, a role is"},{"line_number":70,"context_line":"       simply a name."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The Identity Service assigns a tenant and a role to a user. You might"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_249d3c0a","line":69,"updated":"2015-06-10 04:56:53.000000000","message":"\"Identity Service\" should be \"Identity service\".","commit_id":"7c78ef61556a86002756f33eede9cf762e15d7ea"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"d73ba3d92e562f68f2b57748e418d7fa363b83fc","unresolved":false,"context_lines":[{"line_number":66,"context_line":"    .. note::"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"       Individual services, such as Compute and the Image service,"},{"line_number":69,"context_line":"       assign meaning to roles. In the Identity Service, a role is"},{"line_number":70,"context_line":"       simply a name."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The Identity Service assigns a tenant and a role to a user. You might"}],"source_content_type":"text/x-rst","patch_set":2,"id":"3afb71cf_9fe55939","line":69,"in_reply_to":"3afb71cf_249d3c0a","updated":"2015-06-10 05:13:09.000000000","message":"Done","commit_id":"7c78ef61556a86002756f33eede9cf762e15d7ea"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"3d65e2adbc9f8526c886d245086039014fdda2cb","unresolved":false,"context_lines":[{"line_number":66,"context_line":"    .. note::"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"       Individual services, such as Compute and the Image service,"},{"line_number":69,"context_line":"       assign meaning to roles. In the Identity Service, a role is"},{"line_number":70,"context_line":"       simply a name."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The Identity Service assigns a tenant and a role to a user. You might"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_3fdae54c","line":69,"updated":"2015-06-10 06:07:26.000000000","message":"\"Identity Service\" should be \"Identity service\".","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"473e5ec9c0142997312c4001ac383e86658d93de","unresolved":false,"context_lines":[{"line_number":66,"context_line":"    .. note::"},{"line_number":67,"context_line":""},{"line_number":68,"context_line":"       Individual services, such as Compute and the Image service,"},{"line_number":69,"context_line":"       assign meaning to roles. In the Identity Service, a role is"},{"line_number":70,"context_line":"       simply a name."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The Identity Service assigns a tenant and a role to a user. You might"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_077a3f77","line":69,"in_reply_to":"3afb71cf_3fdae54c","updated":"2015-06-10 06:53:56.000000000","message":"Addressed in Patch Set 4.","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"3d65e2adbc9f8526c886d245086039014fdda2cb","unresolved":false,"context_lines":[{"line_number":69,"context_line":"       assign meaning to roles. In the Identity Service, a role is"},{"line_number":70,"context_line":"       simply a name."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The Identity Service assigns a tenant and a role to a user. You might"},{"line_number":73,"context_line":"assign the ``compute-user`` role to the ``alice`` user in the ``acme``"},{"line_number":74,"context_line":"tenant:"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_1fdba950","line":72,"updated":"2015-06-10 06:07:26.000000000","message":"\"Identity Service\" should be \"Identity service\".","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"473e5ec9c0142997312c4001ac383e86658d93de","unresolved":false,"context_lines":[{"line_number":69,"context_line":"       assign meaning to roles. In the Identity Service, a role is"},{"line_number":70,"context_line":"       simply a name."},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"The Identity Service assigns a tenant and a role to a user. You might"},{"line_number":73,"context_line":"assign the ``compute-user`` role to the ``alice`` user in the ``acme``"},{"line_number":74,"context_line":"tenant:"},{"line_number":75,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_e77e0369","line":72,"in_reply_to":"3afb71cf_1fdba950","updated":"2015-06-10 06:53:56.000000000","message":"Addressed in Patch Set 4.","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"3d65e2adbc9f8526c886d245086039014fdda2cb","unresolved":false,"context_lines":[{"line_number":111,"context_line":"The :file:`/etc/[SERVICE_CODENAME]/policy.json` file controls the tasks that"},{"line_number":112,"context_line":"users can perform for a given service. For example,"},{"line_number":113,"context_line":":file:`/etc/nova/policy.json` file specifies the access policy for the Compute"},{"line_number":114,"context_line":"service, :file:`/etc/glance/policy.json` file specifies the access policy for the Image service, and :file:`/etc/keystone/policy.json` file specifies the access policy for the Identity Service."