)]}'
{"doc/config-reference/source/identity/federated-identity.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"29d7865d7e4e61a726f38e195edbc9be2912ced1","unresolved":false,"context_lines":[{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"* abbr:`Service Provider (SP)`: provides a service to an end-user and"},{"line_number":6,"context_line":"  consumes the user\u0027s identity from the identity provider, via SAML."},{"line_number":7,"context_line":"* abbr:`Identity Provider (IdP)`: service that stores information about"},{"line_number":8,"context_line":"  users and groups."},{"line_number":9,"context_line":"* `SAML assertion`: contains information about a user as provided by an IdP."}],"source_content_type":"text/x-rst","patch_set":1,"id":"dada55a8_396e9695","line":6,"updated":"2016-07-19 16:56:55.000000000","message":"I\u0027d reverse the ordering of things in this sentence to match the actual federation workflow...\n\n    Consumes the end user\u0027s identity from the identity provider via\n    SAML, and provides a service to the user.","commit_id":"58df12a1e5d387b5f7ad6d0d53003e85fabb5c78"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"1f80f66e4eeceba32ac62d701624720e54162162","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Federated Identity"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"* abbr:`Service Provider (SP)`: Consumes the end user\u0027s identity from the"},{"line_number":6,"context_line":"  Identity Provider via SAML, and provides a service to the user."},{"line_number":7,"context_line":"* abbr:`Identity Provider (IdP)`: service that stores information about"},{"line_number":8,"context_line":"  users and groups."}],"source_content_type":"text/x-rst","patch_set":4,"id":"dada55a8_989aae60","line":5,"range":{"start_line":5,"start_character":2,"end_line":5,"end_character":30},"updated":"2016-07-27 13:23:49.000000000","message":":term:`Service Provider (SP) \u003cservice provider\u003e`","commit_id":"d13be3f61faebe7e7e1565074929a64b3303328f"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"1f80f66e4eeceba32ac62d701624720e54162162","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"* abbr:`Service Provider (SP)`: Consumes the end user\u0027s identity from the"},{"line_number":6,"context_line":"  Identity Provider via SAML, and provides a service to the user."},{"line_number":7,"context_line":"* abbr:`Identity Provider (IdP)`: service that stores information about"},{"line_number":8,"context_line":"  users and groups."},{"line_number":9,"context_line":"* `SAML assertion`: contains information about a user as provided by an IdP."},{"line_number":10,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"dada55a8_78dffa0c","line":7,"range":{"start_line":7,"start_character":2,"end_line":7,"end_character":32},"updated":"2016-07-27 13:23:49.000000000","message":":term:`Identity Provider (IdP) \u003cidentity provider\u003e`","commit_id":"d13be3f61faebe7e7e1565074929a64b3303328f"},{"author":{"_account_id":10705,"name":"Darren Chan","email":"dazzachan@yahoo.com.au","username":"daz"},"change_message_id":"117c9c93627bdf12db57ea724829d4b797282933","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Federated Identity"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"* abbr:`Service Provider (SP)`: Consumes the end user\u0027s identity from the"},{"line_number":6,"context_line":"  Identity Provider via SAML, and provides a service to the user."},{"line_number":7,"context_line":"* abbr:`Identity Provider (IdP)`: service that stores information about"},{"line_number":8,"context_line":"  users and groups."},{"line_number":9,"context_line":"* `SAML assertion`: contains information about a user as provided by an IdP."},{"line_number":10,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"dada55a8_a08dd5d4","line":8,"range":{"start_line":5,"start_character":0,"end_line":8,"end_character":19},"updated":"2016-07-27 00:30:47.000000000","message":"Remove \"abbr:\". See\nhttp://docs-draft.openstack.org/43/344143/4/check/gate-openstack-manuals-tox-doc-publish-checkbuild/b5515bb//publish-docs/draft/config-reference/identity/federated-identity.html\n\nPerhaps use a definition list or add it to the common glossary.\n\nIt would be nice to have a brief explanation of federated identity and context around the definitions provided.","commit_id":"d13be3f61faebe7e7e1565074929a64b3303328f"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"1f80f66e4eeceba32ac62d701624720e54162162","unresolved":false,"context_lines":[{"line_number":6,"context_line":"  Identity Provider via SAML, and provides a service to the user."},{"line_number":7,"context_line":"* abbr:`Identity Provider (IdP)`: service that stores information about"},{"line_number":8,"context_line":"  users and groups."},{"line_number":9,"context_line":"* `SAML assertion`: contains information about a user as provided by an IdP."},{"line_number":10,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"dada55a8_f8faca73","line":9,"range":{"start_line":9,"start_character":2,"end_line":9,"end_character":18},"updated":"2016-07-27 13:23:49.000000000","message":":term:`SAML assertion`","commit_id":"d13be3f61faebe7e7e1565074929a64b3303328f"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"efbf5096e86de8107f81315d7b6f4fb7531cba9a","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  and provides a service to the user."},{"line_number":8,"context_line":":term:`Identity Provider (IdP)`"},{"line_number":9,"context_line":"  A service that stores information about users and groups."},{"line_number":10,"context_line":":term:`SAML assertion"},{"line_number":11,"context_line":"  Contains information about a user as provided by an IdP."},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":5,"id":"bacf61ea_0381fd4a","line":10,"range":{"start_line":10,"start_character":11,"end_line":10,"end_character":21},"updated":"2016-07-27 17:19:51.000000000","message":"assertion`","commit_id":"56392d1c417b2622d67b53d76a4e6fd8247885b6"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"e7813129f1c2c658e788bd7695fda61b3febf451","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":".. glossary::"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"   Service Provider (SP)"},{"line_number":8,"context_line":"      Consumes the end user\u0027s identity from the Identity Provider via SAML,"},{"line_number":9,"context_line":"      and provides a service to the user."},{"line_number":10,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"bacf61ea_6c12f30a","line":7,"updated":"2016-07-29 16:26:04.000000000","message":"I like the definition list idea.","commit_id":"fe5b6f45c6476e080167989ea56043f526db738e"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"b216b98910159dc610cb0216171e43f5cae2e634","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":".. glossary::"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"   Service Provider (SP)"},{"line_number":8,"context_line":"      Consumes the end user\u0027s identity from the Identity Provider via SAML,"},{"line_number":9,"context_line":"      and provides a service to the user."},{"line_number":10,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"bacf61ea_7365a0b3","line":7,"in_reply_to":"bacf61ea_6c12f30a","updated":"2016-07-29 23:39:12.000000000","message":"+1 to definition idea.\n\nThe \".. glossary::\" markup defines the glossary itself. We should have glossaries on \"glossary\", and refer them from each guide with \":term:\".","commit_id":"fe5b6f45c6476e080167989ea56043f526db738e"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"266f18f8410d338e0e586ea274f28a661d3e9c97","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":".. note::"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"   Federated users are not mirrored in the keystone identity backend"},{"line_number":36,"context_line":"   (for example, using the SQL driver). The external Identity Provider is"},{"line_number":37,"context_line":"   responsible for authenticating users, and communicates the result of"},{"line_number":38,"context_line":"   authentication to keystone using identity properties. Keystone maps"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9ad45d7e_64eebeb5","line":35,"range":{"start_line":35,"start_character":61,"end_line":35,"end_character":68},"updated":"2016-08-09 14:50:48.000000000","message":"back end","commit_id":"1d55732f050f6b4e2f17db28b350cffde4a1fa4e"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"266f18f8410d338e0e586ea274f28a661d3e9c97","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"   Federated users are not mirrored in the keystone identity backend"},{"line_number":36,"context_line":"   (for example, using the SQL driver). The external Identity Provider is"},{"line_number":37,"context_line":"   responsible for authenticating users, and communicates the result of"},{"line_number":38,"context_line":"   authentication to keystone using identity properties. Keystone maps"},{"line_number":39,"context_line":"   these values to keystone user groups and assignments created in keystone."}],"source_content_type":"text/x-rst","patch_set":9,"id":"9ad45d7e_e4ebce76","line":37,"range":{"start_line":37,"start_character":39,"end_line":37,"end_character":40},"updated":"2016-08-09 14:50:48.000000000","message":"We can remove comma here.","commit_id":"1d55732f050f6b4e2f17db28b350cffde4a1fa4e"},{"author":{"_account_id":22314,"name":"Ryan Selden","email":"seldenr@icloud.com","username":"seldenr"},"change_message_id":"5a35d3b9292c431f0a07eab8d28e4976e72b6b84","unresolved":false,"context_lines":[{"line_number":232,"context_line":""},{"line_number":233,"context_line":"#. Create a new Service Provider with an ID of BETA."},{"line_number":234,"context_line":""},{"line_number":235,"context_line":"#. Create a ``sp_url`` of `\u003chttp://beta.example.com/Shibboleth.sso/SAML2/ECP \u003e`_."},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"#. Create a ``auth_url`` of `\u003chttp://beta.example.com:5000/v3/OS-FEDERATION/identity_providers/beta/protocols/saml2/auth \u003e`_."},{"line_number":238,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"9ad45d7e_9f05e77b","line":235,"range":{"start_line":235,"start_character":10,"end_line":235,"end_character":11},"updated":"2016-08-09 20:31:14.000000000","message":"an","commit_id":"c059de0b2b2368b8254bbd7e3c19914e758e0876"},{"author":{"_account_id":22314,"name":"Ryan Selden","email":"seldenr@icloud.com","username":"seldenr"},"change_message_id":"5a35d3b9292c431f0a07eab8d28e4976e72b6b84","unresolved":false,"context_lines":[{"line_number":234,"context_line":""},{"line_number":235,"context_line":"#. Create a ``sp_url`` of `\u003chttp://beta.example.com/Shibboleth.sso/SAML2/ECP \u003e`_."},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"#. Create a ``auth_url`` of `\u003chttp://beta.example.com:5000/v3/OS-FEDERATION/identity_providers/beta/protocols/saml2/auth \u003e`_."},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"   .. note::"},{"line_number":240,"context_line":""}],"source_content_type":"text/x-rst","patch_set":15,"id":"9ad45d7e_7f08f391","line":237,"range":{"start_line":237,"start_character":10,"end_line":237,"end_character":11},"updated":"2016-08-09 20:31:14.000000000","message":"an","commit_id":"c059de0b2b2368b8254bbd7e3c19914e758e0876"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f4f7daf125a2d5a088e734a84419a7cc4cefc0a8","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Federation for keystone can be utilised in two ways:"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"* Supporting keystone as a Service Provider (SP): consuming identity"},{"line_number":8,"context_line":"  properties issued by an external Identity Provider, such as SAML"},{"line_number":9,"context_line":"  assertions or OpenID Connect claims."},{"line_number":10,"context_line":"* Supporting keystone as an Identity Provider (IdP): fulfilling requests on"},{"line_number":11,"context_line":"  behalf of Service Providers."}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_ba02796d","line":8,"updated":"2016-08-09 21:38:08.000000000","message":"s/properties/assertions/ - or is that too much technical jargon","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f4f7daf125a2d5a088e734a84419a7cc4cefc0a8","unresolved":false,"context_lines":[{"line_number":7,"context_line":"* Supporting keystone as a Service Provider (SP): consuming identity"},{"line_number":8,"context_line":"  properties issued by an external Identity Provider, such as SAML"},{"line_number":9,"context_line":"  assertions or OpenID Connect claims."},{"line_number":10,"context_line":"* Supporting keystone as an Identity Provider (IdP): fulfilling requests on"},{"line_number":11,"context_line":"  behalf of Service Providers."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"There is currently support for two major federation protocols:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_7a2f61f6","line":10,"updated":"2016-08-09 21:38:08.000000000","message":"s/requests/authentication requests/","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f7da5644e0413413b12f6819020e1dd15c24d894","unresolved":false,"context_lines":[{"line_number":8,"context_line":"  properties issued by an external Identity Provider, such as SAML"},{"line_number":9,"context_line":"  assertions or OpenID Connect claims."},{"line_number":10,"context_line":"* Supporting keystone as an Identity Provider (IdP): fulfilling requests on"},{"line_number":11,"context_line":"  behalf of Service Providers."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"There is currently support for two major federation protocols:"},{"line_number":14,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_3a5209de","line":11,"updated":"2016-08-09 21:34:28.000000000","message":"\"on behalf of\" sounds awkward to describe this relationship, but it might be correct.","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":8,"context_line":"  properties issued by an external Identity Provider, such as SAML"},{"line_number":9,"context_line":"  assertions or OpenID Connect claims."},{"line_number":10,"context_line":"* Supporting keystone as an Identity Provider (IdP): fulfilling requests on"},{"line_number":11,"context_line":"  behalf of Service Providers."