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"The default :file:`policy.json` files in the Compute, Identity, and Image"},{"line_number":117,"context_line":"service recognize only the ``admin`` role; all operations that do not"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_5fbc81db","line":114,"updated":"2015-06-10 06:07:26.000000000","message":"\"Identity Service\" should be \"Identity service\".","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"473e5ec9c0142997312c4001ac383e86658d93de","unresolved":false,"context_lines":[{"line_number":111,"context_line":"The :file:`/etc/[SERVICE_CODENAME]/policy.json` file controls the tasks that"},{"line_number":112,"context_line":"users can perform for a given service. For example,"},{"line_number":113,"context_line":":file:`/etc/nova/policy.json` file specifies the access policy for the Compute"},{"line_number":114,"context_line":"service, :file:`/etc/glance/policy.json` file specifies the access policy for the Image service, and :file:`/etc/keystone/policy.json` file specifies the access policy for the Identity Service."},{"line_number":115,"context_line":""},{"line_number":116,"context_line":"The default :file:`policy.json` files in the Compute, Identity, and Image"},{"line_number":117,"context_line":"service recognize only the ``admin`` role; all operations that do not"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_c798a7c2","line":114,"in_reply_to":"3afb71cf_5fbc81db","updated":"2015-06-10 06:53:56.000000000","message":"Addressed in Patch Set 4.","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"3d65e2adbc9f8526c886d245086039014fdda2cb","unresolved":false,"context_lines":[{"line_number":119,"context_line":"in a tenant."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"To restrict users from performing operations in, for example, the"},{"line_number":122,"context_line":"Compute service, you need to create a role in the Identity Service and"},{"line_number":123,"context_line":"then modify the :file:`/etc/nova/policy.json` file so that this role is required for Compute operations."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"For example, the following line in the :file:`/etc/nova/policy.json` file"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_3fc1c554","line":122,"updated":"2015-06-10 06:07:26.000000000","message":"\"Identity Service\" should be \"Identity service\".","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"473e5ec9c0142997312c4001ac383e86658d93de","unresolved":false,"context_lines":[{"line_number":119,"context_line":"in a tenant."},{"line_number":120,"context_line":""},{"line_number":121,"context_line":"To restrict users from performing operations in, for example, the"},{"line_number":122,"context_line":"Compute service, you need to create a role in the Identity Service and"},{"line_number":123,"context_line":"then modify the :file:`/etc/nova/policy.json` file so that this role is required for Compute operations."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"For example, the following line in the :file:`/etc/nova/policy.json` file"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_a795ab87","line":122,"in_reply_to":"3afb71cf_3fc1c554","updated":"2015-06-10 06:53:56.000000000","message":"Addressed in Patch Set 4.","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"3d65e2adbc9f8526c886d245086039014fdda2cb","unresolved":false,"context_lines":[{"line_number":260,"context_line":""},{"line_number":261,"context_line":"* keystone Web Server Gateway Interface (WSGI) service"},{"line_number":262,"context_line":"    Can be run in a WSGI-capable web server such as Apache httpd to provide"},{"line_number":263,"context_line":"    the Identity Service. The service and administrative APIs are run as"},{"line_number":264,"context_line":"    separate instances of the WSGI service."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"* Identity service functions"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_1fb28906","line":263,"updated":"2015-06-10 06:07:26.000000000","message":"\"Identity Service\" should be \"Identity service\".","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"473e5ec9c0142997312c4001ac383e86658d93de","unresolved":false,"context_lines":[{"line_number":260,"context_line":""},{"line_number":261,"context_line":"* keystone Web Server Gateway Interface (WSGI) service"},{"line_number":262,"context_line":"    Can be run in a WSGI-capable web server such as Apache httpd to provide"},{"line_number":263,"context_line":"    the Identity Service. The service and administrative APIs are run as"},{"line_number":264,"context_line":"    separate instances of the WSGI service."