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"There is currently support for two major federation protocols:"},{"line_number":14,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_25978e49","line":11,"updated":"2016-08-09 21:52:26.000000000","message":"It\u0027d be good to have a not here that points out that you can also have one keystone act as a service provider consuming identity from another keystone acting as an identity provider (krazy2krazy).","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f7da5644e0413413b12f6819020e1dd15c24d894","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"   Keystone federation"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"To enable federation, execute the following:"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"#. Run keystone under Apache. See `Configure the Apache HTTP server \u003chttp://docs.openstack.org/mitaka/install-guide-obs/keystone-install.html\u003e`_"},{"line_number":26,"context_line":"   for more information."}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_7a0921dd","line":23,"updated":"2016-08-09 21:34:28.000000000","message":"~\"you need to do the following steps, described in greater detail below:\"","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f7da5644e0413413b12f6819020e1dd15c24d894","unresolved":false,"context_lines":[{"line_number":23,"context_line":"To enable federation, execute the following:"},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"#. Run keystone under Apache. See `Configure the Apache HTTP server \u003chttp://docs.openstack.org/mitaka/install-guide-obs/keystone-install.html\u003e`_"},{"line_number":26,"context_line":"   for more information."},{"line_number":27,"context_line":"#. Configure Apache to use a federation capable authentication method."},{"line_number":28,"context_line":"   We recommend Shibboleth, see `here \u003chttp://docs.openstack.org/developer/keystone/federation/shibboleth.html\u003e`_"},{"line_number":29,"context_line":"   for more information."}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_1ae905e7","line":26,"updated":"2016-08-09 21:34:28.000000000","message":"\"Other application servers, such as `nginx https://www.nginx.com/resources/wiki/`_ have support for federation extensions that may work but are not tested by the community.\"","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f7da5644e0413413b12f6819020e1dd15c24d894","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"#. Run keystone under Apache. See `Configure the Apache HTTP server \u003chttp://docs.openstack.org/mitaka/install-guide-obs/keystone-install.html\u003e`_"},{"line_number":26,"context_line":"   for more information."},{"line_number":27,"context_line":"#. Configure Apache to use a federation capable authentication method."},{"line_number":28,"context_line":"   We recommend Shibboleth, see `here \u003chttp://docs.openstack.org/developer/keystone/federation/shibboleth.html\u003e`_"},{"line_number":29,"context_line":"   for more information."},{"line_number":30,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_faacf136","line":27,"updated":"2016-08-09 21:34:28.000000000","message":"s/authentication method/module/","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":".. note::"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"   Federated users are not mirrored in the keystone identity back end"},{"line_number":41,"context_line":"   (for example, using the SQL driver). The external IdP is"},{"line_number":42,"context_line":"   responsible for authenticating users and communicates the result of"},{"line_number":43,"context_line":"   authentication to keystone using identity properties. Keystone maps"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_9a9695ee","line":40,"updated":"2016-08-09 21:52:26.000000000","message":"This isn\u0027t true, anymore! As of Mitaka, we \"shadow\" federated users into the local user database. The rest of the paragraph remains true, though.","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f7da5644e0413413b12f6819020e1dd15c24d894","unresolved":false,"context_lines":[{"line_number":40,"context_line":"   Federated users are not mirrored in the keystone identity back end"},{"line_number":41,"context_line":"   (for example, using the SQL driver). The external IdP is"},{"line_number":42,"context_line":"   responsible for authenticating users and communicates the result of"},{"line_number":43,"context_line":"   authentication to keystone using identity properties. Keystone maps"},{"line_number":44,"context_line":"   these values to keystone user groups and assignments created in keystone."},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Supporting keystone as a Service Provider (SP)"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_1adf456a","line":43,"updated":"2016-08-09 21:34:28.000000000","message":"using authentication assertions?","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":46,"context_line":"Supporting keystone as a Service Provider (SP)"},{"line_number":47,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"For keystone acting as a Service Provider (SP), you will need to configure"},{"line_number":50,"context_line":"keystone to accept assertions from external IdPs. Examples of external"},{"line_number":51,"context_line":"IdPs may be:"},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_3aa7a950","line":49,"updated":"2016-08-09 21:52:26.000000000","message":"\"For keystone acting as\" reads a bit awkwardly; \"To have keystone as as a Service Provider (SP), you will need to...\"","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f4f7daf125a2d5a088e734a84419a7cc4cefc0a8","unresolved":false,"context_lines":[{"line_number":48,"context_line":""},{"line_number":49,"context_line":"For keystone acting as a Service Provider (SP), you will need to configure"},{"line_number":50,"context_line":"keystone to accept assertions from external IdPs. Examples of external"},{"line_number":51,"context_line":"IdPs may be:"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"* Active Directory Federation Services (ADFS)"},{"line_number":54,"context_line":"* FreeIPA"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_9a4b3587","line":51,"updated":"2016-08-09 21:38:08.000000000","message":"s/may be/are/ because they definitely are :-)","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":52,"context_line":""},{"line_number":53,"context_line":"* Active Directory Federation Services (ADFS)"},{"line_number":54,"context_line":"* FreeIPA"},{"line_number":55,"context_line":"* Tivoli Access Manager"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Configuring federation in keystone"},{"line_number":58,"context_line":"----------------------------------"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_3a7e89ae","line":55,"updated":"2016-08-09 21:52:26.000000000","message":"Ooh, we can actually add Keystone to this list","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f4f7daf125a2d5a088e734a84419a7cc4cefc0a8","unresolved":false,"context_lines":[{"line_number":60,"context_line":"#. Configure authentication drivers in ``keystone.conf`` by adding the"},{"line_number":61,"context_line":"   authentication methods to the ``[auth]`` section in ``keystone.conf``."},{"line_number":62,"context_line":"   Ensure the names are equal to protocol names added via Identity API v3."},{"line_number":63,"context_line":"   For example:"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"   .. code-block:: ini"},{"line_number":66,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_5a31bd04","line":63,"updated":"2016-08-09 21:38:08.000000000","message":"We should somehow call out that mapped and openid are the federation specific drivers. The others in the example are not related to federation.","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"   .. important::"},{"line_number":73,"context_line":""},{"line_number":74,"context_line":"      No new users will be added to the Identity back end, but the Identity"},{"line_number":75,"context_line":"      service requires group-based role assignments to authorize federated"},{"line_number":76,"context_line":"      users. The federation mapping function maps the user into local"},{"line_number":77,"context_line":"      Identity service groups objects, and to local role assignments."}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_e50a9620","line":74,"updated":"2016-08-09 21:52:26.000000000","message":"The first part of this sentence (before the comma) is no longer true as of Mitaka.","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f7da5644e0413413b12f6819020e1dd15c24d894","unresolved":false,"context_lines":[{"line_number":74,"context_line":"      No new users will be added to the Identity back end, but the Identity"},{"line_number":75,"context_line":"      service requires group-based role assignments to authorize federated"},{"line_number":76,"context_line":"      users. The federation mapping function maps the user into local"},{"line_number":77,"context_line":"      Identity service groups objects, and to local role assignments."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"#. Create an IdP object in keystone. Make sure it represents the"},{"line_number":80,"context_line":"   IdP you will use to authenticate end users:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_85d47a47","line":77,"updated":"2016-08-09 21:34:28.000000000","message":"\"Identity service group objects, which can have local role assignments.\" \n\nor \n\n\"Identity service group objects, which can have local role assignments on projects and domains.\"","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":74,"context_line":"      No new users will be added to the Identity back end, but the Identity"},{"line_number":75,"context_line":"      service requires group-based role assignments to authorize federated"},{"line_number":76,"context_line":"      users. The federation mapping function maps the user into local"},{"line_number":77,"context_line":"      Identity service groups objects, and to local role assignments."},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"#. Create an IdP object in keystone. Make sure it represents the"},{"line_number":80,"context_line":"   IdP you will use to authenticate end users:"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_85ed9a27","line":77,"updated":"2016-08-09 21:52:26.000000000","message":"\"The federation mapping engine maps federated users into local user groups, which are the actors in Keystone role assignments.\"","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":149,"context_line":"For Identity Federation, a keystone node can assume one of two roles:"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"#. Identity Provider (IdP)"},{"line_number":152,"context_line":"#. keystone-as-an-Identity-Provider"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"The primary role of keystone is to issue assertions about users owned"},{"line_number":155,"context_line":"by keystone. This is done using PySAML2."}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_85be3ad2","line":152,"updated":"2016-08-09 21:52:26.000000000","message":"These are both the same thing? This also sounds like the intro bit; maybe just cut L149-152?","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":151,"context_line":"#. Identity Provider (IdP)"},{"line_number":152,"context_line":"#. keystone-as-an-Identity-Provider"},{"line_number":153,"context_line":""},{"line_number":154,"context_line":"The primary role of keystone is to issue assertions about users owned"},{"line_number":155,"context_line":"by keystone. This is done using PySAML2."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Keystone acting as an IdP is known as Keystone-2-Keystone"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_25faee75","line":154,"updated":"2016-08-09 21:52:26.000000000","message":"When acting as an identity provider, the primary role of keystone is to issue assertions...","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":154,"context_line":"The primary role of keystone is to issue assertions about users owned"},{"line_number":155,"context_line":"by keystone. This is done using PySAML2."},{"line_number":156,"context_line":""},{"line_number":157,"context_line":"Keystone acting as an IdP is known as Keystone-2-Keystone"},{"line_number":158,"context_line":"or K2K Federation, where a keystone somewhere is acting as the SP"},{"line_number":159,"context_line":"and another keystone is acting as the IdP. All IdPs issue"},{"line_number":160,"context_line":"assertions about the identities it owns using a `Protocol`."}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_45ef22b0","line":157,"updated":"2016-08-09 21:52:26.000000000","message":"We think the introduction of k2k should be described last, and it should focus on how to \"connect\" a service provider keystone to an identity provider keystone.","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f7da5644e0413413b12f6819020e1dd15c24d894","unresolved":false,"context_lines":[{"line_number":157,"context_line":"Keystone acting as an IdP is known as Keystone-2-Keystone"},{"line_number":158,"context_line":"or K2K Federation, where a keystone somewhere is acting as the SP"},{"line_number":159,"context_line":"and another keystone is acting as the IdP. All IdPs issue"},{"line_number":160,"context_line":"assertions about the identities it owns using a `Protocol`."},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"Configuring federation in keystone"},{"line_number":163,"context_line":"----------------------------------"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_45c1e22d","line":160,"updated":"2016-08-09 21:34:28.000000000","message":"I wonder if it makes sense to have this in its own section. Keystone-2-Keystone is only viable when a keystone Identity Provider is issuing assertions to a keystone Service Provider (where Identity Provider is a role and Service Provider is a role). This might make more sense after we describe the entire role of a Service Provider and an Identity Provider?","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":219,"context_line":"Create a Service Provider (SP)"},{"line_number":220,"context_line":"------------------------------"},{"line_number":221,"context_line":""},{"line_number":222,"context_line":"In order to setup keystone-as-a-Service-Provider properly, you will need to"},{"line_number":223,"context_line":"understand what `Protocols` are supported by external IdPs."},{"line_number":224,"context_line":"For example, if you are looking to setup keystone-as-a-Service-Provider and"},{"line_number":225,"context_line":"want to allow identities to federate in from a ADFS IdP,"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_e5a0d645","line":222,"updated":"2016-08-09 21:52:26.000000000","message":"Thanks, Lance.","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":221,"context_line":""},{"line_number":222,"context_line":"In order to setup keystone-as-a-Service-Provider properly, you will need to"},{"line_number":223,"context_line":"understand what `Protocols` are supported by external IdPs."},{"line_number":224,"context_line":"For example, if you are looking to setup keystone-as-a-Service-Provider and"},{"line_number":225,"context_line":"want to allow identities to federate in from a ADFS IdP,"},{"line_number":226,"context_line":"configure the SP to understand the SAML v2.0 Protocol since"},{"line_number":227,"context_line":"ADFS issues assertions using SAML v2.0. Some examples of federated Protocols"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_c5baf26d","line":224,"updated":"2016-08-09 21:52:26.000000000","message":"Go-Lance-Go","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f4f7daf125a2d5a088e734a84419a7cc4cefc0a8","unresolved":false,"context_lines":[{"line_number":282,"context_line":"           {"},{"line_number":283,"context_line":"               \"local\": ["},{"line_number":284,"context_line":"                  {"},{"line_number":285,"context_line":"                       \"\u003cuser\u003e or \u003cgroup\u003e\""},{"line_number":286,"context_line":"                   }"},{"line_number":287,"context_line":"               ],"},{"line_number":288,"context_line":"               \"remote\": ["}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_e00a8420","line":285,"updated":"2016-08-09 21:38:08.000000000","message":"Should we expand on this to show how substitution works?","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f4f7daf125a2d5a088e734a84419a7cc4cefc0a8","unresolved":false,"context_lines":[{"line_number":294,"context_line":"       ]"},{"line_number":295,"context_line":"   }"},{"line_number":296,"context_line":""},{"line_number":297,"context_line":"* ``rules``: top-level list of rules."},{"line_number":298,"context_line":"* ``local``: a rule containing information on what local attributes"},{"line_number":299,"context_line":"  will be mapped."},{"line_number":300,"context_line":"* ``remote``: a rule containing information on what remote attributes will"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_0509aa31","line":297,"updated":"2016-08-09 21:38:08.000000000","message":"We should add a few more examples. At least 1 to show multiple rules.","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"f4f7daf125a2d5a088e734a84419a7cc4cefc0a8","unresolved":false,"context_lines":[{"line_number":336,"context_line":"will know to map the `jsmith` user to the ``Developer Group`` because the assertion"},{"line_number":337,"context_line":"says `jsmith` is a member of the ``hacker`` group."},{"line_number":338,"context_line":""},{"line_number":339,"context_line":"Mapping schema"},{"line_number":340,"context_line":"--------------"},{"line_number":341,"context_line":""},{"line_number":342,"context_line":"The schema for mapping is a description of how a mapping should"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_206adcb3","line":339,"updated":"2016-08-09 21:38:08.000000000","message":"I think we can probably remove this section. It\u0027s more of a developer thing that I don\u0027t think operators would ever care about.","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"f7da5644e0413413b12f6819020e1dd15c24d894","unresolved":false,"context_lines":[{"line_number":351,"context_line":""},{"line_number":352,"context_line":"    {"},{"line_number":353,"context_line":"        \"type\": \"object\","},{"line_number":354,"context_line":"        \"required\": [\u0027rules\u0027],"},{"line_number":355,"context_line":"        \"properties\": {"},{"line_number":356,"context_line":"            \"rules\": {"},{"line_number":357,"context_line":"                \"minItems\": 1,"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_c502f26e","line":354,"updated":"2016-08-09 21:34:28.000000000","message":"Do the docs treat single quotes different than double quotes? Or, is this valid JSON?","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":353,"context_line":"        \"type\": \"object\","},{"line_number":354,"context_line":"        \"required\": [\u0027rules\u0027],"},{"line_number":355,"context_line":"        \"properties\": {"},{"line_number":356,"context_line":"            \"rules\": {"},{"line_number":357,"context_line":"                \"minItems\": 1,"},{"line_number":358,"context_line":"                \"type\": \"array\","},{"line_number":359,"context_line":"                \"items\": {"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_05224ab9","line":356,"updated":"2016-08-09 21:52:26.000000000","message":"A specific mapping example with multiple rules would be nice to illustrate and describe.","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"d408d289acb179ae2367f75fe10a9736968ee8f8","unresolved":false,"context_lines":[{"line_number":374,"context_line":"                                    {\"$ref\": \"#/definitions/any_one_of\"},"},{"line_number":375,"context_line":"                                    {\"$ref\": \"#/definitions/not_any_of\"},"},{"line_number":376,"context_line":"                                    {\"$ref\": \"#/definitions/blacklist\"},"},{"line_number":377,"context_line":"                                    {\"$ref\": \"#/definitions/whitelist\"}"},{"line_number":378,"context_line":"                                ],"},{"line_number":379,"context_line":"                            }"},{"line_number":380,"context_line":"                        }"}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_6508662d","line":377,"updated":"2016-08-09 21:52:26.000000000","message":"Any example of each of these types of rules would be nice.","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Federated Identity"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Federation for keystone can be utilised in two ways:"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"* Supporting keystone as a Service Provider (SP): consuming identity"},{"line_number":8,"context_line":"  assertions issued by an external Identity Provider, such as SAML"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_8a5c7dee","line":5,"range":{"start_line":5,"start_character":31,"end_line":5,"end_character":39},"updated":"2016-08-22 17:09:17.000000000","message":"Consider replacing with \u0027used\u0027\nIt is better for non-native readers and translations.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Federation for keystone can be utilised in two ways:"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"* Supporting keystone as a Service Provider (SP): consuming identity"},{"line_number":8,"context_line":"  assertions issued by an external Identity Provider, such as SAML"},{"line_number":9,"context_line":"  assertions or OpenID Connect claims."},{"line_number":10,"context_line":"* Supporting keystone as an Identity Provider (IdP): fulfilling authentication"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_6aa2e1af","line":7,"range":{"start_line":7,"start_character":27,"end_line":7,"end_character":48},"updated":"2016-08-22 17:09:17.000000000","message":":abbr:`SP (Service Provider)`","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":7,"context_line":"* Supporting keystone as a Service Provider (SP): consuming identity"},{"line_number":8,"context_line":"  assertions issued by an external Identity Provider, such as SAML"},{"line_number":9,"context_line":"  assertions or OpenID Connect claims."},{"line_number":10,"context_line":"* Supporting keystone as an Identity Provider (IdP): fulfilling authentication"},{"line_number":11,"context_line":"  requests on behalf of Service Providers."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"  .. note::"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_ca915554","line":10,"range":{"start_line":10,"start_character":28,"end_line":10,"end_character":51},"updated":"2016-08-22 17:09:17.000000000","message":":abbr:`IdP (Identity Provider)`","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":15,"context_line":"      It is also possible to have one keystone act as an SP that"},{"line_number":16,"context_line":"      consumes Identity from another keystone acting as an IdP."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"There is currently support for two major federation protocols:"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"* `SAML \u003chttps://en.wikipedia.org/wiki/SAML_2.0\u003e`_"},{"line_number":21,"context_line":"* `OpenID Connect \u003chttps://en.wikipedia.org/wiki/OpenID_Connect\u003e`_"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_4a8c4535","line":18,"range":{"start_line":18,"start_character":0,"end_line":18,"end_character":61},"updated":"2016-08-22 17:09:17.000000000","message":"Two major federation protocols are currently supported:","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"   Keystone federation"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"To enable federation, ensure you follow the steps below:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"#. Run keystone under Apache. See `Configure the Apache HTTP server \u003chttp://docs.openstack.org/mitaka/install-guide-obs/keystone-install.html\u003e`_"},{"line_number":31,"context_line":"   for more information."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_0ac1ad2e","line":28,"range":{"start_line":28,"start_character":0,"end_line":28,"end_character":56},"updated":"2016-08-22 17:09:17.000000000","message":"Follow these steps to enable federation:\n\nKeeping the simple sentence structure makes the content easier to consume for non-native readers. It also satisfies the OpenStack writing style guidelines.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":37,"context_line":"      by the community."},{"line_number":38,"context_line":""},{"line_number":39,"context_line":"#. Configure Apache to use a federation capable module."},{"line_number":40,"context_line":"   We recommend Shibboleth, see `here \u003chttp://docs.openstack.org/developer/keystone/federation/shibboleth.html\u003e`_"},{"line_number":41,"context_line":"   for more information."},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"   .. note::"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_8a875dd6","line":40,"range":{"start_line":40,"start_character":33,"end_line":40,"end_character":37},"updated":"2016-08-22 17:09:17.000000000","message":"the Shibboleth documentation","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":42,"context_line":""},{"line_number":43,"context_line":"   .. note::"},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"      Another option is ``mod_auth_melon``, see `the github repo \u003chttps://github.com/UNINETT/mod_auth_mellon\u003e`_"},{"line_number":46,"context_line":"      for more information."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"#. Configure federation in keystone."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_aa6e99fe","line":45,"range":{"start_line":45,"start_character":49,"end_line":45,"end_character":64},"updated":"2016-08-22 17:09:17.000000000","message":"the mod\u0027s github repo\n\nAvoid generic text for links. It makes finding broken links very difficult thus making the content harder to maintain.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":54,"context_line":"   Keystone maps these values to keystone user groups and assignments"},{"line_number":55,"context_line":"   created in keystone."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Supporting keystone as a Service Provider (SP)"},{"line_number":58,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"To have keystone as as a Service Provider (SP), you will need to configure"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_0a552d1c","line":57,"range":{"start_line":57,"start_character":25,"end_line":57,"end_character":46},"updated":"2016-08-22 17:09:17.000000000","message":"SP suffices. The abbreviation is defined above.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":57,"context_line":"Supporting keystone as a Service Provider (SP)"},{"line_number":58,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"To have keystone as as a Service Provider (SP), you will need to configure"},{"line_number":61,"context_line":"keystone to accept assertions from external IdPs. Examples of external"},{"line_number":62,"context_line":"IdPs are:"},{"line_number":63,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_8a3f5dd5","line":60,"range":{"start_line":60,"start_character":25,"end_line":60,"end_character":46},"updated":"2016-08-22 17:09:17.000000000","message":"ditto","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":61,"context_line":"keystone to accept assertions from external IdPs. Examples of external"},{"line_number":62,"context_line":"IdPs are:"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"* Active Directory Federation Services (ADFS)"},{"line_number":65,"context_line":"* FreeIPA"},{"line_number":66,"context_line":"* Tivoli Access Manager"},{"line_number":67,"context_line":"* Keystone"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_d5145645","line":64,"range":{"start_line":64,"start_character":2,"end_line":64,"end_character":45},"updated":"2016-08-22 17:09:17.000000000","message":":abbr:`ADFS (Active Directory Federation Services)`","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"#. Configure authentication drivers in ``keystone.conf`` by adding the"},{"line_number":73,"context_line":"   authentication methods to the ``[auth]`` section in ``keystone.conf``."},{"line_number":74,"context_line":"   Ensure the names are equal to protocol names added via Identity API v3."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"   For example:"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_55bb46e5","line":74,"range":{"start_line":74,"start_character":30,"end_line":74,"end_character":41},"updated":"2016-08-22 17:09:17.000000000","message":"to the protocol","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":83,"context_line":"   .. note::"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"      ``mapped`` and ``openid`` are the federation specific drivers."},{"line_number":86,"context_line":"      The others in the example are not related to federation."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"#. Create local keystone groups and assign roles."