},{"line_number":265,"context_line":""},{"line_number":266,"context_line":"* Identity service functions"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_47eb9713","line":263,"in_reply_to":"3afb71cf_1fb28906","updated":"2015-06-10 06:53:56.000000000","message":"Addressed in Patch Set 4.","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"3d65e2adbc9f8526c886d245086039014fdda2cb","unresolved":false,"context_lines":[{"line_number":282,"context_line":"Groups"},{"line_number":283,"context_line":"------"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"A group is a collection of users in a domain. Administrators can create groups and add users to them. A role can then be assigned to the group, rather than individual users. Groups were introduced with the Identity API v3."},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"Identity API V3 provides the following group-related operations:"},{"line_number":288,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_9f18b91f","line":285,"updated":"2015-06-10 06:07:26.000000000","message":"please break line into appropriate characters.","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"473e5ec9c0142997312c4001ac383e86658d93de","unresolved":false,"context_lines":[{"line_number":282,"context_line":"Groups"},{"line_number":283,"context_line":"------"},{"line_number":284,"context_line":""},{"line_number":285,"context_line":"A group is a collection of users in a domain. Administrators can create groups and add users to them. A role can then be assigned to the group, rather than individual users. Groups were introduced with the Identity API v3."},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"Identity API V3 provides the following group-related operations:"},{"line_number":288,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_e7f5e3ec","line":285,"in_reply_to":"3afb71cf_9f18b91f","updated":"2015-06-10 06:53:56.000000000","message":"Thanks, will fix in Patch Set 5.","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"3d65e2adbc9f8526c886d245086039014fdda2cb","unresolved":false,"context_lines":[{"line_number":645,"context_line":""},{"line_number":646,"context_line":"The logs show the components that have come in to the WSGI request, and"},{"line_number":647,"context_line":"ideally show an error that explains why an authorization request failed."},{"line_number":648,"context_line":"If you do not see the request in the logs, run keystone with the :option:`--debug` parameter. Pass the :option:`--debug` parameter before the command parameters."},{"line_number":649,"context_line":""},{"line_number":650,"context_line":"Debug PKI middleware"},{"line_number":651,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_7f15fde2","line":648,"updated":"2015-06-10 06:07:26.000000000","message":"please break line into appropriate characters.","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"473e5ec9c0142997312c4001ac383e86658d93de","unresolved":false,"context_lines":[{"line_number":645,"context_line":""},{"line_number":646,"context_line":"The logs show the components that have come in to the WSGI request, and"},{"line_number":647,"context_line":"ideally show an error that explains why an authorization request failed."},{"line_number":648,"context_line":"If you do not see the request in the logs, run keystone with the :option:`--debug` parameter. Pass the :option:`--debug` parameter before the command parameters."},{"line_number":649,"context_line":""},{"line_number":650,"context_line":"Debug PKI middleware"},{"line_number":651,"context_line":"--------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_a7dc8b73","line":648,"in_reply_to":"3afb71cf_7f15fde2","updated":"2015-06-10 06:53:56.000000000","message":"Thanks, will fix in Patch Set 5.","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"3d65e2adbc9f8526c886d245086039014fdda2cb","unresolved":false,"context_lines":[{"line_number":651,"context_line":"--------------------"},{"line_number":652,"context_line":""},{"line_number":653,"context_line":"If you receive an ``Invalid OpenStack Identity Credentials`` message when"},{"line_number":654,"context_line":"you talk to an OpenStack service, it might be caused by the changeover from UUID tokens to PKI tokens in the Grizzly release. Learn how to troubleshoot this error."