},{"line_number":89,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_35a5eab4","line":86,"range":{"start_line":86,"start_character":10,"end_line":86,"end_character":16},"updated":"2016-08-22 17:09:17.000000000","message":"other names","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"   .. important::"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"      The Identity service requires group-based role assignments to authorize"},{"line_number":93,"context_line":"      federated users. The federation mapping engine maps federated users into"},{"line_number":94,"context_line":"      local user groups, which are the actors in keystone role assignments."},{"line_number":95,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_75864214","line":92,"range":{"start_line":92,"start_character":10,"end_line":92,"end_character":18},"updated":"2016-08-22 17:09:17.000000000","message":"identity","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"4f8065a635398ad0a19a70dbebcec4d2b0aff172","unresolved":false,"context_lines":[{"line_number":89,"context_line":""},{"line_number":90,"context_line":"   .. important::"},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"      The Identity service requires group-based role assignments to authorize"},{"line_number":93,"context_line":"      federated users. The federation mapping engine maps federated users into"},{"line_number":94,"context_line":"      local user groups, which are the actors in keystone role assignments."},{"line_number":95,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_9718f81f","line":92,"range":{"start_line":92,"start_character":10,"end_line":92,"end_character":18},"in_reply_to":"1ac06dbe_75864214","updated":"2016-08-23 07:44:15.000000000","message":"Identity should be upper case as this is the use of the service name, and not the project name. As per the conventions, should be capitalised.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":91,"context_line":""},{"line_number":92,"context_line":"      The Identity service requires group-based role assignments to authorize"},{"line_number":93,"context_line":"      federated users. The federation mapping engine maps federated users into"},{"line_number":94,"context_line":"      local user groups, which are the actors in keystone role assignments."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"#. Create an IdP object in keystone. Make sure it represents the"},{"line_number":97,"context_line":"   IdP you will use to authenticate end users:"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_55b7c6d7","line":94,"range":{"start_line":94,"start_character":49,"end_line":94,"end_character":57},"updated":"2016-08-22 17:09:17.000000000","message":"keystone\u0027s","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":93,"context_line":"      federated users. The federation mapping engine maps federated users into"},{"line_number":94,"context_line":"      local user groups, which are the actors in keystone role assignments."},{"line_number":95,"context_line":""},{"line_number":96,"context_line":"#. Create an IdP object in keystone. Make sure it represents the"},{"line_number":97,"context_line":"   IdP you will use to authenticate end users:"},{"line_number":98,"context_line":""},{"line_number":99,"context_line":"   .. code:: ini"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_956e5eff","line":96,"range":{"start_line":96,"start_character":37,"end_line":96,"end_character":60},"updated":"2016-08-22 17:09:17.000000000","message":"The object must represent","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":112,"context_line":""},{"line_number":113,"context_line":"   .. note::"},{"line_number":114,"context_line":""},{"line_number":115,"context_line":"       The only Identity API objects that support mapping are groups and users."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"#. Add a protocol object and specify the mapping ID you want to use with the"},{"line_number":118,"context_line":"   combination of the IdP and Protocol:"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_d0b0e445","line":115,"range":{"start_line":115,"start_character":16,"end_line":115,"end_character":24},"updated":"2016-08-22 17:09:17.000000000","message":"identity","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":115,"context_line":"       The only Identity API objects that support mapping are groups and users."},{"line_number":116,"context_line":""},{"line_number":117,"context_line":"#. Add a protocol object and specify the mapping ID you want to use with the"},{"line_number":118,"context_line":"   combination of the IdP and Protocol:"},{"line_number":119,"context_line":""},{"line_number":120,"context_line":"   .. code:: ini"},{"line_number":121,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_b06e0894","line":118,"range":{"start_line":118,"start_character":30,"end_line":118,"end_character":38},"updated":"2016-08-22 17:09:17.000000000","message":"protocol","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":130,"context_line":""},{"line_number":131,"context_line":"   .. note::"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"      Unlike other authentication methods in the Identity service, the user does"},{"line_number":134,"context_line":"      not issue an HTTP POST request with authentication data in the request body."},{"line_number":135,"context_line":"      To start federated authentication a user must access the dedicated URL with"},{"line_number":136,"context_line":"      IdP\u0027s and Protocol’s identifiers stored within a protected URL."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_f016c0ef","line":133,"range":{"start_line":133,"start_character":49,"end_line":133,"end_character":57},"updated":"2016-08-22 17:09:17.000000000","message":"identity","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":133,"context_line":"      Unlike other authentication methods in the Identity service, the user does"},{"line_number":134,"context_line":"      not issue an HTTP POST request with authentication data in the request body."},{"line_number":135,"context_line":"      To start federated authentication a user must access the dedicated URL with"},{"line_number":136,"context_line":"      IdP\u0027s and Protocol’s identifiers stored within a protected URL."},{"line_number":137,"context_line":"      The URL has a format of:"},{"line_number":138,"context_line":"      ``/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}/auth``."},{"line_number":139,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_10ca7c6d","line":136,"range":{"start_line":136,"start_character":16,"end_line":136,"end_character":24},"updated":"2016-08-22 17:09:17.000000000","message":"protocol","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":152,"context_line":""},{"line_number":153,"context_line":"      GET /OS-FEDERATION/projects"},{"line_number":154,"context_line":""},{"line_number":155,"context_line":"#. Get a scoped token. A federated user may request a scoped token, by using"},{"line_number":156,"context_line":"   the unscoped token. A project or domain may be specified by either ID or"},{"line_number":157,"context_line":"   name. An ID is sufficient to uniquely identify a project or domain."},{"line_number":158,"context_line":""},{"line_number":159,"context_line":"   .. code:: ini"},{"line_number":160,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_d0558450","line":157,"range":{"start_line":155,"start_character":23,"end_line":157,"end_character":8},"updated":"2016-08-22 17:09:17.000000000","message":"A federated user can request a scoped token using the unscoped token. A project or domain can be specified by either ID or name.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":184,"context_line":"      idp_sso_endpoint\u003dhttps://keystone.example.com/v3/OS-FEDERATION/saml2/sso"},{"line_number":185,"context_line":"      idp_metadata_path\u003d/etc/keystone/saml2_idp_metadata.xml"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"#. We recommend the following `Organization` configuration options be setup."},{"line_number":188,"context_line":"   Make sure these values are URL safe:"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"   .. code:: ini"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_3067b826","line":187,"range":{"start_line":187,"start_character":66,"end_line":187,"end_character":75},"updated":"2016-08-22 17:09:17.000000000","message":"remove, it is redundant.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":185,"context_line":"      idp_metadata_path\u003d/etc/keystone/saml2_idp_metadata.xml"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"#. We recommend the following `Organization` configuration options be setup."},{"line_number":188,"context_line":"   Make sure these values are URL safe:"},{"line_number":189,"context_line":""},{"line_number":190,"context_line":"   .. code:: ini"},{"line_number":191,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_6aec9c8f","line":188,"range":{"start_line":188,"start_character":30,"end_line":188,"end_character":38},"updated":"2016-08-22 17:09:17.000000000","message":"Unclear/without context. I know what you mean to say but that is not what is being said. I would suggest:\nEnsure these values contain not special characters that may cause problems as part of a URL.\nThe issue is that \u0027URL safe\u0027 is not something non-native readers can find in the dictionary.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":208,"context_line":"Generate metadata"},{"line_number":209,"context_line":"-----------------"},{"line_number":210,"context_line":""},{"line_number":211,"context_line":"In order to create a trust between the IdP and SP, metadata must be"},{"line_number":212,"context_line":"exchanged."},{"line_number":213,"context_line":""},{"line_number":214,"context_line":"#. Create metadata for your keystone IdP, run the ``keystone-manage`` command"},{"line_number":215,"context_line":"   and pipe the output to a file. For example:"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_6a3f7cd6","line":212,"range":{"start_line":211,"start_character":0,"end_line":212,"end_character":10},"updated":"2016-08-22 17:09:17.000000000","message":"Metadata must be exchanged to create a trust between the IdP and the SP.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":220,"context_line":""},{"line_number":221,"context_line":"   .. note::"},{"line_number":222,"context_line":""},{"line_number":223,"context_line":"      Ensure the file location matches the value of the configuration option"},{"line_number":224,"context_line":"      ``idp_metadata_path`` that was assigned in the previous section."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"Create a Service Provider (SP)"},{"line_number":227,"context_line":"------------------------------"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_ad0fce2c","line":224,"range":{"start_line":223,"start_character":6,"end_line":224,"end_character":70},"updated":"2016-08-22 17:09:17.000000000","message":"The file location must match the value of the ``idp_metadata_path`` configuration option assigned previously.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":223,"context_line":"      Ensure the file location matches the value of the configuration option"},{"line_number":224,"context_line":"      ``idp_metadata_path`` that was assigned in the previous section."},{"line_number":225,"context_line":""},{"line_number":226,"context_line":"Create a Service Provider (SP)"},{"line_number":227,"context_line":"------------------------------"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"In order to setup keystone-as-a-Service-Provider properly, you will need to"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_4d9c5ac0","line":226,"range":{"start_line":226,"start_character":9,"end_line":226,"end_character":30},"updated":"2016-08-22 17:09:17.000000000","message":"SP","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":226,"context_line":"Create a Service Provider (SP)"},{"line_number":227,"context_line":"------------------------------"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"In order to setup keystone-as-a-Service-Provider properly, you will need to"},{"line_number":230,"context_line":"understand what `Protocols` are supported by external IdPs."},{"line_number":231,"context_line":"For example, if you are looking to setup keystone-as-a-Service-Provider and"},{"line_number":232,"context_line":"want to allow identities to federate in from a ADFS IdP,"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_4d83ba56","line":229,"range":{"start_line":229,"start_character":0,"end_line":229,"end_character":11},"updated":"2016-08-22 17:09:17.000000000","message":"To","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":227,"context_line":"------------------------------"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"In order to setup keystone-as-a-Service-Provider properly, you will need to"},{"line_number":230,"context_line":"understand what `Protocols` are supported by external IdPs."},{"line_number":231,"context_line":"For example, if you are looking to setup keystone-as-a-Service-Provider and"},{"line_number":232,"context_line":"want to allow identities to federate in from a ADFS IdP,"},{"line_number":233,"context_line":"configure the SP to understand the SAML v2.0 Protocol since"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_ed8c2681","line":230,"range":{"start_line":230,"start_character":17,"end_line":230,"end_character":26},"updated":"2016-08-22 17:09:17.000000000","message":"protocols","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":228,"context_line":""},{"line_number":229,"context_line":"In order to setup keystone-as-a-Service-Provider properly, you will need to"},{"line_number":230,"context_line":"understand what `Protocols` are supported by external IdPs."},{"line_number":231,"context_line":"For example, if you are looking to setup keystone-as-a-Service-Provider and"},{"line_number":232,"context_line":"want to allow identities to federate in from a ADFS IdP,"},{"line_number":233,"context_line":"configure the SP to understand the SAML v2.0 Protocol since"},{"line_number":234,"context_line":"ADFS issues assertions using SAML v2.0. Some examples of federated Protocols"},{"line_number":235,"context_line":"may be:"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"* SAML v2.0"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_ad734ee6","line":234,"range":{"start_line":231,"start_character":0,"end_line":234,"end_character":38},"updated":"2016-08-22 17:09:17.000000000","message":"The sentence is too long and unclear. I have divided it into two:\n\nFor example, keystone as an SP can allow identities to federate in from a ADFS IdP but it must be configured to understand the SAML v2.0 protocol. The reason is that ADFS issues assertions using SAML v2.0.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":231,"context_line":"For example, if you are looking to setup keystone-as-a-Service-Provider and"},{"line_number":232,"context_line":"want to allow identities to federate in from a ADFS IdP,"},{"line_number":233,"context_line":"configure the SP to understand the SAML v2.0 Protocol since"},{"line_number":234,"context_line":"ADFS issues assertions using SAML v2.0. Some examples of federated Protocols"},{"line_number":235,"context_line":"may be:"},{"line_number":236,"context_line":""},{"line_number":237,"context_line":"* SAML v2.0"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_c0149145","line":234,"range":{"start_line":234,"start_character":67,"end_line":234,"end_character":76},"updated":"2016-08-22 17:09:17.000000000","message":"protocols","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":238,"context_line":"* OpenID Connect"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"The following instructions are an example of how you can configure"},{"line_number":241,"context_line":"keystone-as-a-Service-Provider."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"#. Create a new Service Provider with an ID of BETA."},{"line_number":244,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_806f39c4","line":241,"range":{"start_line":241,"start_character":0,"end_line":241,"end_character":30},"updated":"2016-08-22 17:09:17.000000000","message":"keystone as an SP","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":240,"context_line":"The following instructions are an example of how you can configure"},{"line_number":241,"context_line":"keystone-as-a-Service-Provider."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"#. Create a new Service Provider with an ID of BETA."},{"line_number":244,"context_line":""},{"line_number":245,"context_line":"#. Create a ``sp_url`` of `\u003chttp://beta.example.com/Shibboleth.sso/SAML2/ECP\u003e`_."},{"line_number":246,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_20864565","line":243,"range":{"start_line":243,"start_character":16,"end_line":243,"end_character":32},"updated":"2016-08-22 17:09:17.000000000","message":"SP\nBe consistent, if you want to use the abbreviation, that is perfectly fine, but do so everywhere. Otherwise, readers get confused as to what the abbreviation means since it is only used sometimes.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":252,"context_line":"      the current keystone IdP. Use the ``auth_url`` when retrieving the token"},{"line_number":253,"context_line":"      for BETA once the SAML assertion is sent."},{"line_number":254,"context_line":""},{"line_number":255,"context_line":"#. Set the ``enabled`` field to ``true``. It will be set to"},{"line_number":256,"context_line":"   ``false`` by default."},{"line_number":257,"context_line":""},{"line_number":258,"context_line":"#. Your output should reflect the following example:"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_8059f900","line":255,"range":{"start_line":255,"start_character":45,"end_line":255,"end_character":52},"updated":"2016-08-22 17:09:17.000000000","message":"is","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":265,"context_line":"     -d \u0027{\"service_provider\": {\"auth_url\": \"http://beta.example.com:5000/v3/OS-FEDERATION/identity_providers/beta/protocols/saml2/auth\", \"sp_url\": \"https://example.com:5000/Shibboleth.sso/SAML2/ECP\", \"enabled\": true}}\u0027 \\"},{"line_number":266,"context_line":"     http://localhost:5000/v3/OS-FEDERATION/service_providers/BETA | python -mjson.tool"},{"line_number":267,"context_line":""},{"line_number":268,"context_line":"keystone-to-keystone (k2k)"},{"line_number":269,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"Keystone acting as an IdP is known as Keystone-2-Keystone"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_a06eb593","line":268,"range":{"start_line":268,"start_character":20,"end_line":268,"end_character":26},"updated":"2016-08-22 17:09:17.000000000","message":"remove","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":268,"context_line":"keystone-to-keystone (k2k)"},{"line_number":269,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"Keystone acting as an IdP is known as Keystone-2-Keystone"},{"line_number":272,"context_line":"or K2K Federation, where a keystone somewhere is acting as the SP"},{"line_number":273,"context_line":"and another keystone is acting as the IdP. All IdPs issue"},{"line_number":274,"context_line":"assertions about the identities it owns using a `Protocol`."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_80de193d","line":271,"range":{"start_line":271,"start_character":38,"end_line":271,"end_character":57},"updated":"2016-08-22 17:09:17.000000000","message":":abbr:`k2k (keystone-2-keystone)`","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":269,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":270,"context_line":""},{"line_number":271,"context_line":"Keystone acting as an IdP is known as Keystone-2-Keystone"},{"line_number":272,"context_line":"or K2K Federation, where a keystone somewhere is acting as the SP"},{"line_number":273,"context_line":"and another keystone is acting as the IdP. All IdPs issue"},{"line_number":274,"context_line":"assertions about the identities it owns using a `Protocol`."},{"line_number":275,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_c096514b","line":272,"range":{"start_line":272,"start_character":3,"end_line":272,"end_character":17},"updated":"2016-08-22 17:09:17.000000000","message":"k2k federation","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":277,"context_line":"~~~~~~~~~~~~~"},{"line_number":278,"context_line":""},{"line_number":279,"context_line":"Mapping adds a set of rules to map federation attributes to keystone users"},{"line_number":280,"context_line":"or groups. An Identity Provider has exactly one mapping specified per protocol."},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"A mapping is a translation between assertions provided from an IdP and"},{"line_number":283,"context_line":"permission and roles applied by a SP. Given an assertion from an IdP, a"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_4061c138","line":280,"range":{"start_line":280,"start_character":14,"end_line":280,"end_character":31},"updated":"2016-08-22 17:09:17.000000000","message":"IdP","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":280,"context_line":"or groups. An Identity Provider has exactly one mapping specified per protocol."},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"A mapping is a translation between assertions provided from an IdP and"},{"line_number":283,"context_line":"permission and roles applied by a SP. Given an assertion from an IdP, a"},{"line_number":284,"context_line":"SP applies a mapping to translate attributes from the"},{"line_number":285,"context_line":"IdP to known roles for the SP. A mapping is typically"},{"line_number":286,"context_line":"owned by a Service Provider."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_60715de0","line":283,"range":{"start_line":283,"start_character":32,"end_line":283,"end_character":33},"updated":"2016-08-22 17:09:17.000000000","message":"an","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":280,"context_line":"or groups. An Identity Provider has exactly one mapping specified per protocol."},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"A mapping is a translation between assertions provided from an IdP and"},{"line_number":283,"context_line":"permission and roles applied by a SP. Given an assertion from an IdP, a"},{"line_number":284,"context_line":"SP applies a mapping to translate attributes from the"},{"line_number":285,"context_line":"IdP to known roles for the SP. A mapping is typically"},{"line_number":286,"context_line":"owned by a Service Provider."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_c3149b45","line":283,"range":{"start_line":283,"start_character":70,"end_line":283,"end_character":71},"updated":"2016-08-22 17:09:17.000000000","message":"an","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":280,"context_line":"or groups. An Identity Provider has exactly one mapping specified per protocol."},{"line_number":281,"context_line":""},{"line_number":282,"context_line":"A mapping is a translation between assertions provided from an IdP and"},{"line_number":283,"context_line":"permission and roles applied by a SP. Given an assertion from an IdP, a"},{"line_number":284,"context_line":"SP applies a mapping to translate attributes from the"},{"line_number":285,"context_line":"IdP to known roles for the SP. A mapping is typically"},{"line_number":286,"context_line":"owned by a Service Provider."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_e0a6ed51","line":283,"range":{"start_line":283,"start_character":0,"end_line":283,"end_character":10},"updated":"2016-08-22 17:09:17.000000000","message":"the permission","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":282,"context_line":"A mapping is a translation between assertions provided from an IdP and"},{"line_number":283,"context_line":"permission and roles applied by a SP. Given an assertion from an IdP, a"},{"line_number":284,"context_line":"SP applies a mapping to translate attributes from the"},{"line_number":285,"context_line":"IdP to known roles for the SP. A mapping is typically"},{"line_number":286,"context_line":"owned by a Service Provider."},{"line_number":287,"context_line":""},{"line_number":288,"context_line":"Mapping objects can be used multiple times by different combinations"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_6324c7ae","line":285,"range":{"start_line":285,"start_character":19,"end_line":285,"end_character":29},"updated":"2016-08-22 17:09:17.000000000","message":"remove, redundant.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":283,"context_line":"permission and roles applied by a SP. Given an assertion from an IdP, a"},{"line_number":284,"context_line":"SP applies a mapping to translate attributes from the"},{"line_number":285,"context_line":"IdP to known roles for the SP. A mapping is typically"},{"line_number":286,"context_line":"owned by a Service Provider."},{"line_number":287,"context_line":""},{"line_number":288,"context_line":"Mapping objects can be used multiple times by different combinations"},{"line_number":289,"context_line":"of Identity Provider and Protocol."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_434eeb6f","line":286,"range":{"start_line":286,"start_character":9,"end_line":286,"end_character":27},"updated":"2016-08-22 17:09:17.000000000","message":"the SP.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":286,"context_line":"owned by a Service Provider."},{"line_number":287,"context_line":""},{"line_number":288,"context_line":"Mapping objects can be used multiple times by different combinations"},{"line_number":289,"context_line":"of Identity Provider and Protocol."},{"line_number":290,"context_line":""},{"line_number":291,"context_line":"A rule hierarchy is as follows:"},{"line_number":292,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_43754b96","line":289,"range":{"start_line":289,"start_character":3,"end_line":289,"end_character":33},"updated":"2016-08-22 17:09:17.000000000","message":"IdPs and protocols","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":322,"context_line":"Mapping creation"},{"line_number":323,"context_line":"----------------"},{"line_number":324,"context_line":""},{"line_number":325,"context_line":"Mapping creation starts with communication between the IdP and SP."},{"line_number":326,"context_line":"The IdP usually provides a set of assertions that their users"},{"line_number":327,"context_line":"have in their assertion document. The Service Provider will have to map"},{"line_number":328,"context_line":"those assertions to groups and roles known by the Service Provider."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_c3de5b6c","line":325,"range":{"start_line":325,"start_character":24,"end_line":325,"end_character":28},"updated":"2016-08-22 17:09:17.000000000","message":"with the","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":324,"context_line":""},{"line_number":325,"context_line":"Mapping creation starts with communication between the IdP and SP."},{"line_number":326,"context_line":"The IdP usually provides a set of assertions that their users"},{"line_number":327,"context_line":"have in their assertion document. The Service Provider will have to map"},{"line_number":328,"context_line":"those assertions to groups and roles known by the Service Provider."},{"line_number":329,"context_line":"For example:"},{"line_number":330,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_43d1cb56","line":327,"range":{"start_line":327,"start_character":38,"end_line":327,"end_character":54},"updated":"2016-08-22 17:09:17.000000000","message":"SP","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":325,"context_line":"Mapping creation starts with communication between the IdP and SP."},{"line_number":326,"context_line":"The IdP usually provides a set of assertions that their users"},{"line_number":327,"context_line":"have in their assertion document. The Service Provider will have to map"},{"line_number":328,"context_line":"those assertions to groups and roles known by the Service Provider."},{"line_number":329,"context_line":"For example:"},{"line_number":330,"context_line":""},{"line_number":331,"context_line":".. code:: ini"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_6345e715","line":328,"range":{"start_line":328,"start_character":20,"end_line":328,"end_character":66},"updated":"2016-08-22 17:09:17.000000000","message":"known groups and roles.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":346,"context_line":"     Groups: hackers"},{"line_number":347,"context_line":""},{"line_number":348,"context_line":"The ``Developer Group`` may have a role assignment on the"},{"line_number":349,"context_line":"``Developer Project``. When `jsmith` authenticates against Identity Provider"},{"line_number":350,"context_line":"1, and presents that assertion to the Service Provider, the Service Provider"},{"line_number":351,"context_line":"will know to map the `jsmith` user to the ``Developer Group`` because the assertion"},{"line_number":352,"context_line":"says `jsmith` is a member of the ``hacker`` group."