},{"line_number":655,"context_line":""},{"line_number":656,"context_line":"The PKI-based token validation scheme relies on certificates from"},{"line_number":657,"context_line":"Identity that are fetched through HTTP and stored in a local directory."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_5fd5a119","line":654,"updated":"2015-06-10 06:07:26.000000000","message":"please break line into appropriate characters.","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"473e5ec9c0142997312c4001ac383e86658d93de","unresolved":false,"context_lines":[{"line_number":651,"context_line":"--------------------"},{"line_number":652,"context_line":""},{"line_number":653,"context_line":"If you receive an ``Invalid OpenStack Identity Credentials`` message when"},{"line_number":654,"context_line":"you talk to an OpenStack service, it might be caused by the changeover from UUID tokens to PKI tokens in the Grizzly release. Learn how to troubleshoot this error."},{"line_number":655,"context_line":""},{"line_number":656,"context_line":"The PKI-based token validation scheme relies on certificates from"},{"line_number":657,"context_line":"Identity that are fetched through HTTP and stored in a local directory."}],"source_content_type":"text/x-rst","patch_set":3,"id":"3afb71cf_67e21331","line":654,"in_reply_to":"3afb71cf_5fd5a119","updated":"2015-06-10 06:53:56.000000000","message":"Thanks, will fix in Patch Set 5.","commit_id":"c69512d426e075ef25fa8bef20c300bceffb3d6d"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"e9e9e5b04ec9289a9c97460c0379b5ab06a7462d","unresolved":false,"context_lines":[{"line_number":122,"context_line":""},{"line_number":123,"context_line":"To restrict users from performing operations in, for example, the"},{"line_number":124,"context_line":"Compute service, you need to create a role in the Identity service and"},{"line_number":125,"context_line":"then modify the :file:`/etc/nova/policy.json` file so that this role is required for Compute operations."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"For example, the following line in the :file:`/etc/nova/policy.json` file"},{"line_number":128,"context_line":"specifies that there are no restrictions on which users can create volumes:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3afb71cf_0ab24606","line":125,"updated":"2015-06-10 07:43:15.000000000","message":"Please wrap this line so that it has not more than 70 characters.","commit_id":"30c9b53a8ca2be3bf9e61eecf9aaec6e31a78686"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"fe2f938ad9af278117b8d120cd8cabbbd503e4b2","unresolved":false,"context_lines":[{"line_number":122,"context_line":""},{"line_number":123,"context_line":"To restrict users from performing operations in, for example, the"},{"line_number":124,"context_line":"Compute service, you need to create a role in the Identity service and"},{"line_number":125,"context_line":"then modify the :file:`/etc/nova/policy.json` file so that this role is required for Compute operations."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"For example, the following line in the :file:`/etc/nova/policy.json` file"},{"line_number":128,"context_line":"specifies that there are no restrictions on which users can create volumes:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3afb71cf_ff768304","line":125,"in_reply_to":"3afb71cf_0ab24606","updated":"2015-06-10 09:52:55.000000000","message":"Thanks for spotting it. Yes, the limit is 79 characters. I\u0027ll fix it in another conversion patch ;)","commit_id":"30c9b53a8ca2be3bf9e61eecf9aaec6e31a78686"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"930c21706d915a92defa6fe8a19f13a2f3eb64fe","unresolved":false,"context_lines":[{"line_number":122,"context_line":""},{"line_number":123,"context_line":"To restrict users from performing operations in, for example, the"},{"line_number":124,"context_line":"Compute service, you need to create a role in the Identity service and"},{"line_number":125,"context_line":"then modify the :file:`/etc/nova/policy.json` file so that this role is required for Compute operations."},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"For example, the following line in the :file:`/etc/nova/policy.json` file"},{"line_number":128,"context_line":"specifies that there are no restrictions on which users can create volumes:"}],"source_content_type":"text/x-rst","patch_set":5,"id":"3afb71cf_02f106cd","line":125,"in_reply_to":"3afb71cf_ff768304","updated":"2015-06-10 10:10:42.000000000","message":"Hi Darren! Conventions allow 70 chars if I got it right - https://wiki.openstack.org/wiki/Documentation/Markup_conventions#Avoid_long_lines\n\n\nAnyways, thanks! \u003d)","commit_id":"30c9b53a8ca2be3bf9e61eecf9aaec6e31a78686"}]}