},{"line_number":353,"context_line":""},{"line_number":354,"context_line":"Mapping examples"},{"line_number":355,"context_line":"----------------"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_23be4fd4","line":352,"range":{"start_line":349,"start_character":23,"end_line":352,"end_character":50},"updated":"2016-08-22 17:09:17.000000000","message":"When `jsmith` authenticates against IdP 1, it presents that assertion to the SP.The SP maps the `jsmith` user to the ``Developer Group`` because the assertion says `jsmith` is a member of the ``hacker`` group.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":355,"context_line":"----------------"},{"line_number":356,"context_line":""},{"line_number":357,"context_line":"A bare bones mapping is sufficient if you would like all federated users to"},{"line_number":358,"context_line":"have the same authorization in the service provider cloud. However, mapping is"},{"line_number":359,"context_line":"quite powerful, and the flexibility it affords you to map different remote"},{"line_number":360,"context_line":"users into different user groups in keystone is limited only by the number of"},{"line_number":361,"context_line":"assertions your IdP makes about each user."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_43a26baf","line":358,"range":{"start_line":358,"start_character":35,"end_line":358,"end_character":51},"updated":"2016-08-22 17:09:17.000000000","message":"SP","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":356,"context_line":""},{"line_number":357,"context_line":"A bare bones mapping is sufficient if you would like all federated users to"},{"line_number":358,"context_line":"have the same authorization in the service provider cloud. However, mapping is"},{"line_number":359,"context_line":"quite powerful, and the flexibility it affords you to map different remote"},{"line_number":360,"context_line":"users into different user groups in keystone is limited only by the number of"},{"line_number":361,"context_line":"assertions your IdP makes about each user."},{"line_number":362,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_a3787f2c","line":359,"range":{"start_line":359,"start_character":5,"end_line":359,"end_character":53},"updated":"2016-08-22 17:09:17.000000000","message":"powerful and flexible. You can","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":357,"context_line":"A bare bones mapping is sufficient if you would like all federated users to"},{"line_number":358,"context_line":"have the same authorization in the service provider cloud. However, mapping is"},{"line_number":359,"context_line":"quite powerful, and the flexibility it affords you to map different remote"},{"line_number":360,"context_line":"users into different user groups in keystone is limited only by the number of"},{"line_number":361,"context_line":"assertions your IdP makes about each user."},{"line_number":362,"context_line":""},{"line_number":363,"context_line":"A mapping is composed of a list of rules, and each rule is further composed of"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_e3727748","line":360,"range":{"start_line":360,"start_character":44,"end_line":360,"end_character":48},"updated":"2016-08-22 17:09:17.000000000","message":",","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":362,"context_line":""},{"line_number":363,"context_line":"A mapping is composed of a list of rules, and each rule is further composed of"},{"line_number":364,"context_line":"a list of remote attributes and a list of local attributes. If a rule is"},{"line_number":365,"context_line":"matched, all of the local attributes are applied in the service provider. For a"},{"line_number":366,"context_line":"rule to match, all of the remote attributes it defines must be matched."},{"line_number":367,"context_line":""},{"line_number":368,"context_line":"In the base case, a federated user simply has to have an assertion containing"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_23bacfc0","line":365,"range":{"start_line":365,"start_character":56,"end_line":365,"end_character":72},"updated":"2016-08-22 17:09:17.000000000","message":"SP","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":363,"context_line":"A mapping is composed of a list of rules, and each rule is further composed of"},{"line_number":364,"context_line":"a list of remote attributes and a list of local attributes. If a rule is"},{"line_number":365,"context_line":"matched, all of the local attributes are applied in the service provider. For a"},{"line_number":366,"context_line":"rule to match, all of the remote attributes it defines must be matched."},{"line_number":367,"context_line":""},{"line_number":368,"context_line":"In the base case, a federated user simply has to have an assertion containing"},{"line_number":369,"context_line":"an email address to be identified in the service provider cloud. To achieve"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_63b4c7d0","line":366,"range":{"start_line":366,"start_character":60,"end_line":366,"end_character":70},"updated":"2016-08-22 17:09:17.000000000","message":"match","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":365,"context_line":"matched, all of the local attributes are applied in the service provider. For a"},{"line_number":366,"context_line":"rule to match, all of the remote attributes it defines must be matched."},{"line_number":367,"context_line":""},{"line_number":368,"context_line":"In the base case, a federated user simply has to have an assertion containing"},{"line_number":369,"context_line":"an email address to be identified in the service provider cloud. To achieve"},{"line_number":370,"context_line":"that, we only need one rule requiring the presence one remote attribute:"},{"line_number":371,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_a3cd1f5f","line":368,"range":{"start_line":368,"start_character":42,"end_line":368,"end_character":53},"updated":"2016-08-22 17:09:17.000000000","message":"needs","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":366,"context_line":"rule to match, all of the remote attributes it defines must be matched."},{"line_number":367,"context_line":""},{"line_number":368,"context_line":"In the base case, a federated user simply has to have an assertion containing"},{"line_number":369,"context_line":"an email address to be identified in the service provider cloud. To achieve"},{"line_number":370,"context_line":"that, we only need one rule requiring the presence one remote attribute:"},{"line_number":371,"context_line":""},{"line_number":372,"context_line":".. code:: javascript"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_83ff4366","line":369,"range":{"start_line":369,"start_character":41,"end_line":369,"end_character":57},"updated":"2016-08-22 17:09:17.000000000","message":"SP","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":366,"context_line":"rule to match, all of the remote attributes it defines must be matched."},{"line_number":367,"context_line":""},{"line_number":368,"context_line":"In the base case, a federated user simply has to have an assertion containing"},{"line_number":369,"context_line":"an email address to be identified in the service provider cloud. To achieve"},{"line_number":370,"context_line":"that, we only need one rule requiring the presence one remote attribute:"},{"line_number":371,"context_line":""},{"line_number":372,"context_line":".. code:: javascript"},{"line_number":373,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_c36e5b2e","line":370,"range":{"start_line":369,"start_character":65,"end_line":370,"end_character":71},"updated":"2016-08-22 17:09:17.000000000","message":"To achieve that, only one rule is needed that requires the presence of one remote attribute:","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":391,"context_line":"    }"},{"line_number":392,"context_line":""},{"line_number":393,"context_line":"However, that is not particularly useful as the federated user would receive no"},{"line_number":394,"context_line":"authorization. To rectify that, we can map all federated users with email"},{"line_number":395,"context_line":"addresses into a ``federated-users`` group in the ``default`` domain. All"},{"line_number":396,"context_line":"federated users will then be able to consume whatever role assignments that"},{"line_number":397,"context_line":"user group has already received in keystone:"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_23cbef1f","line":394,"range":{"start_line":394,"start_character":25,"end_line":394,"end_character":42},"updated":"2016-08-22 17:09:17.000000000","message":"it, you can map","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":398,"context_line":""},{"line_number":399,"context_line":".. note::"},{"line_number":400,"context_line":""},{"line_number":401,"context_line":"   We have just one rule in this example requiring one remote attribute."},{"line_number":402,"context_line":""},{"line_number":403,"context_line":".. code:: javascript"},{"line_number":404,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_d93008eb","line":401,"range":{"start_line":401,"start_character":3,"end_line":401,"end_character":72},"updated":"2016-08-22 17:09:17.000000000","message":"In this example, there is only one rule requiring one remote attribute.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":429,"context_line":"        ]"},{"line_number":430,"context_line":"    }"},{"line_number":431,"context_line":""},{"line_number":432,"context_line":"We can evolve this example further by adding a second rule that conveys"},{"line_number":433,"context_line":"additional authorization to only a subset of federated users. Federated users"},{"line_number":434,"context_line":"with a `title` attribute that matches either ``Manager`` or"},{"line_number":435,"context_line":"``Supervisor`` are granted the hypothetical ``observer`` role, which would"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_b9b0ac44","line":432,"range":{"start_line":432,"start_character":0,"end_line":432,"end_character":35},"updated":"2016-08-22 17:09:17.000000000","message":"This example can be expanded","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":485,"context_line":""},{"line_number":486,"context_line":".. note::"},{"line_number":487,"context_line":""},{"line_number":488,"context_line":"   The use of ``any_one_of`` and ``regex`` in the rule above, which"},{"line_number":489,"context_line":"   map federated users into the ``observers`` group when a user\u0027s ``Title``"},{"line_number":490,"context_line":"   assertion matches any of the regular expressions specified in the"},{"line_number":491,"context_line":"   ``any_one_of`` attribute."},{"line_number":492,"context_line":""},{"line_number":493,"context_line":"Keystone also supports the following:"},{"line_number":494,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_79b114e1","line":491,"range":{"start_line":488,"start_character":3,"end_line":491,"end_character":28},"updated":"2016-08-22 17:09:17.000000000","message":"Unclear, I suggest:\n\n``any_one_of`` and ``regex`` in the rule above map federated users into the ``observers`` group when a user\u0027s ``Title`` assertion matches any of the regular expressions specified in the ``any_one_of`` attribute.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":492,"context_line":""},{"line_number":493,"context_line":"Keystone also supports the following:"},{"line_number":494,"context_line":""},{"line_number":495,"context_line":"* ``not_any_of``, which matches any assertion that does not include one of"},{"line_number":496,"context_line":"  the specified values"},{"line_number":497,"context_line":"* ``blacklist``, which matches all assertions of the specified type except"},{"line_number":498,"context_line":"  those included in the specified value"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_39de7c11","line":495,"range":{"start_line":495,"start_character":18,"end_line":495,"end_character":23},"updated":"2016-08-22 17:09:17.000000000","message":"remove","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":494,"context_line":""},{"line_number":495,"context_line":"* ``not_any_of``, which matches any assertion that does not include one of"},{"line_number":496,"context_line":"  the specified values"},{"line_number":497,"context_line":"* ``blacklist``, which matches all assertions of the specified type except"},{"line_number":498,"context_line":"  those included in the specified value"},{"line_number":499,"context_line":"* ``whitelist`` which does not match any assertion except those listed in the"},{"line_number":500,"context_line":"  specified value."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_d9d768eb","line":497,"range":{"start_line":497,"start_character":17,"end_line":497,"end_character":22},"updated":"2016-08-22 17:09:17.000000000","message":"remove","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":496,"context_line":"  the specified values"},{"line_number":497,"context_line":"* ``blacklist``, which matches all assertions of the specified type except"},{"line_number":498,"context_line":"  those included in the specified value"},{"line_number":499,"context_line":"* ``whitelist`` which does not match any assertion except those listed in the"},{"line_number":500,"context_line":"  specified value."}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_b9f9cc82","line":499,"range":{"start_line":499,"start_character":16,"end_line":499,"end_character":21},"updated":"2016-08-22 17:09:17.000000000","message":"remove","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":25,"context_line":""},{"line_number":26,"context_line":"   Keystone federation"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Follow these steps to enable federation:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"#. Run keystone under Apache. See `Configure the Apache HTTP server \u003chttp://docs.openstack.org/mitaka/install-guide-obs/keystone-install.html\u003e`_"},{"line_number":31,"context_line":"   for more information."}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_73af0c7d","line":28,"range":{"start_line":28,"start_character":0,"end_line":28,"end_character":40},"updated":"2016-08-24 01:33:12.000000000","message":"\"To enable federation:\"","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":57,"context_line":"Supporting keystone as a SP"},{"line_number":58,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"To have keystone as as a SP, you will need to configure"},{"line_number":61,"context_line":"keystone to accept assertions from external IdPs. Examples of external"},{"line_number":62,"context_line":"IdPs are:"},{"line_number":63,"context_line":""}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_1395f831","line":60,"range":{"start_line":60,"start_character":17,"end_line":60,"end_character":24},"updated":"2016-08-24 01:33:12.000000000","message":"as an","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":71,"context_line":""},{"line_number":72,"context_line":"#. Configure authentication drivers in ``keystone.conf`` by adding the"},{"line_number":73,"context_line":"   authentication methods to the ``[auth]`` section in ``keystone.conf``."},{"line_number":74,"context_line":"   Ensure the names are equal to the protocol names added via Identity API v3."},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"   For example:"},{"line_number":77,"context_line":""}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_73e6ece8","line":74,"range":{"start_line":74,"start_character":24,"end_line":74,"end_character":32},"updated":"2016-08-24 01:33:12.000000000","message":"the same as (or \"identical to\")","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":142,"context_line":"      GET/POST /OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"#. Determine accessible resources. By using the previously returned token, the"},{"line_number":145,"context_line":"   user can issue requests to the list projects and domains that are"},{"line_number":146,"context_line":"   accessible."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"   * List projects a federated user can access: GET /OS-FEDERATION/projects"}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_73fd4c6d","line":145,"range":{"start_line":145,"start_character":34,"end_line":145,"end_character":47},"updated":"2016-08-24 01:33:12.000000000","message":"missing \u0027of\u0027 ?","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":10897,"name":"Joseph Robinson","email":"josephremail@gmail.com","username":"RobiJoe"},"change_message_id":"a4a8e824fca7b53f15a70fb773c5df7475b647be","unresolved":false,"context_lines":[{"line_number":142,"context_line":"      GET/POST /OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"#. Determine accessible resources. By using the previously returned token, the"},{"line_number":145,"context_line":"   user can issue requests to the list projects and domains that are"},{"line_number":146,"context_line":"   accessible."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"   * List projects a federated user can access: GET /OS-FEDERATION/projects"}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_d4e1862b","line":145,"range":{"start_line":145,"start_character":34,"end_line":145,"end_character":47},"in_reply_to":"1ac06dbe_73fd4c6d","updated":"2016-08-24 03:00:00.000000000","message":"This one looks like it is a noun phrase - a \"list project\".","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"665fa80efcfbeebaa21f607853f78d27d23ccf88","unresolved":false,"context_lines":[{"line_number":142,"context_line":"      GET/POST /OS-FEDERATION/identity_providers/{identity_provider}/protocols/{protocol}/auth"},{"line_number":143,"context_line":""},{"line_number":144,"context_line":"#. Determine accessible resources. By using the previously returned token, the"},{"line_number":145,"context_line":"   user can issue requests to the list projects and domains that are"},{"line_number":146,"context_line":"   accessible."},{"line_number":147,"context_line":""},{"line_number":148,"context_line":"   * List projects a federated user can access: GET /OS-FEDERATION/projects"}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_0e773dd5","line":145,"range":{"start_line":145,"start_character":34,"end_line":145,"end_character":47},"in_reply_to":"1ac06dbe_d4e1862b","updated":"2016-08-25 03:54:40.000000000","message":"Hrm, OK, I\u0027ll take your word on that. Maybe it needs a hyphen or something?","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":169,"context_line":"Configuring federation in keystone"},{"line_number":170,"context_line":"----------------------------------"},{"line_number":171,"context_line":""},{"line_number":172,"context_line":"There are certain settings in ``keystone.conf`` that must be setup, prior"},{"line_number":173,"context_line":"to attempting to federate multiple keystone deployments."},{"line_number":174,"context_line":""},{"line_number":175,"context_line":"#. Within ``keystone.conf``, assign values to the ``[saml]``"}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_d34360ad","line":172,"range":{"start_line":172,"start_character":61,"end_line":172,"end_character":66},"updated":"2016-08-24 01:33:12.000000000","message":"two words","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":194,"context_line":"      idp_organization_display_name\u003dExample Corp."},{"line_number":195,"context_line":"      idp_organization_url\u003dexample.com"},{"line_number":196,"context_line":""},{"line_number":197,"context_line":"#. As with the `Organization` options, the `Contact` options, are not"},{"line_number":198,"context_line":"   necessary, but it is advisable to set these values:"},{"line_number":199,"context_line":""},{"line_number":200,"context_line":"   .. code:: ini"}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_5385b0cc","line":197,"range":{"start_line":197,"start_character":60,"end_line":197,"end_character":61},"updated":"2016-08-24 01:33:12.000000000","message":"remove comma","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":227,"context_line":"-----------"},{"line_number":228,"context_line":""},{"line_number":229,"context_line":"To setup keystone-as-a-Service-Provider properly, you will need to"},{"line_number":230,"context_line":"understand what `protocols` are supported by external IdPs."},{"line_number":231,"context_line":"For example, keystone as an SP can allow identities to federate in from a"},{"line_number":232,"context_line":"ADFS IdP but it must be configured to understand the SAML v2.0 protocol."},{"line_number":233,"context_line":"The reason is that ADFS issues assertions using SAML v2.0. Some examples"}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_d371a00d","line":230,"range":{"start_line":230,"start_character":17,"end_line":230,"end_character":26},"updated":"2016-08-24 01:33:12.000000000","message":"remove markup","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":230,"context_line":"understand what `protocols` are supported by external IdPs."},{"line_number":231,"context_line":"For example, keystone as an SP can allow identities to federate in from a"},{"line_number":232,"context_line":"ADFS IdP but it must be configured to understand the SAML v2.0 protocol."},{"line_number":233,"context_line":"The reason is that ADFS issues assertions using SAML v2.0. Some examples"},{"line_number":234,"context_line":"of federated protocols include:"},{"line_number":235,"context_line":""},{"line_number":236,"context_line":"* SAML v2.0"}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_d34880b5","line":233,"range":{"start_line":233,"start_character":0,"end_line":233,"end_character":19},"updated":"2016-08-24 01:33:12.000000000","message":"\u0027This is because\u0027 (or similar, or even just take it out entirely)","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":237,"context_line":"* OpenID Connect"},{"line_number":238,"context_line":""},{"line_number":239,"context_line":"The following instructions are an example of how you can configure"},{"line_number":240,"context_line":"keystone-as-a-Service-Provider."},{"line_number":241,"context_line":""},{"line_number":242,"context_line":"#. Create a new SP with an ID of BETA."},{"line_number":243,"context_line":""}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_13f4d858","line":240,"range":{"start_line":240,"start_character":0,"end_line":240,"end_character":31},"updated":"2016-08-24 01:33:12.000000000","message":"remove hyphens.","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":282,"context_line":"the permission and roles applied by an SP. Given an assertion from an IdP, an"},{"line_number":283,"context_line":"SP applies a mapping to translate attributes from the"},{"line_number":284,"context_line":"IdP to known roles. A mapping is typically"},{"line_number":285,"context_line":"owned by a SP."},{"line_number":286,"context_line":""},{"line_number":287,"context_line":"Mapping objects can be used multiple times by different combinations"},{"line_number":288,"context_line":"of IdP and protocol."}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_53ead074","line":285,"range":{"start_line":285,"start_character":9,"end_line":285,"end_character":10},"updated":"2016-08-24 01:33:12.000000000","message":"an","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":10897,"name":"Joseph Robinson","email":"josephremail@gmail.com","username":"RobiJoe"},"change_message_id":"a4a8e824fca7b53f15a70fb773c5df7475b647be","unresolved":false,"context_lines":[{"line_number":362,"context_line":"A mapping is composed of a list of rules, and each rule is further composed of"},{"line_number":363,"context_line":"a list of remote attributes and a list of local attributes. If a rule is"},{"line_number":364,"context_line":"matched, all of the local attributes are applied in the SP. For a"},{"line_number":365,"context_line":"rule to match, all of the remote attributes it defines must be match."},{"line_number":366,"context_line":""},{"line_number":367,"context_line":"In the base case, a federated user simply needs an assertion containing"},{"line_number":368,"context_line":"an email address to be identified in the SP cloud. To achieve that, only"}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_94a1ce96","line":365,"updated":"2016-08-24 03:00:00.000000000","message":"Change to plural or adjust word order - \"..must be matched\" - \"all defined remote attributes must match\"","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"534912e369775005f356531ed2c94516e8595eb6","unresolved":false,"context_lines":[{"line_number":57,"context_line":"Supporting keystone as a SP"},{"line_number":58,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":59,"context_line":""},{"line_number":60,"context_line":"To have keystone as as a SP, you will need to configure"},{"line_number":61,"context_line":"keystone to accept assertions from external IdPs. Examples of external"},{"line_number":62,"context_line":"IdPs are:"},{"line_number":63,"context_line":""}],"source_content_type":"text/x-rst","patch_set":30,"id":"1ac06dbe_eeac6137","line":60,"range":{"start_line":60,"start_character":16,"end_line":60,"end_character":24},"updated":"2016-08-25 03:54:55.000000000","message":"as an","commit_id":"0eb0cad08bc7a01d1a2972a82ed030655edc49f9"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"534912e369775005f356531ed2c94516e8595eb6","unresolved":false,"context_lines":[{"line_number":238,"context_line":"* OpenID Connect"},{"line_number":239,"context_line":""},{"line_number":240,"context_line":"The following instructions are an example of how you can configure"},{"line_number":241,"context_line":"keystone as a SP."},{"line_number":242,"context_line":""},{"line_number":243,"context_line":"#. Create a new SP with an ID of BETA."},{"line_number":244,"context_line":""}],"source_content_type":"text/x-rst","patch_set":30,"id":"1ac06dbe_0e5e1d45","line":241,"range":{"start_line":241,"start_character":9,"end_line":241,"end_character":13},"updated":"2016-08-25 03:54:55.000000000","message":"as an","commit_id":"0eb0cad08bc7a01d1a2972a82ed030655edc49f9"}],"doc/config-reference/source/identity/sample-configuration-files.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"29d7865d7e4e61a726f38e195edbc9be2912ced1","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Use the ``keystone.conf`` file to configure most Identity service"},{"line_number":12,"context_line":"options:"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":".. remote-code-block:: ini"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"   https://git.openstack.org/cgit/openstack/keystone/plain/etc/keystone.conf.sample?h\u003dstable/mitaka"},{"line_number":17,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"dada55a8_d9e3fa03","line":14,"updated":"2016-07-19 16:56:55.000000000","message":"Cool, I didn\u0027t know this was a thing!","commit_id":"58df12a1e5d387b5f7ad6d0d53003e85fabb5c78"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"29d7865d7e4e61a726f38e195edbc9be2912ced1","unresolved":false,"context_lines":[{"line_number":41,"context_line":"policy.json"},{"line_number":42,"context_line":"~~~~~~~~~~~"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Use the ``policy.json`` file to define additional access controls that apply to"},{"line_number":45,"context_line":"the Identity service:"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":".. remote-code-block:: json"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dada55a8_19c5925a","line":44,"updated":"2016-07-19 16:56:55.000000000","message":"cut \"additional\" -- in keystone\u0027s case, this is the only way to configure access controls","commit_id":"58df12a1e5d387b5f7ad6d0d53003e85fabb5c78"},{"author":{"_account_id":22165,"name":"caoyuan","email":"cao.yingjunz@gmail.com","username":"caoyuan"},"change_message_id":"86e47586ae791f20ddd70b76e63f7ad604eae76e","unresolved":false,"context_lines":[{"line_number":8,"context_line":"keystone.conf"},{"line_number":9,"context_line":"~~~~~~~~~~~~~"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Use the ``keystone.conf`` file to configure most Identity service"},{"line_number":12,"context_line":"options:"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":".. remote-code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9ad45d7e_8abad921","line":11,"range":{"start_line":11,"start_character":10,"end_line":11,"end_character":23},"updated":"2016-08-09 15:00:50.000000000","message":"\"/etc/keystone/keystone.conf \" is better?","commit_id":"1d55732f050f6b4e2f17db28b350cffde4a1fa4e"},{"author":{"_account_id":22165,"name":"caoyuan","email":"cao.yingjunz@gmail.com","username":"caoyuan"},"change_message_id":"86e47586ae791f20ddd70b76e63f7ad604eae76e","unresolved":false,"context_lines":[{"line_number":18,"context_line":"keystone-paste.ini"},{"line_number":19,"context_line":"~~~~~~~~~~~~~~~~~~"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Use the ``keystone-paste.ini`` file to configure the Web Service Gateway"},{"line_number":22,"context_line":"Interface (WSGI) middleware pipeline for the Identity service:"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":".. remote-code-block:: ini"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9ad45d7e_4a974190","line":21,"range":{"start_line":21,"start_character":10,"end_line":21,"end_character":28},"updated":"2016-08-09 15:00:50.000000000","message":"ditto","commit_id":"1d55732f050f6b4e2f17db28b350cffde4a1fa4e"},{"author":{"_account_id":22165,"name":"caoyuan","email":"cao.yingjunz@gmail.com","username":"caoyuan"},"change_message_id":"86e47586ae791f20ddd70b76e63f7ad604eae76e","unresolved":false,"context_lines":[{"line_number":41,"context_line":"policy.json"},{"line_number":42,"context_line":"~~~~~~~~~~~"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Use the ``policy.json`` file to define access controls that apply to"},{"line_number":45,"context_line":"the Identity service:"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":".. remote-code-block:: json"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9ad45d7e_6a8cc57f","line":44,"range":{"start_line":44,"start_character":9,"end_line":44,"end_character":22},"updated":"2016-08-09 15:00:50.000000000","message":"ditto","commit_id":"1d55732f050f6b4e2f17db28b350cffde4a1fa4e"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Identity service sample configuration files"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"You can find the files described in this section in the ``/etc/keystone``"},{"line_number":6,"context_line":"directory."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"keystone.conf"},{"line_number":9,"context_line":"~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_d91c88c3","line":6,"range":{"start_line":5,"start_character":0,"end_line":6,"end_character":10},"updated":"2016-08-22 17:09:17.000000000","message":"The files described in this section are in the ``/etc/keystone`` directory.","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":18,"context_line":"keystone-paste.ini"},{"line_number":19,"context_line":"~~~~~~~~~~~~~~~~~~"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Use the ``keystone-paste.ini`` file to configure the Web Service Gateway"},{"line_number":22,"context_line":"Interface (WSGI) middleware pipeline for the Identity service:"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":".. remote-code-block:: ini"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_f9fd043b","line":22,"range":{"start_line":21,"start_character":53,"end_line":22,"end_character":16},"updated":"2016-08-22 17:09:17.000000000","message":":abbr:`WSGI (Web Service Gateway Interface)`","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":19,"context_line":"~~~~~~~~~~~~~~~~~~"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"Use the ``keystone-paste.ini`` file to configure the Web Service Gateway"},{"line_number":22,"context_line":"Interface (WSGI) middleware pipeline for the Identity service:"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":".. remote-code-block:: ini"},{"line_number":25,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_59a3784f","line":22,"range":{"start_line":22,"start_character":45,"end_line":22,"end_character":53},"updated":"2016-08-22 17:09:17.000000000","message":"identity","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"},{"author":{"_account_id":22141,"name":"Rodrigo Caballero","email":"rodrigo.caballero.abraham@intel.com","username":"rcaballeromx"},"change_message_id":"95b2cadda5e22b7bcfd3adea1aa976cf64c69c80","unresolved":false,"context_lines":[{"line_number":42,"context_line":"~~~~~~~~~~~"},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Use the ``policy.json`` file to define access controls that apply to"},{"line_number":45,"context_line":"the Identity service:"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":".. remote-code-block:: json"},{"line_number":48,"context_line":""}],"source_content_type":"text/x-rst","patch_set":27,"id":"1ac06dbe_194e2096","line":45,"range":{"start_line":45,"start_character":4,"end_line":45,"end_character":12},"updated":"2016-08-22 17:09:17.000000000","message":"identity","commit_id":"2558b3339dff5f343d78b2943e638f8cee9ab024"}],"doc/config-reference/source/identity/token-provider.rst":[{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"29d7865d7e4e61a726f38e195edbc9be2912ced1","unresolved":false,"context_lines":[{"line_number":9,"context_line":"You can register your own token provider by configuring the following property:"},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"* ``provider`` - token provider driver."},{"line_number":12,"context_line":"  Defaults to ``uuid``."},{"line_number":13,"context_line":"  Implemented by :class:`keystone.token.providers.uuid.Provider`"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Each token format uses different technologies to achieve various performance,"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dada55a8_d99f7a4e","line":12,"updated":"2016-07-19 16:56:55.000000000","message":"An updated \u0026 more comprehensive description:\n\n  https://github.com/openstack/keystone/blob/b6c24de/keystone/conf/token.py#L59-L73","commit_id":"58df12a1e5d387b5f7ad6d0d53003e85fabb5c78"},{"author":{"_account_id":10897,"name":"Joseph Robinson","email":"josephremail@gmail.com","username":"RobiJoe"},"change_message_id":"c8e56b2d2957c389d4852a196027f464de877fc2","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"UUID"},{"line_number":21,"context_line":" UUID tokens contain randomly generated UUID4 payloads that are issued and"},{"line_number":22,"context_line":" validated by the Identity service. They must be persisted by the Identity"},{"line_number":23,"context_line":" service in order to be later validated."},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"PKI and PKIZ"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dada55a8_1899fa1f","line":22,"updated":"2016-07-20 01:59:25.000000000","message":"Alex, just one question on this sentence - The UUID tokens \"must be made to persist by the Identity service\"? or, \"They must be made persistent by the Identity service?\"","commit_id":"58df12a1e5d387b5f7ad6d0d53003e85fabb5c78"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"de1b4bf329aeaf7da51287cb0fb993ca70bcc2bc","unresolved":false,"context_lines":[{"line_number":5,"context_line":"OpenStack Identity supports customizable token providers. This is specified"},{"line_number":6,"context_line":"in the ``[token]`` section of the configuration file."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"You can register your own token provider by configuring the following property:"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"* ``provider`` - token provider driver."},{"line_number":11,"context_line":"  Defaults to ``uuid``."}],"source_content_type":"text/x-rst","patch_set":8,"id":"9ad45d7e_1dabff1e","line":8,"updated":"2016-08-08 21:09:18.000000000","message":"More commonly, you\u0027d use this option to change the token provider to one of the ones built in. Alternatively, you can use it to configure your own token provider.","commit_id":"cbc3bcc446a87d25a21eb0c6996f87d54c3aeb1e"},{"author":{"_account_id":4,"name":"Dolph Mathews","email":"dolph.mathews@gmail.com","username":"dolph"},"change_message_id":"de1b4bf329aeaf7da51287cb0fb993ca70bcc2bc","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"This is the entry point for the token provider in the"},{"line_number":15,"context_line":"``keystone.token.provider`` namespace. The token provider controls the token"},{"line_number":16,"context_line":"construction, validation, and revocation operations."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Each token format uses different technologies to achieve various performance,"},{"line_number":19,"context_line":"scaling, and architectural requirements. The Identity service includes"}],"source_content_type":"text/x-rst","patch_set":8,"id":"9ad45d7e_fdf9cb4e","line":16,"updated":"2016-08-08 21:09:18.000000000","message":"This sentence could be moved to the first paragraph, and the sentence that starts on L14 could be moved into the definition of ``provider``.","commit_id":"cbc3bcc446a87d25a21eb0c6996f87d54c3aeb1e"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"266f18f8410d338e0e586ea274f28a661d3e9c97","unresolved":false,"context_lines":[{"line_number":22,"context_line":"Below is the detailed list of the token formats:"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"UUID"},{"line_number":25,"context_line":" ``uuid`` tokens must be persisted (using the backend specified in the"},{"line_number":26,"context_line":" ``[token] driver`` option), but does not require any extra configuration"},{"line_number":27,"context_line":" or setup."},{"line_number":28,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"9ad45d7e_4769fcbd","line":25,"range":{"start_line":25,"start_character":46,"end_line":25,"end_character":53},"updated":"2016-08-09 14:50:48.000000000","message":"back end","commit_id":"1d55732f050f6b4e2f17db28b350cffde4a1fa4e"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"266f18f8410d338e0e586ea274f28a661d3e9c97","unresolved":false,"context_lines":[{"line_number":23,"context_line":""},{"line_number":24,"context_line":"UUID"},{"line_number":25,"context_line":" ``uuid`` tokens must be persisted (using the backend specified in the"},{"line_number":26,"context_line":" ``[token] driver`` option), but does not require any extra configuration"},{"line_number":27,"context_line":" or setup."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"PKI and PKIZ"}],"source_content_type":"text/x-rst","patch_set":9,"id":"9ad45d7e_c7820c52","line":26,"range":{"start_line":26,"start_character":33,"end_line":26,"end_character":37},"updated":"2016-08-09 14:50:48.000000000","message":"does -\u003e do\n\nor -\u003e this format does not...","commit_id":"1d55732f050f6b4e2f17db28b350cffde4a1fa4e"},{"author":{"_account_id":14962,"name":"ologvinova","email":"ologvinova@mirantis.com","username":"ologvinova"},"change_message_id":"266f18f8410d338e0e586ea274f28a661d3e9c97","unresolved":false,"context_lines":[{"line_number":28,"context_line":""},{"line_number":29,"context_line":"PKI and PKIZ"},{"line_number":30,"context_line":" ``pki`` and ``pkiz`` tokens can be validated offline, without making HTTP"},{"line_number":31,"context_line":" calls to keystone. However, it does require that certificates be installed"},{"line_number":32,"context_line":" and distributed to facilitate signing tokens and later validating those"},{"line_number":33,"context_line":" signatures."},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":9,"id":"9ad45d7e_07426410","line":31,"range":{"start_line":31,"start_character":29,"end_line":31,"end_character":44},"updated":"2016-08-09 14:50:48.000000000","message":"this format requires","commit_id":"1d55732f050f6b4e2f17db28b350cffde4a1fa4e"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"e1434b2b34aaa6dc9d2ed0ea580b8419ce6d5443","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"OpenStack Identity supports customizable token providers. This is specified"},{"line_number":6,"context_line":"in the ``[token]`` section of the configuration file. The token provider"},{"line_number":7,"context_line":"controls the token construction, validation, and revocation operations."},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"You can register your own token provider by configuring the following property:"},{"line_number":10,"context_line":""}],"source_content_type":"text/x-rst","patch_set":18,"id":"9ad45d7e_809f48b3","line":7,"updated":"2016-08-09 21:37:47.000000000","message":"We have a very similar section here - http://docs.openstack.org/admin-guide/keystone-tokens.html","commit_id":"0b9dd2d3262103b8fb2cd6894cd9a33d078d0391"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Below is the detailed list of the token formats:"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"UUID"},{"line_number":30,"context_line":" ``uuid`` tokens must be persisted (using the back end specified in the"},{"line_number":31,"context_line":" ``[token] driver`` option), but do not require any extra configuration"},{"line_number":32,"context_line":" or setup."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_b328649b","line":30,"range":{"start_line":30,"start_character":22,"end_line":30,"end_character":34},"updated":"2016-08-24 01:33:12.000000000","message":"persist","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":10897,"name":"Joseph Robinson","email":"josephremail@gmail.com","username":"RobiJoe"},"change_message_id":"a4a8e824fca7b53f15a70fb773c5df7475b647be","unresolved":false,"context_lines":[{"line_number":27,"context_line":"Below is the detailed list of the token formats:"},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"UUID"},{"line_number":30,"context_line":" ``uuid`` tokens must be persisted (using the back end specified in the"},{"line_number":31,"context_line":" ``[token] driver`` option), but do not require any extra configuration"},{"line_number":32,"context_line":" or setup."},{"line_number":33,"context_line":""}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_b4284a9b","line":30,"range":{"start_line":30,"start_character":22,"end_line":30,"end_character":34},"in_reply_to":"1ac06dbe_b328649b","updated":"2016-08-24 03:00:00.000000000","message":"It looks like tokens can \u0027be persisted\u0027 - as in, for the keystone service, a \u0027persisted token\u0027 is one that must be persisted by an administrator. This is based on the admin guide entry on tokens http://docs.openstack.org/admin-guide/keystone-tokens.html\nAnd also on Dolph\u0027s blog, as the SME - http://dolphm.com/benchmarking-openstack-keystone-token-formats/","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"31b37f83e981249debf66f0e148d1629b3d49f86","unresolved":false,"context_lines":[{"line_number":38,"context_line":" those signatures."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Fernet"},{"line_number":41,"context_line":" ``fernet`` tokens do not need to be persisted at all, but require that you run"},{"line_number":42,"context_line":" ``keystone-manage fernet_setup`` (also see the"},{"line_number":43,"context_line":" ``keystone-manage fernet_rotate`` command)."},{"line_number":44,"context_line":""}],"source_content_type":"text/x-rst","patch_set":29,"id":"1ac06dbe_331bd482","line":41,"range":{"start_line":41,"start_character":34,"end_line":41,"end_character":46},"updated":"2016-08-24 01:33:12.000000000","message":"persist","commit_id":"036277461d13b21274c87e16b6e423f7c9fc953f"}]}